Professional Cloud Security Engineer Free Practice Questions — Page 9
Question 73
Your organization is migrating business critical applications to Google Cloud across multiple projects. You only have the required IAM permission at the Google Cloud organization level. You want to grant project access to support engineers from two partner organizations using their existing identity provider (IdP) credentials. What should you do?
A. Create two single sign-on (SSO) profiles for the internal and partner IdPs by using SSO for Cloud Identity.
B. Create users manually by using the Google Cloud console. Assign the users to groups.
C. Create two workforce identity pools for the partner IdPs.
D. Sync user identities from their existing IdPs to Cloud Identity by using Google Cloud Directory Sync (GCDS).
Show Answer
Correct Answer: C
Explanation: The requirement is to grant Google Cloud project access to users from external partner organizations using their existing IdP credentials, with permissions managed at the organization level. Workforce Identity Federation is designed for this exact B2B scenario: it allows external users to authenticate via their own IdPs without creating or syncing user accounts in Cloud Identity. Creating separate workforce identity pools for each partner IdP enables IAM role assignment across projects securely and at scale. Other options either require user synchronization, manual account management, or are not intended for external partner access.
Question 74
You are working with developers to secure custom training jobs running on Vertex AI. For compliance reasons, all supported data types must be encrypted by key materials that reside in the Europe region and are controlled by your organization. The encryption activity must not impact the training operation in Vertex AI. What should you do?
A. Encrypt the code, training data, and metadata with Google default encryption. Use customer-managed encryption keys (CMEK) for the trained models exported to Cloud Storage buckets.
B. Encrypt the code, training data, metadata, and exported trained models with customer-managed encryption keys (CMEK).
C. Encrypt the code, training data, and exported trained models with customer-managed encryption keys (CMEK).
D. Encrypt the code, training data, and metadata with Google default encryption. Implement an organization policy that enforces a constraint to restrict the Cloud KMS location to the Europe region.
Show Answer
Correct Answer: C
Explanation: Vertex AI supports customer-managed encryption keys (CMEK) for training code, input data, and exported trained models without impacting training operations. However, job and resource metadata cannot be encrypted with CMEK and is always protected using Google-managed encryption. Therefore, the correct approach is to encrypt the code, training data, and exported trained models with CMEK, which aligns with compliance requirements while reflecting actual service capabilities.
Question 75
You work for a global company. Due to compliance requirements, certain Compute Engine instances that reside within specific projects must be located exclusively in cloud regions within the European Union (EU). You need to ensure that existing non-compliant workloads are remediated and prevent future Compute Engine instances from being launched in restricted regions. What should you do?
A. Use a third-party configuration management tool to monitor the location of Compute Engine instances. Automatically delete or migrate non-compliant instances, including existing deployments.
B. Deploy a Security Command Center source to detect Compute Engine instances created outside the EU. Use a custom remediation function to automatically relocate the instances, run the function once a day.
C. Use organization policy constraints in Resource Manager to enforce allowed regions for Compute Engine instance creation within specific projects.
D. Set an organization policy that denies the creation of Compute Engine instances outside the EU. Apply the policy to the appropriate projects. Identify existing non-compliant instances and migrate the instances to compliant EU regions.
Show Answer
Correct Answer: D
Explanation: The requirement has two parts: remediate existing non-compliant instances and prevent future non-compliant deployments. Organization Policy constraints (gcp.resourceLocations) can be applied to specific projects to deny creation of Compute Engine instances outside allowed EU regions, which prevents future violations. Existing instances are not automatically fixed by policies, so they must be identified and migrated to EU regions. Option D explicitly covers both prevention and remediation, making it the correct choice.
Question 76
You work for a multinational organization that has systems deployed across multiple cloud providers, including Google Cloud. Your organization maintains an extensive on-premises security information and event management (SIEM) system. New security compliance regulations require that relevant Google Cloud logs be integrated seamlessly with the existing SIEM to provide a unified view of security events. You need to implement a solution that exports Google Cloud logs to your on-premises SIEM by using a push-based, near real-time approach. You must prioritize fault tolerance, security, and auto scaling capabilities. In particular, you must ensure that if a log delivery fails, logs are re-sent. What should you do?
A. Create a Pub/Sub topic for log aggregation. Write a custom Python script on a Cloud Function Leverage the Cloud Logging API to periodically pull logs from Google Cloud and forward the logs to the SIEM. Schedule the Cloud Function to run twice per day.
B. Collect all logs into an organization-level aggregated log sink and send the logs to a Pub/Sub topic. Implement a primary Dataflow pipeline that consumes logs from this Pub/Sub topic and delivers the logs to the SIEM. Implement a secondary Dataflow pipeline that replays failed messages.
C. Deploy a Cloud Logging sink with a filter that routes all logs directly to a syslog endpoint. The endpoint is based on a single Compute Engine hosted on Google Cloud that routes all logs to the on-premises SIEM. Implement a Cloud Function that triggers a retry action in case of failure.
D. Utilize custom firewall rules to allow your SIEM to directly query Google Cloud logs. Implement a Cloud Function that notifies the SIEM of a failed delivery and triggers a retry action.
Show Answer
Correct Answer: B
Explanation: Option B best meets all stated requirements: near real-time, push-based delivery; fault tolerance; security; and automatic scaling with guaranteed re-delivery. An organization-level aggregated log sink exporting to Pub/Sub is the recommended, native way to stream Google Cloud logs in near real time. Pub/Sub provides durable, at-least-once delivery and decouples log ingestion from processing. Dataflow is a fully managed, auto-scaling, fault-tolerant streaming service well suited for delivering logs to external systems such as an on-premises SIEM. Using a primary pipeline with a dead-letter or replay mechanism (secondary pipeline) ensures failed deliveries can be retried, satisfying the requirement that logs be re-sent if delivery fails. The other options lack near real-time behavior, scalability, or robust retry guarantees.
Question 77
You work for a healthcare provider that is expanding into the cloud to store and process sensitive patient data. You must ensure the chosen Google Cloud configuration meets these strict regulatory requirements:
• Data must reside within specific geographic regions.
• Certain administrative actions on patient data require explicit approval from designated compliance officers.
• Access to patient data must be auditable.
What should you do?
A. Select a standard Google Cloud region. Restrict access to patient data based on user location and job function by using Access Context Manager. Enable both Cloud Audit Logging and Access Transparency.
B. Deploy an Assured Workloads environment in an approved region. Configure Access Approval for sensitive operations on patient data. Enable both Cloud Audit Logs and Access Transparency.
C. Deploy an Assured Workloads environment in multiple regions for redundancy. Utilize custom IAM roles with granular permissions. Isolate network-level data by using VPC Service Controls.
D. Select multiple standard Google Cloud regions for high availability. Implement Access Control Lists (ACLs) on individual storage objects containing patient data. Enable Cloud Audit Logs.
Show Answer
Correct Answer: B
Explanation: Assured Workloads enforces data residency in approved regions and aligns with healthcare regulatory requirements. Access Approval ensures certain administrative actions require explicit approval from designated compliance officers. Cloud Audit Logs and Access Transparency together provide comprehensive auditing of access to patient data, including Google administrator access, fully satisfying all stated requirements.
Question 78
Your organization is using Security Command Center Premium as a central tool to detect and alert on security threats. You also want to alert on suspicious outbound traffic that is targeting domains of known suspicious web services. What should you do?
A. Create a DNS Server Policy in Cloud DNS and turn on logs. Attach this policy to all Virtual Private Cloud networks with internet connectivity.
B. Forward all logs to Chronicle Security Information and Event Management. Create an alert for suspicious egress traffic to the internet.
C. Create a Cloud Intrusion Detection endpoint. Connect this endpoint to all Virtual Private Cloud networks with internet connectivity.
D. Create an egress firewall policy with Threat Intelligence as the destination. Attach this policy to all Virtual Private Cloud networks with internet connectivity.
Show Answer
Correct Answer: D
Explanation: Security Command Center Premium natively integrates with Google Cloud Firewall Threat Intelligence. Creating an egress firewall policy that uses Threat Intelligence as the destination allows Google-curated, continuously updated lists of known malicious/suspicious domains and IPs to be detected (and optionally blocked). These events generate logs and findings that surface directly in Security Command Center for alerting. Forwarding to Chronicle is unnecessary for this requirement, and DNS logging or IDS do not specifically alert on known malicious outbound destinations.
Question 79
Your organization has sensitive data stored in BigQuery and Cloud Storage. You need to design a solution that provides granular and flexible control authorization to read data. What should you do?
A. Deidentify sensitive fields within the dataset by using data leakage protection within the Sensitive Data Protection services.
B. Use Cloud External Key Manager (Cloud EKM) to encrypt the data in BigQuery and Cloud Storage.
C. Grant identity and access management (IAM) roles and permissions to principals.
D. Enable server-side encryption on the data in BigQuery and Cloud Storage.
Show Answer
Correct Answer: C
Explanation: Granular and flexible authorization to read data in BigQuery and Cloud Storage is achieved through Identity and Access Management (IAM). IAM lets you assign fine-grained roles and permissions to specific principals at the project, dataset, table, bucket, or object level, enforcing least privilege. The other options focus on encryption or data masking, not access authorization.
Question 80
Your organization must follow the Payment Card Industry Data Security Standard (PCI DSS). To prepare for an audit, you must detect deviations on an infrastructure-as-a-service level in your Google Cloud landing zone. What should you do?
A. Create a data profile covering all payment relevant data types. Configure Data Discovery and a risk analysis job in Google Cloud Sensitive Data Protection to analyze findings.
B. Use the Google Cloud Compliance Reports Manager to download the latest version of the PCI DSS report Analyze the report to detect deviations.
C. Create an Assured Workloads folder in your Google Cloud organization. Migrate existing projects into the folder and monitor for deviations in the PCI DSS.
D. Activate Security Command Center Premium. Use the Compliance Monitoring product to filter findings that may not be PCI DSS compliant.
Show Answer
Correct Answer: D
Explanation: To detect deviations from PCI DSS at the infrastructure-as-a-service level in Google Cloud, you need continuous, automated compliance checks against the standard. Security Command Center Premium provides Compliance Monitoring, which evaluates your live cloud resources against supported frameworks such as PCI DSS and surfaces findings for noncompliant configurations. This directly supports audit preparation by identifying and tracking deviations. The other options either focus only on data classification, provide static reports without environment analysis, or enforce residency/sovereignty controls rather than monitoring compliance deviations.
Question 81
Your organization operates in a highly regulated industry and needs to implement strict controls around temporary access to sensitive Google Cloud resources. You have been using Access Approval to manage this access, but your compliance team has mandated the use of a custom signing key. Additionally, they require that the key be stored in a hardware security module (HSM) located outside Google Cloud. You need to configure Access Approval to use a custom signing key that meets the compliance requirements. What should you do?
A. Create a new asymmetric signing key in Cloud Key Management System (Cloud KMS) using a supported algorithm and grant the Access Approval service account the IAM signerVerifier role on the key.
B. Export your existing Access Approval signing key as a PEM file. Upload the file to your external HSM and reconfigure Access Approval to use the key from the HSM.
C. Create a signing key in your external HSM. Integrate the HSM with Cloud External Key Manager (Cloud EKM) and make the key available within your project. Configure Access Approval to use this key.
D. Create a new asymmetric signing key in Cloud KMS and configure the key with a rotation period of 30 days. Add the corresponding public key to your external HSM.
Show Answer
Correct Answer: C
Explanation: The requirement is to use a custom signing key that is stored in an HSM outside Google Cloud. Cloud KMS keys (option A) are Google‑managed and do not meet the external HSM requirement. Exporting keys (option B) is not supported or secure for Access Approval signing keys. Option D still relies on Cloud KMS for signing. Cloud External Key Manager (EKM) is specifically designed to integrate externally managed HSM keys with Google Cloud services. Creating the key in the external HSM, exposing it through Cloud EKM, and configuring Access Approval to use it satisfies both the custom key and external HSM compliance mandates.
Question 82
Your organization is migrating a complex application to Google Cloud. The application has multiple internal components that interact with each other across several Google Cloud projects. Security is a major concern, and you must design an authorization scheme for administrators that aligns with the principles of least privilege and separation of duties. What should you do?
A. Identify the users who will migrate the application, revoke the default user roles and assign the users with purposely created custom roles.
B. Use multiple external identity providers (IdP) configured to use different SAML profiles and federate the IdPs for each application component.
C. Configure multi-factor authentication (MFA) to enforce the use of physical tokens for all users who will migrate the application.
D. No action needed. When a Google Cloud organization is created, the appropriate permissions are automatically assigned to all users in the domain.
Show Answer
Correct Answer: A
Explanation: Designing for least privilege and separation of duties in Google Cloud is achieved by defining granular IAM permissions. Creating custom roles tailored to specific administrative tasks and assigning them to only the required users limits access to exactly what is needed. Revoking broad default roles avoids excessive permissions. The other options address authentication or identity federation, not authorization, and do not ensure least privilege across projects.
$19
Get all 350 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.