Professional Cloud Security Engineer practice test

1. Question 1 · 1

   Your team needs to make sure that a Compute Engine instance does not have access to the internet or to any Google APIs or services. Which two settings must remain disabled to meet these requirements? (Choose two.)

   Choose all answers that apply.

   • Public IP
   • IP Forwarding
   • Private Google Access
   • Static routes
   • IAM Network User Role

2. Question 2 · 1

   Your team needs to obtain a unified log view of all development cloud projects in your SIEM. The development projects are under the NONPROD organization folder with the test and pre-production projects. The development projects share the ABC-BILLING billing account with the rest of the organization. Which logging export strategy should you use to meet the requirements?

   Choose one answer.

   • 1. Export logs to a Cloud Pub/Sub topic with folders/NONPROD parent and includeChildren property set to True in a dedicated SIEM project. 2. Subscribe SIEM to the topic.
   • 1. Create a Cloud Storage sink with billingAccounts/ABC-BILLING parent and includeChildren property set to False in a dedicated SIEM project. 2. Process Cloud Storage objects in SIEM.
   • 1. Export logs in each dev project to a Cloud Pub/Sub topic in a dedicated SIEM project. 2. Subscribe SIEM to the topic.
   • 1. Create a Cloud Storage sink with a publicly shared Cloud Storage bucket in each project. 2. Process Cloud Storage objects in SIEM.

3. Question 3 · 1

   You need to implement an encryption at-rest strategy that reduces key management complexity for non-sensitive data and protects sensitive data while providing the flexibility of controlling the key residency and rotation schedule. FIPS 140-2 L1 compliance is required for all data types. What should you do?

   Choose one answer.

   • Encrypt non-sensitive data and sensitive data with Cloud External Key Manager.
   • Encrypt non-sensitive data and sensitive data with Cloud Key Management Service
   • Encrypt non-sensitive data with Google default encryption, and encrypt sensitive data with Cloud External Key Manager.
   • Encrypt non-sensitive data with Google default encryption, and encrypt sensitive data with Cloud Key Management Service.

4. Question 4 · 1

   Your company wants to determine what products they can build to help customers improve their credit scores depending on their age range. To achieve this, you need to join user information in the company's banking app with customers' credit score data received from a third party. While using this raw data will allow you to complete this task, it exposes sensitive data, which could be propagated into new systems. This risk needs to be addressed using de-identification and tokenization with Cloud Data Loss Prevention while maintaining the referential integrity across the database. Which cryptographic token format should you use to meet these requirements?

   Choose one answer.

   • Deterministic encryption
   • Secure, key-based hashes
   • Format-preserving encryption
   • Cryptographic hashing

5. Question 5 · 1

   An office manager at your small startup company is responsible for matching payments to invoices and creating billing alerts. For compliance reasons, the office manager is only permitted to have the Identity and Access Management (IAM) permissions necessary for these tasks. Which two IAM roles should the office manager have? (Choose two.)

   Choose all answers that apply.

   • Organization Administrator
   • Project Creator
   • Billing Account Viewer
   • Billing Account Costs Manager
   • Billing Account User

6. Question 6 · 1

   You are designing a new governance model for your organization's secrets that are stored in Secret Manager. Currently, secrets for Production and Non- Production applications are stored and accessed using service accounts. Your proposed solution must: ✑ Provide granular access to secrets ✑ Give you control over the rotation schedules for the encryption keys that wrap your secrets ✑ Maintain environment separation ✑ Provide ease of management Which approach should you take?

   Choose one answer.

   • 1. Use separate Google Cloud projects to store Production and Non-Production secrets. 2. Enforce access control to secrets using project-level identity and Access Management (IAM) bindings. 3. Use customer-managed encryption keys to encrypt secrets.
   • 1. Use a single Google Cloud project to store both Production and Non-Production secrets. 2. Enforce access control to secrets using secret-level Identity and Access Management (IAM) bindings. 3. Use Google-managed encryption keys to encrypt secrets.
   • 1. Use separate Google Cloud projects to store Production and Non-Production secrets. 2. Enforce access control to secrets using secret-level Identity and Access Management (IAM) bindings. 3. Use Google-managed encryption keys to encrypt secrets.
   • 1. Use a single Google Cloud project to store both Production and Non-Production secrets. 2. Enforce access control to secrets using project-level Identity and Access Management (IAM) bindings. 3. Use customer-managed encryption keys to encrypt secrets.

7. Question 7 · 1

   You are a security engineer at a finance company. Your organization plans to store data on Google Cloud, but your leadership team is worried about the security of their highly sensitive data. Specifically, your company is concerned about internal Google employees' ability to access your company's data on Google Cloud. What solution should you propose?

   Choose one answer.

   • Use customer-managed encryption keys.
   • Use Google's Identity and Access Management (IAM) service to manage access controls on Google Cloud.
   • Enable Admin activity logs to monitor access to resources.
   • Enable Access Transparency logs with Access Approval requests for Google employees.

8. Question 8 · 1

   You want to use the gcloud command-line tool to authenticate using a third-party single sign-on (SSO) SAML identity provider. Which options are necessary to ensure that authentication is supported by the third-party identity provider (IdP)? (Choose two.)

   Choose all answers that apply.

   • SSO SAML as a third-party IdP
   • Identity Platform
   • OpenID Connect
   • Identity-Aware Proxy
   • Cloud Identity

9. Question 9 · 1

   You work for a large organization where each business unit has thousands of users. You need to delegate management of access control permissions to each business unit. You have the following requirements: ✑ Each business unit manages access controls for their own projects. ✑ Each business unit manages access control permissions at scale. ✑ Business units cannot access other business units' projects. ✑ Users lose their access if they move to a different business unit or leave the company. ✑ Users and access control permissions are managed by the on-premises directory service. What should you do? (Choose two.)

   Choose all answers that apply.

   • Use VPC Service Controls to create perimeters around each business unit's project.
   • Organize projects in folders, and assign permissions to Google groups at the folder level.
   • Group business units based on Organization Units (OUs) and manage permissions based on OUs
   • Create a project naming convention, and use Google's IAM Conditions to manage access based on the prefix of project names.
   • Use Google Cloud Directory Sync to synchronize users and group memberships in Cloud Identity.

10. Question 10 · 1

    Your organization recently deployed a new application on Google Kubernetes Engine. You need to deploy a solution to protect the application. The solution has the following requirements: ✑ Scans must run at least once per week ✑ Must be able to detect cross-site scripting vulnerabilities ✑ Must be able to authenticate using Google accounts Which solution should you use?

    Choose one answer.

    • Google Cloud Armor
    • Web Security Scanner
    • Security Health Analytics
    • Container Threat Detection

11. Question 11 · 1

    An organization is moving applications to Google Cloud while maintaining a few mission-critical applications on-premises. The organization must transfer the data at a bandwidth of at least 50 Gbps. What should they use to ensure secure continued connectivity between sites?

    Choose one answer.

    • Dedicated Interconnect
    • Cloud Router
    • Cloud VPN
    • Partner Interconnect

12. Question 12 · 1

    Your organization has had a few recent DDoS attacks. You need to authenticate responses to domain name lookups. Which Google Cloud service should you use?

    Choose one answer.

    • Cloud DNS with DNSSEC
    • Cloud NAT
    • HTTP(S) Load Balancing
    • Google Cloud Armor

13. Question 13 · 1

    A customer needs to prevent attackers from hijacking their domain/IP and redirecting users to a malicious site through a man-in-the-middle attack. Which solution should this customer use?

    Choose one answer.

    • VPC Flow Logs
    • Cloud Armor
    • DNS Security Extensions
    • Cloud Identity-Aware Proxy

14. Question 14 · 1

    Your Security team believes that a former employee of your company gained unauthorized access to Google Cloud resources some time in the past 2 months by using a service account key. You need to confirm the unauthorized access and determine the user activity. What should you do?

    Choose one answer.

    • Use Security Health Analytics to determine user activity.
    • Use the Cloud Monitoring console to filter audit logs by user.
    • Use the Cloud Data Loss Prevention API to query logs in Cloud Storage.
    • Use the Logs Explorer to search for user activity.

15. Question 15 · 1

    Your company requires the security and network engineering teams to identify all network anomalies within and across VPCs, internal traffic from VMs to VMs, traffic between end locations on the internet and VMs, and traffic between VMs to Google Cloud services in production. Which method should you use?

    Choose one answer.

    • Define an organization policy constraint.
    • Configure packet mirroring policies.
    • Enable VPC Flow Logs on the subnet.
    • Monitor and analyze Cloud Audit Logs.

Paid access to all 309 questions

Each purchase applies to this certification. Prices are one-time payments, not monthly subscriptions.