Google Cloud Professional Cloud Security Engineer practice questions

Question 1

A platform team is being asked to grant a support group access to a project only when its members connect from the corporate network, and otherwise deny it, without creating separate projects. The team is evaluating native IAM features. Which feature meets this requirement?

Accepted Answer

IAM Conditions on the role binding, granting the role only when the request comes from the corporate network

Answer

Access Context Manager service perimeters, which wrap the project so data cannot leave the network boundary

Answer

Organization policy constraints applied at the folder to restrict which regions the project may deploy into

Answer

VPC firewall rules that block inbound traffic to the project unless it originates from on-premises IP ranges

Question 2

An architect is designing the encryption-in-transit section of a security design document and must characterize what protections Google applies as data moves between end users and Google Cloud and between two internal services. Which description matches the documented model?

Accepted Answer

Google uses authentication, integrity, and encryption for data in transit via TLS, BoringSSL, ALTS, and the PSP security protocol, protecting traffic between end users and Google Cloud and between two services across the broader documented transit-protection model.

Answer

Encryption in transit is only enabled if a customer explicitly opts in through a per-project flag and is otherwise off by default for both user-facing and service-to-service traffic. Encryption in transit is part of Google's baseline security strategy; it is not an opt-in per-project flag.

Answer

Google relies on plaintext between internal services and only encrypts the outermost client-facing leg of the request, on the theory that the internal network is implicitly trusted. Google applies encryption, authentication, and integrity for service-to-service traffic as well as user-to-Google traffic.

Answer

Google's only documented transit protocol is QUIC for end-user traffic and there is no separate protocol family for service-to-service authentication or integrity. Google uses several protocols including TLS, BoringSSL, ALTS, and PSP, not solely QUIC.

Question 3

A security operations team is designing traffic inspection for a set of sensitive VM instances and is evaluating Packet Mirroring to feed an intrusion-detection appliance. Which two statements correctly describe how Packet Mirroring behaves in a VPC network?

Accepted Answer

Packet Mirroring captures all traffic and packet data, including both payloads and headers, then forwards it on.

Accepted Answer

The mirroring happens on the VM instances themselves, so it consumes extra bandwidth on those mirrored VMs.

Answer

Packet Mirroring captures only the packet headers and discards payloads, so deep-payload inspection cannot be done.

Answer

The mirroring runs on the network fabric instead of the VMs, so it adds no extra bandwidth load to instances.

Question 4

A platform team is designing a tenancy model for processing regulated data on Compute Engine and is evaluating Confidential VM for in-use protection. Per Google's documentation, which TWO benefits does Confidential VM explicitly provide?

Accepted Answer

Isolation, where encryption keys are generated and reside in dedicated hardware inaccessible to the hypervisor

Accepted Answer

Attestation, where you verify the identity and state of the VM so key components have not been tampered with

Answer

Secure boot, where UEFI firmware verifies the digital signature of the OS bootloader and kernel before they load

Answer

Mute rules, where filters automatically suppress future and existing findings raised about the VM by default

Question 5

An architect is designing an Assured Workloads deployment and must choose between a control type that restricts the geographic location of data and one that bundles controls for a specific regulation such as CJIS or ITAR. How are these control package types documented?

Accepted Answer

Regional data boundaries restrict where resources can be stored for residency, while regulatory data boundaries bundle controls for a specific compliance requirement.

Answer

Regional data boundaries enforce a specific regulation such as ITAR, while regulatory data boundaries merely pick the cheapest region available for storing your resources.

Answer

Both control types are interchangeable and differ only in the billing account used, so either one can satisfy CJIS or a data residency requirement equally well.

Answer

Sovereign Controls by Partners is the only control type Assured Workloads offers, and it covers both data residency and every regulatory requirement together.

Question 6

A sysadmin is tasked with retiring a service account key that might still be used by an unknown job, and needs a reversible first step before permanently removing it. According to Google's service account key create-and-delete guidance, what is the recommended approach?

Accepted Answer

Disable the key first and wait until you are sure it is no longer needed, then delete it, because a deleted key cannot be undeleted.

Answer

Delete the key immediately and recreate an identical one if a job later breaks, since deleted keys are restorable from the audit logs.

Answer

Rotate the key to a new version, which blocks the old key automatically while keeping the old key material recoverable later on.

Answer

Move the key onto a disabled service account, which pauses only that one key without affecting the other keys on the account.

Question 7

A regulated payments company is evaluating where to store its master encryption keys so that key operations run inside hardware certified to a recognized government standard, and a security engineer must name the Google Cloud service that satisfies that hardware-certification requirement. Which option fits?

Accepted Answer

Cloud HSM, which performs cryptographic operations in a cluster of FIPS 140-2 Level 3 certified hardware modules

Answer

Cloud External Key Manager, which keeps keys in a third-party manager and proxies operations back into Google services

Answer

Customer-supplied encryption keys, where you pass raw AES key bytes to Compute Engine on each disk attach request

Answer

Cloud KMS software keys, which store key material in a software-backed keyring at the default protection level

Question 8

A security engineer is designing a private VPC where VM instances must never have external IP addresses but still need to call Google APIs such as Cloud Storage and BigQuery. The engineer is being asked which networking feature delivers that property. Which mechanism matches the documented model?

Accepted Answer

Private Google Access enables VM instances with only internal IP addresses to reach external IP addresses of Google APIs and services, configured on a per-subnet basis within VPC networks, which is the documented mechanism for the design.

Answer

Disable IAM for the affected service accounts so internal-only VMs can call Google APIs anonymously over the public internet without external IP addresses. Disabling IAM does not change addressing and would break authorization entirely; it is not the documented mechanism.

Answer

Add a public IP alias range to every VM and rely on the Cloud Console firewall wizard to scope outbound Google API traffic across the entire organization centrally. Adding public IP ranges contradicts the requirement that VMs not have external IPs and is not the documented mechanism.

Answer

Attach a Cloud NAT gateway with no logging to every subnet so Google API traffic transits the public internet through ephemeral NAT IPs as the documented model. Cloud NAT is general egress; the per-subnet feature specifically for Google API reach is Private Google Access.

Question 9

An engineer is evaluating Data Access audit logs across a folder of projects and must warn finance about the cost impact before flipping the switch. Which characterization matches the documented Data Access audit log behavior?

Accepted Answer

Data Access audit logs volume can be large. Enabling Data Access logs might result in your Google Cloud project being charged for the additional logs usage, with permission types selectable from ADMIN_READ, DATA_READ, and DATA_WRITE across the affected folder of projects.

Answer

Enabling Data Access audit logs has no measurable impact on logging cost because Data Access entries are stored in a separate free-tier bucket reserved for compliance evidence. Data Access logs share standard logging cost behavior; the docs warn explicitly about volume and cost.

Answer

There is no way to exempt individual principals from Data Access logging, so service accounts that produce high-volume reads must be deleted before enablement. Data Access logging supports exemptions for particular principals during configuration.

Answer

Data Access audit logs can only be enabled at the billing account level and never at the project, folder, or organization level. Data Access logs can be enabled or disabled at the project, folder, organization, or billing account level.

Question 10

An EU customer is designing an Assured Workloads control package rollout and must enumerate which documented residency properties Google Cloud actually delivers for resources created inside an Assured Workloads folder. Which statements apply?

Accepted Answer

When creating resources in an Assured Workloads folder, the selected control package restricts available regions for those resources. The region restriction is delivered through the selected control package on the folder.

Accepted Answer

Google's data residency commitments apply to Customer Data at rest for configurable services, with data processed only within specified regions or multi-regions. The Customer Data at rest commitment applies to configurable services only.

Accepted Answer

European Union Customer Data remains within the EU at rest under the documented Assured Workloads residency commitments. The EU residency commitment is one of the explicit regional commitments Google publishes.

Answer

Assured Workloads stores all EU Customer Data in US multi-regions by default for performance reasons and does not keep EU data within the EU at rest. EU Customer Data is kept within the EU under Assured Workloads; it is not relocated to US multi-regions.

Question 11

A security administrator has decided to replace standing project-owner grants with on-demand elevation, and also needs an after-the-fact record of who held elevated access, when, and why. The administrator is evaluating Privileged Access Manager. Which capability matches this need?

Accepted Answer

It controls just-in-time temporary elevation and records audit logs of who had access and when

Answer

It grants standing roles that never expire but emails an approver each time the role is used

Answer

It federates external identities into a pool so contractors authenticate without service account keys

Answer

It encrypts IAM allow policies so only break-glass administrators can read the role bindings later

Question 12

A platform team is evaluating how to answer the audit question 'which resources does this specific Cloud KMS key protect?' for its CMEK-protected services, and needs the documented mechanism Cloud KMS exposes for that lookup. Which capability applies?

Accepted Answer

Key tracking, since CMEK-protected resources carry a metadata field holding the name of the key that encrypts them

Answer

Access Transparency logs, which record every Google personnel access and thereby list the resources a key encrypts

Answer

Cloud Audit Logs data-access entries, which must be parsed offline to reconstruct key-to-resource relationships

Answer

VPC Service Controls perimeters, which group protected resources by key and report membership in the perimeter view

Question 13

A company is migrating internal workloads that need a single mandatory egress checkpoint: every outbound web request from VMs and containers must be routed to a central instance that inspects the request and applies security policies before allowing it to reach the internet. Which Google Cloud service matches that design?

Accepted Answer

Secure Web Proxy, the central gateway that inspects outbound web requests and enforces egress policies

Answer

Cloud NAT, which translates source addresses for egress but does not inspect or apply web security policies

Answer

Cloud Armor, which inspects inbound requests at the load balancer edge rather than outbound egress traffic

Answer

Identity-Aware Proxy, which brokers inbound user access to applications rather than outbound web egress

Question 14

A platform team is being asked to continuously detect vulnerabilities in container images pushed to Artifact Registry across multiple projects, centralize findings, and feed deployment decisions into Binary Authorization. Which Google Cloud capability matches that pipeline?

Accepted Answer

Artifact Analysis delivers software composition analysis with vulnerability scanning, automatically scans images pushed to Artifact Registry, centralizes findings through Security Command Center, and integrates with Binary Authorization for policy-based deployment across the Artifact Registry images.

Answer

Artifact Analysis only scans operating-system level packages and cannot detect application language package vulnerabilities at any tier. Artifact Analysis supports both container OS and application language package detection.

Answer

Artifact Registry has no integrated vulnerability scanning, so customers must run an external scanner in their own CI pipeline and copy findings into Security Command Center manually. Artifact Analysis automatically scans images pushed to Artifact Registry.

Answer

Artifact Analysis findings cannot be consumed by Binary Authorization for deployment decisions and must be exported to a third-party policy engine instead. Artifact Analysis integrates with Binary Authorization for policy-based deployment decisions.

Question 15

A company needs to obtain Google Cloud's latest ISO/IEC certificates and SOC reports on demand to provide to an external auditor at no additional cost. Which Google Cloud resource is designed for that purpose?

Accepted Answer

Compliance reports manager, which gives on-demand access to Google's ISO/IEC certificates, SOC reports, and self assessments at no additional cost.

Answer

Access Transparency, which streams logs of Google personnel actions and can export the provider's own ISO and SOC certificates directly to auditors.

Answer

Assured Workloads, which enforces compliance control packages and publishes Google's current SOC reports straight into the customer's own audit folder.

Answer

Cloud Audit Logs, which retain Admin Activity entries and would bundle Google's ISO/IEC certificates and SOC reports for download by external auditors.

Google Cloud Professional Cloud Security Engineer

Sample questions

Sources

Similar exams