Best Value Available! 2026 Realistic Verified Free Professional-Cloud-Security-Engineer Exam Questions [Q154-Q177]

4/5 - (1 vote)

Best Value Available! 2026 Realistic Verified Free Professional-Cloud-Security-Engineer Exam Questions

Pass Your Exam Easily! Professional-Cloud-Security-Engineer Real Question Answers Updated

Earning the Google Professional-Cloud-Security-Engineer certification is a great way to advance your career in the cloud security field. It demonstrates to potential employers that you have the skills, knowledge, and experience necessary to secure cloud environments and protect against emerging threats. It also opens up new opportunities for career advancement and higher salaries.

Q154. Your organization is using a third-party identity and authentication provider to centrally manage users. You want to use this identity provider to grant access to the Google Cloud console without syncing identities to Google Cloud. Users should receive permissions based on attributes. What should you do?

Configure the central identity provider as a workforce identity pool provider in Workforce Identity Federation. Create an attribute mapping by using the Common Expression Language (CEL).

Configure a periodic synchronization of relevant users and groups with attributes to Cloud Identity.
Activate single sign-on by using the Security Assertion Markup Language (SAML).

Set up the Google Cloud Identity Platform. Configure an external authentication provider by using OpenID Connect and link user accounts based on attributes.

Activate external identities on the Identity-Aware Proxy. Use the Security Assertion Markup Language (SAML) to configure authentication based on attributes to the central authentication provider.

Q155. Employees at your company use their personal computers to access your organization’s Google Cloud console. You need to ensure that users can only access the Google Cloud console from their corporate-issued devices and verify that they have a valid enterprise certificate.
What should you do?

Implement an Access Policy in BeyondCorp Enterprise to verify the device certificate. Create an access binding with the access policy just created.

Implement a VPC firewall policy. Activate packet inspection and create an allow rule to validate and verify the device certificate.

Implement an organization policy to verify the certificate from the access context.

Implement an Identity and Access Management (IAM) conditional policy to verify the device certificate.

Q156. You want to prevent users from accidentally deleting a Shared VPC host project. Which organization-level policy constraint should you enable?

compute.restrictSharedVpcHostProjects

compute.restrictXpnProjectLienRemoval

compute.restrictSharedVpcSubnetworks

compute.sharedReservationsOwnerProjects

Q157. Your organization operates in a highly regulated industry and uses multiple Google Cloud services. You need to identify potential risks to regulatory compliance. Which situation introduces the greatest risk?

Principals have broad IAM roles allowing the creation and management of Compute Engine VMs without a pre-defined hardening process.

Sensitive data is stored in a Cloud Storage bucket with the uniform bucket-level access setting enabled.

The security team mandates the use of customer-managed encryption keys (CMEK) for all data classified as sensitive.

The audit team needs access to Cloud Audit Logs related to managed services like BigQuery.

Q158. Your organization needs to restrict the types of Google Cloud services that can be deployed within specific folders to enforce compliance requirements You must apply these restrictions only to the designated folders without affecting other parts of the resource hierarchy You want to use the most efficient and simple method What should you do?

Create an organization policy at the folder level using the “Restrict Resource Service Usage” constraint and define the allowed services per folder

Implement IAM conditions on service account creation within each folder

Create a global organization policy at the organization level with the “Restrict Resource Service Usage” constraint and apply exceptions for other folders

Configure VPC Service Controls perimeters around each folder and define the allowed services within the perimeter

The problem requires restricting the types of Google Cloud services that can be deployed within specific folders to enforce compliance, without affecting other parts of the resource hierarchy, using the most efficient and simple method Organization Policies: Organization policies allow you to define centralized, programmatic controls over your Google Cloud resources They apply hierarchically, meaning a policy set on a folder applies to all projects and resources within that folder and its descendants Restrict Resource Service Usage Constraint: This specific organization policy constraint is designed precisely for controlling which Google Cloud services can be used (and thus deployed/created resources for) within a given part of the resource hierarchy It supports both allowlists and denylists of service API identifiers Extract Reference: “The Restrict Resource Service Usage constraint controls the runtime access to all in-scope resources” and “This constraint can be used in two mutually exclusive ways: Denylist – resources of any service that isn’t denied are allowed Allowlist – resources of any service that isn’t allowed are denied” (Google Cloud Documentation: “Restricting resource usage | Resource Manager Documentation” – https://cloudgooglecom/resource-manager/docs/organization-policy/restricting-resources) Folder-Level Application: Applying this organization policy at the folder level directly meets the requirement of applying restrictions “only to the designated folders without affecting other parts of the resource hierarchy” This is more efficient and simpler than applying a global policy with numerous exceptions Let’s evaluate the other options:
B Implement IAM conditions on service account creation within each folder: IAM conditions control permissions for who can do what While they can be used for very fine-grained access control, they are not designed to restrict the types of services that can be deployed directly Controlling service account creation doesn’t prevent a user with appropriate permissions from deploying other resources C Create a global organization policy and apply exceptions: While technically possible, this is less efficient and simple if the goal is to only restrict specific folders Managing exceptions for the entire rest of the organization would be more complex than simply applying the policy directly where it’s needed D Configure VPC Service Controls perimeters around each folder: VPC Service Controls primarily prevent data exfiltration and restrict API access at a network perimeter level They are not designed to restrict which types of Google Cloud services can be deployed within a project or folder; rather, they control how allowed services interact with each other and with external endpoints

Q159. You need to use Cloud External Key Manager to create an encryption key to encrypt specific BigQuery data at rest in Google Cloud. Which steps should you do first?

1. Create or use an existing key with a unique uniform resource identifier (URI) in your Google Cloud project.
2. Grant your Google Cloud project access to a supported external key management partner system.

1. Create or use an existing key with a unique uniform resource identifier (URI) in Cloud Key Management Service (Cloud KMS).
2. In Cloud KMS, grant your Google Cloud project access to use the key.

1. Create or use an existing key with a unique uniform resource identifier (URI) in a supported external key management partner system.
2. In the external key management partner system, grant access for this key to use your Google Cloud project.

1. Create an external key with a unique uniform resource identifier (URI) in Cloud Key Management Service (Cloud KMS).
2. In Cloud KMS, grant your Google Cloud project access to use the key.

Q160. Your organization has on-premises hosts that need to access Google Cloud APIs. You must enforce private connectivity between these hosts, minimize costs, and optimize for operational efficiency.
What should you do?

Set up VPC peering between the hosts on-premises and the VPC through the internet.

Route all on-premises traffic to Google Cloud through an IPsec VPN tunnel to a VPC with Private Google Access enabled.

Enforce a security policy that mandates all applications to encrypt data with a Cloud Key Management Service (KMS) key before you send it over the network.

Route all on-premises traffic to Google Cloud through a dedicated or Partner Interconnect to a VPC with Private Google Access enabled.

Q161. You have stored company approved compute images in a single Google Cloud project that is used as an image repository. This project is protected with VPC Service Controls and exists in the perimeter along with other projects in your organization. This lets other projects deploy images from the image repository project. A team requires deploying a third-party disk image that is stored in an external Google Cloud organization. You need to grant read access to the disk image so that it can be deployed into the perimeter.
What should you do?

Allow the external project by using the organizational policy,
constraints/compute.trustedImageProjects.

1. Update the perimeter.
2. Configure the egressTo field to include the external Google Cloud project number as an allowed resource and the serviceName to compute.googleapis.com.
3. Configure the egressFrom field to set identityType to ANY_IDENTITY.

1. Update the perimeter.
2. Configure the ingressFrom field to set identityType to ANY_IDENTITY.
3. Configure the ingressTo field to include the external Google Cloud project number as an allowed resource and the serviceName to compute.googleapis.com.

1. Update the perimeter.
2. Configure the egressTo field to set identityType to ANY_IDENTITY.
3. Configure the egressFrom field to include the external Google Cloud project number as an allowed resource and the serviceName to compute.googleapis.com.

Q162. Your organization uses a microservices architecture based on Google Kubernetes Engine (GKE). Security reviews recommend tighter controls around deployed container images to reduce potential vulnerabilities and maintain compliance. You need to implement an automated system by using managed services to ensure that only approved container images are deployed to the GKE clusters. What should you do?

Enforce Binary Authorization in your GKE clusters. Integrate container image vulnerability scanning into the CI/CD pipeline and require vulnerability scan results to be used for Binary Authorization policy decisions.

Develop custom organization policies that restrict GKE cluster deployments to container images hosted within a specific Artifact Registry project where your approved images reside.

Build a system using third-party vulnerability databases and custom scripts to identify potential Common Vulnerabilities and Exposures (CVEs) in your container images. Prevent image deployment if the CVE impact score is beyond a specified threshold.

Automatically deploy new container images upon successful CI/CD builds by using Cloud Build triggers. Set up firewall rules to limit and control access to instances to mitigate malware injection

To enhance the security of your microservices architecture on Google Kubernetes Engine (GKE) and ensure that only approved container images are deployed, implementing Binary Authorization is a robust solution.
Option A: Enforcing Binary Authorization in your GKE clusters ensures that only container images that meet your organization’s security policies are deployed. By integrating container image vulnerability scanning into your Continuous Integration/Continuous Deployment (CI/CD) pipeline, you can assess images for known vulnerabilities before they are deployed. Binary Authorization can be configured to use these vulnerability scan results to make policy decisions, effectively preventing the deployment of insecure images. This approach leverages managed services provided by Google Cloud, ensuring scalability and compliance with security standards.
Option B: Developing custom organization policies to restrict deployments to images within a specific Artifact Registry project helps in controlling the source of images but does not inherently assess the security posture of those images. Without integrated vulnerability scanning and enforcement mechanisms, this approach may not fully mitigate the risk of deploying vulnerable images.
Option C: Building a system using third-party vulnerability databases and custom scripts requires significant maintenance and may not integrate seamlessly with GKE. This approach can be error-prone and lacks the efficiency of managed services designed for this purpose.
Option D: Automatically deploying new images upon successful CI/CD builds ensures rapid deployment but does not address the need for security assessments of the images. While setting up firewall rules is good practice, it does not prevent the deployment of potentially vulnerable images.
Therefore, Option A is the most effective approach, as it utilizes Google Cloud’s managed services to enforce security policies and integrate vulnerability assessments directly into the deployment process, ensuring that only approved and secure container images are deployed to your GKE clusters.
Reference:
Binary Authorization Documentation
Container Analysis Documentation

Q163. Your organization’s Google Cloud VMs are deployed via an instance template that configures them with a public IP address in order to host web services for external users. The VMs reside in a service project that is attached to a host (VPC) project containing one custom Shared VPC for the VMs. You have been asked to reduce the exposure of the VMs to the internet while continuing to service external users. You have already recreated the instance template without a public IP address configuration to launch the managed instance group (MIG). What should you do?

Deploy a Cloud NAT Gateway in the service project for the MIG.

Deploy a Cloud NAT Gateway in the host (VPC) project for the MIG.

Deploy an external HTTP(S) load balancer in the service project with the MIG as a backend.

Deploy an external HTTP(S) load balancer in the host (VPC) project with the MIG as a backend.

Q164. You need to use Cloud External Key Manager to create an encryption key to encrypt specific BigQuery data at rest in Google Cloud. Which steps should you do first?

1. Create or use an existing key with a unique uniform resource identifier (URI) in your Google Cloud project. 2. Grant your Google Cloud project access to a supported external key management partner system.

1. Create or use an existing key with a unique uniform resource identifier (URI) in Cloud Key Management Service (Cloud KMS). 2. In Cloud KMS, grant your Google Cloud project access to use the key.

1. Create or use an existing key with a unique uniform resource identifier (URI) in a supported external key management partner system. 2. In the external key management partner system, grant access for this key to use your Google Cloud project.

1. Create an external key with a unique uniform resource identifier (URI) in Cloud Key Management Service (Cloud KMS). 2. In Cloud KMS, grant your Google Cloud project access to use the key.

Q165. Which two implied firewall rules are defined on a VPC network? (Choose two.)

A rule that allows all outbound connections

A rule that denies all inbound connections

A rule that blocks all inbound port 25 connections

A rule that blocks all outbound connections

A rule that allows all inbound port 80 connections

Q166. You are in charge of migrating a legacy application from your company datacenters to GCP before the current maintenance contract expires. You do not know what ports the application is using and no documentation is available for you to check. You want to complete the migration without putting your environment at risk.
What should you do?

Migrate the application into an isolated project using a “Lift & Shift” approach. Enable all internal TCP traffic using VPC Firewall rules. Use VPC Flow logs to determine what traffic should be allowed for the application to work properly.

Migrate the application into an isolated project using a “Lift & Shift” approach in a custom network. Disable all traffic within the VPC and look at the Firewall logs to determine what traffic should be allowed for the application to work properly.

Refactor the application into a micro-services architecture in a GKE cluster. Disable all traffic from outside the cluster using Firewall Rules. Use VPC Flow logs to determine what traffic should be allowed for the application to work properly.

Refactor the application into a micro-services architecture hosted in Cloud Functions in an isolated project.
Disable all traffic from outside your project using Firewall Rules. Use VPC Flow logs to determine what traffic should be allowed for the application to work properly.

Q167. Your company is using Cloud Dataproc for its Spark and Hadoop jobs. You want to be able to create, rotate, and destroy symmetric encryption keys used for the persistent disks used by Cloud Dataproc. Keys can be stored in the cloud.
What should you do?

Use the Cloud Key Management Service to manage the data encryption key (DEK).

Use the Cloud Key Management Service to manage the key encryption key (KEK).

Use customer-supplied encryption keys to manage the data encryption key (DEK).

Use customer-supplied encryption keys to manage the key encryption key (KEK).

Q168. You need to create a VPC that enables your security team to control network resources such as firewall rules. How should you configure the network to allow for separation of duties for network resources?

Set up multiple VPC networks, and set up multi-NIC virtual appliances to connect the networks.

Set up VPC Network Peering, and allow developers to peer their network with a Shared VPC.

Set up a VPC in a project. Assign the Compute Network Admin role to the security team, and assign the Compute Admin role to the developers.

Set up a Shared VPC where the security team manages the firewall rules, and share the network with developers via service projects.

Q169. A customer deployed an application on Compute Engine that takes advantage of the elastic nature of cloud computing.
How can you work with Infrastructure Operations Engineers to best ensure that Windows Compute Engine VMs are up to date with all the latest OS patches?

Build new base images when patches are available, and use a CI/CD pipeline to rebuild VMs, deploying incrementally.

Federate a Domain Controller into Compute Engine, and roll out weekly patches via Group Policy Object.

Use Deployment Manager to provision updated VMs into new serving Instance Groups (IGs).

Reboot all VMs during the weekly maintenance window and allow the StartUp Script to download the latest patches from the internet.

Q170. A retail customer allows users to upload comments and product reviews. The customer needs to make sure the text does not include sensitive data before the comments or reviews are published.
Which Google Cloud Service should be used to achieve this?

Cloud Key Management Service

Cloud Data Loss Prevention API

BigQuery

Cloud Security Scanner

Q171. Your team needs to make sure that a Compute Engine instance does not have access to the internet or to any Google APIs or services.
Which two settings must remain disabled to meet these requirements? (Choose two.)

Public IP

IP Forwarding

Private Google Access

Static routes

IAM Network User Role

Q172. You are deploying a web application hosted on Compute Engine. A business requirement mandates that application logs are preserved for 12 years and data is kept within European boundaries. You want to implement a storage solution that minimizes overhead and is cost-effective. What should you do?

Create a Cloud Storage bucket to store your logs in the EUROPE-WEST1 region. Modify your application code to ship logs directly to your bucket for increased efficiency.

Configure your Compute Engine instances to use the Google Cloud’s operations suite Cloud Logging agent to send application logs to a custom log bucket in the EUROPE-WEST1 region with a custom retention of 12 years.

Use a Pub/Sub topic to forward your application logs to a Cloud Storage bucket in the EUROPE-WEST1 region.

Configure a custom retention policy of 12 years on your Google Cloud’s operations suite log bucket in the EUROPE-WEST1 region.

Q173. You need to set up a Cloud interconnect connection between your company’s on-premises data center and VPC host network. You want to make sure that on-premises applications can only access Google APIs over the Cloud Interconnect and not through the public internet. You are required to only use APIs that are supported by VPC Service Controls to mitigate against exfiltration risk to non-supported APIs. How should you configure the network?

Enable Private Google Access on the regional subnets and global dynamic routing mode.

Set up a Private Service Connect endpoint IP address with the API bundle of “all-apis”, which is advertised as a route over the Cloud interconnect connection.

Use private.googleapis.com to access Google APIs using a set of IP addresses only routable from within Google Cloud, which are advertised as routes over the connection.

Use restricted googleapis.com to access Google APIs using a set of IP addresses only routable from within Google Cloud, which are advertised as routes over the Cloud Interconnect connection.

Q174. You work for an organization in a regulated industry that has strict data protection requirements.
The organization backs up their data in the cloud. To comply with data privacy regulations, this data can only be stored for a specific length of time and must be deleted after this specific period.
You want to automate the compliance with this regulation while minimizing storage costs. What should you do?

Store the data in a persistent disk, and delete the disk at expiration time.

Store the data in a Cloud Bigtable table, and set an expiration time on the column families.

Store the data in a BigQuery table, and set the table’s expiration time.

Store the data in a Cloud Storage bucket, and configure the bucket’s Object Lifecycle Management feature.

Q175. Your company’s Chief Information Security Officer (CISO) creates a requirement that business data must be stored in specific locations due to regulatory requirements that affect the company’s global expansion plans. After working on the details to implement this requirement, you determine the following:
The services in scope are included in the Google Cloud Data Residency Terms.
The business data remains within specific locations under the same organization.
The folder structure can contain multiple data residency locations.
You plan to use the Resource Location Restriction organization policy constraint. At which level in the resource hierarchy should you set the constraint?

Folder

Resource

Project

Organization

Q176. Your company is storing sensitive data in Cloud Storage. You want a key generated on-premises to be used in the encryption process.
What should you do?

Use the Cloud Key Management Service to manage a data encryption key (DEK).

Use the Cloud Key Management Service to manage a key encryption key (KEK).

Use customer-supplied encryption keys to manage the data encryption key (DEK).

Use customer-supplied encryption keys to manage the key encryption key (KEK).

Q177. You are asked to recommend a solution to store and retrieve sensitive configuration data from an application that runs on Compute Engine. Which option should you recommend?

Cloud Key Management Service

Compute Engine guest attributes

Compute Engine custom metadata

Secret Manager

To pass the exam, individuals must demonstrate a deep understanding of Google Cloud security tools and techniques, including identity and access management, network security, data encryption, and compliance. They must also be able to design and implement security solutions that are tailored to specific organizational needs, and be able to monitor and troubleshoot these solutions to ensure ongoing security and compliance.

Actual Questions Answers Pass With Real Professional-Cloud-Security-Engineer Exam Dumps: https://www.examcollectionpass.com/Google/Professional-Cloud-Security-Engineer-practice-exam-dumps.html