Google Professional Cloud Security Engineer Practice Exams
Last updated on Oct 21,2026- Exam Code: Professional Cloud Security Engineer
- Exam Name: Google Cloud Certified - Professional Cloud Security Engineer
- Certification Provider: Google
- Latest update: Oct 21,2026
Your team wants to centrally manage GCP IAM permissions from their on-premises Active Directory Service. Your team wants to manage permissions by AD group membership.
What should your team do to meet these requirements?
- A . Set up Cloud Directory Sync to sync groups, and set IAM permissions on the groups.
- B . Set up SAML 2.0 Single Sign-On (SSO), and assign IAM permissions to the groups.
- C . Use the Cloud Identity and Access Management API to create groups and IAM permissions from Active Directory.
- D . Use the Admin SDK to create groups and assign IAM permissions from Active Directory.
A
Explanation:
"In order to be able to keep using the existing identity management system, identities need to be synchronized between AD and GCP IAM. To do so google provides a tool called Cloud Directory Sync. This tool will read all identities in AD and replicate those within GCP. Once the identities have been replicated then it’s possible to apply IAM permissions on the groups. After that you will configure SAML so google can act as a service provider and either you ADFS or other third party tools like Ping or Okta will act as the identity provider. This way you effectively delegate the authentication from Google to something that is under your control."
A DevOps team will create a new container to run on Google Kubernetes Engine. As the application will be internet-facing, they want to minimize the attack surface of the container.
What should they do?
- A . Use Cloud Build to build the container images.
- B . Build small containers using small base images.
- C . Delete non-used versions from Container Registry.
- D . Use a Continuous Delivery tool to deploy the application.
B
Explanation:
Small containers usually have a smaller attack surface as compared to containers that use large base images. https://cloud.google.com/blog/products/gcp/kubernetes-best-practices-how-and-why-to-build-small-container-images
You have the following resource hierarchy. There is an organization policy at each node in the hierarchy as shown.
Which load balancer types are denied in VPCA?
- A . All load balancer types are denied in accordance with the global node’s policy.
- B . INTERNAL_TCP_UDP, INTERNAL_HTTP_HTTPS is denied in accordance with the folder’s policy.
- C . EXTERNAL_TCP_PROXY, EXTERNAL_SSL_PROXY are denied in accordance with the project’s policy.
- D . EXTERNAL_TCP_PROXY, EXTERNAL_SSL_PROXY, INTERNAL_TCP_UDP, and INTERNAL_HTTP_HTTPS are denied in accordance with the folder and project’s policies.
Your company recently published a security policy to minimize the usage of service account keys. On-premises Windows-based applications are interacting with Google Cloud APIs. You need to implement Workload Identity Federation (WIF) with your identity provider on-premises.
What should you do?
- A . Set up a workload identity pool with your corporate Active Directory Federation Service (ADFS) Configure a rule to let principals in the pool impersonate the Google Cloud service account.
- B . Set up a workload identity pool with your corporate Active Directory Federation Service (ADFS) Let all principals in the pool impersonate the Google Cloud service account.
- C . Set up a workload identity pool with an OpenID Connect (OIDC) service on the name machine Configure a rule to let principals in the pool impersonate the Google Cloud service account.
- D . Set up a workload identity pool with an OpenID Connect (OIDC) service on the same machine Let all principals in the pool impersonate the Google Cloud service account.
Your organization processes sensitive health information. You want to ensure that data is encrypted while in use by the virtual machines (VMs). You must create a policy that is enforced across the entire organization.
What should you do?
- A . Implement an organization policy that ensures that all VM resources created across your organization use customer-managed encryption keys (CMEK) protection.
- B . Implement an organization policy that ensures all VM resources created across your organization are Confidential VM instances.
- C . Implement an organization policy that ensures that all VM resources created across your organization use Cloud External Key Manager (EKM) protection.
- D . No action is necessary because Google encrypts data while it is in use by default.
Your organization processes sensitive health information. You want to ensure that data is encrypted while in use by the virtual machines (VMs). You must create a policy that is enforced across the entire organization.
What should you do?
- A . Implement an organization policy that ensures that all VM resources created across your organization use customer-managed encryption keys (CMEK) protection.
- B . Implement an organization policy that ensures all VM resources created across your organization are Confidential VM instances.
- C . Implement an organization policy that ensures that all VM resources created across your organization use Cloud External Key Manager (EKM) protection.
- D . No action is necessary because Google encrypts data while it is in use by default.
You are onboarding new users into Cloud Identity and discover that some users have created consumer user accounts using the corporate domain name.
How should you manage these consumer user accounts with Cloud Identity?
- A . Use Google Cloud Directory Sync to convert the unmanaged user accounts.
- B . Create a new managed user account for each consumer user account.
- C . Use the transfer tool for unmanaged user accounts.
- D . Configure single sign-on using a customer’s third-party provider.
C
Explanation:
https://support.google.com/a/answer/6178640?hl=en
The transfer tool enables you to see what unmanaged users exist, and then invite those unmanaged users to the domain.
An organization’s typical network and security review consists of analyzing application transit routes, request handling, and firewall rules. They want to enable their developer teams to deploy new applications without the overhead of this full review.
How should you advise this organization?
- A . Use Forseti with Firewall filters to catch any unwanted configurations in production.
- B . Mandate use of infrastructure as code and provide static analysis in the CI/CD pipelines to enforce policies.
- C . Route all VPC traffic through customer-managed routers to detect malicious patterns in production.
- D . All production applications will run on-premises. Allow developers free rein in GCP as their dev and QA platforms.
B
Explanation:
https://cloud.google.com/recommender/docs/tutorial-iac
An organization is evaluating the use of Google Cloud Platform (GCP) for certain IT workloads. A well-established directory service is used to manage user identities and lifecycle management. This directory service must continue for the organization to use as the “source of truth” directory for identities.
Which solution meets the organization’s requirements?
- A . Google Cloud Directory Sync (GCDS)
- B . Cloud Identity
- C . Security Assertion Markup Language (SAML)
- D . Pub/Sub
A
Explanation:
With Google Cloud Directory Sync (GCDS), you can synchronize the data in your Google Account with your Microsoft Active Directory or LDAP server. GCDS doesn’t migrate any content (such as email messages, calendar events, or files) to your Google Account. You use GCDS to synchronize your Google users, groups, and shared contacts to match the information in your LDAP server. https://support.google.com/a/answer/106368?hl=en
Your organization wants to protect all workloads that run on Compute Engine VM to ensure that the instances weren’t compromised by boot-level or kernel-level malware. Also, you need to ensure that data in use on the VM cannot be read by the underlying host system by using a hardware-based solution.
What should you do?
- A . • 1 Use Google Shielded VM including secure boot Virtual Trusted Platform Module (vTPM) and integrity monitoring
• 2 Create a Cloud Run function to check for the VM settings generate metrics and run the function regularly - B . • 1 Activate Virtual Machine Threat Detection in Security Command Center (SCO Premium
• 2 Monitor the findings in SCC - C . • 1 Use Google Shielded VM including secure boot Virtual Trusted Platform Module (vTPM) and integrity monitoring
• 2 Activate Confidential Computing
• 3 Enforce these actions by using organization policies - D . • 1 Use secure hardened images from the Google Cloud Marketplace
• 2 When deploying the images activate the Confidential Computing option
• 3 Enforce the use of the correct images and Confidential Computing by using organization
policies