Google Professional Cloud Security Engineer Practice Exams
Last updated on Oct 23,2026- Exam Code: Professional Cloud Security Engineer
- Exam Name: Google Cloud Certified - Professional Cloud Security Engineer
- Certification Provider: Google
- Latest update: Oct 23,2026
Your security team wants to reduce the risk of user-managed keys being mismanaged and compromised. To achieve this, you need to prevent developers from creating user-managed service account keys for projects in their organization.
How should you enforce this?
- A . Configure Secret Manager to manage service account keys.
- B . Enable an organization policy to disable service accounts from being created.
- C . Enable an organization policy to prevent service account keys from being created.
- D . Remove the iam.serviceAccounts.getAccessToken permission from users.
C
Explanation:
https://cloud.google.com/iam/docs/best-practices-for-managing-service-account-keys
"To prevent unnecessary usage of service account keys, use organization policy constraints: At the root of your organization’s resource hierarchy, apply the Disable service account key creation and Disable service account key upload constraints to establish a default where service account keys are disallowed. When needed, override one of the constraints for selected projects to re-enable service account key creation or upload."
Your security team wants to reduce the risk of user-managed keys being mismanaged and compromised. To achieve this, you need to prevent developers from creating user-managed service account keys for projects in their organization.
How should you enforce this?
- A . Configure Secret Manager to manage service account keys.
- B . Enable an organization policy to disable service accounts from being created.
- C . Enable an organization policy to prevent service account keys from being created.
- D . Remove the iam.serviceAccounts.getAccessToken permission from users.
C
Explanation:
https://cloud.google.com/iam/docs/best-practices-for-managing-service-account-keys
"To prevent unnecessary usage of service account keys, use organization policy constraints: At the root of your organization’s resource hierarchy, apply the Disable service account key creation and Disable service account key upload constraints to establish a default where service account keys are disallowed. When needed, override one of the constraints for selected projects to re-enable service account key creation or upload."
A company has redundant mail servers in different Google Cloud Platform regions and wants to route customers to the nearest mail server based on location.
How should the company accomplish this?
- A . Configure TCP Proxy Load Balancing as a global load balancing service listening on port 995.
- B . Create a Network Load Balancer to listen on TCP port 995 with a forwarding rule to forward traffic based on location.
- C . Use Cross-Region Load Balancing with an HTTP(S) load balancer to route traffic to the nearest region.
- D . Use Cloud CDN to route the mail traffic to the closest origin mail server based on client IP address.
A
Explanation:
https://cloud.google.com/load-balancing/docs/tcp
TCP Proxy Load Balancing is implemented on GFEs that are distributed globally. If you choose the Premium Tier of Network Service Tiers, a TCP proxy load balancer is global. In Premium Tier, you can deploy backends in multiple regions, and the load balancer automatically directs user traffic to the closest region that has capacity. If you choose the Standard Tier, a TCP proxy load balancer can only direct traffic among backends in a single region. https://cloud.google.com/load-balancing/docs/load-balancing-overview#tcp-proxy-load-balancing
A company has redundant mail servers in different Google Cloud Platform regions and wants to route customers to the nearest mail server based on location.
How should the company accomplish this?
- A . Configure TCP Proxy Load Balancing as a global load balancing service listening on port 995.
- B . Create a Network Load Balancer to listen on TCP port 995 with a forwarding rule to forward traffic based on location.
- C . Use Cross-Region Load Balancing with an HTTP(S) load balancer to route traffic to the nearest region.
- D . Use Cloud CDN to route the mail traffic to the closest origin mail server based on client IP address.
A
Explanation:
https://cloud.google.com/load-balancing/docs/tcp
TCP Proxy Load Balancing is implemented on GFEs that are distributed globally. If you choose the Premium Tier of Network Service Tiers, a TCP proxy load balancer is global. In Premium Tier, you can deploy backends in multiple regions, and the load balancer automatically directs user traffic to the closest region that has capacity. If you choose the Standard Tier, a TCP proxy load balancer can only direct traffic among backends in a single region. https://cloud.google.com/load-balancing/docs/load-balancing-overview#tcp-proxy-load-balancing
You are setting up a CI/CD pipeline to deploy containerized applications to your production clusters on Google Kubernetes Engine (GKE). You need to prevent containers with known vulnerabilities from being deployed.
You have the following requirements for your solution:
– Must be cloud-native
– Must be cost-efficient
– Minimize operational overhead
How should you accomplish this? (Choose two.)
- A . Create a Cloud Build pipeline that will monitor changes to your container templates in a Cloud Source Repositories repository. Add a step to analyze Container Analysis results before allowing the build to continue.
- B . Use a Cloud Function triggered by log events in Google Cloud’s operations suite to automatically scan your container images in Container Registry.
- C . Use a cron job on a Compute Engine instance to scan your existing repositories for known vulnerabilities and raise an alert if a non-compliant container image is found.
- D . Deploy Jenkins on GKE and configure a CI/CD pipeline to deploy your containers to Container Registry. Add a step to validate your container images before deploying your container to the cluster.
- E . In your CI/CD pipeline, add an attestation on your container image when no vulnerabilities have been found. Use a Binary Authorization policy to block deployments of containers with no attestation in your cluster.
A, E
Explanation:
Reference:
https://cloud.google.com/architecture/prep-kubernetes-engine-for-prod
https://cloud.google.com/container-analysis/docs/container-analysis
Container Analysis is a service that provides vulnerability scanning and metadata storage for containers. The scanning service performs vulnerability scans on images in Container Registry and Artifact Registry, then stores the resulting metadata and makes it available for consumption through an API.
https://cloud.google.com/binary-authorization/docs/attestations
After a container image is built, an attestation can be created to affirm that a required activity was performed on the image such as a regression test, vulnerability scan, or other test. The attestation is created by signing the image’s unique digest.
During deployment, instead of repeating the activities, Binary Authorization verifies the attestations using an attestor. If all of the attestations for an image are verified, Binary Authorization allows the image to be deployed.
An organization receives an increasing number of phishing emails.
Which method should be used to protect employee credentials in this situation?
- A . Multifactor Authentication
- B . A strict password policy
- C . Captcha on login pages
- D . Encrypted emails
A
Explanation:
https://cloud.google.com/blog/products/g-suite/7-ways-admins-can-help-secure-accounts-against-phishing-g-suite
https://www.duocircle.com/content/email-security-services/email-security-in-
cryptography#:~:text=Customer%20Login-
,Email%20Security%20In%20Cryptography%20Is%20One%20Of%20The%20Most,Measures%20To%20Prevent%20Phishing%20Attempts&text=Cybercriminals%20love%20emails%20the%20most,networks%20all%20over%20the%20world.
A large e-retailer is moving to Google Cloud Platform with its ecommerce website. The company wants to ensure payment information is encrypted between the customer’s browser and GCP when the customers checkout online.
What should they do?
- A . Configure an SSL Certificate on an L7 Load Balancer and require encryption.
- B . Configure an SSL Certificate on a Network TCP Load Balancer and require encryption.
- C . Configure the firewall to allow inbound traffic on port 443, and block all other inbound traffic.
- D . Configure the firewall to allow outbound traffic on port 443, and block all other outbound traffic.
A
Explanation:
https://cloud.google.com/load-balancing/docs/load-balancing-overview#external_versus_internal_load_balancing
Run GCDS after user and group lifecycle changes.
Explanation:
To achieve the requirement "Disable any manually created users in Cloud Identity", configure GCDS to suspend rather than delete accounts if user accounts are not found in the LDAP directory in GCDS. Ref: https://support.google.com/a/answer/7177267
Your company’s cloud security policy dictates that VM instances should not have an external IP address. You need to identify the Google Cloud service that will allow VM instances without external IP addresses to connect to the internet to update the VMs.
Which service should you use?
- A . Identity Aware-Proxy
- B . Cloud NAT
- C . TCP/UDP Load Balancing
- D . Cloud DNS
B
Explanation:
https://cloud.google.com/nat/docs/overview "Cloud NAT (network address translation) lets certain resources without external IP addresses create outbound connections to the internet."
Your company’s cloud security policy dictates that VM instances should not have an external IP address. You need to identify the Google Cloud service that will allow VM instances without external IP addresses to connect to the internet to update the VMs.
Which service should you use?
- A . Identity Aware-Proxy
- B . Cloud NAT
- C . TCP/UDP Load Balancing
- D . Cloud DNS
B
Explanation:
https://cloud.google.com/nat/docs/overview "Cloud NAT (network address translation) lets certain resources without external IP addresses create outbound connections to the internet."