Google Professional Cloud Security Engineer Practice Exams
Last updated on Oct 23,2026- Exam Code: Professional Cloud Security Engineer
- Exam Name: Google Cloud Certified - Professional Cloud Security Engineer
- Certification Provider: Google
- Latest update: Oct 23,2026
A customer’s data science group wants to use Google Cloud Platform (GCP) for their analytics workloads. Company policy dictates that all data must be company-owned and all user authentications must go through their own Security Assertion Markup Language (SAML) 2.0 Identity Provider (IdP). The Infrastructure Operations Systems Engineer was trying to set up Cloud Identity for the customer and realized that their domain was already being used by G Suite.
How should you best advise the Systems Engineer to proceed with the least disruption?
- A . Contact Google Support and initiate the Domain Contestation Process to use the domain name in your new Cloud Identity domain.
- B . Register a new domain name, and use that for the new Cloud Identity domain.
- C . Ask Google to provision the data science manager’s account as a Super Administrator in the existing domain.
- D . Ask customer’s management to discover any other uses of Google managed services, and work with the existing Super Administrator.
D
Explanation:
https://support.google.com/cloudidentity/answer/7389973
You have an application where the frontend is deployed on a managed instance group in subnet A and the data layer is stored on a mysql Compute Engine virtual machine (VM) in subnet B on the same VPC. Subnet A and Subnet B hold several other Compute Engine VMs. You only want to allow thee application frontend to access the data in the application’s mysql instance on port 3306.
What should you do?
- A . Configure an ingress firewall rule that allows communication from the src IP range of subnet A to the tag "data-tag" that is applied to the mysql Compute Engine VM on port 3306.
- B . Configure an ingress firewall rule that allows communication from the frontend’s unique service account to the unique service account of the mysql Compute Engine VM on port 3306.
- C . Configure a network tag "fe-tag" to be applied to all instances in subnet A and a network tag "data-tag" to be applied to all instances in subnet
- D . Then configure an egress firewall rule that allows communication from Compute Engine VMs tagged with data-tag to destination Compute Engine VMs tagged fe-tag.
- E . Configure a network tag "fe-tag" to be applied to all instances in subnet A and a network tag "data-tag" to be applied to all instances in subnet
- F . Then configure an ingress firewall rule that allows communication from Compute Engine VMs tagged with fe-tag to destination Compute Engine VMs tagged with data-tag.
B
Explanation:
https://cloud.google.com/sql/docs/mysql/sql-proxy#using-a-service-account
A manager wants to start retaining security event logs for 2 years while minimizing costs. You write a filter to select the appropriate log entries.
Where should you export the logs?
- A . BigQuery datasets
- B . Cloud Storage buckets
- C . StackDriver logging
- D . Cloud Pub/Sub topics
B
Explanation:
Reference: https://cloud.google.com/logging/docs/exclusions
You are part of a security team investigating a compromised service account key. You need to audit which new resources were created by the service account.
What should you do?
- A . Query Data Access logs.
- B . Query Admin Activity logs.
- C . Query Access Transparency logs.
- D . Query Stackdriver Monitoring Workspace.
B
Explanation:
Admin activity logs are always created to log entries for API calls or other actions that modify the configuration or metadata of resources. For example, these logs record when users create VM instances or change Identity and Access Management permissions.
Reference: https://cloud.google.com/iam/docs/audit-logging/examples-service-accounts
You plan to use a Google Cloud Armor policy to prevent common attacks such as cross-site scripting (XSS) and SQL injection (SQLi) from reaching your web application’s backend.
What are two requirements for using Google Cloud Armor security policies? (Choose two.)
- A . The load balancer must be an external SSL proxy load balancer.
- B . Google Cloud Armor Policy rules can only match on Layer 7 (L7) attributes.
- C . The load balancer must use the Premium Network Service Tier.
- D . The backend service’s load balancing scheme must be EXTERNAL.
- E . The load balancer must be an external HTTP(S) load balancer.
D, E
Explanation:
https://cloud.google.com/armor/docs/security-policy-overview#requirements says: The backend service’s load balancing scheme must be EXTERNAL, or EXTERNAL_MANAGED *** if you are using global external HTTP(S) load balancer ***.
You plan to use a Google Cloud Armor policy to prevent common attacks such as cross-site scripting (XSS) and SQL injection (SQLi) from reaching your web application’s backend.
What are two requirements for using Google Cloud Armor security policies? (Choose two.)
- A . The load balancer must be an external SSL proxy load balancer.
- B . Google Cloud Armor Policy rules can only match on Layer 7 (L7) attributes.
- C . The load balancer must use the Premium Network Service Tier.
- D . The backend service’s load balancing scheme must be EXTERNAL.
- E . The load balancer must be an external HTTP(S) load balancer.
D, E
Explanation:
https://cloud.google.com/armor/docs/security-policy-overview#requirements says: The backend service’s load balancing scheme must be EXTERNAL, or EXTERNAL_MANAGED *** if you are using global external HTTP(S) load balancer ***.
You need to enable VPC Service Controls and allow changes to perimeters in existing environments without preventing access to resources.
Which VPC Service Controls mode should you use?
- A . Cloud Run
- B . Native
- C . Enforced
- D . Dry run
D
Explanation:
Reference: https://cloud.google.com/vpc-service-controls/docs/service-perimeters
In dry run mode, requests that violate the perimeter policy are not denied, only logged. Dry run mode is used to test perimeter configuration and to monitor usage of services without preventing access to resources. https://cloud.google.com/vpc-service-controls/docs/dry-run-mode
You want to use the gcloud command-line tool to authenticate using a third-party single sign-on (SSO) SAML identity provider.
Which options are necessary to ensure that authentication is supported by the third-party identity provider (IdP)? (Choose two.)
- A . SSO SAML as a third-party IdP
- B . Identity Platform
- C . OpenID Connect
- D . Identity-Aware Proxy
- E . Cloud Identity
A, C
Explanation:
To provide users with SSO-based access to selected cloud apps, Cloud Identity as your IdP supports the OpenID Connect (OIDC) and Security Assertion Markup Language 2.0 (SAML) protocols. https://cloud.google.com/identity/solutions/enable-sso
You want to evaluate GCP for PCI compliance. You need to identify Google’s inherent controls.
Which document should you review to find the information?
- A . Google Cloud Platform: Customer Responsibility Matrix
- B . PCI DSS Requirements and Security Assessment Procedures
- C . PCI SSC Cloud Computing Guidelines
- D . Product documentation for Compute Engine
A
Explanation:
https://cloud.google.com/files/PCI_DSS_Shared_Responsibility_GCP_v32.pdf https://services.google.com/fh/files/misc/gcp_pci_shared_responsibility_matrix_aug_2021.pdf
You need to centralize your team’s logs for production projects. You want your team to be able to search and analyze the logs using Logs Explorer.
What should you do?
- A . Enable Cloud Monitoring workspace, and add the production projects to be monitored.
- B . Use Logs Explorer at the organization level and filter for production project logs.
- C . Create an aggregate org sink at the parent folder of the production projects, and set the destination to a Cloud Storage bucket.
- D . Create an aggregate org sink at the parent folder of the production projects, and set the destination to a logs bucket.
D
Explanation:
https://cloud.google.com/logging/docs/export/aggregated_sinks#supported-destinations
You can use aggregated sinks to route logs within or between the same organizations and folders to the following destinations: – Another Cloud Logging bucket: Log entries held in Cloud Logging log buckets.