Google Professional Cloud Security Engineer Practice Exams
Last updated on Oct 23,2026- Exam Code: Professional Cloud Security Engineer
- Exam Name: Google Cloud Certified - Professional Cloud Security Engineer
- Certification Provider: Google
- Latest update: Oct 23,2026
You need to centralize your team’s logs for production projects. You want your team to be able to search and analyze the logs using Logs Explorer.
What should you do?
- A . Enable Cloud Monitoring workspace, and add the production projects to be monitored.
- B . Use Logs Explorer at the organization level and filter for production project logs.
- C . Create an aggregate org sink at the parent folder of the production projects, and set the destination to a Cloud Storage bucket.
- D . Create an aggregate org sink at the parent folder of the production projects, and set the destination to a logs bucket.
D
Explanation:
https://cloud.google.com/logging/docs/export/aggregated_sinks#supported-destinations
You can use aggregated sinks to route logs within or between the same organizations and folders to the following destinations: – Another Cloud Logging bucket: Log entries held in Cloud Logging log buckets.
You are exporting application logs to Cloud Storage. You encounter an error message that the log sinks don’t support uniform bucket-level access policies.
How should you resolve this error?
- A . Change the access control model for the bucket
- B . Update your sink with the correct bucket destination.
- C . Add the roles/logging.logWriter Identity and Access Management (IAM) role to the bucket for the log sink identity.
- D . Add the roles/logging.bucketWriter Identity and Access Management (IAM) role to the bucket for the log sink identity.
A
Explanation:
https://cloud.google.com/logging/docs/export/troubleshoot#errors_exporting_to_cloud_storage
https://cloud.google.com/logging/docs/export/troubleshoot
Unable to grant correct permissions to the destination: Even if the sink was successfully created with the correct service account permissions, this error message displays if the access control model for the Cloud Storage bucket was set to uniform access when the bucket was created. For existing Cloud Storage buckets, you can change the access control model for the first 90 days after bucket creation by using the Permissions tab. For new buckets, select the Fine-grained access control model during bucket creation. For details, see Creating Cloud Storage buckets.
An application running on a Compute Engine instance needs to read data from a Cloud Storage bucket. Your team does not allow Cloud Storage buckets to be globally readable and wants to ensure the principle of least privilege.
Which option meets the requirement of your team?
- A . Create a Cloud Storage ACL that allows read-only access from the Compute Engine instance’s IP address and allows the application to read from the bucket without credentials.
- B . Use a service account with read-only access to the Cloud Storage bucket, and store the credentials to the service account in the config of the application on the Compute Engine instance.
- C . Use a service account with read-only access to the Cloud Storage bucket to retrieve the credentials from the instance metadata.
- D . Encrypt the data in the Cloud Storage bucket using Cloud KMS, and allow the application to decrypt the data with the KMS key.
C
Explanation:
If the environment variable GOOGLE_APPLICATION_CREDENTIALS is set, ADC uses the service account key or configuration file that the variable points to. If the environment variable GOOGLE_APPLICATION_CREDENTIALS isn’t set, ADC uses the service account that is attached to the resource that is running your code.
https://cloud.google.com/docs/authentication/production#passing_the_path_to_the_service_account_key_in_code
Your security team uses encryption keys to ensure confidentiality of user data. You want to establish a process to reduce the impact of a potentially compromised symmetric encryption key in Cloud Key Management Service (Cloud KMS).
Which steps should your team take before an incident occurs? (Choose two.)
- A . Disable and revoke access to compromised keys.
- B . Enable automatic key version rotation on a regular schedule.
- C . Manually rotate key versions on an ad hoc schedule.
- D . Limit the number of messages encrypted with each key version.
- E . Disable the Cloud KMS API.
BD
Explanation:
As per document "Limiting the number of messages encrypted with the same key version helps prevent attacks enabled by cryptanalysis." https://cloud.google.com/kms/docs/key-rotation
Configure a virtual appliance using multiple network interfaces, with each interface connected to one of the VPC networks.
Explanation:
Multiple network interfaces. The simplest way to connect multiple VPC networks through a virtual appliance is by using multiple network interfaces, with each interface connecting to one of the VPC networks. Internet and on-premises connectivity is provided over one or two separate network interfaces. With many NGFW products, internet connectivity is connected through an interface marked as untrusted in the NGFW software.
https://cloud.google.com/architecture/best-practices-vpc-design#l7
This architecture has multiple VPC networks that are bridged by an L7 next-generation firewall (NGFW) appliance, which functions as a multi-NIC bridge between VPC networks. An untrusted, outside VPC network is introduced to terminate hybrid interconnects and internet-based connections that terminate on the outside leg of the L7 NGFW for inspection. There are many variations on this design, but the key principle is to filter traffic through the firewall before the traffic reaches trusted VPC networks.
Your application is deployed as a highly available cross-region solution behind a global external HTTP(S) load balancer. You notice significant spikes in traffic from multiple IP addresses but it is unknown whether the IPs are malicious. You are concerned about your application’s availability. You want to limit traffic from these clients over a specified time interval.
What should you do?
- A . Configure a rate_based_ban action by using Google Cloud Armor and set the ban_duration_sec parameter to the specified time interval.
- B . Configure a deny action by using Google Cloud Armor to deny the clients that issued too many requests over the specified time interval.
- C . Configure a throttle action by using Google Cloud Armor to limit the number of requests per client over a specified time interval.
- D . Configure a firewall rule in your VPC to throttle traffic from the identified IP addresses.
You are a security engineer at a finance company. Your organization plans to store data on Google Cloud, but your leadership team is worried about the security of their highly sensitive data Specifically, your company is concerned about internal Google employees’ ability to access your company’s data on Google Cloud.
What solution should you propose?
- A . Use customer-managed encryption keys.
- B . Use Google’s Identity and Access Management (IAM) service to manage access controls on Google Cloud.
- C . Enable Admin activity logs to monitor access to resources.
- D . Enable Access Transparency logs with Access Approval requests for Google employees.
D
Explanation:
https://cloud.google.com/access-transparency Access approval Explicitly approve access to your data or configurations on Google Cloud. Access Approval requests, when combined with Access Transparency logs, can be used to audit an end-to-end chain from support ticket to access request to approval, to eventual access.
Validate that the App Engine Default Service Account is the only account that has a role that can write to BigQuery.
Validate that the App Engine Default Service Account is the only account that has a role that can write to BigQuery.
A company migrated their entire data/center to Google Cloud Platform. It is running thousands of instances across multiple projects managed by different departments. You want to have a historical record of what was running in Google Cloud Platform at any point in time.
What should you do?
- A . Use Resource Manager on the organization level.
- B . Use Forseti Security to automate inventory snapshots.
- C . Use Stackdriver to create a dashboard across all projects.
- D . Use Security Command Center to view all assets across the organization.
B
Explanation:
Only Forseti security can have both ‘past’ and ‘present’ (i.e. historical) records of the resources. https://forsetisecurity.org/about/