Google Professional Cloud Security Engineer Practice Exams
Last updated on Oct 23,2026- Exam Code: Professional Cloud Security Engineer
- Exam Name: Google Cloud Certified - Professional Cloud Security Engineer
- Certification Provider: Google
- Latest update: Oct 23,2026
Which two security characteristics are related to the use of VPC peering to connect two VPC networks? (Choose two.)
- A . Central management of routes, firewalls, and VPNs for peered networks
- B . Non-transitive peered networks; where only directly peered networks can communicate
- C . Ability to peer networks that belong to different Google Cloud Platform organizations
- D . Firewall rules that can be created with a tag from one peered network to another peered network
- E . Ability to share specific subnets across peered networks
BC
Explanation:
https://cloud.google.com/vpc/docs/vpc-peering#key_properties
Your company plans to move most of its IT infrastructure to Google Cloud. They want to leverage their existing on-premises Active Directory as an identity provider for Google Cloud.
Which two steps should you take to integrate the company’s on-premises Active Directory with Google Cloud and configure access management? (Choose two.)
- A . Use Identity Platform to provision users and groups to Google Cloud.
- B . Use Cloud Identity SAML integration to provision users and groups to Google Cloud.
- C . Install Google Cloud Directory Sync and connect it to Active Directory and Cloud Identity.
- D . Create Identity and Access Management (1AM) roles with permissions corresponding to each Active Directory group.
- E . Create Identity and Access Management (1AM) groups with permissions corresponding to each Active Directory group.
CE
Explanation:
https://cloud.google.com/architecture/identity/federating-gcp-with-active-directory-synchronizing-user-accounts?hl=en
https://cloud.google.com/architecture/identity/federating-gcp-with-active-directory-synchronizing-user-accounts?hl=en#deciding_where_to_deploy_gcds
You are a member of the security team at an organization. Your team has a single GCP project with credit card payment processing systems alongside web applications and data processing systems. You want to reduce the scope of systems subject to PCI audit standards.
What should you do?
- A . Use multi-factor authentication for admin access to the web application.
- B . Use only applications certified compliant with PA-DSS.
- C . Move the cardholder data environment into a separate GCP project.
- D . Use VPN for all connections between your office and cloud environments.
C
Explanation:
https://cloud.google.com/solutions/best-practices-vpc-design
"Setting up your payment-processing environment" section in
https://cloud.google.com/solutions/pci-dss-compliance-in-gcp.
Your company is moving to Google Cloud. You plan to sync your users first by using Google Cloud Directory Sync (GCDS). Some employees have already created Google Cloud accounts by using their company email addresses that were created outside of GCDS. You must create your users on Cloud Identity.
What should you do?
- A . Configure GCDS and use GCDS search rules lo sync these users.
- B . Use the transfer tool to migrate unmanaged users.
- C . Write a custom script to identify existing Google Cloud users and call the Admin SDK Directory API to transfer their account.
- D . Configure GCDS and use GCDS exclusion rules to ensure users are not suspended.
A customer wants to deploy a large number of 3-tier web applications on Compute Engine.
How should the customer ensure authenticated network separation between the different tiers of the application?
- A . Run each tier in its own Project, and segregate using Project labels.
- B . Run each tier with a different Service Account (SA), and use SA-based firewall rules.
- C . Run each tier in its own subnet, and use subnet-based firewall rules.
- D . Run each tier with its own VM tags, and use tag-based firewall rules.
B
Explanation:
"Isolate VMs using service accounts when possible" "even though it is possible to uses tags for target filtering in this manner, we recommend that you use service accounts where possible. Target tags are not access-controlled and can be changed by someone with the instance Admin role while VMs are in service. Service accounts are access-controlled, meaning that a specific user must be explicitly authorized to use a service account. There can only be one service account per instance, whereas there can be multiple tags. Also, service accounts assigned to a VM can only be changed when the VM is stopped." https://cloud.google.com/solutions/best-practices-vpc-design#isolate-vms-service-accounts
You need to enforce a security policy in your Google Cloud organization that prevents users from exposing objects in their buckets externally. There are currently no buckets in your organization.
Which solution should you implement proactively to achieve this goal with the least operational overhead?
- A . Create an hourly cron job to run a Cloud Function that finds public buckets and makes them private.
- B . Enable the constraints/storage.publicAccessPrevention constraint at the organization level.
- C . Enable the constraints/storage.uniformBucketLevelAccess constraint at the organization level.
- D . Create a VPC Service Controls perimeter that protects the storage.googleapis.com service in your projects that contains buckets. Add any new project that contains a bucket to the perimeter.
B
Explanation:
https://cloud.google.com/storage/docs/public-access-prevention
Public access prevention protects Cloud Storage buckets and objects from being accidentally exposed to the public. If your bucket is contained within an organization, you can enforce public access prevention by using the organization policy constraint storage.publicAccessPrevention at the project, folder, or organization level.
You need to enforce a security policy in your Google Cloud organization that prevents users from exposing objects in their buckets externally. There are currently no buckets in your organization.
Which solution should you implement proactively to achieve this goal with the least operational overhead?
- A . Create an hourly cron job to run a Cloud Function that finds public buckets and makes them private.
- B . Enable the constraints/storage.publicAccessPrevention constraint at the organization level.
- C . Enable the constraints/storage.uniformBucketLevelAccess constraint at the organization level.
- D . Create a VPC Service Controls perimeter that protects the storage.googleapis.com service in your projects that contains buckets. Add any new project that contains a bucket to the perimeter.
B
Explanation:
https://cloud.google.com/storage/docs/public-access-prevention
Public access prevention protects Cloud Storage buckets and objects from being accidentally exposed to the public. If your bucket is contained within an organization, you can enforce public access prevention by using the organization policy constraint storage.publicAccessPrevention at the project, folder, or organization level.
A company is deploying their application on Google Cloud Platform. Company policy requires long-term data to be stored using a solution that can automatically replicate data over at least two geographic places.
Which Storage solution are they allowed to use?
- A . Cloud Bigtable
- B . Cloud BigQuery
- C . Compute Engine SSD Disk
- D . Compute Engine Persistent Disk
B
Explanation:
https://cloud.google.com/bigquery#:~:text=BigQuery%20transparently%20and%20automatically%20provides,charge%20and%20no%20additional%20setup.&text=BigQuery%20also%20provides%20ODBC%20and,interact%20with%20its%20powerful%20engine.
Reference: https://cloud.google.com/bigquery/docs/locations
Your organization has on-premises hosts that need to access Google Cloud APIs You must enforce private connectivity between these hosts minimize costs and optimize for operational efficiency.
What should you do?
- A . Route all on-premises traffic to Google Cloud through an IPsec VPN tunnel to a VPC with Private Google Access enabled.
- B . Set up VPC peering between the hosts on-premises and the VPC through the internet.
- C . Enforce a security policy that mandates all applications to encrypt data with a Cloud Key Management. Service (KMS) key before you send it over the network.
- D . Route all on-premises traffic to Google Cloud through a dedicated or Partner interconnect to a VPC with Private Google Access enabled.
Your organization has on-premises hosts that need to access Google Cloud APIs You must enforce private connectivity between these hosts minimize costs and optimize for operational efficiency.
What should you do?
- A . Route all on-premises traffic to Google Cloud through an IPsec VPN tunnel to a VPC with Private Google Access enabled.
- B . Set up VPC peering between the hosts on-premises and the VPC through the internet.
- C . Enforce a security policy that mandates all applications to encrypt data with a Cloud Key Management. Service (KMS) key before you send it over the network.
- D . Route all on-premises traffic to Google Cloud through a dedicated or Partner interconnect to a VPC with Private Google Access enabled.