Google Professional Cloud Security Engineer Practice Exams
Last updated on Oct 23,2026- Exam Code: Professional Cloud Security Engineer
- Exam Name: Google Cloud Certified - Professional Cloud Security Engineer
- Certification Provider: Google
- Latest update: Oct 23,2026
An organization is moving applications to Google Cloud while maintaining a few mission-critical applications on-premises. The organization must transfer the data at a bandwidth of at least 50 Gbps.
What should they use to ensure secure continued connectivity between sites?
- A . Dedicated Interconnect
- B . Cloud Router
- C . Cloud VPN
- D . Partner Interconnect
A
Explanation:
Reference:
https://cloud.google.com/architecture/migration-to-google-cloud-transferring-your-large-datasets
https://cloud.google.com/network-connectivity/docs/interconnect/concepts/overview
An organization is moving applications to Google Cloud while maintaining a few mission-critical applications on-premises. The organization must transfer the data at a bandwidth of at least 50 Gbps.
What should they use to ensure secure continued connectivity between sites?
- A . Dedicated Interconnect
- B . Cloud Router
- C . Cloud VPN
- D . Partner Interconnect
A
Explanation:
Reference:
https://cloud.google.com/architecture/migration-to-google-cloud-transferring-your-large-datasets
https://cloud.google.com/network-connectivity/docs/interconnect/concepts/overview
A patch for a vulnerability has been released, and a DevOps team needs to update their running containers in Google Kubernetes Engine (GKE).
How should the DevOps team accomplish this?
- A . Use Puppet or Chef to push out the patch to the running container.
- B . Verify that auto upgrade is enabled; if so, Google will upgrade the nodes in a GKE cluster.
- C . Update the application code or apply a patch, build a new image, and redeploy it.
- D . Configure containers to automatically upgrade when the base image is available in Container Registry.
C
Explanation:
https://cloud.google.com/containers/security
Containers are meant to be immutable, so you deploy a new image in order to make changes. You can simplify patch management by rebuilding your images regularly, so the patch is picked up the next time a container is deployed. Get the full picture of your environment with regular image security reviews.
You want to update your existing VPC Service Controls perimeter with a new access level. You need to avoid breaking the existing perimeter with this change, and ensure the least disruptions to users while minimizing overhead.
What should you do?
- A . Create an exact replica of your existing perimeter. Add your new access level to the replica.
Update the original perimeter after the access level has been vetted. - B . Update your perimeter with a new access level that never matches. Update the new access level to match your desired state one condition at a time to avoid being overly permissive.
- C . Enable the dry run mode on your perimeter. Add your new access level to the perimeter configuration. Update the perimeter configuration after the access level has been vetted.
- D . Enable the dry run mode on your perimeter. Add your new access level to the perimeter dry run configuration. Update the perimeter configuration after the access level has been vetted.
D
Explanation:
https://cloud.google.com/vpc-service-controls/docs/dry-run-mode
When using VPC Service Controls, it can be difficult to determine the impact to your environment when a service perimeter is created or modified. With dry run mode, you can better understand the impact of enabling VPC Service Controls and changes to perimeters in existing environments.
The security operations team needs access to the security-related logs for all projects in their organization.
They have the following requirements:
– Follow the least privilege model by having only view access to logs.
– Have access to Admin Activity logs.
– Have access to Data Access logs.
– Have access to Access Transparency logs.
Which Identity and Access Management (IAM) role should the security operations team be granted?
- A . roles/logging.privateLogViewer
- B . roles/logging.admin
- C . roles/viewer
- D . roles/logging.viewer
A
Explanation:
https://cloud.google.com/logging/docs/access-control#considerations roles/logging.privateLogViewer (Private Logs Viewer) includes all the permissions contained by roles/logging.viewer, plus the ability to read Data Access audit logs in the _Default bucket.
Which two implied firewall rules are defined on a VPC network? (Choose two.)
- A . A rule that allows all outbound connections
- B . A rule that denies all inbound connections
- C . A rule that blocks all inbound port 25 connections
- D . A rule that blocks all outbound connections
- E . A rule that allows all inbound port 80 connections
AB
Explanation:
Implied IPv4 allow egress rule. An egress rule whose action is allow, destination is 0.0.0.0/0, and priority is the lowest possible (65535) lets any instance send traffic to any destination Implied IPv4 deny ingress rule. An ingress rule whose action is deny, source is 0.0.0.0/0, and priority is the lowest possible (65535) protects all instances by blocking incoming connections to them.
https://cloud.google.com/vpc/docs/firewalls?hl=en#default_firewall_rules
You are implementing data protection by design and in accordance with GDPR requirements. As part of design reviews, you are told that you need to manage the encryption key for a solution that includes workloads for Compute Engine, Google Kubernetes Engine, Cloud Storage, BigQuery, and Pub/Sub.
Which option should you choose for this implementation?
- A . Cloud External Key Manager
- B . Customer-managed encryption keys
- C . Customer-supplied encryption keys
- D . Google default encryption
B
Explanation:
https://cloud.google.com/kms/docs/using-other-products#cmek_integrations
https://cloud.google.com/kms/docs/using-other-products#cmek_integrations CMEK is supported for all the listed google services.
How should a customer reliably deliver Stackdriver logs from GCP to their on-premises SIEM system?
- A . Send all logs to the SIEM system via an existing protocol such as syslog.
- B . Configure every project to export all their logs to a common BigQuery DataSet, which will be queried by the SIEM system.
- C . Configure Organizational Log Sinks to export logs to a Cloud Pub/Sub Topic, which will be sent to the SIEM via Dataflow.
- D . Build a connector for the SIEM to query for all logs in real time from the GCP RESTful JSON APIs.
C
Explanation:
Scenarios for exporting Cloud Logging data: Splunk This scenario shows how to export selected logs from Cloud Logging to Pub/Sub for ingestion into Splunk. Splunk is a security information and event management (SIEM) solution that supports several ways of ingesting data, such as receiving streaming data out of Google Cloud through Splunk HTTP Event Collector (HEC) or by fetching data from Google Cloud APIs through Splunk Add-on for Google Cloud. Using the Pub/Sub to Splunk Dataflow template, you can natively forward logs and events from a Pub/Sub topic into Splunk HEC. If Splunk HEC is not available in your Splunk deployment, you can use the Add-on to collect the logs and events from the Pub/Sub topic. https://cloud.google.com/solutions/exporting-stackdriver-logging-for-splunk
You plan to deploy your cloud infrastructure using a CI/CD cluster hosted on Compute Engine. You want to minimize the risk of its credentials being stolen by a third party.
What should you do?
- A . Create a dedicated Cloud Identity user account for the cluster. Use a strong self-hosted vault solution to store the user’s temporary credentials.
- B . Create a dedicated Cloud Identity user account for the cluster. Enable the constraints/iam.disableServiceAccountCreation organization policy at the project level.
- C . Create a custom service account for the cluster Enable the constraints/iam.disableServiceAccountKeyCreation organization policy at the project level.
- D . Create a custom serviviceAccountCredentialLifetimeExtension organization policy at the project level.
C
Explanation:
Disable service account key creation You can use the iam.disableServiceAccountKeyCreation boolean constraint to disable the creation of new external service account keys. This allows you to control the use of unmanaged long-term credentials for service accounts. When this constraint is set, user-managed credentials cannot be created for service accounts in projects affected by the constraint. https://cloud.google.cce account for the cluster Enable the constraints/iam.allowSer
om/resource-manager/docs/organization-policy/restricting-service-accounts#example_policy_boolean_constraint
Your company must follow industry specific regulations. Therefore, you need to enforce customer-managed encryption keys (CMEK) for all new Cloud Storage resources in the organization called org1.
What command should you execute?
- A . • organization policy: constraints/gcp.restrictStorageNonCraekServices
• binding at: orgl
• policy type: deny
• policy value: storage.gcogleapis.com - B . • organization policy: constraints/gcp.restrictHonCmekServices
• binding at: orgl
• policy type: deny
• policy value: storage.googleapis.com - C . • organization policy:constraints/gcp.restrictStorageNonCraekServices
• binding at: orgl
• policy type: allow
• policy value: all supported services - D . • organization policy: constramts/gcp.restrictNonCmekServices
• binding at: orgl
• policy type: allow
• policy value: storage.googleapis.com