Google Professional Cloud Security Engineer Practice Exams
Last updated on Oct 23,2026- Exam Code: Professional Cloud Security Engineer
- Exam Name: Google Cloud Certified - Professional Cloud Security Engineer
- Certification Provider: Google
- Latest update: Oct 23,2026
You need to provide a corporate user account in Google Cloud for each of your developers and operational staff who need direct access to GCP resources. Corporate policy requires you to maintain the user identity in a third-party identity management provider and leverage single sign-on. You learn that a significant number of users are using their corporate domain email addresses for personal Google accounts, and you need to follow Google recommended practices to convert existing unmanaged users to managed accounts.
Which two actions should you take? (Choose two.)
- A . Use Google Cloud Directory Sync to synchronize your local identity management system to Cloud Identity.
- B . Use the Google Admin console to view which managed users are using a personal account for their recovery email.
- C . Add users to your managed Google account and force users to change the email addresses associated with their personal accounts.
- D . Use the Transfer Tool for Unmanaged Users (TTUU) to find users with conflicting accounts and ask them to transfer their personal Google accounts.
- E . Send an email to all of your employees and ask those users with corporate email addresses for personal Google accounts to delete the personal accounts immediately.
AD
Explanation:
https://cloud.google.com/architecture/identity/migrating-consumer-accounts#initiating_a_transfer
An organization is starting to move its infrastructure from its on-premises environment to Google Cloud Platform (GCP). The first step the organization wants to take is to migrate its current data backup and disaster recovery solutions to GCP for later analysis. The organization’s production environment will remain on- premises for an indefinite time. The organization wants a scalable and cost-efficient solution.
Which GCP solution should the organization use?
- A . BigQuery using a data pipeline job with continuous updates
- B . Cloud Storage using a scheduled task and gsutil
- C . Compute Engine Virtual Machines using Persistent Disk
- D . Cloud Datastore using regularly scheduled batch upload jobs
B
Explanation:
https://cloud.google.com/solutions/dr-scenarios-planning-guide#use-cloud-storage-as-part-of-your-daily-backup-routine
An organization is starting to move its infrastructure from its on-premises environment to Google Cloud Platform (GCP). The first step the organization wants to take is to migrate its current data backup and disaster recovery solutions to GCP for later analysis. The organization’s production environment will remain on- premises for an indefinite time. The organization wants a scalable and cost-efficient solution.
Which GCP solution should the organization use?
- A . BigQuery using a data pipeline job with continuous updates
- B . Cloud Storage using a scheduled task and gsutil
- C . Compute Engine Virtual Machines using Persistent Disk
- D . Cloud Datastore using regularly scheduled batch upload jobs
B
Explanation:
https://cloud.google.com/solutions/dr-scenarios-planning-guide#use-cloud-storage-as-part-of-your-daily-backup-routine
A customer terminates an engineer and needs to make sure the engineer’s Google account is automatically deprovisioned.
What should the customer do?
- A . Use the Cloud SDK with their directory service to remove their IAM permissions in Cloud Identity.
- B . Use the Cloud SDK with their directory service to provision and deprovision users from Cloud Identity.
- C . Configure Cloud Directory Sync with their directory service to provision and deprovision users from Cloud Identity.
- D . Configure Cloud Directory Sync with their directory service to remove their IAM permissions in Cloud Identity.
C
Explanation:
https://cloud.google.com/identity/solutions/automate-user-provisioning#cloud_identity_automated_provisioning
"Cloud Identity has a catalog of automated provisioning connectors, which act as a bridge between Cloud Identity and third-party cloud apps."
You are setting up a new Cloud Storage bucket in your environment that is encrypted with a customer managed encryption key (CMEK). The CMEK is stored in Cloud Key Management Service (KMS). in project "pr j -a", and the Cloud Storage bucket will use project "prj-b". The key is backed by a Cloud Hardware Security Module (HSM) and resides in the region europe-west3. Your storage bucket will be located in the region europe-west1. When you create the bucket, you cannot access the key. and you need to troubleshoot why.
What has caused the access issue?
- A . A firewall rule prevents the key from being accessible.
- B . Cloud HSM does not support Cloud Storage
- C . The CMEK is in a different project than the Cloud Storage bucket
- D . The CMEK is in a different region than the Cloud Storage bucket.
D
Explanation:
When you use a customer-managed encryption key (CMEK) to secure a Cloud Storage bucket, the key and the bucket must be located in the same region. In this case, the key is in europe-west3 and the bucket is in europe-west1, which is why you’re unable to access the key.
Your organization’s Google Cloud VMs are deployed via an instance template that configures them with a public IP address in order to host web services for external users. The VMs reside in a service project that is attached to a host (VPC) project containing one custom Shared VPC for the VMs. You have been asked to reduce the exposure of the VMs to the internet while continuing to service external users. You have already recreated the instance template without a public IP address configuration to launch the managed instance group (MIG).
What should you do?
- A . Deploy a Cloud NAT Gateway in the service project for the MIG.
- B . Deploy a Cloud NAT Gateway in the host (VPC) project for the MIG.
- C . Deploy an external HTTP(S) load balancer in the service project with the MIG as a backend.
- D . Deploy an external HTTP(S) load balancer in the host (VPC) project with the MIG as a backend.
D
Explanation:
https://cloud.google.com/load-balancing/docs/https#shared-vpc
While you can create all the load balancing components and backends in the Shared VPC host project, this model does not separate network administration and service development responsibilities.
You are deploying a web application hosted on Compute Engine. A business requirement mandates that application logs are preserved for 12 years and data is kept within European boundaries. You want to implement a storage solution that minimizes overhead and is cost-effective.
What should you do?
- A . Create a Cloud Storage bucket to store your logs in the EUROPE-WEST1 region. Modify your application code to ship logs directly to your bucket for increased efficiency.
- B . Configure your Compute Engine instances to use the Google Cloud’s operations suite Cloud Logging agent to send application logs to a custom log bucket in the EUROPE-WEST1 region with a custom retention of 12 years.
- C . Use a Pub/Sub topic to forward your application logs to a Cloud Storage bucket in the EUROPE-WEST1 region.
- D . Configure a custom retention policy of 12 years on your Google Cloud’s operations suite log bucket in the EUROPE-WEST1 region.
B
Explanation:
https://youtu.be/MI4iG2GIZMA
A customer is running an analytics workload on Google Cloud Platform (GCP) where Compute Engine instances are accessing data stored on Cloud Storage. Your team wants to make sure that this workload will not be able to access, or be accessed from, the internet.
Which two strategies should your team use to meet these requirements? (Choose two.)
- A . Configure Private Google Access on the Compute Engine subnet
- B . Avoid assigning public IP addresses to the Compute Engine cluster.
- C . Make sure that the Compute Engine cluster is running on a separate subnet.
- D . Turn off IP forwarding on the Compute Engine instances in the cluster.
- E . Configure a Cloud NAT gateway.
A customer is running an analytics workload on Google Cloud Platform (GCP) where Compute Engine instances are accessing data stored on Cloud Storage. Your team wants to make sure that this workload will not be able to access, or be accessed from, the internet.
Which two strategies should your team use to meet these requirements? (Choose two.)
- A . Configure Private Google Access on the Compute Engine subnet
- B . Avoid assigning public IP addresses to the Compute Engine cluster.
- C . Make sure that the Compute Engine cluster is running on a separate subnet.
- D . Turn off IP forwarding on the Compute Engine instances in the cluster.
- E . Configure a Cloud NAT gateway.
A customer is running an analytics workload on Google Cloud Platform (GCP) where Compute Engine instances are accessing data stored on Cloud Storage. Your team wants to make sure that this workload will not be able to access, or be accessed from, the internet.
Which two strategies should your team use to meet these requirements? (Choose two.)
- A . Configure Private Google Access on the Compute Engine subnet
- B . Avoid assigning public IP addresses to the Compute Engine cluster.
- C . Make sure that the Compute Engine cluster is running on a separate subnet.
- D . Turn off IP forwarding on the Compute Engine instances in the cluster.
- E . Configure a Cloud NAT gateway.