Google Professional Cloud Security Engineer Practice Exams
Last updated on Oct 23,2026- Exam Code: Professional Cloud Security Engineer
- Exam Name: Google Cloud Certified - Professional Cloud Security Engineer
- Certification Provider: Google
- Latest update: Oct 23,2026
An administrative application is running on a virtual machine (VM) in a managed group at port 5601 inside a Virtual Private Cloud (VPC) instance without access to the internet currently. You want to expose the web interface at port 5601 to users and enforce authentication and authorization Google credentials
What should you do?
- A . Modify the VPC routing with the default route point to the default internet gateway Modify the VPC Firewall rule to allow access from the internet 0.0.0.0/0 to port 5601 on the application instance.
- B . Configure the bastion host with OS Login enabled and allow connection to port 5601 at VPC firewall Log in to the bastion host from the Google Cloud console by using SSH-in-browser and then to the web application
- C . Configure an HTTP Load Balancing instance that points to the managed group with Identity-Aware Proxy (IAP) protection with Google credentials Modify the VPC firewall to allow access from IAP network range
- D . Configure Secure Shell Access (SSH) bastion host in a public network, and allow only the bastion host to connect to the application on port 5601. Use a bastion host as a jump host to connect to the application
C
Explanation:
This approach allows you to expose the web interface securely by using Identity-Aware Proxy (IAP), which provides authentication and authorization with Google credentials. The HTTP Load Balancer can distribute traffic to the VMs in the managed group, and the VPC firewall rule ensures that access is allowed from the IAP network range.
A business unit at a multinational corporation signs up for GCP and starts moving workloads into GCP. The business unit creates a Cloud Identity domain with an organizational resource that has hundreds of projects.
Your team becomes aware of this and wants to take over managing permissions and auditing the domain resources.
Which type of access should your team grant to meet this requirement?
- A . Organization Administrator
- B . Security Reviewer
- C . Organization Role Administrator
- D . Organization Policy Administrator
C
Explanation:
Here are the permissions available to organizationRoleAdmin
iam.roles.create
iam.roles.delete
iam.roles.undelete
iam.roles.get
iam.roles.list
iam.roles.update
resourcemanager.projects.get
resourcemanager.projects.getIamPolicy
resourcemanager.projects.list
resourcemanager.organizations.get
resourcemanager.organizations.getIamPolicy
There are sufficient as per least privilege policy. You can do user management as well as auditing. https://cloud.google.com/iam/docs/understanding-custom-roles
You are creating a new infrastructure CI/CD pipeline to deploy hundreds of ephemeral projects in your Google Cloud organization to enable your users to interact with Google Cloud. You want to restrict the use of the default networks in your organization while following Google-recommended best practices.
What should you do?
- A . Enable the constraints/compute.skipDefaultNetworkCreation organization policy constraint at the organization level.
- B . Create a cron job to trigger a daily Cloud Function to automatically delete all default networks for each project.
- C . Grant your users the 1AM Owner role at the organization level. Create a VPC Service Controls perimeter around the project that restricts the compute.googleapis.com API.
- D . Only allow your users to use your CI/CD pipeline with a predefined set of infrastructure templates they can deploy to skip the creation of the default networks.
A
Explanation:
Enable the constraints/compute.skipDefaultNetworkCreation organization policy constraint at the organization level.
https://cloud.google.com/resource-manager/docs/organization-policy/org-policy-constraints –
constraints/compute.skipDefaultNetworkCreation This boolean constraint skips the creation of the default network and related resources during Google Cloud Platform Project resource creation where this constraint is set to True. By default, a default network and supporting resources are automatically created when creating a Project resource.
Your organization s record data exists in Cloud Storage. You must retain all record data for at least
seven years. This policy must be permanent.
What should you do?
- A . • 1 Identify buckets with record data
• 2 Apply a retention policy and set it to retain for seven years
• 3 Monitor the bucket by using log-based alerts to ensure that no modifications to the retention policy occurs - B . • 1 Identify buckets with record data
• 2 Apply a retention policy and set it to retain for seven years
• 3 Remove any Identity and Access Management (IAM) roles that contain the storage buckets update permission - C . • 1 Identify buckets with record data
• 2 Enable the bucket policy only to ensure that data is retained
• 3 Enable bucket lock - D . • 1 Identify buckets with record data
• 2 Apply a retention policy and set it to retain for seven years
• 3 Enable bucket lock
What are the steps to encrypt data using envelope encryption?
- A . Generate a data encryption key (DEK) locally.
Use a key encryption key (KEK) to wrap the DEK. Encrypt data with the KEK.
Store the encrypted data and the wrapped KEK. - B . Generate a key encryption key (KEK) locally.
Use the KEK to generate a data encryption key (DEK). Encrypt data with the DEK.
Store the encrypted data and the wrapped DEK. - C . Generate a data encryption key (DEK) locally.
Encrypt data with the DEK.
Use a key encryption key (KEK) to wrap the DEK. Store the encrypted data and the wrapped DEK. - D . Generate a key encryption key (KEK) locally.
Generate a data encryption key (DEK) locally. Encrypt data with the KEK.
Store the encrypted data and the wrapped DEK.
C
Explanation:
The process of encrypting data is to generate a DEK locally, encrypt data with the DEK, use a KEK to wrap the DEK, and then store the encrypted data and the wrapped DEK. The KEK never leaves Cloud KMS. https://cloud.google.com/kms/docs/envelope-encryption#how_to_encrypt_data_using_envelope_encryption
Reference: https://cloud.google.com/kms/docs/envelope-encryption
You are responsible for protecting highly sensitive data in BigQuery. Your operations teams need access to this data, but given privacy regulations, you want to ensure that they cannot read the sensitive fields such as email addresses and first names. These specific sensitive fields should only be available on a need-to-know basis to the HR team.
What should you do?
- A . Perform data masking with the DLP API and store that data in BigQuery for later use.
- B . Perform data redaction with the DLP API and store that data in BigQuery for later use.
- C . Perform data inspection with the DLP API and store that data in BigQuery for later use.
- D . Perform tokenization for Pseudonymization with the DLP API and store that data in BigQuery for later use.
D
Explanation:
Pseudonymization is a de-identification technique that replaces sensitive data values with cryptographically generated tokens. Pseudonymization is widely used in industries like finance and healthcare to help reduce the risk of data in use, narrow compliance scope, and minimize the exposure of sensitive data to systems while preserving data utility and accuracy. https://cloud.google.com/dlp/docs/pseudonymization
You recently joined the networking team supporting your company’s Google Cloud implementation. You are tasked with familiarizing yourself with the firewall rules configuration and providing recommendations based on your networking and Google Cloud experience.
What product should you recommend to detect firewall rules that are overlapped by attributes from other firewall rules with higher or equal priority?
- A . Security Command Center
- B . Firewall Rules Logging
- C . VPC Flow Logs
- D . Firewall Insights
D
Explanation:
https://cloud.google.com/network-intelligence-center/docs/firewall-insights/concepts/overview#shadowed-firewall-rules
Firewall Insights analyzes your firewall rules to detect firewall rules that are shadowed by other rules. A shadowed rule is a firewall rule that has all of its relevant attributes, such as its IP address and port ranges, overlapped by attributes from one or more rules with higher or equal priority, called shadowing rules.
Your organization previously stored files in Cloud Storage by using Google Managed Encryption Keys (GMEK). but has recently updated the internal policy to require Customer Managed Encryption Keys (CMEK). You need to re-encrypt the files quickly and efficiently with minimal cost.
What should you do?
- A . Encrypt the files locally, and then use gsutil to upload the files to a new bucket.
- B . Copy the files to a new bucket with CMEK enabled in a secondary region
- C . Reupload the files to the same Cloud Storage bucket specifying a key file by using gsutil.
- D . Change the encryption type on the bucket to CMEK, and rewrite the objects
D
Explanation:
Rewriting the objects in-place within the same bucket, specifying the new CMEK for encryption, allows you to re-encrypt the data without downloading and re-uploading it, thus minimizing costs and time.
https://cloud.google.com/storage/docs/encryption/using-customer-managed-keys
Your company requires the security and network engineering teams to identify all network anomalies and be able to capture payloads within VPCs.
Which method should you use?
- A . Define an organization policy constraint.
- B . Configure packet mirroring policies.
- C . Enable VPC Flow Logs on the subnet.
- D . Monitor and analyze Cloud Audit Logs.
B
Explanation:
https://cloud.google.com/vpc/docs/packet-mirroring
Packet Mirroring clones the traffic of specified instances in your Virtual Private Cloud (VPC) network and forwards it for examination. Packet Mirroring captures all traffic and packet data, including payloads and headers.
Your team wants to limit users with administrative privileges at the organization level.
Which two roles should your team restrict? (Choose two.)
- A . Organization Administrator
- B . Super Admin
- C . GKE Cluster Admin
- D . Compute Admin
- E . Organization Role Viewer
AB
Explanation:
Reference: https://cloud.google.com/resource-manager/docs/creating-managing-organization