Google Professional Cloud Security Engineer Practice Exams
Last updated on Oct 23,2026- Exam Code: Professional Cloud Security Engineer
- Exam Name: Google Cloud Certified - Professional Cloud Security Engineer
- Certification Provider: Google
- Latest update: Oct 23,2026
Your company requires the security and network engineering teams to identify all network anomalies within and across VPCs, internal traffic from VMs to VMs, traffic between end locations on the internet and VMs, and traffic between VMs to Google Cloud services in production.
Which method should you use?
- A . Define an organization policy constraint.
- B . Configure packet mirroring policies.
- C . Enable VPC Flow Logs on the subnet.
- D . Monitor and analyze Cloud Audit Logs.
B
Explanation:
https://cloud.google.com/vpc/docs/packet-mirroring#enterprise_security
Security and network engineering teams must ensure that they are catching all anomalies and threats that might indicate security breaches and intrusions. They mirror all traffic so that they can complete a comprehensive inspection of suspicious flows.
A company allows every employee to use Google Cloud Platform. Each department has a Google Group, with all department members as group members. If a department member creates a new project, all members of that department should automatically have read-only access to all new project resources. Members of any other department should not have access to the project. You need to configure this behavior.
What should you do to meet these requirements?
- A . Create a Folder per department under the Organization. For each department’s Folder, assign the Project Viewer role to the Google Group related to that department.
- B . Create a Folder per department under the Organization. For each department’s Folder, assign the Project Browser role to the Google Group related to that department.
- C . Create a Project per department under the Organization. For each department’s Project, assign the Project Viewer role to the Google Group related to that department.
- D . Create a Project per department under the Organization. For each department’s Project, assign the Project Browser role to the Google Group related to that department.
A
Explanation:
https://cloud.google.com/iam/docs/understanding-roles#project-roles
You have been tasked with configuring Security Command Center for your organization’s Google Cloud environment. Your security team needs to receive alerts of potential crypto mining in the organization’s compute environment and alerts for common Google Cloud misconfigurations that impact security.
Which Security Command Center features should you use to configure these alerts? (Choose two.)
- A . Event Threat Detection
- B . Container Threat Detection
- C . Security Health Analytics
- D . Cloud Data Loss Prevention
- E . Google Cloud Armor
AC
Explanation:
https://cloud.google.com/security-command-center/docs/concepts-event-threat-detection-overview
Event Threat Detection is a built-in service for the Security Command Center Premium tier that continuously monitors your organization and identifies threats within your systems in near-real time. https://cloud.google.com/security-command-center/docs/concepts-security-sources#security-health-analytics
You need to implement an encryption-at-rest strategy that protects sensitive data and reduces key
management complexity for non-sensitive data.
Your solution has the following requirements:
– Schedule key rotation for sensitive data.
– Control which region the encryption keys for sensitive data are stored in.
– Minimize the latency to access encryption keys for both sensitive and non-sensitive data.
What should you do?
- A . Encrypt non-sensitive data and sensitive data with Cloud External Key Manager.
- B . Encrypt non-sensitive data and sensitive data with Cloud Key Management Service.
- C . Encrypt non-sensitive data with Google default encryption, and encrypt sensitive data with Cloud External Key Manager.
- D . Encrypt non-sensitive data with Google default encryption, and encrypt sensitive data with Cloud Key Management Service.
D
Explanation:
Google uses a common cryptographic library, Tink, which incorporates our FIPS 140-2 Level 1 validated module, BoringCrypto, to implement encryption consistently across almost all Google Cloud products. To provideflexibility of controlling the key residency and rotation schedule, use google provided key for non-sensitive and encrypt sensitive data with Cloud Key Management Service
An organization is migrating from their current on-premises productivity software systems to G Suite. Some network security controls were in place that were mandated by a regulatory body in their region for their previous on-premises system. The organization’s risk team wants to ensure that network security controls are maintained and effective in G Suite. A security architect supporting this migration has been asked to ensure that network security controls are in place as part of the new shared responsibility model between the organization and Google Cloud.
What solution would help meet the requirements?
- A . Ensure that firewall rules are in place to meet the required controls.
- B . Set up Cloud Armor to ensure that network security controls can be managed for G Suite.
- C . Network security is a built-in solution and Google’s Cloud responsibility for SaaS products like G Suite.
- D . Set up an array of Virtual Private Cloud (VPC) networks to control network security as mandated by the relevant regulation.
C
Explanation:
https://gsuite.google.com/learn-more/security/security-whitepaper/page-1.html
Shared responsibility “Security of the Cloud” – GCP is responsible for protecting the infrastructure that runs all of the services offered in the GCP Cloud. This infrastructure is composed of the hardware, software, networking, and facilities that run GCP Cloud services.
You are a Security Administrator at your organization. You need to restrict service account creation capability within production environments. You want to accomplish this centrally across the organization.
What should you do?
- A . Use Identity and Access Management (IAM) to restrict access of all users and service accounts that have access to the production environment.
- B . Use organization policy constraints/iam.disableServiceAccountKeyCreation boolean to disable the creation of new service accounts.
- C . Use organization policy constraints/iam.disableServiceAccountKeyUpload boolean to disable the creation of new service accounts.
- D . Use organization policy constraints/iam.disableServiceAccountCreation boolean to disable the creation of new service accounts.
D
Explanation:
Reference: https://cloud.google.com/resource-manager/docs/organization-policy/restricting-service-accounts
You can use the iam.disableServiceAccountCreation boolean constraint to disable the creation of new service accounts. This allows you to centralize management of service accounts while not restricting the other permissions your developers have on projects. https://cloud.google.com/resource-manager/docs/organization-policy/restricting-service-accounts#disable_service_account_creation
Your company is using Cloud Dataproc for its Spark and Hadoop jobs. You want to be able to create, rotate, and destroy symmetric encryption keys used for the persistent disks used by Cloud Dataproc. Keys can be stored in the cloud.
What should you do?
- A . Use the Cloud Key Management Service to manage the data encryption key (DEK).
- B . Use the Cloud Key Management Service to manage the key encryption key (KEK).
- C . Use customer-supplied encryption keys to manage the data encryption key (DEK).
- D . Use customer-supplied encryption keys to manage the key encryption key (KEK).
B
Explanation:
This PD and bucket data is encrypted using a Google-generated data encryption key (DEK) and key encryption key (KEK). The CMEK feature allows you to create, use, and revoke the key encryption key (KEK). Google still controls the data encryption key (DEK). For more information on Google data encryption keys, see Encryption at Rest.
https://cloud.google.com/dataproc/docs/concepts/configuring-clusters/customer-managed-
encryption
https://codelabs.developers.google.com/codelabs/encrypt-and-decrypt-data-with-cloud-kms#0
Your company is using Cloud Dataproc for its Spark and Hadoop jobs. You want to be able to create, rotate, and destroy symmetric encryption keys used for the persistent disks used by Cloud Dataproc. Keys can be stored in the cloud.
What should you do?
- A . Use the Cloud Key Management Service to manage the data encryption key (DEK).
- B . Use the Cloud Key Management Service to manage the key encryption key (KEK).
- C . Use customer-supplied encryption keys to manage the data encryption key (DEK).
- D . Use customer-supplied encryption keys to manage the key encryption key (KEK).
B
Explanation:
This PD and bucket data is encrypted using a Google-generated data encryption key (DEK) and key encryption key (KEK). The CMEK feature allows you to create, use, and revoke the key encryption key (KEK). Google still controls the data encryption key (DEK). For more information on Google data encryption keys, see Encryption at Rest.
https://cloud.google.com/dataproc/docs/concepts/configuring-clusters/customer-managed-
encryption
https://codelabs.developers.google.com/codelabs/encrypt-and-decrypt-data-with-cloud-kms#0
You are working with protected health information (PHI) for an electronic health record system. The privacy officer is concerned that sensitive data is stored in the analytics system. You are tasked with anonymizing the sensitive data in a way that is not reversible. Also, the anonymized data should not preserve the character set and length.
Which Google Cloud solution should you use?
- A . Cloud Data Loss Prevention with deterministic encryption using AES-SIV
- B . Cloud Data Loss Prevention with format-preserving encryption
- C . Cloud Data Loss Prevention with cryptographic hashing
- D . Cloud Data Loss Prevention with Cloud Key Management Service wrapped cryptographic keys
C
Explanation:
Reference:
https://cloud.google.com/dlp/docs/pseudonymization
https://cloud.google.com/dlp/docs/pseudonymization?hl=JA&skip_cache=true#supported-methods
For compliance reasons, an organization needs to ensure that in-scope PCI Kubernetes Pods reside on “in- scope” Nodes only. These Nodes can only contain the “in-scope” Pods.
How should the organization achieve this objective?
- A . Add a nodeSelector field to the pod configuration to only use the Nodes labeled inscope: true.
- B . Create a node pool with the label inscope: true and a Pod Security Policy that only allows the Pods to run on Nodes with that label.
- C . Place a taint on the Nodes with the label inscope: true and effect NoSchedule and a toleration to match in the Pod configuration.
- D . Run all in-scope Pods in the namespace “in-scope-pci”.
A
Explanation:
nodeSelector is the simplest recommended form of node selection constraint. You can add the nodeSelector field to your Pod specification and specify the node labels you want the target node to have. Kubernetes only schedules the Pod onto nodes that have each of the labels you specify. => https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#nodeselector Tolerations are applied to pods. Tolerations allow the scheduler to schedule pods with matching taints. Tolerations allow scheduling but don’t guarantee scheduling: the scheduler also evaluates other parameters as part of its function. => https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/