Google Professional Cloud Security Engineer Practice Exams
Last updated on Oct 23,2026- Exam Code: Professional Cloud Security Engineer
- Exam Name: Google Cloud Certified - Professional Cloud Security Engineer
- Certification Provider: Google
- Latest update: Oct 23,2026
Your team needs to make sure that a Compute Engine instance does not have access to the internet or to any Google APIs or services.
Which two settings must remain disabled to meet these requirements? (Choose two.)
- A . Public IP
- B . IP Forwarding
- C . Private Google Access
- D . Static routes
- E . IAM Network User Role
AC
Explanation:
Reference: https://cloud.google.com/vpc/docs/configure-private-google-access
You perform a security assessment on a customer architecture and discover that multiple VMs have public IP addresses. After providing a recommendation to remove the public IP addresses, you are told those VMs need to communicate to external sites as part of the customer’s typical operations.
What should you recommend to reduce the need for public IP addresses in your customer’s VMs?
- A . Google Cloud Armor
- B . Cloud NAT
- C . Cloud Router
- D . Cloud VPN
B
Explanation:
https://cloud.google.com/nat/docs/overview
Your organization wants to be General Data Protection Regulation (GDPR) compliant You want to ensure that your DevOps teams can only create Google Cloud resources in the Europe regions.
What should you do?
- A . Use the org policy constraint "Restrict Resource Service Usage’* on your Google Cloud organization node.
- B . Use Identity and Access Management (1AM) custom roles to ensure that your DevOps team can only create resources in the Europe regions
- C . Use the org policy constraint Google Cloud Platform – Resource Location Restriction" on your Google Cloud organization node.
- D . Use Identity-Aware Proxy (IAP) with Access Context Manager to restrict the location of Google Cloud resources.
A
Explanation:
https://cloud.google.com/resource-manager/docs/organization-policy/defining-locations
Your organization wants to be General Data Protection Regulation (GDPR) compliant You want to ensure that your DevOps teams can only create Google Cloud resources in the Europe regions.
What should you do?
- A . Use the org policy constraint "Restrict Resource Service Usage’* on your Google Cloud organization node.
- B . Use Identity and Access Management (1AM) custom roles to ensure that your DevOps team can only create resources in the Europe regions
- C . Use the org policy constraint Google Cloud Platform – Resource Location Restriction" on your Google Cloud organization node.
- D . Use Identity-Aware Proxy (IAP) with Access Context Manager to restrict the location of Google Cloud resources.
A
Explanation:
https://cloud.google.com/resource-manager/docs/organization-policy/defining-locations
You are migrating an on-premises data warehouse to BigQuery Cloud SQL, and Cloud Storage. You need to configure security services in the data warehouse.
Your company compliance policies mandate that the data warehouse must:
• Protect data at rest with full lifecycle management on cryptographic keys
• Implement a separate key management provider from data management
• Provide visibility into all encryption key requests
What services should be included in the data warehouse implementation? Choose 2 answers
- A . Customer-managed encryption keys
- B . Customer-Supplied Encryption Keys
- C . Key Access Justifications
- D . Access Transparency and Approval
- E . Cloud External Key Manager
You have numerous private virtual machines on Google Cloud. You occasionally need to manage the servers through Secure Socket Shell (SSH) from a remote location. You want to configure remote access to the servers in a manner that optimizes security and cost efficiency.
What should you do?
- A . Create a site-to-site VPN from your corporate network to Google Cloud.
- B . Configure server instances with public IP addresses Create a firewall rule to only allow traffic from your corporate IPs.
- C . Create a firewall rule to allow access from the Identity-Aware Proxy (IAP) IP range Grant the role of an IAP- secured Tunnel User to the administrators.
- D . Create a jump host instance with public IP Manage the instances by connecting through the jump host.
You have numerous private virtual machines on Google Cloud. You occasionally need to manage the servers through Secure Socket Shell (SSH) from a remote location. You want to configure remote access to the servers in a manner that optimizes security and cost efficiency.
What should you do?
- A . Create a site-to-site VPN from your corporate network to Google Cloud.
- B . Configure server instances with public IP addresses Create a firewall rule to only allow traffic from your corporate IPs.
- C . Create a firewall rule to allow access from the Identity-Aware Proxy (IAP) IP range Grant the role of an IAP- secured Tunnel User to the administrators.
- D . Create a jump host instance with public IP Manage the instances by connecting through the jump host.
You have numerous private virtual machines on Google Cloud. You occasionally need to manage the servers through Secure Socket Shell (SSH) from a remote location. You want to configure remote access to the servers in a manner that optimizes security and cost efficiency.
What should you do?
- A . Create a site-to-site VPN from your corporate network to Google Cloud.
- B . Configure server instances with public IP addresses Create a firewall rule to only allow traffic from your corporate IPs.
- C . Create a firewall rule to allow access from the Identity-Aware Proxy (IAP) IP range Grant the role of an IAP- secured Tunnel User to the administrators.
- D . Create a jump host instance with public IP Manage the instances by connecting through the jump host.
Your company conducts clinical trials and needs to analyze the results of a recent study that are stored in BigQuery. The interval when the medicine was taken contains start and stop dates. The interval data is critical to the analysis, but specific dates may identify a particular batch and introduce bias You need to obfuscate the start and end dates for each row and preserve the interval data.
What should you do?
- A . Use bucketing to shift values to a predetermined date based on the initial value.
- B . Extract the date using TimePartConfig from each date field and append a random month and year
- C . Use date shifting with the context set to the unique ID of the test subject
- D . Use the FFX mode of format preserving encryption (FPE) and maintain data consistency
A
Explanation:
"Date shifting techniques randomly shift a set of dates but preserve the sequence and duration of a period of time. Shifting dates is usually done in context to an individual or an entity. That is, each individual’s dates are shifted by an amount of time that is unique to that individual."
Your company is concerned about unauthorized parties gaming access to the Google Cloud environment by using a fake login page. You must implement a solution to protect against person-in-the-middle attacks.
Which security measure should you use?
- A . Text message or phone call code
- B . Security key
- C . Google Authenticator application
- D . Google prompt
B
Explanation:
A security key is a physical device that you can use for two-step verification, providing an additional layer of security for your Google Account. Security keys can defend against phishing and man-in-the-middle attacks, making your login process more secure.