Google Professional Cloud Security Engineer Practice Exams
Last updated on Oct 23,2026- Exam Code: Professional Cloud Security Engineer
- Exam Name: Google Cloud Certified - Professional Cloud Security Engineer
- Certification Provider: Google
- Latest update: Oct 23,2026
Your company is concerned about unauthorized parties gaming access to the Google Cloud environment by using a fake login page. You must implement a solution to protect against person-in-the-middle attacks.
Which security measure should you use?
- A . Text message or phone call code
- B . Security key
- C . Google Authenticator application
- D . Google prompt
B
Explanation:
A security key is a physical device that you can use for two-step verification, providing an additional layer of security for your Google Account. Security keys can defend against phishing and man-in-the-middle attacks, making your login process more secure.
Configure private access using the restricted.googleapis.com domains in on-premises DNS configurations.
Explanation:
restricted.googleapis.com (199.36.153.4/30) only provides access to Cloud and Developer APIs that support VPC Service Controls. VPC Service Controls are enforced for these services https://cloud.google.com/vpc/docs/configure-private-google-access-hybrid
You manage one of your organization’s Google Cloud projects (Project A). AVPC Service Control (SC) perimeter is blocking API access requests to this project including Pub/Sub. A resource running under a service account in another project (Project B) needs to collect messages from a Pub/Sub topic in your project Project B is not included in a VPC SC perimeter. You need to provide access from Project B to the Pub/Sub topic in Project A using the principle of least Privilege.
What should you do?
- A . Configure an ingress policy for the perimeter in Project A and allow access for the service account in Project B to collect messages.
- B . Create an access level that allows a developer in Project B to subscribe to the Pub/Sub topic that is located in Project A.
- C . Create a perimeter bridge between Project A and Project B to allow the required communication between both projects.
- D . Remove the Pub/Sub API from the list of restricted services in the perimeter configuration for Project A.
Your team needs to prevent users from creating projects in the organization. Only the DevOps team should be allowed to create projects on behalf of the requester.
Which two tasks should your team perform to handle this request? (Choose two.)
- A . Remove all users from the Project Creator role at the organizational level.
- B . Create an Organization Policy constraint, and apply it at the organizational level.
- C . Grant the Project Editor role at the organizational level to a designated group of users.
- D . Add a designated group of users to the Project Creator role at the organizational level.
- E . Grant the billing account creator role to the designated DevOps team.
AD
Explanation:
https://cloud.google.com/resource-manager/docs/organization-policy/org-policy-constraints
You are responsible for managing your company’s identities in Google Cloud. Your company enforces 2-Step Verification (2SV) for all users. You need to reset a user’s access, but the user lost their second factor for 2SV. You want to minimize risk.
What should you do?
- A . On the Google Admin console, select the appropriate user account, and generate a backup code to allow the user to sign in. Ask the user to update their second factor.
- B . On the Google Admin console, temporarily disable the 2SV requirements for all users. Ask the user to log in and add their new second factor to their account. Re-enable the 2SV requirement for all users.
- C . On the Google Admin console, select the appropriate user account, and temporarily disable 2SV for this account Ask the user to update their second factor, and then re-enable 2SV for this account.
- D . On the Google Admin console, use a super administrator account to reset the user account’s credentials. Ask the user to update their credentials after their first login.
A
Explanation:
https://support.google.com/a/answer/9176734
Use backup codes for account recovery If you need to recover an account, use backup codes.
Accounts are still protected by 2-Step Verification, and backup codes are easy to generate.
You are in charge of migrating a legacy application from your company datacenters to GCP before the current maintenance contract expires. You do not know what ports the application is using and no documentation is available for you to check. You want to complete the migration without putting your environment at risk.
What should you do?
- A . Migrate the application into an isolated project using a “Lift & Shift” approach. Enable all internal TCP traffic using VPC Firewall rules. Use VPC Flow logs to determine what traffic should be allowed for the
application to work properly. - B . Migrate the application into an isolated project using a “Lift & Shift” approach in a custom network. Disable all traffic within the VPC and look at the Firewall logs to determine what traffic should be allowed for the application to work properly.
- C . Refactor the application into a micro-services architecture in a GKE cluster. Disable all traffic from outside the cluster using Firewall Rules. Use VPC Flow logs to determine what traffic should be allowed for the application to work properly.
- D . Refactor the application into a micro-services architecture hosted in Cloud Functions in an isolated project.
Disable all traffic from outside your project using Firewall Rules. Use VPC Flow logs to determine what traffic should be allowed for the application to work properly.
A
Explanation:
Migrate the application into an isolated project using a "Lift & Shift" approach. Enable all internal TCP traffic using VPC Firewall rules. Use VPC Flow logs to determine what traffic should be allowed for the application to work properly.
Your privacy team uses crypto-shredding (deleting encryption keys) as a strategy to delete personally identifiable information (PII). You need to implement this practice on Google Cloud while still utilizing the majority of the platform’s services and minimizing operational overhead.
What should you do?
- A . Use client-side encryption before sending data to Google Cloud, and delete encryption keys on-premises
- B . Use Cloud External Key Manager to delete specific encryption keys.
- C . Use customer-managed encryption keys to delete specific encryption keys.
- D . Use Google default encryption to delete specific encryption keys.
C
Explanation:
https://cloud.google.com/sql/docs/mysql/cmek
"You might have situations where you want to permanently destroy data encrypted with CMEK. To do this, you destroy the customer-managed encryption key version. You can’t destroy the keyring or key, but you can destroy key versions of the key."
A website design company recently migrated all customer sites to App Engine. Some sites are still in progress and should only be visible to customers and company employees from any location.
Which solution will restrict access to the in-progress sites?
- A . Upload an .htaccess file containing the customer and employee user accounts to App Engine.
- B . Create an App Engine firewall rule that allows access from the customer and employee networks and denies all other traffic.
- C . Enable Cloud Identity-Aware Proxy (IAP), and allow access to a Google Group that contains the customer and employee user accounts.
- D . Use Cloud VPN to create a VPN connection between the relevant on-premises networks and the company’s GCP Virtual Private Cloud (VPC) network.
C
Explanation:
https://cloud.google.com/iap/docs/concepts-overview#when_to_use_iap
A company is running their webshop on Google Kubernetes Engine and wants to analyze customer transactions in BigQuery. You need to ensure that no credit card numbers are stored in BigQuery
What should you do?
- A . Create a BigQuery view with regular expressions matching credit card numbers to query and delete affected rows.
- B . Use the Cloud Data Loss Prevention API to redact related infoTypes before data is ingested into BigQuery.
- C . Leverage Security Command Center to scan for the assets of type Credit Card Number in BigQuery.
- D . Enable Cloud Identity-Aware Proxy to filter out credit card numbers before storing the logs in BigQuery.
B
Explanation:
https://cloud.google.com/bigquery/docs/scan-with-dlp
Cloud Data Loss Prevention API allows to detect and redact or remove sensitive data before the comments or reviews are published. Cloud DLP will read information from BigQuery, Cloud Storage or Datastore and scan it for sensitive data.
You have created an OS image that is hardened per your organization’s security standards and is being stored in a project managed by the security team. As a Google Cloud administrator, you need to make sure all VMs in your Google Cloud organization can only use that specific OS image while minimizing operational overhead.
What should you do? (Choose two.)
- A . Grant users the compuce.imageUser role in their own projects.
- B . Grant users the compuce.imageUser role in the OS image project.
- C . Store the image in every project that is spun up in your organization.
- D . Set up an image access organization policy constraint, and list the security team managed project in the projects allow list.
- E . Remove VM instance creation permission from users of the projects, and only allow you and your team to create VM instances.
BD
Explanation:
https://cloud.google.com/resource-manager/docs/organization-policy/org-policy-constraints – constraints/compute.trustedImageProjects
This list constraint defines the set of projects that can be used for image storage and disk instantiation for Compute Engine. If this constraint is active, only images from trusted projects will be allowed as the source for boot disks for new instances.