Google Professional Cloud Security Engineer Practice Exams
Last updated on Oct 22,2026- Exam Code: Professional Cloud Security Engineer
- Exam Name: Google Cloud Certified - Professional Cloud Security Engineer
- Certification Provider: Google
- Latest update: Oct 22,2026
A large financial institution is moving its Big Data analytics to Google Cloud Platform. They want to have maximum control over the encryption process of data stored at rest in BigQuery.
What technique should the institution use?
- A . Use Cloud Storage as a federated Data Source.
- B . Use a Cloud Hardware Security Module (Cloud HSM).
- C . Customer-managed encryption keys (CMEK).
- D . Customer-supplied encryption keys (CSEK).
C
Explanation:
If you want to manage the key encryption keys used for your data at rest, instead of having Google manage the keys, use Cloud Key Management Service to manage your keys. This scenario is known as customer-managed encryption keys (CMEK). https://cloud.google.com/bigquery/docs/encryption-at-rest
Reference: https://cloud.google.com/bigquery/docs/encryption-at-rest
Your Google Cloud environment has one organization node, one folder named Apps." and several projects within that folder The organizational node enforces the constraints/iam.allowedPolicyMemberDomains organization policy, which allows members from the terramearth.com organization The "Apps" folder enforces the constraints/iam.allowedPolicyMemberDomains organization policy, which allows members from the flowlogistic.com organization. It also has the inheritFromParent: false property.
You attempt to grant access to a project in the Apps folder to the user [email protected].
What is the result of your action and why?
- A . The action fails because a constraints/iam.allowedPolicyMemberDomains organization policy must be defined on the current project to deactivate the constraint temporarily.
- B . The action fails because a constraints/iam.allowedPolicyMemberDomains organization policy is in place and only members from the flowlogistic.com organization are allowed.
- C . The action succeeds because members from both organizations, terramearth. com or flowlogistic.com, are allowed on projects in the "Apps" folder
- D . The action succeeds and the new member is successfully added to the project’s Identity and Access Management (1AM) policy because all policies are inherited by underlying folders and projects.
B
Explanation:
The action fails because a constraints/iam.allowedPolicyMemberDomains organization policy is in place and only members from the flowlogistic.com organization are allowed. The inheritFromParent: false property on the “Apps” folder means that it does not inherit the organization policy from the organization node. Therefore, only the policy set at the folder level applies, which allows only members from the flowlogistic.com organization. As a result, the attempt to grant access to the user [email protected] fails because this user is not a member of the flowlogistic.com organization.
Your Google Cloud environment has one organization node, one folder named Apps." and several projects within that folder The organizational node enforces the constraints/iam.allowedPolicyMemberDomains organization policy, which allows members from the terramearth.com organization The "Apps" folder enforces the constraints/iam.allowedPolicyMemberDomains organization policy, which allows members from the flowlogistic.com organization. It also has the inheritFromParent: false property.
You attempt to grant access to a project in the Apps folder to the user [email protected].
What is the result of your action and why?
- A . The action fails because a constraints/iam.allowedPolicyMemberDomains organization policy must be defined on the current project to deactivate the constraint temporarily.
- B . The action fails because a constraints/iam.allowedPolicyMemberDomains organization policy is in place and only members from the flowlogistic.com organization are allowed.
- C . The action succeeds because members from both organizations, terramearth. com or flowlogistic.com, are allowed on projects in the "Apps" folder
- D . The action succeeds and the new member is successfully added to the project’s Identity and Access Management (1AM) policy because all policies are inherited by underlying folders and projects.
B
Explanation:
The action fails because a constraints/iam.allowedPolicyMemberDomains organization policy is in place and only members from the flowlogistic.com organization are allowed. The inheritFromParent: false property on the “Apps” folder means that it does not inherit the organization policy from the organization node. Therefore, only the policy set at the folder level applies, which allows only members from the flowlogistic.com organization. As a result, the attempt to grant access to the user [email protected] fails because this user is not a member of the flowlogistic.com organization.
Your organization uses the top-tier folder to separate application environments (prod and dev). The developers need to see all application development audit logs but they are not permitted to review production logs. Your security team can review all logs in production and development environments. You must grant Identity and Access Management (1AM) roles at the right resource level tor the developers and security team while you ensure least privilege.
What should you do?
- A . • 1 Grant logging, viewer rote to the security team at the organization resource level.
• 2 Grant logging, viewer rote to the developer team at the folder resource level that contains all the dev projects. - B . • 1 Grant logging. viewer rote to the security team at the organization resource level.
• 2 Grant logging. admin role to the developer team at the organization resource level. - C . • 1 Grant logging.admin role to the security team at the organization resource level.
• 2 Grant logging. viewer rote to the developer team at the folder resource level that contains all the dev projects. - D . • 1 Grant logging.admin role to the security team at the organization resource level.
• 2 Grant logging.admin role to the developer team at the organization resource level.
You are in charge of creating a new Google Cloud organization for your company.
Which two actions should you take when creating the super administrator accounts? (Choose two.)
- A . Create an access level in the Google Admin console to prevent super admin from logging in to Google Cloud.
- B . Disable any Identity and Access Management (1AM) roles for super admin at the organization level in the Google Cloud Console.
- C . Use a physical token to secure the super admin credentials with multi-factor authentication (MFA).
- D . Use a private connection to create the super admin accounts to avoid sending your credentials over the Internet.
- E . Provide non-privileged identities to the super admin users for their day-to-day activities.
CE
Explanation:
https://cloud.google.com/resource-manager/docs/super-admin-best-practices#discourage_super_admin_account_usage
– Use a security key or other physical authentication device to enforce two-step verification – Give super admins a separate account that requires a separate login
Your company uses Google Cloud and has publicly exposed network assets. You want to discover the assets and perform a security audit on these assets by using a software tool in the least amount of time.
What should you do?
- A . Run a platform security scanner on all instances in the organization.
- B . Notify Google about the pending audit and wait for confirmation before performing the scan.
- C . Contact a Google approved security vendor to perform the audit.
- D . Identify all external assets by using Cloud Asset Inventory and then run a network security scanner against them.
D
Explanation:
Cloud Asset Inventory: Using Cloud Asset Inventory allows you to quickly identify all the external assets and resources in your Google Cloud environment. This includes information about your projects, instances, storage buckets, and more. This step is crucial for understanding the scope of your audit. Network Security Scanner: Once you have identified the external assets, you can run a network security scanner to assess the security of these assets. Network security scanners can help identify vulnerabilities and potential security risks quickly.
Your organization recently activated the Security Command Center {SCO standard tier. There are a few Cloud Storage buckets that were accidentally made accessible to the public. You need to investigate the impact of the incident and remediate it.
What should you do?
- A . • 1 Remove the Identity and Access Management (IAM) granting access to allusers from the buckets
• 2 Apply the organization policy storage. unifromBucketLevelAccess to prevent regressions
• 3 Query the data access logs to report on unauthorized access - B . • 1 Change bucket permissions to limit access
• 2 Query the data access audit logs for any unauthorized access to the buckets
• 3 After the misconfiguration is corrected mute the finding in the Security Command Center - C . • 1 Change permissions to limit access for authorized users
• 2 Enforce a VPC Service Controls perimeter around all the production projects to immediately stop any unauthorized access
• 3 Review the administrator activity audit logs to report on any unauthorized access - D . • 1 Change the bucket permissions to limit access
• 2 Query the buckets usage logs to report on unauthorized access to the data
• 3 Enforce the organization policy storage.publicAccessPrevention to avoid regressions
You are auditing all your Google Cloud resources in the production project. You want to identity all
principals who can change firewall rules.
What should you do?
- A . Use Policy Analyzer lo query the permissions compute, firewalls, create of compute, firewalls. Create of compute,firewalls.delete.
- B . Reference the Security Health Analytics – Firewall Vulnerability Findings in the Security Command Center.
- C . Use Policy Analyzer to query the permissions compute, firewalls, get of compute, firewalls, list.
- D . Use Firewall Insights to understand your firewall rules usage patterns.
You are working with a client who plans to migrate their data to Google Cloud. You are responsible for recommending an encryption service to manage their encrypted keys.
You have the following requirements:
– The master key must be rotated at least once every 45 days.
– The solution that stores the master key must be FIPS 140-2 Level 3 validated.
– The master key must be stored in multiple regions within the US for redundancy.
Which solution meets these requirements?
- A . Customer-managed encryption keys with Cloud Key Management Service
- B . Customer-managed encryption keys with Cloud HSM
- C . Customer-supplied encryption keys
- D . Google-managed encryption keys
B
Explanation:
https://cloud.google.com/docs/security/key-management-deep-dive https://cloud.google.com/kms/docs/faq
You work for an organization in a regulated industry that has strict data protection requirements. The organization backs up their data in the cloud. To comply with data privacy regulations, this data can only be stored for a specific length of time and must be deleted after this specific period.
You want to automate the compliance with this regulation while minimizing storage costs.
What should you do?
- A . Store the data in a persistent disk, and delete the disk at expiration time.
- B . Store the data in a Cloud Bigtable table, and set an expiration time on the column families.
- C . Store the data in a BigQuery table, and set the table’s expiration time.
- D . Store the data in a Cloud Storage bucket, and configure the bucket’s Object Lifecycle Management feature.
D
Explanation:
To miminize costs, it’s always GCS even though BQ comes as a close 2nd. But, since the question did not specify what kind of data it is (raw files vs tabular data), it is safe to assume GCS is the preferred option with LifeCycle enablement.