Google Professional Cloud Security Engineer Practice Exams
Last updated on Oct 23,2026- Exam Code: Professional Cloud Security Engineer
- Exam Name: Google Cloud Certified - Professional Cloud Security Engineer
- Certification Provider: Google
- Latest update: Oct 23,2026
Process Cloud Storage objects in SIEM.
Explanation:
"Your team needs to obtain a unified log view of all development cloud projects in your SIEM" – This means we are ONLY interested in development projects. "The development projects are under the NONPROD organization folder with the test and pre-production projects" – We will need to filter out development from others i.e test and pre-prod. "The development projects share the ABC-BILLING billing account with the rest of the organization." – This is unnecessary information.
An organization adopts Google Cloud Platform (GCP) for application hosting services and needs guidance on setting up password requirements for their Cloud Identity account. The organization has a password policy requirement that corporate employee passwords must have a minimum number of characters.
Which Cloud Identity password guidelines can the organization use to inform their new requirements?
- A . Set the minimum length for passwords to be 8 characters.
- B . Set the minimum length for passwords to be 10 characters.
- C . Set the minimum length for passwords to be 12 characters.
- D . Set the minimum length for passwords to be 6 characters.
A
Explanation:
Default password length is 8 characters. https://support.google.com/cloudidentity/answer/33319?hl=en
https://support.google.com/cloudidentity/answer/139399?hl=en#:~:text=It%20can%20be%20betwe en%208,decide%20to%20change%20their%20password.
You are migrating an application into the cloud The application will need to read data from a Cloud Storage bucket. Due to local regulatory requirements, you need to hold the key material used for encryption fully under your control and you require a valid rationale for accessing the key material.
What should you do?
- A . Encrypt the data in the Cloud Storage bucket by using Customer Managed Encryption Keys. Configure an 1AM deny policy for unauthorized groups
- B . Encrypt the data in the Cloud Storage bucket by using Customer Managed Encryption Keys backed by a Cloud Hardware Security Module (HSM). Enable data access logs.
- C . Generate a key in your on-premises environment and store it in a Hardware Security Module (HSM) that is managed on-premises Use this key as an external key in the Cloud Key Management Service (KMS). Activate Key Access Justifications (KAJ) and set the external key system to reject unauthorized accesses.
- D . Generate a key in your on-premises environment to encrypt the data before you upload the data to the Cloud Storage bucket Upload the key to the Cloud Key Management Service (KMS). Activate Key Access Justifications (KAJ) and have the external key system reject unauthorized accesses.
C
Explanation:
By generating a key in your on-premises environment and storing it in an HSM that you manage, you’re ensuring that the key material is fully under your control. Using the key as an external key in Cloud KMS allows you to use the key with Google Cloud services without having the key stored on Google Cloud. Activating Key Access Justifications (KAJ) provides a reason every time the key is accessed, and you can configure the external key system to reject unauthorized access attempts.
Your organization must comply with the regulation to keep instance logging data within Europe. Your workloads will be hosted in the Netherlands in region europe-west4 in a new project. You must configure Cloud Logging to keep your data in the country.
What should you do?
- A . Configure the organization policy constraint gcp.resourceLocations to europe-west4.
- B . Set the logging storage region to eurcpe-west4 by using the gcloud CLI logging settings update.
- C . Create a new tog bucket in europe-west4. and redirect the _Def auit bucKet to the new bucket.
- D . Configure log sink to export all logs into a Cloud Storage bucket in europe-west4.
Your organization must comply with the regulation to keep instance logging data within Europe. Your workloads will be hosted in the Netherlands in region europe-west4 in a new project. You must configure Cloud Logging to keep your data in the country.
What should you do?
- A . Configure the organization policy constraint gcp.resourceLocations to europe-west4.
- B . Set the logging storage region to eurcpe-west4 by using the gcloud CLI logging settings update.
- C . Create a new tog bucket in europe-west4. and redirect the _Def auit bucKet to the new bucket.
- D . Configure log sink to export all logs into a Cloud Storage bucket in europe-west4.
Your organization s customers must scan and upload the contract and their driver license into a web portal in Cloud Storage. You must remove all personally identifiable information (Pll) from files that are older than 12 months. Also you must archive the anonymized files for retention purposes.
What should you do?
- A . Set a time to live (TTL) of 12 months for the files in the Cloud Storage bucket that removes PH and moves the files to the archive storage class.
- B . Create a Cloud Data Loss Prevention (DLP) inspection job that de-identifies Pll in files created more than 12 months ago and archives them to another Cloud Storage bucket. Delete the original files.
- C . Schedule a Cloud Key Management Service (KMS) rotation period of 12 months for the encryption keys of the Cloud Storage files containing Pll to de-identify them Delete the original keys.
- D . Configure the Autoclass feature of the Cloud Storage bucket to de-identify Pll Archive the files that are older than 12 months Delete the original files.
When working with agents in a support center via online chat, an organization’s customers often share pictures of their documents with personally identifiable information (PII). The organization that owns the support center is concerned that the PII is being stored in their databases as part of the regular chat logs they retain for review by internal or external analysts for customer service trend analysis.
Which Google Cloud solution should the organization use to help resolve this concern for the customer while still maintaining data utility?
- A . Use Cloud Key Management Service (KMS) to encrypt the PII data shared by customers before storing it for analysis.
- B . Use Object Lifecycle Management to make sure that all chat records with PII in them are discarded and not saved for analysis.
- C . Use the image inspection and redaction actions of the DLP API to redact PII from the images before storing them for analysis.
- D . Use the generalization and bucketing actions of the DLP API solution to redact PII from the texts
before storing them for analysis.
C
Explanation:
https://cloud.google.com/dlp/docs/concepts-image-redaction
You are creating an internal App Engine application that needs to access a user’s Google Drive on the user’s behalf. Your company does not want to rely on the current user’s credentials. It also wants to follow Google- recommended practices.
What should you do?
- A . Create a new Service account, and give all application users the role of Service Account User.
- B . Create a new Service account, and add all application users to a Google Group. Give this group the role of Service Account User.
- C . Use a dedicated G Suite Admin account, and authenticate the application’s operations with these G Suite credentials.
- D . Create a new service account, and grant it G Suite domain-wide delegation. Have the application use it to impersonate the user.
D
Explanation:
https://developers.google.com/admin-sdk/directory/v1/guides/delegation
You are backing up application logs to a shared Cloud Storage bucket that is accessible to both the administrator and analysts. Analysts should not have access to logs that contain any personally identifiable information (PII). Log files containing PII should be stored in another bucket that is only accessible to the administrator.
What should you do?
- A . Upload the logs to both the shared bucket and the bucket with Pll that is only accessible to the administrator. Use the Cloud Data Loss Prevention API to create a job trigger. Configure the trigger to delete any files that contain Pll from the shared bucket.
- B . On the shared bucket, configure Object Lifecycle Management to delete objects that contain Pll.
- C . On the shared bucket, configure a Cloud Storage trigger that is only triggered when Pll is uploaded. Use Cloud Functions to capture the trigger and delete the files that contain Pll.
- D . Use Pub/Sub and Cloud Functions to trigger a Cloud Data Loss Prevention scan every time a file is uploaded to the administrator’s bucket. If the scan does not detect Pll, have the function move the objects into the shared Cloud Storage bucket.
Your company’s users access data in a BigQuery table. You want to ensure they can only access the
data during working hours.
What should you do?
- A . Assign a BigQuery Data Viewer role along with an 1AM condition that limits the access to specified working hours.
- B . Configure Cloud Scheduler so that it triggers a Cloud Functions instance that modifies the organizational policy constraints for BigQuery during the specified working hours.
- C . Assign a BigQuery Data Viewer role to a service account that adds and removes the users daily during the specified working hours
- D . Run a gsuttl script that assigns a BigQuery Data Viewer role, and remove it only during the specified working hours.