Google Professional Cloud Security Engineer Practice Exams
Last updated on Oct 23,2026- Exam Code: Professional Cloud Security Engineer
- Exam Name: Google Cloud Certified - Professional Cloud Security Engineer
- Certification Provider: Google
- Latest update: Oct 23,2026
Your company’s users access data in a BigQuery table. You want to ensure they can only access the
data during working hours.
What should you do?
- A . Assign a BigQuery Data Viewer role along with an 1AM condition that limits the access to specified working hours.
- B . Configure Cloud Scheduler so that it triggers a Cloud Functions instance that modifies the organizational policy constraints for BigQuery during the specified working hours.
- C . Assign a BigQuery Data Viewer role to a service account that adds and removes the users daily during the specified working hours
- D . Run a gsuttl script that assigns a BigQuery Data Viewer role, and remove it only during the specified working hours.
Your organization is using GitHub Actions as a continuous integration and delivery (Cl/CD) platform.
You must enable access to Google Cloud resources from the Cl/CD pipelines in the most secure way.
What should you do?
- A . Create a service account key and add it to the GitHub pipeline configuration file.
- B . Create a service account key and add it to the GitHub repository content.
- C . Configure a Google Kubernetes Engine cluster that uses Workload Identity to supply credentials to GitHub.
- D . Configure workload identity federation to use GitHub as an identity pool provider.
A customer wants to run a batch processing system on VMs and store the output files in a Cloud Storage bucket. The networking and security teams have decided that no VMs may reach the public internet.
How should this be accomplished?
- A . Create a firewall rule to block internet traffic from the VM.
- B . Provision a NAT Gateway to access the Cloud Storage API endpoint.
- C . Enable Private Google Access on the VPC.
- D . Mount a Cloud Storage bucket as a local filesystem on every VM.
C
Explanation:
https://cloud.google.com/vpc/docs/private-google-access
You run applications on Cloud Run. You already enabled container analysis for vulnerability scanning. However, you are concerned about the lack of control on the applications that are deployed. You must ensure that only trusted container images are deployed on Cloud Run.
What should you do? Choose 2 answers
- A . Enable Binary Authorization on the existing Kubernetes cluster.
- B . Set the organization policy constraint constraints/run. allowedBinaryAuthorizationPolicie to the list of allowed Binary Authorization policy names.
- C . Set the organization policy constraint constraints/compute.trustedimageProjects to the list of protects that contain the trusted container images.
- D . Enable Binary Authorization on the existing Cloud Run service.
- E . Use Cloud Run breakglass to deploy an image that meets the Binary Authorization policy by default.
You run applications on Cloud Run. You already enabled container analysis for vulnerability scanning. However, you are concerned about the lack of control on the applications that are deployed. You must ensure that only trusted container images are deployed on Cloud Run.
What should you do? Choose 2 answers
- A . Enable Binary Authorization on the existing Kubernetes cluster.
- B . Set the organization policy constraint constraints/run. allowedBinaryAuthorizationPolicie to the list of allowed Binary Authorization policy names.
- C . Set the organization policy constraint constraints/compute.trustedimageProjects to the list of protects that contain the trusted container images.
- D . Enable Binary Authorization on the existing Cloud Run service.
- E . Use Cloud Run breakglass to deploy an image that meets the Binary Authorization policy by default.
You are developing a new application that uses exclusively Compute Engine VMs Once a day. this application will execute five different batch jobs Each of the batch jobs requires a dedicated set of permissions on Google Cloud resources outside of your application. You need to design a secure access concept for the batch jobs that adheres to the least-privilege principle.
What should you do?
- A . 1. Create a general service account **g-sa" to execute the batch jobs.
• 2. Grant the permissions required to execute the batch jobs to g-sa.
• 3. Execute the batch jobs with the permissions granted to g-sa - B . 1. Create a general service account "g-sa" to orchestrate the batch jobs.
• 2. Create one service account per batch job Mb-sa-[1-5]," and grant only the permissions required to run the individual batch jobs to the service accounts.
• 3. Grant the Service Account Token Creator role to g-sa Use g-sa to obtain short-lived access
tokens for b-sa-[1-5] and to execute the batch jobs with the permissions of b-sa-[1-5]. - C . 1. Create a workload identity pool and configure workload identity pool providers for each batch job
• 2. Assign the workload identity user role to each of the identities configured in the providers.
• 3. Create one service account per batch job Mb-sa-[1-5]". and grant only the permissions required to run the individual batch jobs to the service accounts
• 4. Generate credential configuration files for each of the providers Use these files to execute the batch jobs with the permissions of b-sa-[1-5]. - D . • 1. Create a general service account "g-sa" to orchestrate the batch jobs.
• 2. Create one service account per batch job ‘b-sa-[1-5) Grant only the permissions required to run the individual batch jobs to the service accounts and generate service account keys for each of these service accounts
• 3. Store the service account keys in Secret Manager. Grant g-sa access to Secret Manager and run the batch jobs with the permissions of b-sa-[1-5].
You are the security admin of your company. Your development team creates multiple GCP projects under the "implementation" folder for several dev, staging, and production workloads. You want to prevent data exfiltration by malicious insiders or compromised code by setting up a security perimeter. However, you do not want to restrict communication between the projects.
What should you do?
- A . Use a Shared VPC to enable communication between all projects, and use firewall rules to prevent data exfiltration.
- B . Create access levels in Access Context Manager to prevent data exfiltration, and use a shared VPC for communication between projects.
- C . Use an infrastructure-as-code software tool to set up a single service perimeter and to deploy a Cloud Function that monitors the "implementation" folder via Stackdriver and Cloud Pub/Sub. When the function notices that a new project is added to the folder, it executes Terraform to add the new project to the associated perimeter.
- D . Use an infrastructure-as-code software tool to set up three different service perimeters for dev, staging, and prod and to deploy a Cloud Function that monitors the "implementation" folder via Stackdriver and Cloud Pub/Sub. When the function notices that a new project is added to the folder, it executes Terraform to add the new project to the respective perimeter.
C
Explanation:
https://cloud.google.com/vpc-service-controls/docs/overview#benefits
https://github.com/terraform-google-modules/terraform-google-vpc-service-controls/tree/master/examples/automatic_folder
You have been tasked with implementing external web application protection against common web application attacks for a public application on Google Cloud. You want to validate these policy changes before they are enforced.
What service should you use?
- A . Google Cloud Armor’s preconfigured rules in preview mode
- B . Prepopulated VPC firewall rules in monitor mode
- C . The inherent protections of Google Front End (GFE)
- D . Cloud Load Balancing firewall rules
- E . VPC Service Controls in dry run mode
A
Explanation:
Reference: https://cloud.google.com/architecture/owasp-top-ten-mitigation
You can preview the effects of a rule without enforcing it. In preview mode, actions are noted in Cloud Monitoring. You can choose to preview individual rules in a security policy, or you can preview every rule in the policy. https://cloud.google.com/armor/docs/security-policy-overview#preview_mode
When creating a secure container image, which two items should you incorporate into the build if possible? (Choose two.)
- A . Ensure that the app does not run as PID 1.
- B . Package a single app as a container.
- C . Remove any unnecessary tools not needed by the app.
- D . Use public container images as a base image for the app.
- E . Use many container image layers to hide sensitive information.
BC
Explanation:
Reference:
https://cloud.google.com/solutions/best-practices-for-building-containers
https://cloud.google.com/architecture/best-practices-for-building-containers#solution_1_run_as_pid_1_and_register_signal_handlers
You manage your organization’s Security Operations Center (SOC). You currently monitor and detect network traffic anomalies in your VPCs based on network logs. However, you want to explore your environment using network payloads and headers.
Which Google Cloud product should you use?
- A . Cloud IDS
- B . VPC Service Controls logs
- C . VPC Flow Logs
- D . Google Cloud Armor
- E . Packet Mirroring
E
Explanation:
https://cloud.google.com/vpc/docs/packet-mirroring
Packet Mirroring clones the traffic of specified instances in your Virtual Private Cloud (VPC) network and forwards it for examination. Packet Mirroring captures all traffic and packet data, including payloads and headers.