Google Professional Cloud Security Engineer Practice Exams
Last updated on Oct 23,2026- Exam Code: Professional Cloud Security Engineer
- Exam Name: Google Cloud Certified - Professional Cloud Security Engineer
- Certification Provider: Google
- Latest update: Oct 23,2026
You are routing all your internet facing traffic from Google Cloud through your on-premises internet connection. You want to accomplish this goal securely and with the highest bandwidth possible.
What should you do?
- A . Create an HA VPN connection to Google Cloud Replace the default 0 0 0 0/0 route.
- B . Create a routing VM in Compute Engine Configure the default route with the VM as the next hop.
- C . Configure Cloud Interconnect with HA VPN Replace the default 0 0 0 0/0 route to an on-premises destination.
- D . Configure Cloud Interconnect and route traffic through an on-premises firewall.
Use customer-managed encryption keys to encrypt secrets.
Explanation:
Provide granular access to secrets: 2. Enforce access control to secrets using project-level identity and Access Management (IAM) bindings. Give you control over the rotation schedules for the encryption keys that wrap your secrets: 3. Use customer-managed encryption keys to encrypt secrets. Maintain environment separation: 1. Use separate Google Cloud projects to store Production and Non-Production secrets.
Your company wants to determine what products they can build to help customers improve their credit scores depending on their age range. To achieve this, you need to join user information in the company’s banking app with customers’ credit score data received from a third party. While using this raw data will allow you to complete this task, it exposes sensitive data, which could be propagated into new systems.
This risk needs to be addressed using de-identification and tokenization with Cloud Data Loss Prevention while maintaining the referential integrity across the database.
Which cryptographic token format should you use to meet these requirements?
- A . Deterministic encryption
- B . Secure, key-based hashes
- C . Format-preserving encryption
- D . Cryptographic hashing
A
Explanation:
”This encryption method is reversible, which helps to maintain referential integrity across your database and has no character-set limitations.” https://cloud.google.com/blog/products/identity-security/take-charge-of-your-data-how-tokenization-makes-data-usable-without-sacrificing-privacy
https://cloud.google.com/dlp/docs/pseudonymization
FPE provides fewer security guarantees compared to other deterministic encryption methods such as AES-SIV. For these reasons, Google strongly recommends using deterministic encryption with AES-SIV instead of FPE for all security sensitive use cases. Other methods like deterministic encryption using AES-SIV provide these stronger security guarantees and are recommended for tokenization use cases unless length and character set preservation are strict requirements―for example, for backward compatibility with a legacy data system.
Users are reporting an outage on your public-facing application that is hosted on Compute Engine. You suspect that a recent change to your firewall rules is responsible. You need to test whether your firewall rules are working properly.
What should you do?
- A . Enable Firewall Rules Logging on the latest rules that were changed. Use Logs Explorer to analyze whether the rules are working correctly.
- B . Connect to a bastion host in your VPC. Use a network traffic analyzer to determine at which point your requests are being blocked.
- C . In a pre-production environment, disable all firewall rules individually to determine which one is blocking user traffic.
- D . Enable VPC Flow Logs in your VPC. Use Logs Explorer to analyze whether the rules are working correctly.
A
Explanation:
Reference:
https://cloud.google.com/vpc/docs/using-flow-logs
https://cloud.google.com/vpc/docs/firewall-rules-logging
You are a member of your company’s security team. You have been asked to reduce your Linux bastion host external attack surface by removing all public IP addresses. Site Reliability Engineers (SREs) require access to the bastion host from public locations so they can access the internal VPC while off-site.
How should you enable this access?
- A . Implement Cloud VPN for the region where the bastion host lives.
- B . Implement OS Login with 2-step verification for the bastion host.
- C . Implement Identity-Aware Proxy TCP forwarding for the bastion host.
- D . Implement Google Cloud Armor in front of the bastion host.
C
Explanation:
Reference:
https://cloud.google.com/architecture/building-internet-connectivity-for-private-vms
https://cloud.google.com/architecture/building-internet-connectivity-for-private-vms#configuring_iap_tunnels_for_interacting_with_instances
Employees at your company use their personal computers to access your organization s Google Cloud console. You need to ensure that users can only access the Google Cloud console from their corporate-issued devices and verify that they have a valid enterprise certificate.
What should you do?
- A . Implement an Identity and Access Management (1AM) conditional policy to verify the device certificate
- B . Implement a VPC firewall policy Activate packet inspection and create an allow rule to validate and verify the device certificate.
- C . Implement an organization policy to verify the certificate from the access context.
- D . Implement an Access Policy in BeyondCorp Enterprise to verify the device certificate Create an access binding with the access policy just created.
D
Explanation:
https://cloud.google.com/beyondcorp?hl=pt-br
Your Security team believes that a former employee of your company gained unauthorized access to Google Cloud resources some time in the past 2 months by using a service account key. You need to confirm the unauthorized access and determine the user activity.
What should you do?
- A . Use Security Health Analytics to determine user activity.
- B . Use the Cloud Monitoring console to filter audit logs by user.
- C . Use the Cloud Data Loss Prevention API to query logs in Cloud Storage.
- D . Use the Logs Explorer to search for user activity.
D
Explanation:
We use audit logs by searching the Service Account and checking activities in the past 2 months. (the user identity will not be seen since he used the SA identity but we can make correlations based on ip address, working hour, etc. )
You need to create a VPC that enables your security team to control network resources such as firewall rules.
How should you configure the network to allow for separation of duties for network resources?
- A . Set up multiple VPC networks, and set up multi-NIC virtual appliances to connect the networks.
- B . Set up VPC Network Peering, and allow developers to peer their network with a Shared VPC.
- C . Set up a VPC in a project. Assign the Compute Network Admin role to the security team, and assign the Compute Admin role to the developers.
- D . Set up a Shared VPC where the security team manages the firewall rules, and share the network with developers via service projects.
You are a Cloud Identity administrator for your organization. In your Google Cloud environment groups are used to manage user permissions. Each application team has a dedicated group Your team is responsible for creating these groups and the application teams can manage the team members on their own through the Google Cloud console. You must ensure that the application teams can only add users from within your organization to their groups.
What should you do?
- A . Change the configuration of the relevant groups in the Google Workspace Admin console to prevent external users from being added to the group.
- B . Set an Identity and Access Management (1AM) policy that includes a condition that restricts group membership to user principals that belong to your organization.
- C . Define an Identity and Access Management (IAM) deny policy that denies the assignment of principals that are outside your organization to the groups in scope.
- D . Export the Cloud Identity logs to BigQuery Configure an alert for external members added to groups Have the alert trigger a Cloud Function instance that removes the external members from the group.
You are a Cloud Identity administrator for your organization. In your Google Cloud environment groups are used to manage user permissions. Each application team has a dedicated group Your team is responsible for creating these groups and the application teams can manage the team members on their own through the Google Cloud console. You must ensure that the application teams can only add users from within your organization to their groups.
What should you do?
- A . Change the configuration of the relevant groups in the Google Workspace Admin console to prevent external users from being added to the group.
- B . Set an Identity and Access Management (1AM) policy that includes a condition that restricts group membership to user principals that belong to your organization.
- C . Define an Identity and Access Management (IAM) deny policy that denies the assignment of principals that are outside your organization to the groups in scope.
- D . Export the Cloud Identity logs to BigQuery Configure an alert for external members added to groups Have the alert trigger a Cloud Function instance that removes the external members from the group.