Google Professional Cloud Security Engineer Practice Exams
Last updated on Oct 23,2026- Exam Code: Professional Cloud Security Engineer
- Exam Name: Google Cloud Certified - Professional Cloud Security Engineer
- Certification Provider: Google
- Latest update: Oct 23,2026
You define central security controls in your Google Cloud environment for one of the folders in your organization you set an organizational policy to deny the assignment of external IP addresses to VMs. Two days later you receive an alert about a new VM with an external IP address under that folder.
What could have caused this alert?
- A . The VM was created with a static external IP address that was reserved in the project before the organizational policy rule was set.
- B . The organizational policy constraint wasn’t properly enforced and is running in "dry run mode.
- C . At project level, the organizational policy control has been overwritten with an ‘allow’ value.
- D . The policy constraint on the folder level does not have any effect because of an allow" value for that constraint on the organizational level.
A customer’s internal security team must manage its own encryption keys for encrypting data on Cloud Storage and decides to use customer-supplied encryption keys (CSEK).
How should the team complete this task?
- A . Upload the encryption key to a Cloud Storage bucket, and then upload the object to the same bucket.
- B . Use the gsutil command line tool to upload the object to Cloud Storage, and specify the location of the encryption key.
- C . Generate an encryption key in the Google Cloud Platform Console, and upload an object to Cloud Storage using the specified key.
- D . Encrypt the object, then use the gsutil command line tool or the Google Cloud Platform Console to upload the object to Cloud Storage.
B
Explanation:
https://cloud.google.com/storage/docs/encryption/customer-supplied-keys#gsutil
Your organization has had a few recent DDoS attacks. You need to authenticate responses to domain name lookups.
Which Google Cloud service should you use?
- A . Cloud DNS with DNSSEC
- B . Cloud NAT
- C . HTTP(S) Load Balancing
- D . Google Cloud Armor
A
Explanation:
Reference: https://developers.google.com/speed/public-dns/faq
The Domain Name System Security Extensions (DNSSEC) is a feature of the Domain Name System (DNS) that authenticates responses to domain name lookups. It does not provide privacy protections for those lookups, but prevents attackers from manipulating or poisoning the responses to DNS requests. https://cloud.google.com/dns/docs/dnssec
Your company is using GSuite and has developed an application meant for internal usage on Google App Engine. You need to make sure that an external user cannot gain access to the application even when an employee’s password has been compromised.
What should you do?
- A . Enforce 2-factor authentication in GSuite for all users.
- B . Configure Cloud Identity-Aware Proxy for the App Engine Application.
- C . Provision user passwords using GSuite Password Sync.
- D . Configure Cloud VPN between your private network and GCP.
A
Explanation:
https://docs.google.com/document/d/11o3e14tyhnT7w45Q8-r9ZmTAfj2WUNUpJPZImrxm_F4/edit?usp=sharing
https://support.google.com/a/answer/175197?hl=en
Your security team wants to implement a defense-in-depth approach to protect sensitive data stored in a Cloud Storage bucket. Your team has the following requirements: The Cloud Storage bucket in Project A can only be readable from Project B.
The Cloud Storage bucket in Project A cannot be accessed from outside the network.
Data in the Cloud Storage bucket cannot be copied to an external Cloud Storage bucket.
What should the security team do?
- A . Enable domain restricted sharing in an organization policy, and enable uniform bucket-level access on the Cloud Storage bucket.
- B . Enable VPC Service Controls, create a perimeter around Projects A and
- C . and include the Cloud Storage API in the Service Perimeter configuration.
- D . Enable Private Access in both Project A and B’s networks with strict firewall rules that allow communication between the networks.
- E . Enable VPC Peering between Project A and B’s networks with strict firewall rules that allow communication between the networks.
B
Explanation:
VPC Peering is between organizations not between Projects in an organization. That is Shared VPC. In this case, both projects are in same organization so having VPC Service Controls around both projects with necessary rules should be fine.
https://cloud.google.com/vpc-service-controls/docs/overview
Your organization wants full control of the keys used to encrypt data at rest in their Google Cloud environments. Keys must be generated and stored outside of Google and integrate with many Google Services including BigQuery.
What should you do?
- A . Create a Cloud Key Management Service (KMS) key with imported key material Wrap the key for protection during import. Import the key generated on a trusted system in Cloud KMS.
- B . Create a KMS key that is stored on a Google managed FIPS 140-2 level 3 Hardware Security Module (HSM) Manage the Identity and Access Management (IAM) permissions settings, and set up
the key rotation period. - C . Use Cloud External Key Management (EKM) that integrates with an external Hardware Security Module (HSM) system from supported vendors.
- D . Use customer-supplied encryption keys (CSEK) with keys generated on trusted external systems Provide the raw CSEK as part of the API call.
C
Explanation:
Cloud EKM allows you to use encryption keys that are stored and managed in a third-party key management system deployed outside of Google’s infrastructure. This gives your organization full control over the keys used to encrypt data at rest in Google Cloud environments, including BigQuery.
You are a security administrator at your company and are responsible for managing access controls (identification, authentication, and authorization) on Google Cloud.
Which Google-recommended best practices should you follow when configuring authentication and authorization? (Choose two.)
- A . Use Google default encryption.
- B . Manually add users to Google Cloud.
- C . Provision users with basic roles using Google’s Identity and Access Management (1AM) service.
- D . Use SSO/SAML integration with Cloud Identity for user authentication and user lifecycle management.
- E . Provide granular access with predefined roles.
DE
Explanation:
https://cloud.google.com/iam/docs/using-iam-securely#least_privilege Basic roles include thousands of permissions across all Google Cloud services. In production environments, do not grant basic roles unless there is no alternative. Instead, grant the most limited predefined roles or custom roles that meet your needs.
You have stored company approved compute images in a single Google Cloud project that is used as an image repository. This project is protected with VPC Service Controls and exists in the perimeter along with other projects in your organization. This lets other projects deploy images from the image repository project. A team requires deploying a third-party disk image that is stored in an external Google Cloud organization. You need to grant read access to the disk image so that it can be deployed into the perimeter.
What should you do?
- A . • 1 Update the perimeter
• 2 Configure the egressTo field to set identity Type to any_identity.
• 3 Configure the egressFrom field to include the external Google Cloud project number as an allowed resource and the serviceName to compute. googleapis. com. - B . • Allow the external project by using the organizational policy constraints/compute.trustedlmageProjects.
- C . • 1 Update the perimeter
• 2 Configure the egressTo field to include the external Google Cloud project number as an allowed resource and the serviceName to compute. googleapis. com.
• 3 Configure the egressFrom field to set identity Type to any_idestity. - D . • 1 Update the perimeter
• 2 Configure the ingressFrcm field to set identityType to an-y_identity.
• 3 Configure the ingressTo field to include the external Google Cloud project number as an allowed resource and the serviceName to compute.googleapis -com.
You discovered that sensitive personally identifiable information (PII) is being ingested to your Google Cloud environment in the daily ETL process from an on-premises environment to your BigQuery datasets. You need to redact this data to obfuscate the PII, but need to re-identify it for data analytics purposes.
Which components should you use in your solution? (Choose two.)
- A . Secret Manager
- B . Cloud Key Management Service
- C . Cloud Data Loss Prevention with cryptographic hashing
- D . Cloud Data Loss Prevention with automatic text redaction
- E . Cloud Data Loss Prevention with deterministic encryption using AES-SIV
BE
Explanation:
B: you need KMS to store the CryptoKey https://cloud.google.com/dlp/docs/reference/rest/v2/projects.deidentifyTemplates#crypt
E: for the de-identity you need to use CryptoReplaceFfxFpeConfig or CryptoDeterministicConfig https://cloud.google.com/dlp/docs/reference/rest/v2/projects.deidentifyTemplates#cryptodeterministicconfig
https://cloud.google.com/dlp/docs/deidentify-sensitive-data
Your company operates an application instance group that is currently deployed behind a Google Cloud load balancer in us-central-1 and is configured to use the Standard Tier network. The infrastructure team wants to expand to a second Google Cloud region, us-east-2. You need to set up a single external IP address to distribute new requests to the instance groups in both regions.
What should you do?
- A . Change the load balancer backend configuration to use network endpoint groups instead of instance groups.
- B . Change the load balancer frontend configuration to use the Premium Tier network, and add the new instance group.
- C . Create a new load balancer in us-east-2 using the Standard Tier network, and assign a static external IP address.
- D . Create a Cloud VPN connection between the two regions, and enable Google Private Access.
B
Explanation:
https://cloud.google.com/load-balancing/docs/choosing-load-balancer#global-regional