Google Professional Cloud Security Engineer Practice Exams
Last updated on Oct 23,2026- Exam Code: Professional Cloud Security Engineer
- Exam Name: Google Cloud Certified - Professional Cloud Security Engineer
- Certification Provider: Google
- Latest update: Oct 23,2026
An office manager at your small startup company is responsible for matching payments to invoices and creating billing alerts. For compliance reasons, the office manager is only permitted to have the Identity and Access Management (IAM) permissions necessary for these tasks.
Which two IAM roles should the office manager have? (Choose two.)
- A . Organization Administrator
- B . Project Creator
- C . Billing Account Viewer
- D . Billing Account Costs Manager
- E . Billing Account User
CD
Explanation:
https://cloud.google.com/billing/docs/how-to/billing-access#overview-of-cloud-billing-roles-in-cloud-iam
Billing Account Costs Manager (roles/billing.costsManager)
– Manage budgets and view and export cost information of billing accounts (but not pricing information)
Billing Account Viewer (roles/billing.viewer)
– View billing account cost information and transactions.
An office manager at your small startup company is responsible for matching payments to invoices and creating billing alerts. For compliance reasons, the office manager is only permitted to have the Identity and Access Management (IAM) permissions necessary for these tasks.
Which two IAM roles should the office manager have? (Choose two.)
- A . Organization Administrator
- B . Project Creator
- C . Billing Account Viewer
- D . Billing Account Costs Manager
- E . Billing Account User
CD
Explanation:
https://cloud.google.com/billing/docs/how-to/billing-access#overview-of-cloud-billing-roles-in-cloud-iam
Billing Account Costs Manager (roles/billing.costsManager)
– Manage budgets and view and export cost information of billing accounts (but not pricing information)
Billing Account Viewer (roles/billing.viewer)
– View billing account cost information and transactions.
Applications often require access to “secrets” – small pieces of sensitive data at build or run time. The administrator managing these secrets on GCP wants to keep a track of “who did what, where, and when?” within their GCP projects.
Which two log streams would provide the information that the administrator is looking for? (Choose two.)
- A . Admin Activity logs
- B . System Event logs
- C . Data Access logs
- D . VPC Flow logs
- E . Agent logs
AC
Explanation:
https://cloud.google.com/secret-manager/docs/audit-logging
Reference: https://cloud.google.com/kms/docs/secret-management
You want data on Compute Engine disks to be encrypted at rest with keys managed by Cloud Key Management Service (KMS). Cloud Identity and Access Management (IAM) permissions to these keys must be managed in a grouped way because the permissions should be the same for all keys.
What should you do?
- A . Create a single KeyRing for all persistent disks and all Keys in this KeyRing. Manage the IAM permissions at the Key level.
- B . Create a single KeyRing for all persistent disks and all Keys in this KeyRing. Manage the IAM permissions at the KeyRing level.
- C . Create a KeyRing per persistent disk, with each KeyRing containing a single Key. Manage the IAM permissions at the Key level.
- D . Create a KeyRing per persistent disk, with each KeyRing containing a single Key. Manage the IAM permissions at the KeyRing level.
B
Explanation:
https://cloud.netapp.com/blog/gcp-cvo-blg-how-to-use-google-cloud-encryption-with-a-persistent-disk
A database administrator notices malicious activities within their Cloud SQL instance. The database administrator wants to monitor the API calls that read the configuration or metadata of resources.
Which logs should the database administrator review?
- A . Admin Activity
- B . System Event
- C . Access Transparency
- D . Data Access
D
Explanation:
https://cloud.google.com/logging/docs/audit/#data-access "Data Access audit logs contain API calls that read the configuration or metadata of resources, as well as user-driven API calls that create, modify, or read user-provided resource data."
You are the project owner for a regulated workload that runs in a project you own and manage as an Identity and Access Management (IAM) admin. For an upcoming audit, you need to provide access reviews evidence.
Which tool should you use?
- A . Policy Troubleshooter
- B . Policy Analyzer
- C . IAM Recommender
- D . Policy Simulator
B
Explanation:
https://cloud.google.com/policy-intelligence/docs/policy-analyzer-overview
Policy Analyzer lets you find out which principals (for example, users, service accounts, groups, and domains) have what access to which Google Cloud resources based on your IAM allow policies.
You are a security administrator at your company. Per Google-recommended best practices, you implemented the domain restricted sharing organization policy to allow only required domains to access your projects. An engineering team is now reporting that users at an external partner outside your organization domain cannot be granted access to the resources in a project.
How should you make an exception for your partner’s domain while following the stated best practices?
- A . Turn off the domain restriction sharing organization policy. Set the policy value to "Allow All."
- B . Turn off the domain restricted sharing organization policy. Provide the external partners with the required permissions using Google’s Identity and Access Management (IAM) service.
- C . Turn off the domain restricted sharing organization policy. Add each partner’s Google Workspace customer ID to a Google group, add the Google group as an exception under the organization policy, and then turn the policy back on.
- D . Turn off the domain restricted sharing organization policy. Set the policy value to "Custom." Add each external partner’s Cloud Identity or Google Workspace customer ID as an exception under the organization policy, and then turn the policy back on.
D
Explanation:
https://cloud.google.com/resource-manager/docs/organization-policy/restricting-domains#setting_the_organization_policy
The domain restriction constraint is a type of list constraint. Google Workspace customer IDs can be added and removed from the allowed_values list of a domain restriction constraint. The domain restriction constraint does not support denying values, and an organization policy can’t be saved with IDs in the denied_values list. All domains associated with a Google Workspace account listed in the allowed_values will be allowed by the organization policy. All other domains will be denied by the organization policy.
You are a security administrator at your company. Per Google-recommended best practices, you implemented the domain restricted sharing organization policy to allow only required domains to access your projects. An engineering team is now reporting that users at an external partner outside your organization domain cannot be granted access to the resources in a project.
How should you make an exception for your partner’s domain while following the stated best practices?
- A . Turn off the domain restriction sharing organization policy. Set the policy value to "Allow All."
- B . Turn off the domain restricted sharing organization policy. Provide the external partners with the required permissions using Google’s Identity and Access Management (IAM) service.
- C . Turn off the domain restricted sharing organization policy. Add each partner’s Google Workspace customer ID to a Google group, add the Google group as an exception under the organization policy, and then turn the policy back on.
- D . Turn off the domain restricted sharing organization policy. Set the policy value to "Custom." Add each external partner’s Cloud Identity or Google Workspace customer ID as an exception under the organization policy, and then turn the policy back on.
D
Explanation:
https://cloud.google.com/resource-manager/docs/organization-policy/restricting-domains#setting_the_organization_policy
The domain restriction constraint is a type of list constraint. Google Workspace customer IDs can be added and removed from the allowed_values list of a domain restriction constraint. The domain restriction constraint does not support denying values, and an organization policy can’t be saved with IDs in the denied_values list. All domains associated with a Google Workspace account listed in the allowed_values will be allowed by the organization policy. All other domains will be denied by the organization policy.
Your organization is using Active Directory and wants to configure Security Assertion Markup Language (SAML). You must set up and enforce single sign-on (SSO) for all users.
What should you do?
- A . • 1. Manage SAML profile assignments.
• 2. Enable OpenID Connect (OIDC) in your Active Directory (AD) tenant.
• 3. Verify the domain. - B . • 1. Create a new SAML profile.
• 2. Upload the X.509 certificate.
• 3. Enable the change password URL.
• 4. Configure Entity ID and ACS URL in your IdP. - C . • 1. Create a new SAML profile.
• 2. Populate the sign-in and sign-out page URLs.
• 3. Upload the X.509 certificate.
• 4. Configure Entity ID and ACS URL in your IdP - D . • 1. Configure prerequisites for OpenID Connect (OIDC) in your Active Directory (AD) tenant
• 2. Verify the AD domain.
• 3. Decide which users should use SAML.
• 4. Assign the pre-configured profile to the select organizational units (OUs) and groups.
C
Explanation:
When configuring SAML-based Single Sign-On (SSO) in an organization that’s using Active Directory, the general steps would involve setting up a SAML profile, specifying the necessary URLs for sign-in and sign-out processes, uploading an X.509 certificate for secure communication, and setting up the Entity ID and Assertion Consumer Service (ACS) URL in the Identity Provider (which in this case would be Active Directory).
You want to prevent users from accidentally deleting a Shared VPC host project.
Which organization-level policy constraint should you enable?
- A . compute.restrictSharedVpcHostProjects
- B . compute.restrictXpnProjectLienRemoval
- C . compute.restrictSharedVpcSubnetworks
- D . compute.sharedReservationsOwnerProjects
B
Explanation:
Reference:
https://cloud.google.com/vpc/docs/provisioning-shared-vpc https://cloud.google.com/resource-manager/docs/organization-policy/org-policy-constraints#constraints-for-specific-services
– constraints/compute.restrictXpnProjectLienRemoval
– Restrict shared VPC project lien removal
This boolean constraint restricts the set of users that can remove a Shared VPC host project lien without organization-level permission where this constraint is set to True.
By default, any user with the permission to update liens can remove a Shared VPC host project lien.
Enforcing this constraint requires that permission be granted at the organization level.