Google Professional Cloud Security Engineer Practice Exams
Last updated on Oct 23,2026- Exam Code: Professional Cloud Security Engineer
- Exam Name: Google Cloud Certified - Professional Cloud Security Engineer
- Certification Provider: Google
- Latest update: Oct 23,2026
You need to audit the network segmentation for your Google Cloud footprint. You currently operate Production and Non-Production infrastructure-as-a-service (IaaS) environments. All your VM instances are deployed without any service account customization.
After observing the traffic in your custom network, you notice that all instances can communicate freely C despite tag-based VPC firewall rules in place to segment traffic properly C with a priority of 1000.
What are the most likely reasons for this behavior?
- A . All VM instances are missing the respective network tags.
- B . All VM instances are residing in the same network subnet.
- C . All VM instances are configured with the same network route.
- D . A VPC firewall rule is allowing traffic between source/targets based on the same service account with priority 999.
- E . A VPC firewall rule is allowing traffic between source/targets based on the same service account with priority 1001.
Your company’s Chief Information Security Officer (CISO) creates a requirement that business data must be stored in specific locations due to regulatory requirements that affect the company’s global expansion plans.
After working on the details to implement this requirement, you determine the following:
– The services in scope are included in the Google Cloud Data Residency Terms.
– The business data remains within specific locations under the same organization.
– The folder structure can contain multiple data residency locations.
– You plan to use the Resource Location Restriction organization policy constraint.
At which level in the resource hierarchy should you set the constraint?
- A . Folder
- B . Resource
- C . Project
- D . Organization
C
Explanation:
https://cloud.google.com/resource-manager/docs/organization-policy/defining-locations
You’re developing the incident response plan for your company. You need to define the access strategy that your DevOps team will use when reviewing and investigating a deployment issue in your Google Cloud environment. There are two main requirements: Least-privilege access must be enforced at all times.
The DevOps team must be able to access the required resources only during the deployment issue.
How should you grant access while following Google-recommended best practices?
- A . Assign the Project Viewer Identity and Access Management (1AM) role to the DevOps team.
- B . Create a custom 1AM role with limited list/view permissions, and assign it to the DevOps team.
- C . Create a service account, and grant it the Project Owner 1AM role. Give the Service Account User
Role on this service account to the DevOps team. - D . Create a service account, and grant it limited list/view permissions. Give the Service Account User Role on this service account to the DevOps team.
After completing a security vulnerability assessment, you learned that cloud administrators leave Google Cloud CLI sessions open for days. You need to reduce the risk of attackers who might exploit these open sessions by setting these sessions to the minimum duration.
What should you do?
- A . Set the session duration for the Google session control to one hour.
- B . Set the reauthentication frequency (or the Google Cloud Session Control to one hour.
- C . Set the organization policy constraint constraints/iam.allowServiceAccountCredentialLifetimeExtension to one hour.
- D . Set the organization policy constraint constraints/iam. serviceAccountKeyExpiryHours to one hour and inheritFromParent to false.
Your company has deployed an application on Compute Engine. The application is accessible by clients on port 587. You need to balance the load between the different instances running the application. The connection should be secured using TLS, and terminated by the Load Balancer.
What type of Load Balancing should you use?
- A . Network Load Balancing
- B . HTTP(S) Load Balancing
- C . TCP Proxy Load Balancing
- D . SSL Proxy Load Balancing
D
Explanation:
https://cloud.google.com/load-balancing/docs/ssl – SSL Proxy Load Balancing is a reverse proxy load balancer that distributes SSL traffic coming from the internet to virtual machine (VM) instances in your Google Cloud VPC network.
Reference: https://cloud.google.com/load-balancing/docs/ssl/
An organization is starting to move its infrastructure from its on-premises environment to Google Cloud Platform (GCP). The first step the organization wants to take is to migrate its ongoing data backup and disaster recovery solutions to GCP. The organization’s on-premises production environment is going to be the next phase for migration to GCP. Stable networking connectivity between the on-premises environment and GCP is also being implemented.
Which GCP solution should the organization use?
- A . BigQuery using a data pipeline job with continuous updates via Cloud VPN
- B . Cloud Storage using a scheduled task and gsutil via Cloud Interconnect
- C . Compute Engines Virtual Machines using Persistent Disk via Cloud Interconnect
- D . Cloud Datastore using regularly scheduled batch upload jobs via Cloud VPN
B
Explanation:
https://cloud.google.com/solutions/dr-scenarios-for-data#production_environment_is_on-premises https://medium.com/@pvergadia/cold-disaster-recovery-on-google-cloud-for-applications-running-on-premises-114b31933d02
Your organization wants to be continuously evaluated against CIS Google Cloud Computing Foundations Benchmark v1 3 0 (CIS Google Cloud Foundation 1 3). Some of the controls are irrelevant to your organization and must be disregarded in evaluation. You need to create an automated system or process to ensure that only the relevant controls are evaluated.
What should you do?
- A . Mark all security findings that are irrelevant with a tag and a value that indicates a security exception Select all marked findings and mute them on the console every time they appear Activate Security Command Center (SCC) Premium.
- B . Activate Security Command Center (SCC) Premium Create a rule to mute the security findings in SCC so they are not evaluated.
- C . Download all findings from Security Command Center (SCC) to a CSV file Mark the findings that are part of CIS Google Cloud Foundation 1 3 in the file Ignore the entries that are irrelevant and out of scope for the company.
- D . Ask an external audit company to provide independent reports including needed CIS benchmarks.
In the scope of the audit clarify that some of the controls are not needed and must be disregarded.
Your organization wants to be continuously evaluated against CIS Google Cloud Computing Foundations Benchmark v1 3 0 (CIS Google Cloud Foundation 1 3). Some of the controls are irrelevant to your organization and must be disregarded in evaluation. You need to create an automated system or process to ensure that only the relevant controls are evaluated.
What should you do?
- A . Mark all security findings that are irrelevant with a tag and a value that indicates a security exception Select all marked findings and mute them on the console every time they appear Activate Security Command Center (SCC) Premium.
- B . Activate Security Command Center (SCC) Premium Create a rule to mute the security findings in SCC so they are not evaluated.
- C . Download all findings from Security Command Center (SCC) to a CSV file Mark the findings that are part of CIS Google Cloud Foundation 1 3 in the file Ignore the entries that are irrelevant and out of scope for the company.
- D . Ask an external audit company to provide independent reports including needed CIS benchmarks.
In the scope of the audit clarify that some of the controls are not needed and must be disregarded.
Your organization wants to be continuously evaluated against CIS Google Cloud Computing Foundations Benchmark v1 3 0 (CIS Google Cloud Foundation 1 3). Some of the controls are irrelevant to your organization and must be disregarded in evaluation. You need to create an automated system or process to ensure that only the relevant controls are evaluated.
What should you do?
- A . Mark all security findings that are irrelevant with a tag and a value that indicates a security exception Select all marked findings and mute them on the console every time they appear Activate Security Command Center (SCC) Premium.
- B . Activate Security Command Center (SCC) Premium Create a rule to mute the security findings in SCC so they are not evaluated.
- C . Download all findings from Security Command Center (SCC) to a CSV file Mark the findings that are part of CIS Google Cloud Foundation 1 3 in the file Ignore the entries that are irrelevant and out of scope for the company.
- D . Ask an external audit company to provide independent reports including needed CIS benchmarks.
In the scope of the audit clarify that some of the controls are not needed and must be disregarded.
Your organization wants to be continuously evaluated against CIS Google Cloud Computing Foundations Benchmark v1 3 0 (CIS Google Cloud Foundation 1 3). Some of the controls are irrelevant to your organization and must be disregarded in evaluation. You need to create an automated system or process to ensure that only the relevant controls are evaluated.
What should you do?
- A . Mark all security findings that are irrelevant with a tag and a value that indicates a security exception Select all marked findings and mute them on the console every time they appear Activate Security Command Center (SCC) Premium.
- B . Activate Security Command Center (SCC) Premium Create a rule to mute the security findings in SCC so they are not evaluated.
- C . Download all findings from Security Command Center (SCC) to a CSV file Mark the findings that are part of CIS Google Cloud Foundation 1 3 in the file Ignore the entries that are irrelevant and out of scope for the company.
- D . Ask an external audit company to provide independent reports including needed CIS benchmarks.
In the scope of the audit clarify that some of the controls are not needed and must be disregarded.