Google Professional Cloud Security Engineer Practice Exams
Last updated on Oct 23,2026- Exam Code: Professional Cloud Security Engineer
- Exam Name: Google Cloud Certified - Professional Cloud Security Engineer
- Certification Provider: Google
- Latest update: Oct 23,2026
Your company’s new CEO recently sold two of the company’s divisions. Your Director asks you to help migrate the Google Cloud projects associated with those divisions to a new organization node.
Which preparation steps are necessary before this migration occurs? (Choose two.)
- A . Remove all project-level custom Identity and Access Management (1AM) roles.
- B . Disallow inheritance of organization policies.
- C . Identify inherited Identity and Access Management (1AM) roles on projects to be migrated.
- D . Create a new folder for all projects to be migrated.
- E . Remove the specific migration projects from any VPC Service Controls perimeters and bridges.
C
Explanation:
https://cloud.google.com/resource-manager/docs/project-migration#plan_policy
When you migrate your project, it will no longer inherit the policies from its current place in the resource hierarchy, and will be subject to the effective policy evaluation at its destination. We recommend making sure that the effective policies at the project’s destination match as much as possible the policies that the project had in its source location. https://cloud.google.com/resource-manager/docs/project-migration#import_export_folders
Policy inheritance can cause unintended effects when you are migrating a project, both in the source and destination organization resources. You can mitigate this risk by creating specific folders to hold only projects for export and import, and ensuring that the same policies are inherited by the folders in both organization resources. You can also set permissions on these folders that will be inherited to the projects moved within them, helping to accelerate the project migration process.
You need to set up a Cloud interconnect connection between your company’s on-premises data center and VPC host network. You want to make sure that on-premises applications can only access Google APIs over the Cloud Interconnect and not through the public internet. You are required to only use APIs that are supported by VPC Service Controls to mitigate against exfiltration risk to non-supported APIs.
How should you configure the network?
- A . Enable Private Google Access on the regional subnets and global dynamic routing mode.
- B . Set up a Private Service Connect endpoint IP address with the API bundle of "all-apis", which is advertised as a route over the Cloud interconnect connection.
- C . Use private.googleapis.com to access Google APIs using a set of IP addresses only routable from within Google Cloud, which are advertised as routes over the connection.
- D . Use restricted googleapis.com to access Google APIs using a set of IP addresses only routable from within Google Cloud, which are advertised as routes over the Cloud Interconnect connection.
D
Explanation:
https://cloud.google.com/vpc/docs/private-service-connect
An API bundle:
All APIs (all-apis): most Google APIs
(same as private.googleapis.com).
VPC-SC (vpc-sc): APIs that VPC Service Controls supports
(same as restricted.googleapis.com).
VMs in the same VPC network as the endpoint (all regions) On-premises systems that are connected to the VPC network that contains the endpoint
Which type of load balancer should you use to maintain client IP by default while using the standard network tier?
- A . SSL Proxy
- B . TCP Proxy
- C . Internal TCP/UDP
- D . TCP/UDP Network
D
Explanation:
https://cloud.google.com/load-balancing/docs/load-balancing-overview
https://cloud.google.com/load-balancing/docs/load-balancing-overview#choosing_a_load_balancer
A customer wants to move their sensitive workloads to a Compute Engine-based cluster using Managed Instance Groups (MIGs). The jobs are bursty and must be completed quickly. They have a requirement to be able to manage and rotate the encryption keys.
Which boot disk encryption solution should you use on the cluster to meet this customer’s requirements?
- A . Customer-supplied encryption keys (CSEK)
- B . Customer-managed encryption keys (CMEK) using Cloud Key Management Service (KMS)
- C . Encryption by default
- D . Pre-encrypting files before transferring to Google Cloud Platform (GCP) for analysis
B
Explanation:
Reference https://cloud.google.com/kubernetes-engine/docs/how-to/dynamic-provisioning-cmek
Which Identity-Aware Proxy role should you grant to an Identity and Access Management (IAM) user to access HTTPS resources?
- A . Security Reviewer
- B . lAP-Secured Tunnel User
- C . lAP-Secured Web App User
- D . Service Broker Operator
C
Explanation:
IAP-Secured Tunnel User: Grants access to tunnel resources that use IAP. IAP-Secured Web App User:
Access HTTPS resources which use Identity-Aware Proxy, Grants access to App Engine, Cloud Run, and Compute Engine resources.
https://cloud.google.com/iap/docs/managing-access#roles
Which Identity-Aware Proxy role should you grant to an Identity and Access Management (IAM) user to access HTTPS resources?
- A . Security Reviewer
- B . lAP-Secured Tunnel User
- C . lAP-Secured Web App User
- D . Service Broker Operator
C
Explanation:
IAP-Secured Tunnel User: Grants access to tunnel resources that use IAP. IAP-Secured Web App User:
Access HTTPS resources which use Identity-Aware Proxy, Grants access to App Engine, Cloud Run, and Compute Engine resources.
https://cloud.google.com/iap/docs/managing-access#roles
Your team uses a service account to authenticate data transfers from a given Compute Engine virtual machine instance of to a specified Cloud Storage bucket. An engineer accidentally deletes the service account, which breaks application functionality. You want to recover the application as quickly as possible without compromising security.
What should you do?
- A . Temporarily disable authentication on the Cloud Storage bucket.
- B . Use the undelete command to recover the deleted service account.
- C . Create a new service account with the same name as the deleted service account.
- D . Update the permissions of another existing service account and supply those credentials to the applications.
B
Explanation:
https://cloud.google.com/iam/docs/reference/rest/v1/projects.serviceAccounts/undelete
Reference: https://cloud.google.com/iam/docs/creating-managing-service-accounts#undeleting_a_service_account
Create an allow VPC firewall rule that specifies the target/source with respective service accounts.
Explanation:
https://cloud.google.com/vpc/docs/firewalls#service-accounts-vs-tags
https://cloud.google.com/vpc/docs/firewalls#service-accounts-vs-tags
A service account represents an identity associated with an instance. Only one service account can be associated with an instance. You control access to the service account by controlling the grant of the Service Account User role for other IAM principals. For an IAM principal to start an instance by using a service account, that principal must have the Service Account User role to at least use that service account and appropriate permissions to create instances (for example, having the Compute Engine Instance Admin role to the project).
You are consulting with a client that requires end-to-end encryption of application data (including data in transit, data in use, and data at rest) within Google Cloud.
Which options should you utilize to accomplish this? (Choose two.)
- A . External Key Manager
- B . Customer-supplied encryption keys
- C . Hardware Security Module
- D . Confidential Computing and Istio
- E . Client-side encryption
DE
Explanation:
Google Cloud customers with additional requirements for encryption of data over WAN can choose to implement further protections for data as it moves from a user to an application, or virtual machine to virtual machine. These protections include IPSec tunnels, Gmail S/MIME, managed SSL certificates, and Istio. https://cloud.google.com/docs/security/encryption-in-transit
You have been tasked with inspecting IP packet data for invalid or malicious content.
What should you do?
- A . Use Packet Mirroring to mirror traffic to and from particular VM instances. Perform inspection using security software that analyzes the mirrored traffic.
- B . Enable VPC Flow Logs for all subnets in the VPC. Perform inspection on the Flow Logs data using Cloud Logging.
- C . Configure the Fluentd agent on each VM Instance within the VPC. Perform inspection on the log data using Cloud Logging.
- D . Configure Google Cloud Armor access logs to perform inspection on the log data.
A
Explanation:
https://cloud.google.com/vpc/docs/packet-mirroring
Packet Mirroring clones the traffic of specified instances in your Virtual Private Cloud (VPC) network and forwards it for examination. Packet Mirroring captures all traffic and packet data, including payloads and headers.