Google Professional Cloud Security Engineer Practice Exams
Last updated on Oct 23,2026- Exam Code: Professional Cloud Security Engineer
- Exam Name: Google Cloud Certified - Professional Cloud Security Engineer
- Certification Provider: Google
- Latest update: Oct 23,2026
A customer deployed an application on Compute Engine that takes advantage of the elastic nature of cloud computing.
How can you work with Infrastructure Operations Engineers to best ensure that Windows Compute Engine VMs are up to date with all the latest OS patches?
- A . Build new base images when patches are available, and use a CI/CD pipeline to rebuild VMs, deploying incrementally.
- B . Federate a Domain Controller into Compute Engine, and roll out weekly patches via Group Policy Object.
- C . Use Deployment Manager to provision updated VMs into new serving Instance Groups (IGs).
- D . Reboot all VMs during the weekly maintenance window and allow the StartUp Script to download the latest patches from the internet.
A
Explanation:
Compute Engine doesn’t automatically update the OS or the software on your deployed instances. You will need to patch or update your deployed Compute Engine instances when necessary. However, in the cloud it is not recommended that you patch or update individual running instances. Instead it is best to patch the image that was used to launch the instance and then replace each affected instance with a new copy.
You will create a new Service Account that should be able to list the Compute Engine instances in the project. You want to follow Google-recommended practices.
What should you do?
- A . Create an Instance Template, and allow the Service Account Read Only access for the Compute Engine Access Scope.
- B . Create a custom role with the permission compute.instances.list and grant the Service Account this role.
- C . Give the Service Account the role of Compute Viewer, and use the new Service Account for all instances.
- D . Give the Service Account the role of Project Viewer, and use the new Service Account for all instances.
B
Explanation:
https://cloud.google.com/compute/docs/access/iam
A company is running workloads in a dedicated server room. They must only be accessed from within the private company network. You need to connect to these workloads from Compute Engine instances within a Google Cloud Platform project.
Which two approaches can you take to meet the requirements? (Choose two.)
- A . Configure the project with Cloud VPN.
- B . Configure the project with Shared VPC.
- C . Configure the project with Cloud Interconnect.
- D . Configure the project with VPC peering.
- E . Configure all Compute Engine instances with Private Access.
AC
Explanation:
A) IPsec VPN tunels: https://cloud.google.com/network-connectivity/docs/vpn/concepts/overview Interconnect https://cloud.google.com/network-connectivity/docs/interconnect/concepts/dedicated-overview
Reference: https://cloud.google.com/solutions/secure-data-workloads-use-cases
Your organization operates Virtual Machines (VMs) with only private IPs in the Virtual Private Cloud
(VPC) with internet access through Cloud NAT Everyday, you must patch all VMs with critical OS
updates and provide summary reports
What should you do?
- A . Validate that the egress firewall rules allow any outgoing traffic Log in to each VM and execute OS specific update commands Configure the Cloud Scheduler job to update with critical patches daily for daily updates.
- B . Ensure that VM Manager is installed and running on the VMs. In the OS patch management service. configure the patch jobs to update with critical patches daily.
- C . Assign public IPs to VMs. Validate that the egress firewall rules allow any outgoing traffic Log in to each VM. and configure a daily cron job to enable for OS updates at night during low activity periods.
- D . Copy the latest patches to the Cloud Storage bucket. Log in to each VM. download the patches from the bucket, and install them.
B
Explanation:
VM Manager is a suite of tools that can be used to manage operating systems for large virtual machine (VM) fleets running Windows and Linux on Compute Engine. It helps drive efficiency through automation and reduces the operational burden of maintaining these VM fleets. VM Manager includes several services such as OS patch management, OS inventory management, and OS configuration management. By using VM Manager, you can apply patches, collect operating system information, and install, remove, or auto-update software packages. The suite provides a high level of control and automation for managing large VM fleets on Google Cloud. https://cloud.google.com/compute/docs/vm-manager
A customer is collaborating with another company to build an application on Compute Engine. The customer is building the application tier in their GCP Organization, and the other company is building the storage tier in a different GCP Organization. This is a 3-tier web application. Communication between portions of the application must not traverse the public internet by any means.
Which connectivity option should be implemented?
- A . VPC peering
- B . Cloud VPN
- C . Cloud Interconnect
- D . Shared VPC
A
Explanation:
Peering two VPCs does permit traffic to flow between the two shared networks, but it’s only bi-directional. Peered VPC networks remain administratively separate.
You work for a large organization where each business unit has thousands of users. You need to delegate management of access control permissions to each business unit.
You have the following requirements:
– Each business unit manages access controls for their own projects.
– Each business unit manages access control permissions at scale.
– Business units cannot access other business units’ projects.
– Users lose their access if they move to a different business unit or leave the company.
– Users and access control permissions are managed by the on-premises directory service.
What should you do? (Choose two.)
- A . Use VPC Service Controls to create perimeters around each business unit’s project.
- B . Organize projects in folders, and assign permissions to Google groups at the folder level.
- C . Group business units based on Organization Units (OUs) and manage permissions based on OUs.
- D . Create a project naming convention, and use Google’s IAM Conditions to manage access based on the prefix of project names.
- E . Use Google Cloud Directory Sync to synchronize users and group memberships in Cloud Identity.
A customer needs an alternative to storing their plain text secrets in their source-code management (SCM) system.
How should the customer achieve this using Google Cloud Platform?
- A . Use Cloud Source Repositories, and store secrets in Cloud SQL.
- B . Encrypt the secrets with a Customer-Managed Encryption Key (CMEK), and store them in Cloud Storage.
- C . Run the Cloud Data Loss Prevention API to scan the secrets, and store them in Cloud SQL.
- D . Deploy the SCM to a Compute Engine VM with local SSDs, and enable preemptible VMs.
An organization’s security and risk management teams are concerned about where their responsibility lies for certain production workloads they are running in Google Cloud Platform (GCP), and where Google’s responsibility lies. They are mostly running workloads using Google Cloud’s Platform-as-a-Service (PaaS) offerings, including App Engine primarily.
Which one of these areas in the technology stack would they need to focus on as their primary responsibility when using App Engine?
- A . Configuring and monitoring VPC Flow Logs
- B . Defending against XSS and SQLi attacks
- C . Manage the latest updates and security patches for the Guest OS
- D . Encrypting all stored data
B
Explanation:
in PaaS the customer is responsible for web app security, deployment, usage, access policy, and content. https://cloud.google.com/architecture/framework/security/shared-responsibility-shared-fate
An organization’s security and risk management teams are concerned about where their responsibility lies for certain production workloads they are running in Google Cloud Platform (GCP), and where Google’s responsibility lies. They are mostly running workloads using Google Cloud’s Platform-as-a-Service (PaaS) offerings, including App Engine primarily.
Which one of these areas in the technology stack would they need to focus on as their primary responsibility when using App Engine?
- A . Configuring and monitoring VPC Flow Logs
- B . Defending against XSS and SQLi attacks
- C . Manage the latest updates and security patches for the Guest OS
- D . Encrypting all stored data
B
Explanation:
in PaaS the customer is responsible for web app security, deployment, usage, access policy, and content. https://cloud.google.com/architecture/framework/security/shared-responsibility-shared-fate
An organization’s security and risk management teams are concerned about where their responsibility lies for certain production workloads they are running in Google Cloud Platform (GCP), and where Google’s responsibility lies. They are mostly running workloads using Google Cloud’s Platform-as-a-Service (PaaS) offerings, including App Engine primarily.
Which one of these areas in the technology stack would they need to focus on as their primary responsibility when using App Engine?
- A . Configuring and monitoring VPC Flow Logs
- B . Defending against XSS and SQLi attacks
- C . Manage the latest updates and security patches for the Guest OS
- D . Encrypting all stored data
B
Explanation:
in PaaS the customer is responsible for web app security, deployment, usage, access policy, and content. https://cloud.google.com/architecture/framework/security/shared-responsibility-shared-fate