Google Professional Cloud Security Engineer Practice Exams
Last updated on Oct 23,2026- Exam Code: Professional Cloud Security Engineer
- Exam Name: Google Cloud Certified - Professional Cloud Security Engineer
- Certification Provider: Google
- Latest update: Oct 23,2026
Which international compliance standard provides guidelines for information security controls applicable to the provision and use of cloud services?
- A . ISO 27001
- B . ISO 27002
- C . ISO 27017
- D . ISO 27018
C
Explanation:
Create a new Service Account that should be able to list the Compute Engine instances in the project.
You want to follow Google-recommended practices.
https://cloud.google.com/security/compliance/iso-27017
You are troubleshooting access denied errors between Compute Engine instances connected to a Shared VPC and BigQuery datasets. The datasets reside in a project protected by a VPC Service Controls perimeter.
What should you do?
- A . Add the host project containing the Shared VPC to the service perimeter.
- B . Add the service project where the Compute Engine instances reside to the service perimeter.
- C . Create a service perimeter between the service project where the Compute Engine instances reside and the host project that contains the Shared VPC.
- D . Create a perimeter bridge between the service project where the Compute Engine instances reside and the perimeter that contains the protected BigQuery datasets.
A
Explanation:
https://cloud.google.com/vpc-service-controls/docs/service-perimeters#secure-google-managed-resources
If you’re using Shared VPC, you must include the host project in a service perimeter along with any projects that belong to the Shared VPC.
Your organization is rolling out a new continuous integration and delivery (CI/CD) process to deploy infrastructure and applications in Google Cloud Many teams will use their own instances of the CI/CD workflow It will run on Google Kubernetes Engine (GKE) The CI/CD pipelines must be designed to securely access Google Cloud APIs
What should you do?
- A . • 1 Create a dedicated service account for the CI/CD pipelines
• 2 Run the deployment pipelines in a dedicated nodes pool in the GKE cluster
• 3 Use the service account that you created as identity for the nodes in the pool to authenticate to the Google Cloud APIs - B . • 1 Create service accounts for each deployment pipeline
• 2 Generate private keys for the service accounts
• 3 Securely store the private keys as Kubernetes secrets accessible only by the pods that run the specific deploy pipeline - C . * 1 Create individual service accounts (or each deployment pipeline
• 2 Add an identifier for the pipeline in the service account naming convention
• 3 Ensure each pipeline runs on dedicated pods
• 4 Use workload identity to map a deployment pipeline pod with a service account - D . • 1 Create two service accounts one for the infrastructure and one for the application deployment
• 2 Use workload identities to let the pods run the two pipelines and authenticate with the service accounts
• 3 Run the infrastructure and application pipelines in separate namespaces
A company is backing up application logs to a Cloud Storage bucket shared with both analysts and the administrator. Analysts should only have access to logs that do not contain any personally identifiable information (PII). Log files containing PII should be stored in another bucket that is only accessible by the administrator.
What should you do?
- A . Use Cloud Pub/Sub and Cloud Functions to trigger a Data Loss Prevention scan every time a file is uploaded to the shared bucket. If the scan detects PII, have the function move into a Cloud Storage bucket only accessible by the administrator.
- B . Upload the logs to both the shared bucket and the bucket only accessible by the administrator.
Create a job trigger using the Cloud Data Loss Prevention API. Configure the trigger to delete any files from the shared bucket that contain PII. - C . On the bucket shared with both the analysts and the administrator, configure Object Lifecycle Management to delete objects that contain any PII.
- D . On the bucket shared with both the analysts and the administrator, configure a Cloud Storage Trigger that is only triggered when PII data is uploaded. Use Cloud Functions to capture the trigger and delete such files.
A
Explanation:
https://codelabs.developers.google.com/codelabs/cloud-storage-dlp-functions#0 https://www.youtube.com/watch?v=0TmO1f-Ox40
Your organization uses BigQuery to process highly sensitive, structured datasets.
Following the "need to know" principle, you need to create the Identity and Access Management (IAM) design to meet the needs of these users:
• Business user must access curated reports.
• Data engineer: must administrate the data lifecycle in the platform.
• Security operator: must review user activity on the data platform.
What should you do?
- A . Configure data access log for BigQuery services, and grant Project Viewer role to security operators.
- B . Generate a CSV data file based on the business user’s needs, and send the data to their email addresses.
- C . Create curated tables in a separate dataset and assign the role roles/bigquery.dataViewer.
- D . Set row-based access control based on the "region" column, and filter the record from the United States for data engineers.
C
Explanation:
This option directly addresses the needs of the business user who must access curated reports. By creating curated tables in a separate dataset, you can control access to specific data. Assigning the roles/bigquery.dataViewer role allows the business user to view the data in BigQuery.
You want to make sure that your organization’s Cloud Storage buckets cannot have data publicly available to the internet. You want to enforce this across all Cloud Storage buckets.
What should you do?
- A . Remove Owner roles from end users, and configure Cloud Data Loss Prevention.
- B . Remove Owner roles from end users, and enforce domain restricted sharing in an organization policy.
- C . Configure uniform bucket-level access, and enforce domain restricted sharing in an organization policy.
- D . Remove *.setIamPolicy permissions from all roles, and enforce domain restricted sharing in an organization policy.
C
Explanation:
– Uniform bucket-level access: https://cloud.google.com/storage/docs/uniform-bucket-level-access#should-you-use
– Domain Restricted Sharing: https://cloud.google.com/resource-manager/docs/organization-policy/restricting-domains#public_data_sharing
You want to limit the images that can be used as the source for boot disks. These images will be stored in a dedicated project.
What should you do?
- A . Use the Organization Policy Service to create a compute.trustedimageProjects constraint on the organization level. List the trusted project as the whitelist in an allow operation.
- B . Use the Organization Policy Service to create a compute.trustedimageProjects constraint on the organization level. List the trusted projects as the exceptions in a deny operation.
- C . In Resource Manager, edit the project permissions for the trusted project. Add the organization as member with the role: Compute Image User.
- D . In Resource Manager, edit the organization permissions. Add the project ID as member with the role: Compute Image User.
A
Explanation:
https://cloud.google.com/compute/docs/images/restricting-image-access#trusted_images
Reference: https://cloud.google.com/compute/docs/images/restricting-image-access