Google Professional Cloud Security Engineer Practice Exams
Last updated on Oct 22,2026- Exam Code: Professional Cloud Security Engineer
- Exam Name: Google Cloud Certified - Professional Cloud Security Engineer
- Certification Provider: Google
- Latest update: Oct 22,2026
Your company’s chief information security officer (CISO) is requiring business data to be stored in specific locations due to regulatory requirements that affect the company’s global expansion plans.
After working on a plan to implement this requirement, you determine the following:
– The services in scope are included in the Google Cloud data residency requirements.
– The business data remains within specific locations under the same organization.
– The folder structure can contain multiple data residency locations.
– The projects are aligned to specific locations.
You plan to use the Resource Location Restriction organization policy constraint with very granular control.
At which level in the hierarchy should you set the constraint?
- A . Organization
- B . Resource
- C . Project
- D . Folder
Your company’s chief information security officer (CISO) is requiring business data to be stored in specific locations due to regulatory requirements that affect the company’s global expansion plans.
After working on a plan to implement this requirement, you determine the following:
– The services in scope are included in the Google Cloud data residency requirements.
– The business data remains within specific locations under the same organization.
– The folder structure can contain multiple data residency locations.
– The projects are aligned to specific locations.
You plan to use the Resource Location Restriction organization policy constraint with very granular control.
At which level in the hierarchy should you set the constraint?
- A . Organization
- B . Resource
- C . Project
- D . Folder
Your organization wants to be compliant with the General Data Protection Regulation (GDPR) on Google Cloud You must implement data residency and operational sovereignty in the EU.
What should you do? Choose 2 answers
- A . Limit the physical location of a new resource with the Organization Policy Service resource locations constraint."
- B . Use Cloud IDS to get east-west and north-south traffic visibility in the EU to monitor intra-VPC and mter-VPC communication.
- C . Limit Google personnel access based on predefined attributes such as their citizenship or geographic location by using Key Access Justifications
- D . Use identity federation to limit access to Google Cloud resources from non-EU entities.
- E . Use VPC Flow Logs to monitor intra-VPC and inter-VPC traffic in the EU.
A, C
Explanation:
https://cloud.google.com/architecture/framework/security/data-residency-sovereignty#manage_your_operational_sovereignty
You are part of a security team that wants to ensure that a Cloud Storage bucket in Project A can only be readable from Project B. You also want to ensure that data in the Cloud Storage bucket cannot be accessed from or copied to Cloud Storage buckets outside the network, even if the user has the correct credentials.
What should you do?
- A . Enable VPC Service Controls, create a perimeter with Project A and B, and include Cloud Storage service.
- B . Enable Domain Restricted Sharing Organization Policy and Bucket Policy Only on the Cloud Storage bucket.
- C . Enable Private Access in Project A and B networks with strict firewall rules to allow communication between the networks.
- D . Enable VPC Peering between Project A and B networks with strict firewall rules to allow communication between the networks.
A
Explanation:
https://cloud.google.com/vpc-service-controls/docs/overview#isolate
Your company is storing sensitive data in Cloud Storage. You want a key generated on-premises to be used in the encryption process.
What should you do?
- A . Use the Cloud Key Management Service to manage a data encryption key (DEK).
- B . Use the Cloud Key Management Service to manage a key encryption key (KEK).
- C . Use customer-supplied encryption keys to manage the data encryption key (DEK).
- D . Use customer-supplied encryption keys to manage the key encryption key (KEK).
C
Explanation:
This is a Customer-supplied encryption keys (CSEK). We generate our own encryption key and manage it on-premises. A KEK never leaves Cloud KMS. There is no KEK or KMS on-premises. Encryption at rest by default, with various key management options https://cloud.google.com/security/encryption-at-rest
Reference: https://cloud.google.com/security/encryption-at-rest/default-encryption/
You are asked to recommend a solution to store and retrieve sensitive configuration data from an application that runs on Compute Engine.
Which option should you recommend?
- A . Cloud Key Management Service
- B . Compute Engine guest attributes
- C . Compute Engine custom metadata
- D . Secret Manager
D
Explanation:
Secret Manager is a secure and convenient storage system for API keys, passwords, certificates, and other sensitive data. Secret Manager provides a central place and single source of truth to manage, access, and audit secrets across Google Cloud. https://cloud.google.com/secret-manager
You are tasked with exporting and auditing security logs for login activity events for Google Cloud console and API calls that modify configurations to Google Cloud resources.
Your export must meet the following requirements:
– Export related logs for all projects in the Google Cloud organization.
– Export logs in near real-time to an external SIEM.
What should you do? (Choose two.)
- A . Create a Log Sink at the organization level with a Pub/Sub destination.
- B . Create a Log Sink at the organization level with the includeChildren parameter, and set the destination to a Pub/Sub topic.
- C . Enable Data Access audit logs at the organization level to apply to all projects.
- D . Enable Google Workspace audit logs to be shared with Google Cloud in the Admin Console.
- E . Ensure that the SIEM processes the AuthenticationInfo field in the audit log entry to gather identity information.
BD
Explanation:
Reference: https://www.datadoghq.com/blog/monitoring-gcp-audit-logs/
"Google Workspace Login Audit: Login Audit logs track user sign-ins to your domain. These logs only record the login event. They don’t record which system was used to perform the login action." https://cloud.google.com/logging/docs/audit/gsuite-audit-logging#services
You are tasked with exporting and auditing security logs for login activity events for Google Cloud console and API calls that modify configurations to Google Cloud resources.
Your export must meet the following requirements:
– Export related logs for all projects in the Google Cloud organization.
– Export logs in near real-time to an external SIEM.
What should you do? (Choose two.)
- A . Create a Log Sink at the organization level with a Pub/Sub destination.
- B . Create a Log Sink at the organization level with the includeChildren parameter, and set the destination to a Pub/Sub topic.
- C . Enable Data Access audit logs at the organization level to apply to all projects.
- D . Enable Google Workspace audit logs to be shared with Google Cloud in the Admin Console.
- E . Ensure that the SIEM processes the AuthenticationInfo field in the audit log entry to gather identity information.
BD
Explanation:
Reference: https://www.datadoghq.com/blog/monitoring-gcp-audit-logs/
"Google Workspace Login Audit: Login Audit logs track user sign-ins to your domain. These logs only record the login event. They don’t record which system was used to perform the login action." https://cloud.google.com/logging/docs/audit/gsuite-audit-logging#services
You need to follow Google-recommended practices to leverage envelope encryption and encrypt data at the application layer.
What should you do?
- A . Generate a data encryption key (DEK) locally to encrypt the data, and generate a new key encryption key (KEK) in Cloud KMS to encrypt the DEK. Store both the encrypted data and the encrypted DEK.
- B . Generate a data encryption key (DEK) locally to encrypt the data, and generate a new key encryption key (KEK) in Cloud KMS to encrypt the DEK. Store both the encrypted data and the KEK.
- C . Generate a new data encryption key (DEK) in Cloud KMS to encrypt the data, and generate a key encryption key (KEK) locally to encrypt the key. Store both the encrypted data and the encrypted DEK.
- D . Generate a new data encryption key (DEK) in Cloud KMS to encrypt the data, and generate a key encryption key (KEK) locally to encrypt the key. Store both the encrypted data and the KEK.
A
Explanation:
Reference: https://cloud.google.com/kms/docs/envelope-encryption
Envelope Encryption: https://cloud.google.com/kms/docs/envelope-encryption
Here are best practices for managing DEKs:
-Generate DEKs locally.
-When stored, always ensure DEKs are encrypted at rest.
– For easy access, store the DEK near the data that it encrypts.
The DEK is encrypted (also known as wrapped) by a key encryption key (KEK). The process of
encrypting a key with another key is known as envelope encryption.
Here are best practices for managing KEKs:
-Store KEKs centrally. (KMS )
-Set the granularity of the DEKs they encrypt based on their use case. For example, consider a workload that requires multiple DEKs to encrypt the workload’s data chunks. You could use a single KEK to wrap all DEKs that are responsible for that workload’s encryption. -Rotate keys regularly, and also after a suspected incident.
You need to follow Google-recommended practices to leverage envelope encryption and encrypt data at the application layer.
What should you do?
- A . Generate a data encryption key (DEK) locally to encrypt the data, and generate a new key encryption key (KEK) in Cloud KMS to encrypt the DEK. Store both the encrypted data and the encrypted DEK.
- B . Generate a data encryption key (DEK) locally to encrypt the data, and generate a new key encryption key (KEK) in Cloud KMS to encrypt the DEK. Store both the encrypted data and the KEK.
- C . Generate a new data encryption key (DEK) in Cloud KMS to encrypt the data, and generate a key encryption key (KEK) locally to encrypt the key. Store both the encrypted data and the encrypted DEK.
- D . Generate a new data encryption key (DEK) in Cloud KMS to encrypt the data, and generate a key encryption key (KEK) locally to encrypt the key. Store both the encrypted data and the KEK.
A
Explanation:
Reference: https://cloud.google.com/kms/docs/envelope-encryption
Envelope Encryption: https://cloud.google.com/kms/docs/envelope-encryption
Here are best practices for managing DEKs:
-Generate DEKs locally.
-When stored, always ensure DEKs are encrypted at rest.
– For easy access, store the DEK near the data that it encrypts.
The DEK is encrypted (also known as wrapped) by a key encryption key (KEK). The process of
encrypting a key with another key is known as envelope encryption.
Here are best practices for managing KEKs:
-Store KEKs centrally. (KMS )
-Set the granularity of the DEKs they encrypt based on their use case. For example, consider a workload that requires multiple DEKs to encrypt the workload’s data chunks. You could use a single KEK to wrap all DEKs that are responsible for that workload’s encryption. -Rotate keys regularly, and also after a suspected incident.