Google Professional Cloud Security Engineer Practice Exams
Last updated on Oct 22,2026- Exam Code: Professional Cloud Security Engineer
- Exam Name: Google Cloud Certified - Professional Cloud Security Engineer
- Certification Provider: Google
- Latest update: Oct 22,2026
Your customer has an on-premises Public Key Infrastructure (PKI) with a certificate authority (CA). You need to issue certificates for many HTTP load balancer frontends. The on-premises PKI should be minimally affected due to many manual processes, and the solution needs to scale.
What should you do?
- A . Use Certificate Manager to issue Google managed public certificates and configure it at HTTP the load balancers in your infrastructure as code (laC).
- B . Use Certificate Manager to import certificates issued from on-premises PKI and for the frontends. Leverage the gcloud tool for importing
- C . Use a subordinate CA in the Google Certificate Authority Service from the on-premises PKI system to issue certificates for the load balancers.
- D . Use the web applications with PKCS12 certificates issued from subordinate CA based on OpenSSL on-premises Use the gcloud tool for importing. Use the External TCP/UDP Network load balancer instead of an external HTTP Load Balancer.
C
Explanation:
This approach allows you to leverage your existing on-premises PKI infrastructure while minimizing its impact and manual processes. By creating a subordinate CA in Google’s Certificate Authority Service, you can automate the process of issuing certificates for your HTTP load balancer frontends. This solution scales well as the number of load balancers increases.
You manage a mission-critical workload for your organization, which is in a highly regulated industry The workload uses Compute Engine VMs to analyze and process the sensitive data after it is uploaded to Cloud Storage from the endpomt computers. Your compliance team has detected that this workload does not meet the data protection requirements for sensitive data.
You need to meet these requirements;
• Manage the data encryption key (DEK) outside the Google Cloud boundary.
• Maintain full control of encryption keys through a third-party provider.
• Encrypt the sensitive data before uploading it to Cloud Storage
• Decrypt the sensitive data during processing in the Compute Engine VMs
• Encrypt the sensitive data in memory while in use in the Compute Engine VMs
What should you do? Choose 2 answers
- A . Create a VPC Service Controls service perimeter across your existing Compute Engine VMs and Cloud Storage buckets
- B . Migrate the Compute Engine VMs to Confidential VMs to access the sensitive data.
- C . Configure Cloud External Key Manager to encrypt the sensitive data before it is uploaded to Cloud Storage and decrypt the sensitive data after it is downloaded into your VMs
- D . Create Confidential VMs to access the sensitive data.
- E . Configure Customer Managed Encryption Keys to encrypt the sensitive data before it is uploaded to Cloud Storage, and decrypt the sensitive data after it is downloaded into your VMs.
C, D
Explanation:
https://cloud.google.com/confidential-computing/confidential-vm/docs/creating-cvm-instance#considerations
Confidential VM does not support live migration. You can only enable Confidential Computing on a VM when you first create the instance. https://cloud.google.com/confidential-computing/confidential-vm/docs/creating-cvm-instance
Your team sets up a Shared VPC Network where project co-vpc-prod is the host project. Your team has configured the firewall rules, subnets, and VPN gateway on the host project. They need to enable Engineering Group A to attach a Compute Engine instance to only the 10.1.1.0/24 subnet.
What should your team grant to Engineering Group A to meet this requirement?
- A . Compute Network User Role at the host project level.
- B . Compute Network User Role at the subnet level.
- C . Compute Shared VPC Admin Role at the host project level.
- D . Compute Shared VPC Admin Role at the service project level.
B
Explanation:
https://cloud.google.com/vpc/docs/shared-vpc#svc_proj_admins
https://cloud.google.com/vpc/docs/shared-vpc#svc_proj_admins
Your organization develops software involved in many open source projects and is concerned about software supply chain threats You need to deliver provenance for the build to demonstrate the software is untampered.
What should you do?
- A . • 1. Generate Supply Chain Levels for Software Artifacts (SLSA) level 3 assurance by using Cloud Build.
• 2. View the build provenance in the Security insights side panel within the Google Cloud console. - B . • 1. Review the software process.
• 2. Generate private and public key pairs and use Pretty Good Privacy (PGP) protocols to sign the output software artifacts together with a file containing the address of your enterprise and point of contact.
• 3. Publish the PGP signed attestation to your public web page. - C . • 1, Publish the software code on GitHub as open source.
• 2. Establish a bug bounty program, and encourage the open source community to review, report, and fix the vulnerabilities. - D . • 1. Hire an external auditor to review and provide provenance
• 2. Define the scope and conditions.
• 3. Get support from the Security department or representative.
• 4. Publish the attestation to your public web page.
A
Explanation:
https://cloud.google.com/build/docs/securing-builds/view-build-provenance
You are working with a client that is concerned about control of their encryption keys for sensitive data. The client does not want to store encryption keys at rest in the same cloud service provider (CSP) as the data that the keys are encrypting.
Which Google Cloud encryption solutions should you recommend to this client? (Choose two.)
- A . Customer-supplied encryption keys.
- B . Google default encryption
- C . Secret Manager
- D . Cloud External Key Manager
- E . Customer-managed encryption keys
In Cloud KMS, grant your Google Cloud project access to use the key.
Explanation:
https://cloud.google.com/kms/docs/ekm#how_it_works
– First, you create or use an existing key in a supported external key management partner system. This key has a unique URI or key path.
– Next, you grant your Google Cloud project access to use the key, in the external key management partner system.
– In your Google Cloud project, you create a Cloud EKM key, using the URI or key path for the externally-managed key.
In Cloud KMS, grant your Google Cloud project access to use the key.
Explanation:
https://cloud.google.com/kms/docs/ekm#how_it_works
– First, you create or use an existing key in a supported external key management partner system. This key has a unique URI or key path.
– Next, you grant your Google Cloud project access to use the key, in the external key management partner system.
– In your Google Cloud project, you create a Cloud EKM key, using the URI or key path for the externally-managed key.
Which Google Cloud service should you use to enforce access control policies for applications and resources?
- A . Identity-Aware Proxy
- B . Cloud NAT
- C . Google Cloud Armor
- D . Shielded VMs
A
Explanation:
https://cloud.google.com/iap/docs/concepts-overview "Use IAP when you want to enforce access control policies for applications and resources."
Your organization uses Google Workspace Enterprise Edition tor authentication. You are concerned about employees leaving their laptops unattended for extended periods of time after authenticating into Google Cloud. You must prevent malicious people from using an employee’s unattended laptop to modify their environment.
What should you do?
- A . Create a policy that requires employees to not leave their sessions open for long durations.
- B . Review and disable unnecessary Google Cloud APIs.
- C . Require strong passwords and 2SV through a security token or Google authenticate.
- D . Set the session length timeout for Google Cloud services to a shorter duration.
Your organization uses Google Workspace Enterprise Edition tor authentication. You are concerned about employees leaving their laptops unattended for extended periods of time after authenticating into Google Cloud. You must prevent malicious people from using an employee’s unattended laptop to modify their environment.
What should you do?
- A . Create a policy that requires employees to not leave their sessions open for long durations.
- B . Review and disable unnecessary Google Cloud APIs.
- C . Require strong passwords and 2SV through a security token or Google authenticate.
- D . Set the session length timeout for Google Cloud services to a shorter duration.