Google Professional Cloud Security Engineer Practice Exams
Last updated on Oct 22,2026- Exam Code: Professional Cloud Security Engineer
- Exam Name: Google Cloud Certified - Professional Cloud Security Engineer
- Certification Provider: Google
- Latest update: Oct 22,2026
A customer deploys an application to App Engine and needs to check for Open Web Application Security Project (OWASP) vulnerabilities.
Which service should be used to accomplish this?
- A . Cloud Armor
- B . Google Cloud Audit Logs
- C . Cloud Security Scanner
- D . Forseti Security
C
Explanation:
Reference: https://cloud.google.com/security-scanner/
Web Security Scanner supports categories in the OWASP Top Ten, a document that ranks and provides remediation guidance for the top 10 most critical web application security risks, as determined by the Open Web Application Security Project (OWASP). https://cloud.google.com/security-command-center/docs/concepts-web-security-scanner-overview#detectors_and_compliance
Your team wants to make sure Compute Engine instances running in your production project do not have public IP addresses. The frontend application Compute Engine instances will require public IPs.
The product engineers have the Editor role to modify resources. Your team wants to enforce this requirement.
How should your team meet these requirements?
- A . Enable Private Access on the VPC network in the production project.
- B . Remove the Editor role and grant the Compute Admin IAM role to the engineers.
- C . Set up an organization policy to only permit public IPs for the front-end Compute Engine instances.
- D . Set up a VPC network with two subnets: one with public IPs and one without public IPs.
C
Explanation:
Reference:
https://cloud.google.com/compute/docs/ip-addresses/reserve-static-external-ip-address
https://cloud.google.com/resource-manager/docs/organization-policy/org-policy-constraints#constraints-for-specific-services
You are deploying regulated workloads on Google Cloud. The regulation has data residency and data access requirements. It also requires that support is provided from the same geographical location as
where the data resides.
What should you do?
- A . Enable Access Transparency Logging.
- B . Deploy resources only to regions permitted by data residency requirements
- C . Use Data Access logging and Access Transparency logging to confirm that no users are accessing data from another region.
- D . Deploy Assured Workloads.
D
Explanation:
Assured Workloads for Google Cloud allows you to deploy regulated workloads with data residency, access, and support requirements. It helps you configure your environment in a manner that aligns with specific compliance frameworks and standards.
A customer implements Cloud Identity-Aware Proxy for their ERP system hosted on Compute Engine. Their security team wants to add a security layer so that the ERP systems only accept traffic from Cloud Identity- Aware Proxy.
What should the customer do to meet these requirements?
- A . Make sure that the ERP system can validate the JWT assertion in the HTTP requests.
- B . Make sure that the ERP system can validate the identity headers in the HTTP requests.
- C . Make sure that the ERP system can validate the x-forwarded-for headers in the HTTP requests.
- D . Make sure that the ERP system can validate the user’s unique identifier headers in the HTTP requests.
A
Explanation:
Use Cryptographic Verification If there is a risk of IAP being turned off or bypassed, your app can check to make sure the identity information it receives is valid. This uses a third web request header added by IAP, called X-Goog-IAP-JWT-Assertion. The value of the header is a cryptographically signed object that also contains the user identity data. Your application can verify the digital signature and use the data provided in this object to be certain that it was provided by IAP without alteration.
A customer’s company has multiple business units. Each business unit operates independently, and each has their own engineering group. Your team wants visibility into all projects created within the company and wants to organize their Google Cloud Platform (GCP) projects based on different business units. Each business unit also requires separate sets of IAM permissions.
Which strategy should you use to meet these needs?
- A . Create an organization node, and assign folders for each business unit.
- B . Establish standalone projects for each business unit, using gmail.com accounts.
- C . Assign GCP resources in a project, with a label identifying which business unit owns the resource.
- D . Assign GCP resources in a VPC for each business unit to separate network access.
A
Explanation:
Refer to: https://cloud.google.com/resource-manager/docs/listing-all-resources
Also: https://wideops.com/mapping-your-organization-with-the-google-cloud-platform-resource-hierarchy/
You are using Security Command Center (SCC) to protect your workloads and receive alerts for suspected security breaches at your company. You need to detect cryptocurrency mining software.
Which SCC service should you use?
- A . Container Threat Detection
- B . Web Security Scanner
- C . Rapid Vulnerability Detection
- D . Virtual Machine Threat Detection
Your organization hosts a financial services application running on Compute Engine instances for a third-party company. The third-party company’s servers that will consume the application also run on Compute Engine in a separate Google Cloud organization. You need to configure a secure network connection between the Compute Engine instances. You have the following requirements: The network connection must be encrypted.
The communication between servers must be over private IP addresses.
What should you do?
- A . Configure a Cloud VPN connection between your organization’s VPC network and the third party’s that is controlled by VPC firewall rules.
- B . Configure a VPC peering connection between your organization’s VPC network and the third party’s that is controlled by VPC firewall rules.
- C . Configure a VPC Service Controls perimeter around your Compute Engine instances, and provide access to the third party via an access level.
- D . Configure an Apigee proxy that exposes your Compute Engine-hosted application as an API, and is encrypted with TLS which allows access only to the third party.
B
Explanation:
Google encrypts and authenticates data in transit at one or more network layers when data moves outside physical boundaries not controlled by Google or on behalf of Google. All VM-to-VM traffic within a VPC network and peered VPC networks is encrypted. https://cloud.google.com/docs/security/encryption-in-transit#cio-level_summary
You are the security admin of your company. You have 3,000 objects in your Cloud Storage bucket. You do not want to manage access to each object individually. You also do not want the uploader of an object to always have full control of the object. However, you want to use Cloud Audit Logs to manage access to your bucket.
What should you do?
- A . Set up an ACL with OWNER permission to a scope of allUsers.
- B . Set up an ACL with READER permission to a scope of allUsers.
- C . Set up a default bucket ACL and manage access for users using IAM.
- D . Set up Uniform bucket-level access on the Cloud Storage bucket and manage access for users using IAM.
D
Explanation:
https://cloud.google.com/storage/docs/uniform-bucket-level-access#enabled
Reference: https://cloud.google.com/storage/docs/access-control/lists
You are the security admin of your company. You have 3,000 objects in your Cloud Storage bucket. You do not want to manage access to each object individually. You also do not want the uploader of an object to always have full control of the object. However, you want to use Cloud Audit Logs to manage access to your bucket.
What should you do?
- A . Set up an ACL with OWNER permission to a scope of allUsers.
- B . Set up an ACL with READER permission to a scope of allUsers.
- C . Set up a default bucket ACL and manage access for users using IAM.
- D . Set up Uniform bucket-level access on the Cloud Storage bucket and manage access for users using IAM.
D
Explanation:
https://cloud.google.com/storage/docs/uniform-bucket-level-access#enabled
Reference: https://cloud.google.com/storage/docs/access-control/lists
You are on your company’s development team. You noticed that your web application hosted in staging on GKE dynamically includes user data in web pages without first properly validating the inputted data. This could allow an attacker to execute gibberish commands and display arbitrary content in a victim user’s browser in a production environment.
How should you prevent and fix this vulnerability?
- A . Use Cloud IAP based on IP address or end-user device attributes to prevent and fix the vulnerability.
- B . Set up an HTTPS load balancer, and then use Cloud Armor for the production environment to prevent the potential XSS attack.
- C . Use Web Security Scanner to validate the usage of an outdated library in the code, and then use a secured version of the included library.
- D . Use Web Security Scanner in staging to simulate an XSS injection attack, and then use a templating system that supports contextual auto-escaping.
D
Explanation:
There is mention about simulating in Web Security Scanner. "Web Security Scanner cross-site scripting (XSS) injection testing *simulates* an injection attack by inserting a benign test string into user-editable fields and then performing various user actions." https://cloud.google.com/security-command-center/docs/how-to-remediate-web-security-scanner-findings#xss
Reference: https://cloud.google.com/security-scanner/docs/remediate-findings