Google Professional Cloud Security Engineer Practice Exams
Last updated on Oct 22,2026- Exam Code: Professional Cloud Security Engineer
- Exam Name: Google Cloud Certified - Professional Cloud Security Engineer
- Certification Provider: Google
- Latest update: Oct 22,2026
Your team needs to configure their Google Cloud Platform (GCP) environment so they can centralize the control over networking resources like firewall rules, subnets, and routes. They also have an on-premises environment where resources need access back to the GCP resources through a private VPN connection. The networking resources will need to be controlled by the network security team.
Which type of networking design should your team use to meet these requirements?
- A . Shared VPC Network with a host project and service projects
- B . Grant Compute Admin role to the networking team for each engineering project
- C . VPC peering between all engineering projects using a hub and spoke model
- D . Cloud VPN Gateway between all engineering projects using a hub and spoke model
A
Explanation:
Reference: https://cloud.google.com/docs/enterprise/best-practices-for-enterprise-organizations#centralize_network_control
Use Shared VPC to connect to a common VPC network. Resources in those projects can communicate with each other securely and efficiently across project boundaries using internal IPs. You can manage shared network resources, such as subnets, routes, and firewalls, from a central host project, enabling you to apply and enforce consistent network policies across the projects.
A company’s application is deployed with a user-managed Service Account key. You want to use Google- recommended practices to rotate the key.
What should you do?
- A . Open Cloud Shell and run gcloud iam service-accounts enable-auto-rotate –iam-account=IAM_ACCOUNT.
- B . Open Cloud Shell and run gcloud iam service-accounts keys rotate –iam- account=IAM_ACCOUNT –key=NEW_KEY.
- C . Create a new key, and use the new key in the application. Delete the old key from the Service Account.
- D . Create a new key, and use the new key in the application. Store the old key on the system as a backup key.
C
Explanation:
You can rotate a key by creating a new key, updating applications to use the new key, and deleting the old key. Use the serviceAccount.keys.create() method and serviceAccount.keys.delete() method together to automate the rotation.
Reference: https://cloud.google.com/iam/docs/understanding-service-accounts
You manage a fleet of virtual machines (VMs) in your organization. You have encountered issues with
lack of patching in many VMs. You need to automate regular patching in your VMs and view the
patch management data across multiple projects.
What should you do? Choose 2 answers
- A . Deploy patches with VM Manager by using OS patch management
- B . View patch management data in VM Manager by using OS patch management.
- C . Deploy patches with Security Command Center by using Rapid Vulnerability Detection.
- D . View patch management data in a Security Command Center dashboard.
- E . View patch management data in Artifact Registry.
A, B
Explanation:
https://cloud.google.com/compute/docs/os-patch-management
Your company runs a website that will store PII on Google Cloud Platform. To comply with data privacy regulations, this data can only be stored for a specific amount of time and must be fully deleted after this specific period. Data that has not yet reached the time period should not be deleted. You want to automate the process of complying with this regulation.
What should you do?
- A . Store the data in a single Persistent Disk, and delete the disk at expiration time.
- B . Store the data in a single BigQuery table and set the appropriate table expiration time.
- C . Store the data in a Cloud Storage bucket, and configure the bucket’s Object Lifecycle Management feature.
- D . Store the data in a single BigTable table and set an expiration time on the column families.
C
Explanation:
"To support common use cases like setting a Time to Live (TTL) for objects, retaining noncurrent versions of objects, or "downgrading" storage classes of objects to help manage costs, Cloud Storage offers the Object Lifecycle Management feature. This page describes the feature as well as the options available when using it. To learn how to enable Object Lifecycle Management, and for examples of lifecycle policies, see Managing Lifecycles." https://cloud.google.com/storage/docs/lifecycle
You are a consultant for an organization that is considering migrating their data from its private cloud to Google Cloud. The organization’s compliance team is not familiar with Google Cloud and needs guidance on how compliance requirements will be met on Google Cloud. One specific compliance requirement is for customer data at rest to reside within specific geographic boundaries.
Which option should you recommend for the organization to meet their data residency requirements on Google Cloud?
- A . Organization Policy Service constraints
- B . Shielded VM instances
- C . Access control lists
- D . Geolocation access controls
- E . Google Cloud Armor
A
Explanation:
https://cloud.google.com/resource-manager/docs/organization-policy/using-constraints#list-constraint
You are a consultant for an organization that is considering migrating their data from its private cloud to Google Cloud. The organization’s compliance team is not familiar with Google Cloud and needs guidance on how compliance requirements will be met on Google Cloud. One specific compliance requirement is for customer data at rest to reside within specific geographic boundaries.
Which option should you recommend for the organization to meet their data residency requirements on Google Cloud?
- A . Organization Policy Service constraints
- B . Shielded VM instances
- C . Access control lists
- D . Geolocation access controls
- E . Google Cloud Armor
A
Explanation:
https://cloud.google.com/resource-manager/docs/organization-policy/using-constraints#list-constraint
Your organization is moving virtual machines (VMs) to Google Cloud. You must ensure that operating system images that are used across your projects are trusted and meet your security requirements.
What should you do?
- A . Implement an organization policy to enforce that boot disks can only be created from images that come from the trusted image project.
- B . Create a Cloud Function that is automatically triggered when a new virtual machine is created from the trusted image repository Verify that the image is not deprecated.
- C . Implement an organization policy constraint that enables the Shielded VM service on all projects to enforce the trusted image repository usage.
- D . Automate a security scanner that verifies that no common vulnerabilities and exposures (CVEs) are present in your trusted image repository.
An engineering team is launching a web application that will be public on the internet. The web application is hosted in multiple GCP regions and will be directed to the respective backend based on the URL request.
Your team wants to avoid exposing the application directly on the internet and wants to deny traffic from a specific list of malicious IP addresses
Which solution should your team implement to meet these requirements?
- A . Cloud Armor
- B . Network Load Balancing
- C . SSL Proxy Load Balancing
- D . NAT Gateway
A
Explanation:
https://cloud.google.com/armor/docs/security-policy-overview#edge-security
Reference: https://cloud.google.com/armor/docs/security-policy-concepts
An engineering team is launching a web application that will be public on the internet. The web application is hosted in multiple GCP regions and will be directed to the respective backend based on the URL request.
Your team wants to avoid exposing the application directly on the internet and wants to deny traffic from a specific list of malicious IP addresses
Which solution should your team implement to meet these requirements?
- A . Cloud Armor
- B . Network Load Balancing
- C . SSL Proxy Load Balancing
- D . NAT Gateway
A
Explanation:
https://cloud.google.com/armor/docs/security-policy-overview#edge-security
Reference: https://cloud.google.com/armor/docs/security-policy-concepts
In a shared security responsibility model for IaaS, which two layers of the stack does the customer share responsibility for? (Choose two.)
- A . Hardware
- B . Network Security
- C . Storage Encryption
- D . Access Policies
- E . Boot
BD
Explanation:
https://cloud.google.com/blog/products/containers-kubernetes/exploring-container-security-the-shared-responsibility-model-in-gke-container-security-shared-responsibility-model-gke