Google Professional Cloud Security Engineer Practice Exams
Last updated on Oct 22,2026- Exam Code: Professional Cloud Security Engineer
- Exam Name: Google Cloud Certified - Professional Cloud Security Engineer
- Certification Provider: Google
- Latest update: Oct 22,2026
In a shared security responsibility model for IaaS, which two layers of the stack does the customer share responsibility for? (Choose two.)
- A . Hardware
- B . Network Security
- C . Storage Encryption
- D . Access Policies
- E . Boot
BD
Explanation:
https://cloud.google.com/blog/products/containers-kubernetes/exploring-container-security-the-shared-responsibility-model-in-gke-container-security-shared-responsibility-model-gke
A customer has 300 engineers. The company wants to grant different levels of access and efficiently manage IAM permissions between users in the development and production environment projects.
Which two steps should the company take to meet these requirements? (Choose two.)
- A . Create a project with multiple VPC networks for each environment.
- B . Create a folder for each development and production environment.
- C . Create a Google Group for the Engineering team, and assign permissions at the folder level.
- D . Create an Organizational Policy constraint for each folder environment.
- E . Create projects for each environment, and grant IAM rights to each engineering user.
You need to implement an encryption at-rest strategy that reduces key management complexity for non-sensitive data and protects sensitive data while providing the flexibility of controlling the key residency and rotation schedule. FIPS 140-2 L1 compliance is required for all data types.
What should you do?
- A . Encrypt non-sensitive data and sensitive data with Cloud External Key Manager.
- B . Encrypt non-sensitive data and sensitive data with Cloud Key Management Service
- C . Encrypt non-sensitive data with Google default encryption, and encrypt sensitive data with Cloud External Key Manager.
- D . Encrypt non-sensitive data with Google default encryption, and encrypt sensitive data with Cloud Key Management Service.
D
Explanation:
Google uses a common cryptographic library, Tink, which incorporates our FIPS 140-2 Level 1 validated module, Boring Crypto, to implement encryption consistently across almost all Google Cloud products. To provide flexibility of controlling the key residency and rotation schedule, use google provided key for non-sensitive and encrypt sensitive data with Cloud Key Management Service
Your organization has implemented synchronization and SAML federation between Cloud Identity and Microsoft Active Directory. You want to reduce the risk of Google Cloud user accounts being compromised.
What should you do?
- A . Create a Cloud Identity password policy with strong password settings, and configure 2-Step Verification with security keys in the Google Admin console.
- B . Create a Cloud Identity password policy with strong password settings, and configure 2-Step Verification with verification codes via text or phone call in the Google Admin console.
- C . Create an Active Directory domain password policy with strong password settings, and configure post-SSO (single sign-on) 2-Step Verification with security keys in the Google Admin console.
- D . Create an Active Directory domain password policy with strong password settings, and configure post-SSO (single sign-on) 2-Step Verification with verification codes via text or phone call in the Google Admin console.
C
Explanation:
Reference: https://cloud.google.com/architecture/identity/federating-gcp-with-active-directory-introduction
"We recommend against using text messages. The National Institute of Standards and Technology (NIST) no longer recommends SMS-based 2SV due to the hijacking risk from state-sponsored entities."
A company is using Google Kubernetes Engine (GKE) with container images of a mission-critical application The company wants to scan the images for known security issues and securely share the report with the security team without exposing them outside Google Cloud.
What should you do?
- A . 1. Enable Container Threat Detection in the Security Command Center Premium tier.
• 2. Upgrade all clusters that are not on a supported version of GKE to the latest possible GKE version.
• 3. View and share the results from the Security Command Center - B . • 1. Use an open source tool in Cloud Build to scan the images.
• 2. Upload reports to publicly accessible buckets in Cloud Storage by using gsutil
• 3. Share the scan report link with your security department. - C . • 1. Enable vulnerability scanning in the Artifact Registry settings.
• 2. Use Cloud Build to build the images
• 3. Push the images to the Artifact Registry for automatic scanning.
• 4. View the reports in the Artifact Registry. - D . • 1. Get a GitHub subscription.
• 2. Build the images in Cloud Build and store them in GitHub for automatic scanning
• 3. Download the report from GitHub and share with the Security Team
C
Explanation:
"The service evaluates all changes and remote access attempts to detect runtime attacks in near-real time." : https://cloud.google.com/security-command-center/docs/concepts-container-threat-detection-overview This has nothing to do with KNOWN security Vulns in images
In an effort for your company messaging app to comply with FIPS 140-2, a decision was made to use GCP compute and network services. The messaging app architecture includes a Managed Instance Group (MIG) that controls a cluster of Compute Engine instances. The instances use Local SSDs for data caching and UDP for instance-to-instance communications. The app development team is willing to make any changes necessary to comply with the standard
Which options should you recommend to meet the requirements?
- A . Encrypt all cache storage and VM-to-VM communication using the BoringCrypto module.
- B . Set Disk Encryption on the Instance Template used by the MIG to customer-managed key and use BoringSSL for all data transit between instances.
- C . Change the app instance-to-instance communications from UDP to TCP and enable BoringSSL on clients’ TLS connections.
- D . Set Disk Encryption on the Instance Template used by the MIG to Google-managed Key and use BoringSSL library on all instance-to-instance communications.
A
Explanation:
https://cloud.google.com/security/compliance/fips-140-2-validated
Google Cloud Platform uses a FIPS 140-2 validated encryption module called BoringCrypto (certificate 3318) in our production environment. This means that both data in transit to the customer and between data centers, and data at rest are encrypted using FIPS 140-2 validated encryption. The module that achieved FIPS 140-2 validation is part of our BoringSSL library.
An employer wants to track how bonus compensations have changed over time to identify employee outliers and correct earning disparities. This task must be performed without exposing the sensitive compensation data for any individual and must be reversible to identify the outlier.
Which Cloud Data Loss Prevention API technique should you use to accomplish this?
- A . Generalization
- B . Redaction
- C . CryptoHashConfig
- D . CryptoReplaceFfxFpeConfig
D
Explanation:
De-identifying sensitive data Cloud Data Loss Prevention (DLP) can de-identify sensitive data in text content, including text stored in container structures such as tables. De-identification is the process of removing identifying information from data. The API detects sensitive data such as personally identifiable information (PII), and then uses a de-identification transformation to mask, delete, or otherwise obscure the data. For example, de-identification techniques can include any of the following: Masking sensitive data by partially or fully replacing characters with a symbol, such as an asterisk (*) or hash (#). Replacing each instance of sensitive data with a token, or surrogate, string. Encrypting and replacing sensitive data using a randomly generated or pre-determined key. When you de-identify data using the CryptoReplaceFfxFpeConfig or CryptoDeterministicConfig infoType transformations, you can re-identify that data, as long as you have the CryptoKey used to originally de-identify the data. https://cloud.google.com/dlp/docs/deidentify-sensitive-data
Your team needs to make sure that their backend database can only be accessed by the frontend application and no other instances on the network.
How should your team design this network?
- A . Create an ingress firewall rule to allow access only from the application to the database using firewall tags.
- B . Create a different subnet for the frontend application and database to ensure network isolation.
- C . Create two VPC networks, and connect the two networks using Cloud VPN gateways to ensure network isolation.
- D . Create two VPC networks, and connect the two networks using VPC peering to ensure network isolation.
A
Explanation:
"However, even though it is possible to uses tags for target filtering in this manner, we recommend that you use service accounts where possible. Target tags are not access-controlled and can be changed by someone with the instance Admin role while VMs are in service. Service accounts are access-controlled, meaning that a specific user must be explicitly authorized to use a service account. There can only be one service account per instance, whereas there can be multiple tags. Also, service accounts assigned to a VM can only be changed when the VM is stopped"
You have noticed an increased number of phishing attacks across your enterprise user accounts. You want to implement the Google 2-Step Verification (2SV) option that uses a cryptographic signature to authenticate a user and verify the URL of the login page.
Which Google 2SV option should you use?
- A . Titan Security Keys
- B . Google prompt
- C . Google Authenticator app
- D . Cloud HSM keys
A
Explanation:
https://cloud.google.com/titan-security-key
Security keys use public key cryptography to verify a user’s identity and URL of the login page ensuring attackers can’t access your account even if you are tricked into providing your username and password.
Your organization is transitioning to Google Cloud You want to ensure that only trusted container images are deployed on Google Kubernetes Engine (GKE) clusters in a project. The containers must be deployed from a centrally managed. Container Registry and signed by a trusted authority.
What should you do?
Choose 2 answers
- A . Configure the Binary Authorization policy with respective attestations for the project.
- B . Create a custom organization policy constraint to enforce Binary Authorization for Google Kubernetes Engine (GKE).
- C . Enable Container Threat Detection in the Security Command Center (SCC) for the project.
- D . Configure the trusted image organization policy constraint for the project.
- E . Enable Pod Security standards and set them to Restricted.