Google Professional Cloud Security Engineer Practice Exams
Last updated on Oct 22,2026- Exam Code: Professional Cloud Security Engineer
- Exam Name: Google Cloud Certified - Professional Cloud Security Engineer
- Certification Provider: Google
- Latest update: Oct 22,2026
You manage your organization’s Security Operations Center (SOC). You currently monitor and detect network traffic anomalies in your Google Cloud VPCs based on packet header information. However, you want the capability to explore network flows and their payload to aid investigations.
Which Google Cloud product should you use?
- A . Marketplace IDS
- B . VPC Flow Logs
- C . VPC Service Controls logs
- D . Packet Mirroring
- E . Google Cloud Armor Deep Packet Inspection
D
Explanation:
Reference: https://aws.amazon.com/blogs/aws/new-vpc-traffic-mirroring/
Packet Mirroring clones the traffic of specified instances in your Virtual Private Cloud (VPC) network and forwards it for examination. Packet Mirroring captures all traffic and packet data, including payloads and headers. https://cloud.google.com/vpc/docs/packet-mirroring
Your organization recently deployed a new application on Google Kubernetes Engine. You need to deploy a solution to protect the application.
The solution has the following requirements:
– Scans must run at least once per week
– Must be able to detect cross-site scripting vulnerabilities
– Must be able to authenticate using Google accounts
Which solution should you use?
- A . Google Cloud Armor
- B . Web Security Scanner
- C . Security Health Analytics
- D . Container Threat Detection
B
Explanation:
Reference: https://cloud.google.com/security-command-center/docs/concepts-web-security-scanner-overview
Web Security Scanner identifies security vulnerabilities in your App Engine, Google Kubernetes Engine (GKE), and Compute Engine web applications. https://cloud.google.com/security-command-center/docs/concepts-web-security-scanner-overview
A customer needs to prevent attackers from hijacking their domain/IP and redirecting users to a malicious site through a man-in-the-middle attack.
Which solution should this customer use?
- A . VPC Flow Logs
- B . Cloud Armor
- C . DNS Security Extensions
- D . Cloud Identity-Aware Proxy
C
Explanation:
Reference: https://cloud.google.com/blog/products/gcp/dnssec-now-available-in-cloud-dns
DNSSEC ― use a DNS registrar that supports DNSSEC, and enable it. DNSSEC digitally signs DNS communication, making it more difficult (but not impossible) for hackers to intercept and spoof. Domain Name System Security Extensions (DNSSEC) adds security to the Domain Name System (DNS) protocol by enabling DNS responses to be validated. Having a trustworthy Domain Name System (DNS) that translates a domain name like www.example.com into its associated IP address is an increasingly important building block of today’s web-based applications. Attackers can hijack this process of domain/IP lookup and redirect users to a malicious site through DNS hijacking and man-in-the-middle attacks. DNSSEC helps mitigate the risk of such attacks by cryptographically signing DNS records. As a result, it prevents attackers from issuing fake DNS responses that may misdirect browsers to nefarious websites. https://cloud.google.com/blog/products/gcp/dnssec-now-available-in-cloud-dns
While migrating your organization’s infrastructure to GCP, a large number of users will need to access GCP Console. The Identity Management team already has a well-established way to manage your users and want to keep using your existing Active Directory or LDAP server along with the existing SSO password.
What should you do?
- A . Manually synchronize the data in Google domain with your existing Active Directory or LDAP server.
- B . Use Google Cloud Directory Sync to synchronize the data in Google domain with your existing Active Directory or LDAP server.
- C . Users sign in directly to the GCP Console using the credentials from your on-premises Kerberos compliant identity provider.
- D . Users sign in using OpenID (OIDC) compatible IdP, receive an authentication token, then use that token to log in to the GCP Console.
B
Explanation:
https://cloud.google.com/architecture/identity/federating-gcp-with-active-directory-configuring-single-sign-on
Reference: https://cloud.google.com/blog/products/identity-security/using-your-existing-identity-management-system-with-google-cloud-platform
In order to meet PCI DSS requirements, a customer wants to ensure that all outbound traffic is authorized.
Which two cloud offerings meet this requirement without additional compensating controls? (Choose two.)
- A . App Engine
- B . Cloud Functions
- C . Compute Engine
- D . Google Kubernetes Engine
- E . Cloud Storage
CD
Explanation:
App Engine ingress firewall rules are available, but egress rules are not currently available. Per requirements 1.2.1 and 1.3.4, you must ensure that all outbound traffic is authorized. SAQ A-EP and SAQ DCtype merchants must provide compensating controls or use a different Google Cloud product. Compute Engine and GKE are the preferred alternatives. https://cloud.google.com/solutions/pci-dss-compliance-in-gcp
You have a highly sensitive BigQuery workload that contains personally identifiable information (Pll) that you want to ensure is not accessible from the internet. To prevent data exfiltration only requests from authorized IP addresses are allowed to query your BigQuery tables.
What should you do?
- A . Use service perimeter and create an access level based on the authorized source IP address as the condition.
- B . Use Google Cloud Armor security policies defining an allowlist of authorized IP addresses at the global HTTPS load balancer.
- C . Use the Restrict allowed Google Cloud APIs and services organization policy constraint along with Cloud Data Loss Prevention (DLP).
- D . Use the Restrict Resource service usage organization policy constraint along with Cloud Data Loss Prevention (DLP).
A customer has an analytics workload running on Compute Engine that should have limited internet access.
Your team created an egress firewall rule to deny (priority 1000) all traffic to the internet.
The Compute Engine instances now need to reach out to the public repository to get security updates.
What should your team do?
- A . Create an egress firewall rule to allow traffic to the CIDR range of the repository with a priority greater than 1000.
- B . Create an egress firewall rule to allow traffic to the CIDR range of the repository with a priority less than 1000.
- C . Create an egress firewall rule to allow traffic to the hostname of the repository with a priority greater than 1000.
- D . Create an egress firewall rule to allow traffic to the hostname of the repository with a priority less than 1000.
B
Explanation:
https://cloud.google.com/vpc/docs/firewalls#priority_order_for_firewall_rules
Your Google Cloud organization allows for administrative capabilities to be distributed to each team through provision of a Google Cloud project with Owner role (roles/ owner). The organization contains thousands of Google Cloud Projects Security Command Center Premium has surfaced multiple cpen_myscl_port findings. You are enforcing the guardrails and need to prevent these types of common misconfigurations.
What should you do?
- A . Create a firewall rule for each virtual private cloud (VPC) to deny traffic from 0 0 0 0/0 with priority 0.
- B . Create a hierarchical firewall policy configured at the organization to deny all connections from 0 0 0 0/0.
- C . Create a Google Cloud Armor security policy to deny traffic from 0 0 0 0/0.
- D . Create a hierarchical firewall policy configured at the organization to allow connections only from internal IP ranges
Your Google Cloud organization allows for administrative capabilities to be distributed to each team through provision of a Google Cloud project with Owner role (roles/ owner). The organization contains thousands of Google Cloud Projects Security Command Center Premium has surfaced multiple cpen_myscl_port findings. You are enforcing the guardrails and need to prevent these types of common misconfigurations.
What should you do?
- A . Create a firewall rule for each virtual private cloud (VPC) to deny traffic from 0 0 0 0/0 with priority 0.
- B . Create a hierarchical firewall policy configured at the organization to deny all connections from 0 0 0 0/0.
- C . Create a Google Cloud Armor security policy to deny traffic from 0 0 0 0/0.
- D . Create a hierarchical firewall policy configured at the organization to allow connections only from internal IP ranges
Install external packages from the internet onto the VM.
Your security team just enabled the organizational policy. consrraints/compure.vnExtemallpAccess. to restrict the usage of public IP Addresses on VMs. In response your DevOps team updated their scripts to remove public IP addresses on the Compute Engine VMs however the build pipeline is failing due to connectivity issues.
What should you do? Choose 2 answers
- A . Provision a Cloud NAT instance in the same VPC and region as the Compute Engine VM
- B . Provision an HTTP load balancer with the VM in an unmanaged instance group to allow inbound connections from the internet to your VM.
- C . Update the VPC routes to allow traffic to and from the internet.
- D . Provision a Cloud VPN tunnel in the same VPC and region as the Compute Engine VM.
- E . Enable Private Google Access on the subnet that the Compute Engine VM is deployed within.