Google Professional-Cloud-Security-Engineer Exam Dumps

Google Cloud Certified - Professional Cloud Security Engineer

942 Reviews

Exam Code	Professional-Cloud-Security-Engineer
Exam Name	Google Cloud Certified - Professional Cloud Security Engineer
Questions	318 Questions Answers With Explanation
Update Date	August 03, 2026
Price	Was : $81 Today : $45 Was : $99 Today : $55 Was : $117 Today : $65

Add To Cart

Demo Questions

Question # 1

Your organization s customers must scan and upload the contract and their driver license into a web portal in Cloud Storage. You must remove all personally identifiable information (Pll) from files that are older than 12 months. Also you must archive the anonymized files for retention purposes. What should you do? 

A. Set a time to live (TTL) of 12 months for the files in the Cloud Storage bucket that removes PH and moves the files to the archive storage class. 
B. Create a Cloud Data Loss Prevention (DLP) inspection job that de-identifies Pll in files created more than 12 months ago and archives them to another Cloud Storage bucket. Delete the original files. 
C. Schedule a Cloud Key Management Service (KMS) rotation period of 12 months for the encryption keys of the Cloud Storage files containing Pll to de-identify them Delete the original keys. 
D. Configure the Autoclass feature of the Cloud Storage bucket to de-identify Pll Archive the files that are older than 12 months Delete the original fil

Show Answer

Question # 2

Your organization uses the top-tier folder to separate application environments (prod and dev). The developers need to see all application development audit logs but they are not permitted to review production logs. Your security team can review all logs in production and development environments. You must grant Identity and Access Management (1AM) roles at the right resource level tor the developers and security team while you ensure least privilege. What should you do? 

A. 1 Grant logging, viewer rote to the security team at the organization resource level. 2 Grant logging, viewer rote to the developer team at the folder resource level that contains all the dev projects
B. 1 Grant logging. viewer rote to the security team at the organization resource level. 2 Grant logging. admin role to the developer team at the organization resource level. 
C. 1 Grant logging.admin role to the security team at the organization resource level. 2 Grant logging. viewer rote to the developer team at the folder resource level that contains all the dev projects.
D. 1 Grant logging.admin role to the security team at the organization resource level. 2 Grant logging.admin role to the developer team at the organization resource level. 

Show Answer

Question # 3

Your organization recently activated the Security Command Center {SCO standard tier. There are a few Cloud Storage buckets that were accidentally made accessible to the public. You need to investigate the impact of the incident and remediate it. What should you do? 

A. 1 Remove the Identity and Access Management (IAM) granting access to allusers from the buckets 2 Apply the organization policy storage. unifromBucketLevelAccess to prevent regressions 3 Query the data access logs to report on unauthorized access 
B. 1 Change bucket permissions to limit access 2 Query the data access audit logs for any unauthorized access to the buckets 3 After the misconfiguration is corrected mute the finding in the Security Command Center 
C. 1 Change permissions to limit access for authorized users 2 Enforce a VPC Service Controls perimeter around all the production projects to immediately stop any unauthorized access 3 Review the administrator activity audit logs to report on any unauthorized access 
D. 1 Change the bucket permissions to limit access 2 Query the buckets usage logs to report on unauthorized access to the data 3 Enforce the organization policy storage.publicAccessPrevention to avoid regressions â– â–  

Show Answer

Question # 4

You have stored company approved compute images in a single Google Cloud project that is used as an image repository. This project is protected with VPC Service Controls and exists in the perimeter along with other projects in your organization. This lets other projects deploy images from the image repository project. A team requires deploying a third-party disk image that is stored in an external Google Cloud organization. You need to grant read access to the disk image so that it can be deployed into the perimeter. What should you do? 

A. 1 Update the perimeter 2 Configure the egressTo field to set identity Type to any_identity. 3 Configure the egressFrom field to include the external Google Cloud project number as an allowed resource and the serviceName to compute. googleapis. com.
B. * Allow the external project by using the organizational policy constraints/compute.trustedlmageProjects. 
C. 1 Update the perimeter 2 Configure the egressTo field to include the external Google Cloud project number as an allowed resource and the serviceName to compute. googleapis. com. 3 Configure the egressFrom field to set identity Type to any_idestity.
D. 1 Update the perimeter 2 Configure the ingressFrcm field to set identityType to an-y_identity. 3 Configure the ingressTo field to include the external Google Cloud project number as an allowed resource and the serviceName to compute.googleapis -com. 

Show Answer

Question # 5

Your company recently published a security policy to minimize the usage of service account keys. Onpremises Windows-based applications are interacting with Google Cloud APIs. You need to implement Workload Identity Federation (WIF) with your identity provider on-premises. What should you do? 

A. Set up a workload identity pool with your corporate Active Directory Federation Service (ADFS) Configure a rule to let principals in the pool impersonate the Google Cloud service account. 
B. Set up a workload identity pool with your corporate Active Directory Federation Service (ADFS) Let all principals in the pool impersonate the Google Cloud service account. 
C. Set up a workload identity pool with an OpenID Connect (OIDC) service on the name machine Configure a rule to let principals in the pool impersonate the Google Cloud service account. 
D. Set up a workload identity pool with an OpenID Connect (OIDC) service on the same machine Let all principals in the pool impersonate the Google Cloud service account.

Show Answer

Question # 6

Your DevOps team uses Packer to build Compute Engine images by using this process: 1 Create an ephemeral Compute Engine VM. 2 Copy a binary from a Cloud Storage bucket to the VM's file system. 3 Update the VM's package manager. 4 Install external packages from the internet onto the VM. Your security team just enabled the organizational policy. consrraints/compure.vnExtemallpAccess. to restrict the usage of public IP Addresses on VMs. In response your DevOps team updated their scripts to remove public IP addresses on the Compute Engine VMs however the build pipeline is failing due to connectivity issues. What should you do? Choose 2 answers

A. Provision a Cloud NAT instance in the same VPC and region as the Compute Engine VM 
B. Provision an HTTP load balancer with the VM in an unmanaged instance group to allow inbound connections from the internet to your VM. 
C. Update the VPC routes to allow traffic to and from the internet. 
D. Provision a Cloud VPN tunnel in the same VPC and region as the Compute Engine VM. 
E. Enable Private Google Access on the subnet that the Compute Engine VM is deployed within.

Show Answer

Question # 7

You are using Security Command Center (SCC) to protect your workloads and receive alerts for suspected security breaches at your company. You need to detect cryptocurrency mining software. Which SCC service should you use?

A. Container Threat Detection  
B. Web Security Scanner 
C. Rapid Vulnerability Detection 
D. Virtual Machine Threat Detection

Show Answer

Question # 8

You define central security controls in your Google Cloud environment for one of the folders in your organization you set an organizational policy to deny the assignment of external IP addresses to VMs. Two days later you receive an alert about a new VM with an external IP address under that folder. What could have caused this alert? 

A. The VM was created with a static external IP address that was reserved in the project before the organizational policy rule was set. 
B. The organizational policy constraint wasn't properly enforced and is running in "dry run mode. 
C. At project level, the organizational policy control has been overwritten with an 'allow' value.
D. The policy constraint on the folder level does not have any effect because of an allow" value for that constraint on the organizational level.

Show Answer

Question # 9

Your organization is moving virtual machines (VMs) to Google Cloud. You must ensure that operating system images that are used across your projects are trusted and meet your security requirements. What should you do? 

A. Implement an organization policy to enforce that boot disks can only be created from images that come from the trusted image projec
B. Create a Cloud Function that is automatically triggered when a new virtual machine is created from the trusted image repository Verify that the image is not deprecated. 
C. Implement an organization policy constraint that enables the Shielded VM service on all projects to enforce the trusted image repository usage. 
D. Automate a security scanner that verifies that no common vulnerabilities and exposures (CVEs) are present in your trusted image repository. 

Show Answer

Question # 10

You have a highly sensitive BigQuery workload that contains personally identifiable information (Pll) that you want to ensure is not accessible from the internet. To prevent data exfiltration only requests from authorized IP addresses are allowed to query your BigQuery tables. What should you do? 

A. Use service perimeter and create an access level based on the authorized source IP address as the condition. 
B. Use Google Cloud Armor security policies defining an allowlist of authorized IP addresses at the global HTTPS load balancer. 
C. Use the Restrict allowed Google Cloud APIs and services organization policy constraint along with Cloud Data Loss Prevention (DLP).
D. Use the Restrict Resource service usage organization policy constraint along with Cloud Data Loss Prevention (DLP).

Show Answer

Question # 11

You run applications on Cloud Run. You already enabled container analysis for vulnerability scanning. However, you are concerned about the lack of control on the applications that are deployed. You must ensure that only trusted container images are deployed on Cloud Run. What should you do? Choose 2 answers

A. Enable Binary Authorization on the existing Kubernetes cluster. 
B. Set the organization policy constraint constraints/run. allowedBinaryAuthorizationPolicie to the list of allowed Binary Authorization policy names. 
C. Set the organization policy constraint constraints/compute.trustedimageProjects to the list of protects that contain the trusted container images.
D. Enable Binary Authorization on the existing Cloud Run service. 
E. Use Cloud Run breakglass to deploy an image that meets the Binary Authorization policy by default.

Show Answer

Question # 12

You manage one of your organization's Google Cloud projects (Project A). AVPC Service Control (SC) perimeter is blocking API access requests to this project including Pub/Sub. A resource running under a service account in another project (Project B) needs to collect messages from a Pub/Sub topic in your project Project B is not included in a VPC SC perimeter. You need to provide access from Project B to the Pub/Sub topic in Project A using the principle of least Privilege. What should you do? 

A. Configure an ingress policy for the perimeter in Project A and allow access for the service account in Project B to collect messages.
B. Create an access level that allows a developer in Project B to subscribe to the Pub/Sub topic that is located in Project A.
C. Create a perimeter bridge between Project A and Project B to allow the required communication between both projects. 
D. Remove the Pub/Sub API from the list of restricted services in the perimeter configuration for Project A.

Show Answer

Question # 13

You are auditing all your Google Cloud resources in the production project. You want to identity all principals who can change firewall rules. What should you do?

A. Use Policy Analyzer lo query the permissions compute, firewalls, create of compute, firewalls. Create of compute,firewalls.delete. 
B. Reference the Security Health Analytics - Firewall Vulnerability Findings in the Security Command Center. 
C. Use Policy Analyzer to query the permissions compute, firewalls, get of compute, firewalls, list.
D. Use Firewall Insights to understand your firewall rules usage patterns. 

Show Answer

Question # 14

You are migrating an on-premises data warehouse to BigQuery Cloud SQL, and Cloud Storage. You need to configure security services in the data warehouse. Your company compliance policies mandate that the data warehouse must: Protect data at rest with full lifecycle management on cryptographic keys Implement a separate key management provider from data management Provide visibility into all encryption key requests What services should be included in the data warehouse implementation? Choose 2 answers 

A. Customer-managed encryption keys 
B. Customer-Supplied Encryption Keys 
C. Key Access Justifications 
D. Access Transparency and Approval 
E. Cloud External Key Manager 

Show Answer

Question # 15

Your organization uses Google Workspace Enterprise Edition tor authentication. You are concerned about employees leaving their laptops unattended for extended periods of time after authenticating into Google Cloud. You must prevent malicious people from using an employee's unattended laptop to modify their environment. What should you do? 

A. Create a policy that requires employees to not leave their sessions open for long durations. 
B. Review and disable unnecessary Google Cloud APIs. 
C. Require strong passwords and 2SV through a security token or Google authenticate. 
D. Set the session length timeout for Google Cloud services to a shorter duration. 

Show Answer

Question # 16

You are routing all your internet facing traffic from Google Cloud through your on-premises internet connection. You want to accomplish this goal securely and with the highest bandwidth possible. What should you do? 

A. Create an HA VPN connection to Google Cloud Replace the default 0 0 0 0/0 route. 
B. Create a routing VM in Compute Engine Configure the default route with the VM as the next hop. 
C. Configure Cloud Interconnect with HA VPN Replace the default 0 0 0 0/0 route to an on-premises destination. 
D. Configure Cloud Interconnect and route traffic through an on-premises firewall. 

Show Answer

Question # 17

Your organization wants to be continuously evaluated against CIS Google Cloud Computing Foundations Benchmark v1 3 0 (CIS Google Cloud Foundation 1 3). Some of the controls are irrelevant to your organization and must be disregarded in evaluation. You need to create an automated system or process to ensure that only the relevant controls are evaluated. What should you do? 

A. Mark all security findings that are irrelevant with a tag and a value that indicates a security exception Select all marked findings and mute them on the console every time they appear Activate Security Command Center (SCC) Premium.
B. Activate Security Command Center (SCC) Premium Create a rule to mute the security findings in SCC so they are not evaluated. 
C. Download all findings from Security Command Center (SCC) to a CSV file Mark the findings that are part of CIS Google Cloud Foundation 1 3 in the file Ignore the entries that are irrelevant and out of scope for the company. 
D. Ask an external audit company to provide independent reports including needed CIS benchmarks. In the scope of the audit clarify that some of the controls are not needed and must be disregarded.

Show Answer

Question # 18

You are a Cloud Identity administrator for your organization. In your Google Cloud environment groups are used to manage user permissions. Each application team has a dedicated group Your team is responsible for creating these groups and the application teams can manage the team members on their own through the Google Cloud console. You must ensure that the application teams can only add users from within your organization to their groups. What should you do? 

A. Change the configuration of the relevant groups in the Google Workspace Admin console to prevent external users from being added to the group. 
B. Set an Identity and Access Management (1AM) policy that includes a condition that restricts group membership to user principals that belong to your organization. 
C. Define an Identity and Access Management (IAM) deny policy that denies the assignment of principals that are outside your organization to the groups in scope. 
D. Export the Cloud Identity logs to BigQuery Configure an alert for external members added to groups Have the alert trigger a Cloud Function instance that removes the external members from the group.

Show Answer

Question # 19

Your organization processes sensitive health information. You want to ensure that data is encrypted while in use by the virtual machines (VMs). You must create a policy that is enforced across the entire organization. What should you do? 

A. Implement an organization policy that ensures that all VM resources created across your organization use customer-managed encryption keys (CMEK) protection. 
B. Implement an organization policy that ensures all VM resources created across your organization are Confidential VM instances. 
C. Implement an organization policy that ensures that all VM resources created across your organization use Cloud External Key Manager (EKM) protection. 
D. No action is necessary because Google encrypts data while it is in use by default.

Show Answer

Question # 20

Your organization is rolling out a new continuous integration and delivery (CI/CD) process to deploy infrastructure and applications in Google Cloud Many teams will use their own instances of the CI/CD workflow It will run on Google Kubernetes Engine (GKE) The CI/CD pipelines must be designed to securely access Google Cloud APIs What should you do? 

A. 1 Create a dedicated service account for the CI/CD pipelines 2 Run the deployment pipelines in a dedicated nodes pool in the GKE cluster 3 Use the service account that you created as identity for the nodes in the pool to authenticate to the Google Cloud APIs 
B. 1 Create service accounts for each deployment pipeline 2 Generate private keys for the service accounts 3 Securely store the private keys as Kubernetes secrets accessible only by the pods that run the specific deploy pipeline 
C. * 1 Create individual service accounts (or each deployment pipeline 2 Add an identifier for the pipeline in the service account naming convention 3 Ensure each pipeline runs on dedicated pods 4 Use workload identity to map a deployment pipeline pod with a service account
D. 1 Create two service accounts one for the infrastructure and one for the application deployment 2 Use workload identities to let the pods run the two pipelines and authenticate with the service accounts 3 Run the infrastructure and application pipelines in separate namespaces

Show Answer

Question # 21

Your organization must comply with the regulation to keep instance logging data within Europe. Your workloads will be hosted in the Netherlands in region europe-west4 in a new project. You must configure Cloud Logging to keep your data in the country. What should you do?

A. Configure the organization policy constraint gcp.resourceLocations to europe-west4. 
B. Set the logging storage region to eurcpe-west4 by using the gcloud CLI logging settings update. 
C. Create a new tog bucket in europe-west4. and redirect the _Def auit bucKet to the new bucket. 
D. Configure log sink to export all logs into a Cloud Storage bucket in europe-west4. 

Show Answer

Question # 22

Your Google Cloud organization allows for administrative capabilities to be distributed to each team through provision of a Google Cloud project with Owner role (roles/ owner). The organization contains thousands of Google Cloud Projects Security Command Center Premium has surfaced multiple cpen_myscl_port findings. You are enforcing the guardrails and need to prevent these types of common misconfigurations. What should you do? 

A. Create a firewall rule for each virtual private cloud (VPC) to deny traffic from 0 0 0 0/0 with priority 0. 
B. Create a hierarchical firewall policy configured at the organization to deny all connections from 0 0 0 0/0. 
C. Create a Google Cloud Armor security policy to deny traffic from 0 0 0 0/0. 
D. Create a hierarchical firewall policy configured at the organization to allow connections only from internal IP ranges 

Show Answer

Question # 23

Your company must follow industry specific regulations. Therefore, you need to enforce customermanaged encryption keys (CMEK) for all new Cloud Storage resources in the organization called org1. What command should you execute? 

A. organization policy: constraints/gcp.restrictStorageNonCraekServices binding at: orgl policy type: deny policy value: storage.gcogleapis.com
B. organization policy: constraints/gcp.restrictHonCmekServices binding at: orgl policy type: deny policy value: storage.googleapis.com
C. organization policy:constraints/gcp.restrictStorageNonCraekServices binding at: orgl policy type: allow policy value: all supported services
D. organization policy: constramts/gcp.restrictNonCmekServices binding at: orgl policy type: allow policy value: storage.googleapis.com

Show Answer

Question # 24

Your organization is using GitHub Actions as a continuous integration and delivery (Cl/CD) platform. You must enable access to Google Cloud resources from the Cl/CD pipelines in the most secure way. What should you do? 

A. Create a service account key and add it to the GitHub pipeline configuration file. 
B. Create a service account key and add it to the GitHub repository content. 
C. Configure a Google Kubernetes Engine cluster that uses Workload Identity to supply credentials to GitHub. 
D. Configure workload identity federation to use GitHub as an identity pool provider.

Show Answer

Question # 25

Your company is moving to Google Cloud. You plan to sync your users first by using Google Cloud Directory Sync (GCDS). Some employees have already created Google Cloud accounts by using their company email addresses that were created outside of GCDS. You must create your users on Cloud Identity. What should you do? 

A. Configure GCDS and use GCDS search rules lo sync these users.  
B. Use the transfer tool to migrate unmanaged users. 
C. Write a custom script to identify existing Google Cloud users and call the Admin SDK Directory API to transfer their account. 
D. Configure GCDS and use GCDS exclusion rules to ensure users are not suspended.

Show Answer