[Apr 26, 2026] Get New Professional-Cloud-Security-Engineer Practice Test Questions Answers
Professional-Cloud-Security-Engineer Dumps and Exam Test Engine
Google Professional-Cloud-Security-Engineer certification is part of the Google Cloud Certified program, which offers various certifications to validate the skills and knowledge of professionals in using Google Cloud technologies. This program is designed for professionals in different roles, including cloud architects, data engineers, machine learning engineers, and more. Obtaining a Google Cloud certification can help professionals stand out in the job market and demonstrate their expertise in using Google Cloud technologies.
NEW QUESTION # 55
You work for an ecommerce company that stores sensitive customer data across multiple Google Cloud regions. The development team has built a new 3-tier application to process orders and must integrate the application into the production environment.
You must design the network architecture to ensure strong security boundaries and isolation for the new application, facilitate secure remote maintenance by authorized third-party vendors, and follow the principle of least privilege. What should you do?
- A. Create separate VPC networks for each tier. Use VPC peering between application tiers and other required VPCs. Enable Identity-Aware Proxy (IAP) for remote access to management resources, limiting access to authorized vendors.
- B. Create a single VPC network and create different subnets for each tier. Create a new Google project specifically for the third-party vendors. Grant the vendors ownership of that project and the ability to modify the Shared VPC configuration.
- C. Create separate VPC networks for each tier. Use VPC peering between application tiers and other required VPCs. Provide vendors with SSH keys and root access only to the instances within the VPC for maintenance purposes.
- D. Create a single VPC network and create different subnets for each tier. Create a new Google project specifically for the third-party vendors and grant the network admin role to the vendors.
Deploy a VPN appliance and rely on the vendors' configurations to secure third-party access.
Answer: A
Explanation:
This approach ensures that each tier of the application is isolated within its own VPC, enhancing security. VPC peering allows necessary communication between tiers while maintaining isolation.
Using Identity-Aware Proxy (IAP) for remote access ensures that only authorized vendors can access management resources, adhering to the principle of least privilege.
NEW QUESTION # 56
The security operations team needs access to the security-related logs for all projects in their organization.
They have the following requirements:
Follow the least privilege model by having only view access to logs.
Have access to Admin Activity logs.
Have access to Data Access logs.
Have access to Access Transparency logs.
Which Identity and Access Management (IAM) role should the security operations team be granted?
- A. roles/logging.privateLogViewer
- B. roles/logging.admin
- C. roles/logging.viewer
- D. roles/viewer
Answer: A
Explanation:
https://cloud.google.com/logging/docs/access-control#considerations roles/logging.privateLogViewer (Private Logs Viewer) includes all the permissions contained by roles/logging.viewer, plus the ability to read Data Access audit logs in the _Default bucket.
NEW QUESTION # 57
You need to implement an encryption-at-rest strategy that protects sensitive data and reduces key management complexity for non-sensitive data. Your solution has the following requirements:
* Schedule key rotation for sensitive data.
* Control which region the encryption keys for sensitive data are stored in.
* Minimize the latency to access encryption keys for both sensitive and non-sensitive data.
What should you do?
- A. Encrypt non-sensitive data with Google default encryption, and encrypt sensitive data with Cloud Key Management Service.
- B. Encrypt non-sensitive data and sensitive data with Cloud Key Management Service.
- C. Encrypt non-sensitive data and sensitive data with Cloud External Key Manager.
- D. Encrypt non-sensitive data with Google default encryption, and encrypt sensitive data with Cloud External Key Manager.
Answer: A
Explanation:
Explanation
Google uses a common cryptographic library, Tink, which incorporates our FIPS 140-2 Level 1 validated module, BoringCrypto, to implement encryption consistently across almost all Google Cloud products. To provideflexibility of controlling the key residency and rotation schedule, use google provided key for non-sensitive and encrypt sensitive data with Cloud Key Management Service
NEW QUESTION # 58
You are a Security Administrator at your organization. You need to restrict service account creation capability within production environments. You want to accomplish this centrally across the organization. What should you do?
- A. Use organization policy constraints/iam.disableServiceAccountCreation boolean to disable the creation of new service accounts.
- B. Use organization policy constraints/iam.disableServiceAccountKeyCreation boolean to disable the creation of new service accounts.
- C. Use organization policy constraints/iam.disableServiceAccountKeyUpload boolean to disable the creation of new service accounts.
- D. Use Identity and Access Management (IAM) to restrict access of all users and service accounts that have access to the production environment.
Answer: A
NEW QUESTION # 59
You need to connect your organization's on-premises network with an existing Google Cloud environment that includes one Shared VPC with two subnets named Production and Non-Production. You are required to:
Use a private transport link.
Configure access to Google Cloud APIs through private API endpoints originating from on-premises environments.
Ensure that Google Cloud APIs are only consumed via VPC Service Controls.
What should you do?
- A. 1. Set up a Cloud VPN link between the on-premises environment and Google Cloud.2. Configure private access using the restricted googleapis.com domains in on-premises DNS configurations.
- B. 1. Set up a Partner Interconnect link between the on-premises environment and Google Cloud.2.
Configure private access using the private.googleapis.com domains in on-premises DNS configurations. - C. 1. Set up a Dedicated Interconnect link between the on-premises environment and Google Cloud.2.
Configure private access using the restricted.googleapis.com domains in on-premises DNS configurations. - D. 1. Set up a Direct Peering link between the on-premises environment and Google Cloud.2. Configure private access for both VPC subnets.
Answer: C
Explanation:
* Set up a Dedicated Interconnect link between the on-premises environment and Google Cloud:
* Dedicated Interconnect provides a direct physical connection between your on-premises network and Google's network, which is ideal for high-throughput, low-latency connections.
* Request a Dedicated Interconnect from the Google Cloud Console, specifying the required bandwidth and location.
* Once provisioned, set up the connection on your on-premises router and configure the BGP sessions to exchange routes with Google Cloud.
* Configure private access using the restricted.googleapis.com domains in on-premises DNS configurations:
* Configure your on-premises DNS server to resolve Google APIs to restricted.googleapis.com.
This ensures that the traffic stays within the Google network and is not exposed to the public internet.
* Update your DNS settings to use restricted.googleapis.com for the necessary API endpoints.
* This setup ensures that all Google Cloud API traffic is routed through the private link and subject to VPC Service Controls for additional security and compliance.
References:
Dedicated Interconnect Overview
Configuring DNS to use restricted.googleapis.com
NEW QUESTION # 60
A customer deploys an application to App Engine and needs to check for Open Web Application Security Project (OWASP) vulnerabilities.
Which service should be used to accomplish this?
- A. Cloud Armor
- B. Cloud Security Scanner
- C. Google Cloud Audit Logs
- D. Forseti Security
Answer: B
Explanation:
Explanation/Reference: https://cloud.google.com/security-scanner/
NEW QUESTION # 61
While migrating your organization's infrastructure to GCP, a large number of users will need to access GCP Console. The Identity Management team already has a well-established way to manage your users and want to keep using your existing Active Directory or LDAP server along with the existing SSO password.
What should you do?
- A. Use Google Cloud Directory Sync to synchronize the data in Google domain with your existing Active Directory or LDAP server.
- B. Users sign in using OpenID (OIDC) compatible IdP, receive an authentication token, then use that token to log in to the GCP Console.
- C. Users sign in directly to the GCP Console using the credentials from your on-premises Kerberos compliant identity provider.
- D. Manually synchronize the data in Google domain with your existing Active Directory or LDAP server.
Answer: A
Explanation:
Explanation
https://cloud.google.com/architecture/identity/federating-gcp-with-active-directory-configuring-single-sign-on
NEW QUESTION # 62
Your company has recently enabled Security Command Center at the organization level. You need to implement runtime threat detection for applications running in containers within projects residing in the production folder. Specifically, you need to be notified if additional libraries are loaded or malicious scripts are executed within these running containers. You need to configure Security Command Center to meet this requirement while ensuring findings are visible within Security Command Center. What should you do?
- A. Ensure that the containers in the production folder are running on hosts that are using Container- Optimized OS.
- B. Create log-based metrics and alerts in Cloud Logging and Cloud Monitoring for suspicious container activity within the production folder.
- C. Configure Security Health Analytics within Security Command Center to monitor container runtime vulnerabilities in the production folder.
- D. Enable Container Threat Detection in Security Command Center Premium tier for the projects within the production folder.
Answer: D
Explanation:
The requirements are runtime threat detection for containers that specifically detects activities like loading additional libraries or executing malicious scripts, with findings visible in Security Command Center (SCC).
Container Threat Detection (CTD) is the specific SCC service component designed to monitor container runtimes for suspicious events like reverse shells, suspicious library loading, and execution of malicious scripts. It is available only with the Security Command Center Premium tier.
Extracts:
"Container Threat Detection (CTD) is a Security Command Center Premium service that provides runtime threat detection for Google Kubernetes Engine (GKE) and Kubernetes clusters." (Source 4.1)
"CTD detects specific runtime events, such as: Execution of malicious scripts... Loading of suspicious libraries... CTD creates high-fidelity Security Command Center findings for these threats." (Source 4.2)
"Security Health Analytics (Option C) identifies misconfigurations and compliance violations, such as overly permissive IAM roles or open firewall ports, but it does not perform runtime threat detection." (Source 4.3) While using log-based metrics (Option D) is possible, enabling CTD (Option B) is the specific, managed, and authoritative way to generate verified runtime threat findings directly within Security Command Center as required by the prompt.
NEW QUESTION # 63
A centralized security service has been implemented by your company All applications running in Google Cloud are required to send data to this service You need to ensure that developers have high autonomy to configure firewall rules within their projects, while preventing accidental blockage of access to the central security service What should you do?
- A. Use Terraform to automate the creation of the required firewall rule in all projects Restrict rule change permissions solely to the Terraform service account
- B. Deploy a central Secure Web Proxy and connect it to all VPC networks Create a Secure Web Proxy policy to allow traffic to the central security service
- C. Create a central project to manage Shared VPC networks which will be accessible to all other projects Administer all firewall rules centrally within this project
- D. Implement a hierarchical firewall policy that prioritizes the central security service by allowing its connections and directing all other traffic to the subsequent firewall level
Answer: D
Explanation:
The problem has two key requirements:
All applications must send data to a centralized security service
Developers need high autonomy over firewall rules within their projects Prevent accidental blockage of access to the central security service This scenario requires a mechanism to enforce critical network policies at a higher level of the resource hierarchy while still allowing project-level flexibility Hierarchical Firewall Policies: Google Cloud's Hierarchical Firewall Policies (HFP) are designed precisely for this purpose They allow administrators to define firewall rules at the organization or folder level, and these rules are inherited by all projects and VPC networks within that hierarchy Crucially, HFP rules can be prioritized Rules with higher priority (lower numerical value) are evaluated first This means you can create high-priority "allow" rules for critical services that cannot be overridden or blocked by project-level firewall rulesExtract Reference: "Hierarchical firewall policies allow you to define and enforce consistent network security policies across your organization Policies can be applied at the organization or folder level, and they are inherited by all projects and VPC networks within that hierarchy" and "Rules in a hierarchical firewall policy can take precedence over VPC network firewall rules based on priority A rule with a lower priority value takes precedence over a rule with a higher priority value" (Google Cloud documentation: https://cloudgooglecom/vpc/docs/firewall-policies-overview) Preventing Accidental Blockage while Allowing Autonomy: By setting a high-priority "allow" rule for the central security service in a hierarchical firewall policy, you guarantee that this traffic will always be permitted, regardless of what project-level firewall rules developers might configure This ensures the critical connectivity while still allowing developers to manage other, less critical firewall rules within their projects with high autonomy Let's evaluate the other options:
A Deploy a central Secure Web Proxy and connect it to all VPC networks Create a Secure Web Proxy policy to allow traffic to the central security service A Secure Web Proxy is for HTTP/S outbound traffic to external web services The central security service might not be an external web service, and this solution is focused on application-layer proxies, not general network connectivity like sending data to an internal service Also, it doesn't directly address the challenge of developers blocking access with project-level firewall rules C Create a central project to manage Shared VPC networks which will be accessible to all other projects Administer all firewall rules centrally within this project While Shared VPC centralizes network management, it means all firewall rules are administered centrally This directly contradicts the requirement for developers to have "high autonomy to configure firewall rules within their projects" Shared VPC would centralize too much control for this specific scenario D Use Terraform to automate the creation of the required firewall rule in all projects Restrict rule change permissions solely to the Terraform service account This approach automates the creation but doesn't prevent developers from creating conflicting or overriding rules in their projects (unless Terraform is used to manage all rules, again removing autonomy) It also relies on restricting IAM permissions for all firewall rules, which is against the "high autonomy" requirement for developers Hierarchical firewall policies offer a more robust and native solution for overriding and enforcing specific rules
NEW QUESTION # 64
You work for an organization in a regulated industry that has strict data protection requirements. The organization backs up their data in the cloud. To comply with data privacy regulations, this data can only be stored for a specific length of time and must be deleted after this specific period.
You want to automate the compliance with this regulation while minimizing storage costs. What should you do?
- A. Store the data in a Cloud Bigtable table, and set an expiration time on the column families.
- B. Store the data in a Cloud Storage bucket, and configure the bucket's Object Lifecycle Management feature.
- C. Store the data in a BigQuery table, and set the table's expiration time.
- D. Store the data in a persistent disk, and delete the disk at expiration time.
Answer: B
Explanation:
Google Cloud Storage provides an Object Lifecycle Management feature that can help automate data retention and deletion processes, ensuring compliance with data privacy regulations while minimizing storage costs.
Lifecycle Management: Object Lifecycle Management allows you to define rules that automatically delete objects after a specific period. This ensures that data is only retained for the required amount of time and is deleted once it expires.
Configuration: You can configure lifecycle rules to delete objects based on conditions such as the age of the object, the creation date, or custom metadata. This allows for precise control over the retention period of your data.
Cost Efficiency: By using lifecycle policies to delete data automatically, you can reduce storage costs, as you only pay for the storage you actively use.
Reference:
Cloud Storage Object Lifecycle Management
NEW QUESTION # 65
A manager wants to start retaining security event logs for 2 years while minimizing costs. You write a filter to select the appropriate log entries.
Where should you export the logs?
- A. StackDriver logging
- B. Cloud Storage buckets
- C. BigQuery datasets
- D. Cloud Pub/Sub topics
Answer: A
Explanation:
https://cloud.google.com/logging/docs/exclusions
NEW QUESTION # 66
You're developing the incident response plan for your company. You need to define the access strategy that your DevOps team will use when reviewing and investigating a deployment issue in your Google Cloud environment. There are two main requirements:
Least-privilege access must be enforced at all times.
The DevOps team must be able to access the required resources only during the deployment issue.
How should you grant access while following Google-recommended best practices?
- A. Create a custom 1AM role with limited list/view permissions, and assign it to the DevOps team.
- B. Create a service account, and grant it limited list/view permissions. Give the Service Account User Role on this service account to the DevOps team.
- C. Assign the Project Viewer Identity and Access Management (1AM) role to the DevOps team.
- D. Create a service account, and grant it the Project Owner 1AM role. Give the Service Account User Role on this service account to the DevOps team.
Answer: B
Explanation:
To ensure least-privilege access and provide necessary permissions to the DevOps team only during a deployment issue, follow these steps:
Create a Service Account:
In your Google Cloud project, create a new service account specifically for the DevOps team.
Assign Limited Permissions:
Grant the service account permissions with only the necessary list/view roles. For instance, you can create a custom IAM role with compute.instances.list and compute.instances.get permissions.
Grant Service Account User Role:
Assign the Service Account User role to the DevOps team members for the created service account. This allows them to act as the service account and use its permissions.
Access Control During Incidents:
During a deployment issue, the DevOps team can temporarily use the service account to access the resources. This ensures they have the least-privilege access required to investigate and resolve the issue.
Automation and Monitoring:
Implement automation to enable and disable the service account access as needed and monitor the usage to ensure compliance with the least-privilege principle.
Benefits:
Security: Limits access to only what is necessary, reducing the risk of unauthorized changes.
Flexibility: Provides necessary access during incidents without granting permanent elevated permissions.
Reference:
Creating and Managing Service Accounts
Service Account User Role
NEW QUESTION # 67
You need to provide a corporate user account in Google Cloud for each of your developers and operational staff who need direct access to GCP resources. Corporate policy requires you to maintain the user identity in a third-party identity management provider and leverage single sign- on. You learn that a significant number of users are using their corporate domain email addresses for personal Google accounts, and you need to follow Google recommended practices to convert existing unmanaged users to managed accounts.
Which two actions should you take? (Choose two.)
- A. Use the Google Admin console to view which managed users are using a personal account for their recovery email.
- B. Add users to your managed Google account and force users to change the email addresses associated with their personal accounts.
- C. Use Google Cloud Directory Sync to synchronize your local identity management system to Cloud Identity.
- D. Use the Transfer Tool for Unmanaged Users (TTUU) to find users with conflicting accounts and ask them to transfer their personal Google accounts.
- E. Send an email to all of your employees and ask those users with corporate email addresses for personal Google accounts to delete the personal accounts immediately.
Answer: C,D
Explanation:
A - Requires third-party IDp and wants to leverage single sign-on.
D - https://cloud.google.com/architecture/identity/migrating-consumer-
accounts#initiating_a_transfer
"In addition to showing you all unmanaged accounts, the transfer tool for unmanaged users lets you initiate an account transfer by sending an account transfer request."
NEW QUESTION # 68
You are a security administrator at your company and are responsible for managing access controls (identification, authentication, and authorization) on Google Cloud. Which Google-recommended best practices should you follow when configuring authentication and authorization? (Choose two.)
- A. Manually add users to Google Cloud.
- B. Use SSO/SAML integration with Cloud Identity for user authentication and user lifecycle management.
- C. Use Google default encryption.
- D. Provide granular access with predefined roles.
- E. Provision users with basic roles using Google's Identity and Access Management (1AM) service.
Answer: B,D
Explanation:
Explanation
https://cloud.google.com/iam/docs/using-iam-securely#least_privilege Basic roles include thousands of permissions across all Google Cloud services. In production environments, do not grant basic roles unless there is no alternative. Instead, grant the most limited predefined roles or custom roles that meet your needs.
NEW QUESTION # 69
You plan to synchronize identities to Cloud Identity from a third-party identity provider (IdP). You discovered that some employees used their corporate email address to set up consumer accounts to access Google services. You need to ensure that the organization has control over the configuration, security, and lifecycle of these consumer accounts.
What should you do? (Choose two.)
- A. Mandate that those corporate employees delete their unmanaged consumer accounts.
- B. Use the transfer tool to invite those corporate employees to transfer their unmanaged consumer accounts to the corporate domain.
- C. Reconcile accounts that exist in Cloud Identity but not in the third-party IdP.
- D. Use Google Cloud Directory Sync (GCDS) to migrate the unmanaged consumer accounts' emails as user aliases.
- E. Evict the unmanaged consumer accounts in the third-party IdP before you sync identities.
Answer: B,C
Explanation:
https://cloud.google.com/architecture/identity/reconciling-orphaned-managed-user-accounts
NEW QUESTION # 70
You want to evaluate GCP for PCI compliance. You need to identify Google's inherent controls.
Which document should you review to find the information?
- A. PCI DSS Requirements and Security Assessment Procedures
- B. Google Cloud Platform: Customer Responsibility Matrix
- C. PCI SSC Cloud Computing Guidelines
- D. Product documentation for Compute Engine
Answer: B
Explanation:
https://cloud.google.com/files/PCI_DSS_Shared_Responsibility_GCP_v32.pdf
https://services.google.com/fh/files/misc/gcp_pci_shared_responsibility_matrix_aug_2021.pdf
NEW QUESTION # 71
Your team needs to prevent users from creating projects in the organization. Only the DevOps team should be allowed to create projects on behalf of the requester.
Which two tasks should your team perform to handle this request? (Choose two.)
- A. Grant the Project Editor role at the organizational level to a designated group of users.
- B. Add a designated group of users to the Project Creator role at the organizational level.
- C. Grant the billing account creator role to the designated DevOps team.
- D. Remove all users from the Project Creator role at the organizational level.
- E. Create an Organization Policy constraint, and apply it at the organizational level.
Answer: B,D
Explanation:
https://cloud.google.com/resource-manager/docs/organization-policy/org-policy-constraints
NEW QUESTION # 72
An organization is evaluating the use of Google Cloud Platform (GCP) for certain IT workloads. A well- established directory service is used to manage user identities and lifecycle management. This directory service must continue for the organization to use as the "source of truth" directory for identities.
Which solution meets the organization's requirements?
- A. Security Assertion Markup Language (SAML)
- B. Pub/Sub
- C. Cloud Identity
- D. Google Cloud Directory Sync (GCDS)
Answer: D
Explanation:
Explanation
With Google Cloud Directory Sync (GCDS), you can synchronize the data in your Google Account with your Microsoft Active Directory or LDAP server. GCDS doesn't migrate any content (such as email messages, calendar events, or files) to your Google Account. You use GCDS to synchronize your Google users, groups, and shared contacts to match the information in your LDAP server.
https://support.google.com/a/answer/106368?hl=en
NEW QUESTION # 73
Your privacy team uses crypto-shredding (deleting encryption keys) as a strategy to delete personally identifiable information (PII). You need to implement this practice on Google Cloud while still utilizing the majority of the platform's services and minimizing operational overhead.
What should you do?
- A. Use customer-managed encryption keys to delete specific encryption keys.
- B. Use client-side encryption before sending data to Google Cloud, and delete encryption keys on- premises.
- C. Use Google default encryption to delete specific encryption keys.
- D. Use Cloud External Key Manager to delete specific encryption keys.
Answer: A
Explanation:
https://cloud.google.com/sql/docs/mysql/cmek
"You might have situations where you want to permanently destroy data encrypted with CMEK.
To do this, you destroy the customer-managed encryption key version. You can't destroy the keyring or key, but you can destroy key versions of the key."
NEW QUESTION # 74
......
Google Professional Cloud Security Engineer Exam Cover Topics
Candidates must know the exam topics before they start of preparation. Because it will really help them in hitting the core. Our Google Professional Cloud Security Engineer exam dumps will include the following topics:
- Ensuring compliance
- Management of operations in a cloud solution environment
- Configuring network security
- Ensuring data protection
- Configuring access within a cloud solution environment
2026 New VCEDumps Professional-Cloud-Security-Engineer PDF Recently Updated Questions: https://www.vcedumps.com/Professional-Cloud-Security-Engineer-examcollection.html
Google Professional-Cloud-Security-Engineer DUMPS WITH REAL EXAM QUESTIONS: https://drive.google.com/open?id=1BjeAg7MkFxfZ5TcasRPRxAWs8fSLDNxg
