Google Cloud · Free Practice Questions · Last reviewed May 2026
30real exam-style questions organised by domain, each with the correct answer highlighted and a plain-English explanation of why it's right — and why the others are wrong.
25% of exam · 6 sample questions below
A security engineer needs to prevent users from creating service account keys in a Google Cloud project. The solution must be enforceable across all projects in the organization and should not block other IAM operations. Which approach should they use?
Use IAM Conditions to restrict service account key creation to only a specific project.
Create a custom role that excludes the permission iam.serviceAccountKeys.create and assign it to all users.
Use the Organization Policy Service with the constraint constraints/iam.disableServiceAccountKeyCreation.
This is the correct method. The built-in constraint specifically disables service account key creation across the resource hierarchy.
Create an IAM deny policy at the organization level to deny the permission iam.serviceAccountKeys.create.
An organization uses Active Directory (AD) on-premises and wants to synchronize user accounts and groups to Google Cloud Identity for SSO with SAML 2.0. The AD contains 50,000 users and 10,000 groups. The solution must support automatic provisioning and deprovisioning of users. Which tool should they use?
Use SAML 2.0 federation with AD FS to synchronize users.
Use Workload Identity Federation to connect AD to Google Cloud.
Use the Cloud Identity API to manually create users and groups.
Use Google Cloud Directory Sync (GCDS) to synchronize users and groups from AD to Cloud Identity.
GCDS is designed for this exact purpose: one-way sync from AD/LDAP to Google Cloud Directory, including automatic provisioning and deprovisioning.
A developer wants to grant a Compute Engine instance access to read objects from a Cloud Storage bucket. The instance runs under a service account. What is the best practice for granting this access?
Create an IAM policy on the bucket that grants access to the instance's external IP address.
Assign the Storage Object Viewer role to the service account attached to the instance.
This is the correct approach. The service account is authorized, and the instance can access the bucket using its metadata server credentials.
Use a signed URL with a long expiration time for the instance.
Generate a JSON key for the service account, download it to the instance, and use it in application code.
A company has multiple Google Cloud projects organized under folders by department. The security team wants to enforce a policy that all Compute Engine instances must use Shielded VM features. They need to prevent non-compliant instances from being created. Which action should be taken to enforce this requirement most effectively?
Create an IAM deny policy at the organization level that denies the compute.instances.create permission unless the Shielded VM flag is set.
Create a custom role that includes the permission to create instances only with Shielded VM, and assign it to all users.
Use the Organization Policy Service with the constraint constraints/compute.requireShieldedVm.
This built-in constraint forces Shielded VM to be required when creating instances. It can be applied at the folder level to cover all projects under a department.
Implement a service account that only has permission to create instances and use service account impersonation for all instance creation.
What is the purpose of Identity-Aware Proxy (IAP) on Google Cloud?
To enforce identity-based access control for web applications and SSH/RDP to VMs without requiring a VPN.
IAP provides zero-trust access by verifying the user's identity and context, allowing access to web apps and VMs via SSH/RDP without a VPN.
To manage firewall rules for VPC networks.
To provide a VPN connection between on-premises and Google Cloud.
To act as a web application firewall (WAF) that blocks SQL injection and XSS attacks.
A DevOps team uses GitHub Actions to deploy infrastructure to Google Cloud. They want to avoid storing long-lived service account keys. Which approach should they use to authenticate from GitHub Actions to Google Cloud?
Grant the service account token creator role to the GitHub Actions runner.
Download a JSON service account key and store it as a GitHub secret.
Use Workload Identity Federation by configuring a workload identity pool and provider for GitHub.
Workload Identity Federation enables keyless authentication from GitHub Actions to GCP using OIDC tokens.
Create a Compute Engine instance with a service account and run GitHub Actions from there.
Want more Configuring Access Within a Cloud Solution Environment practice?
Practice this domain23% of exam · 6 sample questions below
A security engineer needs to ensure that all customer data stored in Cloud Storage is encrypted at rest using keys that the organization manages and rotates themselves. Which encryption option should they use?
Customer-supplied encryption keys (CSEK)
Google-managed encryption (GMEK)
Customer-managed encryption keys (CMEK) using Cloud KMS
CMEK allows customers to manage and rotate their keys via Cloud KMS.
Cloud HSM
A company uses Cloud KMS with a key purpose of ENCRYPT_DECRYPT. They need to rotate the key automatically every 30 days. What must they configure?
Set a rotation period of 30 days on the key.
Setting the rotation period on the key enables automatic rotation every 30 days.
Use a cron job to rotate keys manually every 30 days.
Set a rotation period of 30 days on the key ring.
Set a rotation period on the key version.
Which Google Cloud service provides near-real-time logs when Google administrators access your customer content?
Access Transparency
Access Transparency logs Google admin access to customer content in near-real-time.
Access Approval
Cloud DLP
Cloud Audit Logs
A company stores API keys in Secret Manager. They want to automatically rotate the secret every 60 days and have a Cloud Function triggered after each rotation to update dependent services. What is the correct approach?
Manually rotate the secret and set a Cloud Scheduler job to invoke the Cloud Function.
Use Cloud Scheduler to call the Secret Manager API to add a new version every 60 days, then trigger a Cloud Function via HTTP.
Set a rotation period on the secret and directly specify a Cloud Function as a webhook in Secret Manager.
Set a rotation period on the secret and configure a Pub/Sub topic for notifications. Create a Cloud Function subscribed to that topic.
This is the correct method: rotation triggers Pub/Sub, Cloud Function acts on it.
A company has a Cloud Storage bucket containing CSV files with sensitive data. They want to use Cloud DLP to scan the files for personally identifiable information (PII) and automatically redact (replace) any detected credit card numbers before the data is used by downstream analytics. What type of job should they create?
Inspection job with a Cloud Data Loss Prevention API to call a Cloud Function.
De-identification job with a bucketing transform.
Inspection job with a Cloud Pub/Sub notification to trigger a Cloud Function that redacts the data.
De-identification job using a masking transform for credit card numbers.
A de-identification job can apply transforms (e.g., masking) to redact sensitive data.
An organization needs to enforce that all new Cloud Storage buckets are created only in the europe-west1 region to meet data residency requirements. Which method should they use?
Assign the roles/storage.admin IAM role with a condition that restricts region.
Use Assured Workloads to enforce data residency.
Define a bucket policy that allows only europe-west1.
Configure an organization policy with the constraint gcp.resourceLocations to allow only europe-west1.
This constraint restricts where resources can be created.
Want more Ensuring Data Protection practice?
Practice this domain19% of exam · 6 sample questions below
A security engineer needs to ensure that all Google Cloud API calls in the organization are logged and retained for 7 years for compliance. Admin Activity logs are enabled by default but retention is limited. Which combination of actions should the engineer take?
Create a log sink with _Required log view filter to export Admin Activity logs to Cloud Storage with a retention policy of 7 years.
The _Required log view includes Admin Activity logs. Exporting to Cloud Storage allows archiving with retention policies.
Create a log sink to export Admin Activity logs to BigQuery and set the table expiration to 7 years.
Enable Data Access logs for all services and set a custom retention period of 7 years on the log bucket.
Enable the 'Admin Activity logs' retention to 7 years in the Logging settings.
A company wants to receive real-time notifications when Security Command Center (SCC) detects a high-severity vulnerability in their Google Cloud projects. They need to integrate with their existing SIEM. Which approach should they use?
Create a Pub/Sub notification config in SCC for the desired finding types and have the SIEM subscribe to the Pub/Sub topic.
SCC supports Pub/Sub notifications for findings, enabling real-time SIEM integration.
Use the SCC API to poll for new findings every minute and push them to the SIEM via a custom script.
Enable Event Threat Detection in SCC Premium tier and configure it to stream findings to Cloud Logging via a log sink.
Configure SCC to send findings to Cloud Logging and set up a log-based metric that triggers a Cloud Function to send to the SIEM.
A DevOps team is implementing Binary Authorization for a GKE cluster. They want to ensure that only container images signed by a specific attestor can be deployed. They have created the attestor and configured Cloud KMS for signing. Which additional step is required to enforce the policy?
Enable the 'gke-binary-authorization' feature flag on the cluster and update the kubeconfig.
Create a Binary Authorization policy that requires at least one attestation and attach it to the GKE cluster.
The policy must require attestation and be applied to the cluster for enforcement.
Create a policy that allows all images and then override it with an admission webhook.
Configure the container registry to block unsigned images by setting a repository-level policy.
A security analyst needs to investigate a potential breach in a Compute Engine instance. They want to create an offline forensic copy of the disk without affecting the running instance. Which action should they take?
Create an image from the disk while the instance is running.
Use the gcloud compute disks copy command to replicate the disk.
Attach a new blank disk to the instance and use dd to clone the data.
Stop the instance and create a snapshot of the boot disk.
Stopping ensures a consistent snapshot; the snapshot can be used for forensics without affecting the original instance.
A company is using Security Command Center (SCC) Standard tier and wants to detect threats like crypto mining attacks and anomalous IAM activity in their GCP environment. Which built-in service should they enable?
Event Threat Detection
Event Threat Detection is a Premium SCC service that monitors logs for malicious activity, including crypto mining.
Security Health Analytics
Web Security Scanner
VM Threat Detection
An organization uses Chronicle SIEM to ingest logs from multiple GCP projects and on-premises firewalls. They need to write a detection rule that triggers when an IP address makes more than 100 failed login attempts across different GCP projects within 10 minutes. Which Chronicle feature should they use?
Dashboard and alerting
Reference list
Unified Data Model (UDM)
YARA-L detection rule
YARA-L rules can correlate events across multiple data sources and time windows.
Want more Managing Operations in a Cloud Solution Environment practice?
Practice this domain22% of exam · 6 sample questions below
A security engineer needs to restrict access to Cloud Storage buckets so that only resources in a specific VPC can reach the Google APIs. Which Google Cloud service should be used?
Firewall Rules
VPC Service Controls
VPC Service Controls enforces perimeters around Google Cloud APIs to control data access.
Identity-Aware Proxy
Cloud Armor
An organization wants to enforce a security policy that denies all egress traffic to the internet from all projects in the organization, except for traffic from a specific set of VMs tagged with 'allow-egress'. Which approach should be used?
Create a VPC firewall rule at the organization level to deny all egress, then allow egress for the specific tag.
Use a hierarchical firewall policy at the organization level with a deny-all egress rule and a higher priority allow rule for the tag.
Hierarchical firewall policies apply across projects and cannot be overridden, ensuring baseline enforcement.
Use VPC Service Controls to block egress traffic.
Configure Cloud Armor with a deny-all egress rule and an exception for the tag.
A company uses VPC Service Controls to protect a BigQuery dataset. They need to allow an external on-premises application to query the dataset without being inside the service perimeter. The external application has a static IP address. Which configuration is required?
Add the external IP to an access level and configure an ingress rule in the service perimeter.
An ingress rule with an IP-based access level allows traffic from that IP to cross the perimeter.
Whitelist the external IP in the BigQuery dataset's IAM policy.
Create a Cloud VPN tunnel between the on-premises network and the VPC, and add the tunnel to the service perimeter.
Use Private Google Access on the VPC to allow on-premises traffic.
A DevOps team wants to automatically provision and renew SSL certificates for a global HTTPS load balancer. Which certificate management option should be used?
Create a Google-managed certificate directly on the load balancer and configure a cron job to check renewal.
Use Certificate Manager with a DNS authorization to create a Google-managed certificate.
Certificate Manager can create Google-managed certificates that auto-renew.
Use a third-party CA and upload the certificate with a longer validity.
Upload a self-managed certificate and configure a cron job to renew it.
An engineer needs to block a specific IP address from accessing an HTTPS load balancer. Which Cloud Armor rule should be used?
A VPC firewall rule with a deny ingress for that IP
A custom rule with a 'deny' action and the IP address in the 'src_ip_ranges' field
Custom rules can block specific IPs using 'src_ip_ranges'.
A Cloud Armor rate limiting rule
A preconfigured rule from the OWASP ModSecurity CRS
A company wants internal VMs to access Google APIs (e.g., Cloud Storage, BigQuery) without traversing the internet. What is the simplest configuration?
Assign external IPs to all VMs and use VPC firewall rules to restrict egress.
Use Cloud NAT to route traffic to Google APIs.
Enable Private Google Access on the subnet where the VMs reside.
Private Google Access allows internal-only VMs to reach Google APIs privately.
Set up Private Service Connect to googleapis.com.
Want more Configuring Network Security practice?
Practice this domain11% of exam · 6 sample questions below
A healthcare organization is required to protect Protected Health Information (PHI) stored in Cloud Storage. They want to automatically detect and redact PHI before storing it. Which Google Cloud service should they use?
Cloud Armor
Cloud Data Loss Prevention (DLP)
Cloud DLP provides built-in detectors for PHI and can be configured to automatically redact or de-identify data in Cloud Storage, meeting HIPAA requirements.
VPC Service Controls
Security Command Center
A company needs to retain audit logs for 7 years to meet compliance requirements. By default, Cloud Audit Logs are retained for 30 days. What should they do to retain the logs for 7 years?
Increase the default audit log retention period in the Logging settings to 7 years.
Enable Logging export to BigQuery and set table expiration to 7 years.
Use Cloud Functions to copy audit logs daily to Coldline Storage.
Create a log sink to export audit logs to a Cloud Storage bucket with a retention policy set to 7 years.
Log sinks can export logs to Cloud Storage, and bucket retention policies can enforce data retention for compliance duration.
A financial institution is deploying a payment application on GKE that must comply with PCI DSS. They need to isolate the cardholder data environment (CDE) from other workloads and ensure only authorized services can communicate. Which combination of controls should they implement?
Use Cloud Armor to inspect all traffic and block non-compliant requests.
Use a separate VPC and VPC Service Controls perimeter for the CDE, and apply Kubernetes Network Policies to restrict pod communication.
Separate VPC for network isolation, VPC Service Controls to restrict data access to managed services, and Network Policies for pod-level segmentation align with PCI DSS requirements.
Enable Data Loss Prevention to scan payment data and restrict access.
Deploy the CDE in a separate project and use IAM roles to restrict access.
An organization handles ITAR-controlled data and must restrict Google personnel access to the underlying infrastructure. Which Google Cloud product should they use to enforce this restriction?
Assured Workloads
Assured Workloads enforces compliance controls including Access Transparency and Access Approval to restrict and audit Google personnel access.
IAM Conditions
VPC Service Controls
Cloud HSM
A company must implement a data retention policy that prevents any modification or deletion of stored log files for 5 years. Which Cloud Storage feature should they use?
Lifecycle management rules
Object versioning
Bucket locking with a retention policy
Bucket locking with a retention policy applies a WORM policy at the bucket level, preventing any modification or deletion of objects for the specified duration. This is the most appropriate feature for a blanket 5-year retention policy on all log files.
Object Retention Lock
A company processes personal data of European Union residents on GCP. They need to ensure that data processing is limited to specific purposes and that data subjects can exercise their rights (access, rectification, erasure). Which actions should they take to comply with GDPR?
Use Assured Workloads with EU Regions and Support and enable Access Transparency.
Enable data encryption with CMEK and sign a DPA with Google.
Sign a DPA with Google, implement data subject request workflows, and use Cloud DLP to classify personal data.
DPA is required; data subject rights must be supported; DLP helps identify personal data for compliance actions.
Enable VPC Service Controls and restrict data access to EU regions.
Want more Supporting Compliance Requirements practice?
Practice this domainThe PCSE exam has 60 questions and must be completed in 120 minutes. The passing score is 720/1000.
Scenario-based questions covering exam objectives with detailed answer explanations.
The exam covers 5 domains: Configuring Access Within a Cloud Solution Environment, Ensuring Data Protection, Managing Operations in a Cloud Solution Environment, Configuring Network Security, Supporting Compliance Requirements. Questions are weighted by domain — higher-weight domains appear more on your actual exam.
No. These are original exam-style practice questions written against the official Google Cloud PCSE exam objectives. They are not copied from the real exam. Courseiva focuses on genuine understanding, not memorisation of braindumps.
Courseiva tracks your accuracy per domain and routes you toward weak areas automatically. Free, no account required.