Knowledge + Practice

Google Professional Cloud Security Engineer (PCSE) — Questions 676–750

960 questions total · 13pages · All types, answers revealed

Take a mock exam Exam hub

Page 10 of 13

676

MCQmedium

A security engineer runs the above query in BigQuery and finds a column containing Social Security Numbers (SSNs). They must ensure that all SSNs in the dataset are automatically encrypted at rest using customer-managed keys (CMEK) and also that future queries do not expose SSNs to users without decryption access. Which approach should they take?

A.Use BigQuery with CMEK on the dataset and create a separate table with encrypted columns.

B.Use Cloud DLP to de-identify the data in the table and then restrict access to the de-identified column.

C.Use Cloud KMS to encrypt the column values and store the encrypted data in BigQuery.

D.Enable CMEK on the dataset, create an authorized view that excludes the sensitive column, and grant view access to users.

AnswerD

CMEK secures data at rest, and authorized views limit exposure.

Why this answer

Enabling CMEK on the dataset ensures all data, including SSNs, is encrypted at rest with customer-managed keys. Creating an authorized view that excludes the sensitive column and granting view access to users prevents exposure of SSNs in query results while still allowing access to non-sensitive data. This approach meets both the encryption and access control requirements without requiring manual encryption or de-identification.

Exam trap

Google Cloud often tests the misconception that manual encryption (e.g., Cloud KMS or DLP) is required for column-level protection, when in fact BigQuery's native CMEK combined with authorized views provides automatic encryption at rest and access control without custom encryption logic.

How to eliminate wrong answers

Option A is wrong because creating a separate table with encrypted columns does not automatically encrypt existing SSNs at rest; CMEK on the dataset encrypts all data at rest, but the separate table approach adds complexity and does not prevent future queries from exposing SSNs unless access is restricted. Option B is wrong because Cloud DLP de-identifies data (e.g., masking or tokenization) but does not encrypt at rest with CMEK; it also does not prevent users with direct table access from querying the original SSNs if the de-identified column is separate. Option C is wrong because using Cloud KMS to encrypt column values and storing encrypted data in BigQuery requires manual encryption/decryption logic in queries, which is error-prone and does not leverage BigQuery's native CMEK for automatic encryption at rest; it also fails to prevent exposure if users have access to the raw encrypted data.

Full explanation →

677

Multi-Selecthard

Which THREE of the following are required to enable VPC Flow Logs for a subnet? (Choose THREE.)

Select 3 answers

A.A subnet in the VPC

B.Setting the subnet's flow logs configuration to ON

C.A VPC network

D.A sample rate

E.An aggregation interval

AnswersA, B, C

Flow logs are per-subnet.

Why this answer

A subnet in the VPC is required because VPC Flow Logs capture IP traffic metadata at the subnet level. Without a subnet, there is no network segment to monitor, as flow logs are associated with a specific subnet within a VPC.

Exam trap

Google Cloud often tests the distinction between required components (subnet, VPC, flow logs ON) and optional tuning parameters (sample rate, aggregation interval), leading candidates to mistakenly select the latter as mandatory.

Full explanation →

678

MCQhard

Refer to the exhibit. Based on the exhibit, the corporate security policy requires that all Cloud KMS symmetric keys have automatic rotation enabled. Which statement is true?

A.Both keys are compliant.

B.Neither key is compliant.

C.Only the encryption-key is compliant.

D.Only the decryption-key is compliant.

AnswerC

Encryption-key has a rotation period; decryption-key does not.

Why this answer

The corporate security policy requires automatic rotation for all Cloud KMS symmetric keys. In the exhibit, the 'encryption-key' has automatic rotation enabled (as indicated by the rotation period being set), while the 'decryption-key' does not have automatic rotation enabled (rotation period is not set or is disabled). Therefore, only the encryption-key is compliant with the policy.

Exam trap

Google Cloud often tests the distinction between keys that have rotation enabled versus those that are simply created with a rotation period set to a non-zero value, tricking candidates into assuming all keys in a key ring are automatically rotated.

How to eliminate wrong answers

Option A is wrong because both keys are not compliant; the decryption-key lacks automatic rotation. Option B is wrong because the encryption-key does have automatic rotation enabled, so it is compliant. Option D is wrong because the decryption-key does not have automatic rotation enabled, making it non-compliant, not the only compliant key.

Full explanation →

679

MCQmedium

A company wants to enforce that no Compute Engine firewall rule in any project under an organization can have a source range of 0.0.0.0/0 for RDP (port 3389). Which approach should be used?

A.Apply a hierarchical firewall policy at the organization level that denies ingress on port 3389 from 0.0.0.0/0.

B.Create a Cloud IDS rule to block RDP traffic.

C.Create a VPC firewall rule with priority 0 to deny RDP from 0.0.0.0/0 in each project.

D.Use organization policy with constraint `compute.skipDefaultNetworkCreation` set to true.

AnswerA

Hierarchical firewall policies are enforced across all VPCs under the organization and cannot be overridden.

Why this answer

Use a hierarchical firewall policy at the organization level that denies ingress traffic on port 3389 from any source (0.0.0.0/0). Hierarchical policies are inherited and cannot be overridden by lower-level firewall rules.

Full explanation →

680

Multi-Selecthard

A security engineer needs to enforce column-level masking on a BigQuery table such that: (1) users with role 'data_analyst' see masked values, (2) users with role 'data_scientist' see plaintext values, and (3) the masking is applied automatically without modifying the underlying table. Which three components must they configure? (Choose 3)

Select 3 answers

A.IAM roles (e.g., roles/bigquery.maskedReader)

B.BigQuery Data Policy with masking rule

C.Cloud KMS key for column encryption

D.Data Catalog taxonomy with policy tags

E.Cloud DLP de-identification job

AnswersA, B, D

Why this answer

BigQuery column-level security uses: a Data Catalog taxonomy to define policy tags, a BigQuery Data Policy that specifies masking rules (e.g., hash, nullify) associated with the policy tag, and IAM roles (e.g., BigQuery Masked Reader) to grant access to masked data. The taxonomy contains the policy tags, the data policy defines the masking rule, and IAM controls who sees masked vs. plaintext.

Full explanation →

681

MCQhard

A healthcare organization is migrating sensitive patient data to Google Cloud and must comply with HIPAA. They plan to use Cloud SQL for MySQL with CMEK for encryption at rest. The security team is concerned about key management and access logging. Which additional measure should be implemented to meet HIPAA audit requirements?

A.Configure VPC Service Controls to restrict access to the Cloud SQL instance.

B.Use Cloud DLP to de-identify the data before storing it in Cloud SQL.

C.Enable Data Access audit logs for the Cloud SQL instance and Cloud KMS key.

D.Store the CMEK keys in Cloud HSM to meet FIPS 140-2 Level 3 requirements.

AnswerC

Data Access audit logs record all accesses to data and keys, satisfying HIPAA audit trail requirements.

Why this answer

HIPAA audit requirements mandate that access to protected health information (PHI) and the keys protecting it must be logged. Enabling Data Access audit logs on both the Cloud SQL instance and the Cloud KMS key captures read, write, and administrative operations, providing the necessary audit trail for compliance. Without these logs, the organization cannot demonstrate who accessed the data or the encryption keys, which is a core HIPAA requirement.

Exam trap

Google Cloud often tests the distinction between security controls that prevent access (like VPC Service Controls or HSM) and controls that provide auditability (like Data Access audit logs), leading candidates to pick a security measure that does not fulfill the specific audit requirement.

How to eliminate wrong answers

Option A is wrong because VPC Service Controls restrict data exfiltration and access boundaries but do not generate the detailed audit logs required by HIPAA for tracking access to PHI and encryption keys. Option B is wrong because Cloud DLP de-identifies data before storage, which can reduce compliance scope but does not address the audit logging requirement for key management and data access. Option D is wrong because storing CMEK keys in Cloud HSM meets FIPS 140-2 Level 3 for key security but does not provide the access logging needed to satisfy HIPAA audit requirements.

Full explanation →

682

MCQeasy

What is the default grace period before Cloud KMS permanently destroys a key version that has been scheduled for destruction?

A.24 hours

B.7 days

C.Immediate destruction with no grace period

D.30 days

AnswerA

The default pending destruction period is 24 hours.

Why this answer

When a key version is disabled and scheduled for destruction, there is a 24-hour pending destruction grace period by default. During this time, the key can be restored. After 24 hours, the key version is permanently destroyed.

Full explanation →

683

Multi-Selecteasy

A company must ensure that all data stored in Google Cloud remains within specific geographic regions to meet data residency regulations. Which TWO methods enforce data location restrictions? (Choose TWO.)

Select 2 answers

A.VPC Service Controls

B.Cloud Data Loss Prevention scan

C.Organization Policy constraints (constraints/gcp.resourceLocations)

D.Cloud Storage bucket custom locations (e.g., US, EU)

E.Cloud Interconnect

AnswersC, D

This policy limits resource creation to specified locations, enforcing data residency.

Why this answer

Organization Policy constraints, specifically `constraints/gcp.resourceLocations`, allow administrators to define a list of allowed geographic locations (e.g., `in:us-central1` or `in:europe-west1`) where Google Cloud resources can be created. This policy is enforced at the project, folder, or organization level, preventing resource creation outside the permitted regions, which directly addresses data residency requirements.

Exam trap

Google Cloud often tests the distinction between data location enforcement (Organization Policy constraints) and data access control (VPC Service Controls), causing candidates to mistakenly choose VPC Service Controls for geographic restrictions.

Full explanation →

684

MCQmedium

A company uses Cloud Armor to protect an external HTTPS load balancer. They want to block requests from a specific IP address range 198.51.100.0/24, but allow all other traffic. After creating a deny rule with the source IP condition, they notice that requests from that range are still reaching the backend. What is the most likely cause?

A.Another rule with a lower priority number that allows all traffic is overriding the deny rule.

B.The rule action is set to 'allow' instead of 'deny'.

C.Cloud Armor cannot block traffic based on source IP; it only supports geographic and header-based conditions.

D.The rule uses the wrong match syntax, such as 'sourceIpRange' instead of 'inIpRange'.

AnswerA

Rules are evaluated in priority order; lower number wins. A default allow rule with priority 1000 might override a deny rule with higher priority.

Why this answer

In Cloud Armor, rules are evaluated in order of priority, where lower priority numbers indicate higher precedence. If a rule with a lower priority number (e.g., 1000) allows all traffic, it will be evaluated before a deny rule with a higher priority number (e.g., 2000), causing the deny rule to be overridden. This is the most likely reason the specific IP range is still reaching the backend despite the deny rule being created.

Exam trap

Google Cloud often tests the concept that priority numbers in Cloud Armor are evaluated from lowest to highest, and candidates mistakenly think a deny rule with a higher priority number will take precedence over an allow rule with a lower priority number.

How to eliminate wrong answers

Option B is wrong because if the rule action were set to 'allow' instead of 'deny', it would explicitly permit the traffic, not block it, but the question states the rule was created to deny, so this is a misconfiguration that would be obvious and not the most likely subtle cause. Option C is wrong because Cloud Armor fully supports source IP-based blocking using conditions like 'inIpRange' or source IP ranges in security policies, not just geographic or header-based conditions. Option D is wrong because Cloud Armor uses the 'sourceIpRange' syntax correctly for IP-based conditions; 'inIpRange' is not a valid match syntax in Cloud Armor rules, so this would cause a syntax error rather than silently allowing traffic.

Full explanation →

685

MCQmedium

A company wants to enforce that all Compute Engine disk encryption uses keys managed by their own HSM on-premises, with keys provided per API call. Which encryption type should they choose when creating a persistent disk?

A.Google-managed encryption (GMEK)

B.Cloud HSM-backed keys

C.Customer-supplied encryption (CSEK)

D.Customer-managed encryption (CMEK) with Cloud KMS

AnswerC

Keys are provided per API call; Google does not store them.

Why this answer

CSEK (Customer-Supplied Encryption Keys) allows you to provide your own key with each API call, and Google never stores the key. This is appropriate for on-premises HSM integration.

Full explanation →

686

MCQeasy

Your organization has a multi-project environment with centralized logging in a dedicated project (logging-project). All VPC Service Controls perimeters are configured correctly. The security team needs to ensure that all audit logs from all projects are retained for 5 years and cannot be deleted or modified by any project administrator. They also want to restrict access to the logs to only the security team members (who have the 'Security Reviewer' role at the organization level). Currently, each project has its own log sink that exports to a BigQuery dataset in logging-project. The security team notices that some project administrators have inadvertently deleted logs from their project's BigQuery dataset. You need to recommend a solution that prevents log deletion and enforces the retention policy. What should you do?

A.Configure the log sinks to export logs to a Cloud Storage bucket with a lifecycle rule that deletes objects after 5 years. Set the bucket's IAM policy to deny the storage.objects.delete permission to all users except the security team.

B.Create a new BigQuery dataset in logging-project with a table expiration of 5 years and configure the log sinks to export to this dataset. Grant the security team the BigQuery Data Viewer role and revoke all other users' access to the dataset.

C.Create a new organization-level log sink that exports logs to a BigQuery dataset in logging-project. Grant the security team the BigQuery Data Owner role on the dataset and remove all other project administrators from the dataset's permissions.

D.Configure the _Required and _Default log buckets in each project to route logs to a Cloud Storage bucket in logging-project using log sinks. Enable Object Hold and set a retention policy of 5 years on the bucket. Grant the security team the Storage Object Admin role on the bucket.

AnswerD

Correct: Cloud Storage retention policies and Object Hold prevent deletion or modification of objects during the retention period. This centralizes logs and enforces retention.

Why this answer

It uses a Cloud Storage bucket with a retention policy and Object Hold to prevent deletion or modification of logs for 5 years. The retention policy enforces a minimum retention period, and Object Hold prevents object deletion even by project administrators. Log sinks from each project's _Required and _Default log buckets route logs to this bucket, ensuring centralized, immutable storage.

Granting the security team Storage Object Admin allows them to manage the bucket while restricting others.

Exam trap

Google Cloud often tests the misconception that BigQuery datasets can enforce immutability or that lifecycle rules alone prevent user deletion, when in fact Cloud Storage retention policies and Object Hold are required for true write-once-read-many (WORM) compliance.

How to eliminate wrong answers

Option A is wrong because a lifecycle rule that deletes objects after 5 years does not prevent deletion by users; it only automates deletion after the period, and denying storage.objects.delete to all except security team is not sufficient because project administrators could still delete objects if they have other permissions (e.g., Storage Admin) that override the deny. Option B is wrong because BigQuery datasets do not support immutable retention policies or object-level locks; table expiration only deletes data after 5 years but does not prevent deletion or modification by dataset owners or project administrators with BigQuery Data Editor or Owner roles. Option C is wrong because an organization-level log sink exports logs to BigQuery, which lacks immutability features; granting BigQuery Data Owner to security team still allows other users with inherited roles (e.g., project-level BigQuery Admin) to modify or delete data, and removing project administrators from dataset permissions does not prevent deletion by those with higher-level roles.

Full explanation →

687

MCQmedium

A government contractor needs to deploy workloads on GCP that meet FedRAMP High baseline requirements. They want to enforce resource location restrictions and access controls for Google personnel. Which product should they use?

A.Cloud Security Command Center

B.VPC Service Controls

C.Organization Policies

D.Assured Workloads

AnswerD

Assured Workloads creates a folder with built-in compliance controls, including resource location, personnel access, and encryption requirements for FedRAMP High.

Why this answer

Assured Workloads provides compliance-focused folders that enforce location restrictions, personnel access controls, and other controls specific to the chosen regime (e.g., FedRAMP High).

Full explanation →

688

MCQeasy

Which feature of Cloud Armor uses machine learning to detect and block distributed denial-of-service (DDoS) attacks?

A.Security policies

B.Rate limiting

C.Preconfigured WAF rules

D.Adaptive Protection

AnswerD

Adaptive Protection uses ML for DDoS detection.

Why this answer

Cloud Armor Adaptive Protection uses ML to model normal traffic and detect anomalous patterns indicative of DDoS attacks.

Full explanation →

689

MCQeasy

Which Security Command Center tier includes Event Threat Detection and Container Threat Detection?

A.Premium tier

B.Standard tier

C.Basic tier

D.Enterprise tier

AnswerA

Premium tier includes Event Threat Detection, Container Threat Detection, VM Threat Detection, Rapid Vulnerability Detection, and Compliance monitoring.

Why this answer

Premium tier adds threat detection services beyond the Standard tier's health analytics and scanner.

Full explanation →

690

MCQmedium

An organization uses VPC Service Controls to protect BigQuery. They want to test a new access level that allows access only from a specific IP range before enforcing it. Which mode should they use?

A.Dry-run mode

B.Audit mode

C.Enforced mode

D.Preview mode

AnswerA

Dry-run mode logs violations but does not block them.

Why this answer

Dry-run mode allows testing perimeters without enforcement, logging violations for review.

Full explanation →

691

MCQmedium

A company is using Cloud DLP to inspect a BigQuery table containing customer PII. They want to redact all credit card numbers found in a column by replacing them with a token that preserves the format (e.g., last 4 digits visible). Which de-identification transform should they use?

A.MaskingConfig with a masking character

B.DateShiftConfig

C.BucketingConfig

D.CryptoReplaceFfxFpeConfig

AnswerD

FPE preserves the format and can keep last 4 digits visible.

Why this answer

CryptoReplaceFfxFpeConfig performs format-preserving encryption (FPE), which can replace a value with a token that retains the format, such as last 4 digits visible.

Full explanation →

692

MCQmedium

An organization needs to enforce a TLS minimum version of 1.2 for all traffic to their HTTPS load balancers. They have multiple load balancers serving different domains. Which Google Cloud feature should they use?

A.Use a global network endpoint group (NEG) with an SSL policy.

B.Create an SSL policy with TLS 1.2 as the minimum version and attach it to the target HTTPS proxy.

C.Create a Cloud Armor security policy with a rule to block TLS 1.0 and 1.1.

D.Configure the backend instances to reject TLS 1.0 and 1.1 connections.

AnswerB

Correct: SSL policies define TLS profiles and can enforce minimum TLS version.

Why this answer

SSL policies allow you to configure the minimum TLS version and cipher suites for HTTPS load balancers. You can create an SSL policy with TLS 1.2 as the minimum and attach it to the target HTTPS proxy of each load balancer.

Full explanation →

693

MCQmedium

A company uses multiple Google Cloud projects. A service account in Project A needs to read data from a Cloud Storage bucket in Project B. What is the correct way to grant access?

A.Make the bucket publicly accessible and use signed URLs.

B.Grant the service account the Project Viewer role on Project B.

C.Add the service account as a member of Project B with the Storage Object Viewer role.

D.Add the service account as a member of the bucket's IAM policy with the Storage Object Viewer role.

AnswerD

This grants least-privilege access specifically to the bucket.

Why this answer

Cloud Storage uses IAM policies at the resource (bucket) level to grant cross-project access. By adding the service account from Project A as a member of the bucket's IAM policy in Project B with the Storage Object Viewer role, you grant the service account read-only access to objects in that bucket without requiring membership in Project B itself. This follows the principle of least privilege and avoids unnecessary project-level permissions.

Exam trap

The trap here is that candidates often confuse project-level IAM roles with resource-level IAM roles, assuming that adding a service account as a member of the target project is necessary, when in fact Cloud Storage supports direct resource-level IAM binding for cross-project access.

How to eliminate wrong answers

Option A is wrong because making the bucket publicly accessible exposes data to the entire internet, which violates security best practices and is unnecessary for granting access to a specific service account. Option B is wrong because the Project Viewer role grants read-only access to all resources in Project B, which is overly permissive and does not specifically grant access to the bucket's objects. Option C is wrong because adding the service account as a member of Project B with the Storage Object Viewer role grants the role at the project level, which applies to all buckets in Project B, violating least privilege and potentially granting unintended access.

Full explanation →

694

MCQeasy

Which of the following is a key advantage of using Workload Identity Federation over service account keys for authenticating workloads running on AWS?

A.It allows the use of short-lived tokens instead of long-lived keys.

B.It eliminates the need to create service accounts.

C.It supports MFA for workload authentication.

D.It reduces latency compared to using keys.

AnswerA

Short-lived tokens reduce risk of key exposure.

Why this answer

Workload Identity Federation allows workloads to use short-lived tokens from the external identity provider (e.g., AWS STS) to impersonate a Google service account, eliminating the need to manage and rotate long-lived keys. Service account keys are long-lived secrets that can be leaked.

Full explanation →

695

Multi-Selecteasy

Which TWO of the following are valid ways to grant cross-project access to a Cloud Storage bucket in Project A from a Compute Engine VM in Project B?

Select 2 answers

A.Disable uniform bucket-level access on the bucket and add an ACL entry for the VM's service account.

B.Grant the VM's service account (from Project B) the roles/storage.objectViewer role on the bucket in Project A.

C.Grant the VM's user account the roles/storage.objectViewer role on the bucket, and have the VM use gcloud with the user's credentials.

D.Use an IAM condition on the bucket that allows access only when the requester is the service account from Project B.

E.Provide the bucket's service account key to the VM and have the VM use that key for authentication.

AnswersB, D

Direct role grant to the service account is valid.

Why this answer

Granting the VM's service account the roles/storage.objectViewer role on the bucket in Project A uses IAM-based cross-project access. IAM roles are the recommended method for granting access to resources across projects, as they allow a service account from one project to be granted permissions on resources in another project without needing to share keys or disable uniform bucket-level access.

Exam trap

Google Cloud often tests the misconception that ACLs or sharing service account keys are valid cross-project access methods, when in fact IAM roles and IAM conditions are the only supported mechanisms for granting cross-project access to Cloud Storage buckets.

Full explanation →

696

MCQmedium

A service provider wants to expose an internal service to external consumers in a controlled manner, without giving them direct access to the VPC. Which Google Cloud service should be used?

A.Private Service Connect

B.Cloud VPN

C.Cloud NAT

D.VPC Peering

AnswerA

PSC enables publishing services with private connectivity.

Why this answer

Private Service Connect allows service providers to publish their services via PSC endpoints, which consumers can access privately from their own VPCs without traversing the internet.

Full explanation →

697

MCQmedium

A company is deploying a multi-region application in Cloud Run and must comply with data residency requirements in the European Union (EU). They want to ensure that only EU-based Cloud Run instances are created. Which approach should they use?

A.Add a label to the Cloud Run service specifying the region and rely on developers to follow it.

B.Set an Organization Policy with constraints/gcp.resourceLocations to restrict allowed regions to EU regions.

C.Use VPC Service Controls to limit access to the Cloud Run service from outside the EU.

D.Configure VPC Firewall rules to only allow egress to EU IP addresses.

AnswerB

This policy will prevent creation of Cloud Run services outside the allowed regions.

Why this answer

Organization Policies with the `constraints/gcp.resourceLocations` constraint allow administrators to enforce a list of allowed Google Cloud regions for resource creation. By setting this policy to include only EU-based regions (e.g., `europe-west1`, `europe-west4`), the company ensures that Cloud Run instances cannot be created outside the EU, directly meeting data residency compliance requirements. This is a preventive control that applies at the project or folder level, overriding any developer choices.

Exam trap

The trap here is that candidates confuse network-level controls (VPC Service Controls, Firewall rules) with resource location enforcement, thinking that restricting access or egress to EU IPs is equivalent to ensuring resources are physically created in EU regions.

How to eliminate wrong answers

Option A is wrong because relying on labels and developer discipline is not an enforceable compliance control; labels are metadata and do not prevent resource creation in non-EU regions. Option C is wrong because VPC Service Controls restrict data exfiltration and access to services from outside a VPC perimeter, but they do not restrict the geographic location where Cloud Run instances are created; they control network access, not resource placement. Option D is wrong because VPC Firewall rules control network traffic based on IP addresses, not the location of resource creation; they cannot prevent a Cloud Run service from being deployed in a non-EU region, and EU IP ranges do not map cleanly to region-based compliance requirements.

Full explanation →

698

MCQeasy

A company wants to grant a user the ability to delete a Cloud SQL instance but not be able to modify any other settings. What is the least privileged role?

A.roles/cloudsql.viewer

B.roles/cloudsql.editor

C.roles/cloudsql.admin

D.Use a custom role with only cloudsql.instances.delete permission.

AnswerD

A custom role with this single permission meets the requirement exactly.

Why this answer

The least privileged role that allows deleting a Cloud SQL instance without granting any other permissions is a custom role containing only the `cloudsql.instances.delete` permission. Predefined roles like viewer, editor, or admin include broader permissions that would allow modifying other settings, violating the principle of least privilege.

Exam trap

The trap here is that candidates may assume a predefined role like `roles/cloudsql.editor` is the least privileged because it includes delete, but they overlook that it also grants modify permissions, which violates the 'least privileged' requirement.

How to eliminate wrong answers

Option A is wrong because `roles/cloudsql.viewer` only grants read-only permissions (e.g., `cloudsql.instances.get`) and does not include the `cloudsql.instances.delete` permission, so it cannot delete an instance. Option B is wrong because `roles/cloudsql.editor` includes permissions to modify instance settings (e.g., `cloudsql.instances.update`) in addition to delete, which exceeds the requirement. Option C is wrong because `roles/cloudsql.admin` grants full control over Cloud SQL instances, including all create, update, and delete permissions, far beyond the single delete action needed.

Full explanation →

699

MCQeasy

An organization needs to block all inbound SSH traffic (port 22) to a set of VM instances that have a common tag 'ssh-restricted'. They want to deny this traffic at the VPC firewall level. Which firewall rule configuration should they use?

A.Allow rule: direction EGRESS, protocol tcp, port 22, target tag 'ssh-restricted'

B.Deny rule: direction INGRESS, protocol tcp, port 22, target service account 'ssh-restricted'

C.Deny rule: direction INGRESS, protocol tcp, port 22, target tag 'ssh-restricted'

D.Allow rule: direction INGRESS, protocol tcp, port 22, source tag 'ssh-restricted'

AnswerC

This correctly denies inbound SSH to VMs with the specified tag.

Why this answer

To block SSH, a deny rule with direction INGRESS, protocol tcp, port 22, and target tag 'ssh-restricted' is needed.

Full explanation →

700

MCQhard

An organization has a Google Cloud organization node with multiple folders for different departments. A deny policy is set at the organization level to block the use of shielded VM constraints. Later, an allow policy at the folder level grants the compute.instances.create permission. A user in that folder tries to create a new VM without shielded VM enabled. What will happen?

A.The user can create the VM because the folder allow policy grants compute.instances.create

B.The VM creation fails because the deny policy at the organization level overrides the folder allow policy

C.The VM is created but without shielded VM because the folder policy allows it

D.The VM creation succeeds because allow policies take precedence over deny policies

AnswerB

Deny policies are evaluated before allow policies and can deny specific permissions, overriding any allows.

Why this answer

Deny policies override allow policies. Since the deny policy at the organization level blocks shielded VM usage, the allow policy at the folder level cannot override it. The VM creation will fail because the deny policy explicitly denies permissions related to shielded VM constraints.

Full explanation →

701

MCQmedium

A DevOps engineer needs to create a custom IAM role that allows creating and deleting Compute Engine instances but not stopping or starting them. Which permissions should be included?

A.compute.instances.start and compute.instances.stop

B.compute.instances.create, compute.instances.delete, and compute.instances.update

C.compute.instances.create and compute.instances.delete

D.compute.instances.create

AnswerC

Correct: these allow create and delete only.

Why this answer

To create and delete instances, the permissions compute.instances.create and compute.instances.delete are required. compute.instances.stop and compute.instances.start are separate permissions for stopping/starting. compute.instances.update is for modifying existing instances.

Full explanation →

702

MCQmedium

Your company is deploying a web application on Google Kubernetes Engine (GKE) with an Internal Load Balancer (ILB) as the ingress. The application must only be accessible from within the same VPC and from an on-premises network connected via Cloud VPN. The on-premises network uses IP range 10.0.0.0/8. You have already created the ILB with a backend service. What is the most secure way to restrict access to the ILB?

A.Configure a VPC firewall rule to deny all ingress traffic to the ILB's forwarding rule IP address, and then create a higher-priority allow rule for the VPC and on-premises ranges

B.Configure the backend service's firewall rules to only allow traffic from the ILB's health check ranges and from the VPC and on-premises source ranges

C.Use GKE Network Policy to restrict ingress traffic to the application pods from the VPC and on-premises ranges

D.Use Cloud Armor to create a security policy that allows traffic only from the VPC and on-premises ranges, and attach it to the ILB

AnswerB

Correct: Firewall rules on the backend instances allow traffic from the ILB's health check probes and from permitted source ranges, ensuring only desired traffic reaches the application.

Why this answer

The most secure way to restrict access to an Internal Load Balancer (ILB) is to apply firewall rules directly on the backend service (the instance group or NEG). This ensures that only traffic from the ILB's health check probe ranges (130.211.0.0/22 and 35.191.0.0/16 for GKE) and the allowed source ranges (VPC and on-premises) can reach the backend instances. This approach prevents any traffic from reaching the backend except through the ILB, which is the intended secure design for an internal-only application.

Exam trap

Google Cloud often tests the misconception that VPC firewall rules can be applied to a load balancer's forwarding rule IP address, but in reality, firewall rules only apply to VM instances or GKE nodes, not to forwarding rules or load balancer IPs.

How to eliminate wrong answers

Option A is wrong because VPC firewall rules cannot be applied to the ILB's forwarding rule IP address; forwarding rules are not network interfaces and are not subject to VPC firewall rules. Option C is wrong because GKE Network Policy operates at the pod level and cannot restrict traffic to the ILB itself; it only controls traffic between pods, not traffic arriving via the ILB. Option D is wrong because Cloud Armor security policies cannot be attached to an Internal Load Balancer; Cloud Armor only supports external load balancers (HTTP(S), SSL Proxy, TCP Proxy) and not ILBs.

Full explanation →

703

MCQmedium

A company is using Cloud NAT to allow instances in a private subnet to access the internet. They notice that some instances are unable to reach external services. The NAT gateway is configured with a single IP address. Which action would most likely resolve the issue?

A.Change the NAT type to static

B.Change the VPC firewall rules to allow egress from the NAT IP

C.Increase the number of NAT IPs

D.Enable TCP established connections only

AnswerC

More NAT IPs increase available ports, reducing the chance of port exhaustion.

Why this answer

The issue is that a single NAT IP address can run out of available ports (each TCP/UDP session consumes a unique source port), causing new connections to fail. Increasing the number of NAT IPs expands the port pool, allowing more concurrent outbound connections. This directly addresses the port exhaustion problem without changing firewall rules or NAT type.

Exam trap

Google Cloud often tests the misconception that firewall rules or NAT type changes fix connectivity issues, when the real problem is port exhaustion from a single NAT IP under heavy connection load.

How to eliminate wrong answers

Option A is wrong because Cloud NAT does not have a 'static' type; the NAT type is either public (with ephemeral or static IPs) or private, and changing the type does not resolve port exhaustion. Option B is wrong because VPC firewall rules control traffic based on source/destination IPs and ports, but the NAT IP is the source IP for outbound traffic; egress rules must allow traffic from the instances' private IPs (or the NAT IP), but the issue is port capacity, not firewall blocking. Option D is wrong because 'TCP established connections only' is a firewall rule concept (e.g., connection tracking) and does not apply to NAT gateway configuration; Cloud NAT handles all protocols and does not have a setting to limit to established connections.

Full explanation →

704

Multi-Selectmedium

A company wants to implement least privilege access for a team that needs to monitor and manage Cloud Run services. Which two IAM roles should be considered? (Choose two.)

Select 2 answers

A.roles/iam.serviceAccountUser

B.roles/run.admin

C.roles/run.viewer

D.roles/run.developer

E.roles/run.invoker

AnswersC, D

Allows viewing services and configurations.

Why this answer

(roles/run.viewer) is correct because it grants read-only permissions to view Cloud Run services, configurations, and revisions, which is sufficient for monitoring without allowing modifications. Option D (roles/run.developer) is correct because it allows both viewing and managing Cloud Run services (e.g., deploying new revisions, updating configurations) while still restricting access to other GCP resources, aligning with least privilege for a team that needs to both monitor and manage.

Exam trap

Google Cloud often tests the distinction between 'viewer' and 'developer' roles, where candidates mistakenly choose 'run.admin' thinking it is needed for management, or 'run.invoker' thinking it covers monitoring, but the exam expects precise matching of permissions to the tasks of monitoring (read-only) and managing (deploy/update) without full administrative control.

Full explanation →

705

Multi-Selecthard

A company runs containerized applications on GKE and uses Binary Authorization. They want to enforce that only images from a specific Artifact Registry repository can be deployed, and those images must be signed by a trusted attestor. Which THREE configurations are required?

Select 3 answers

A.Set up a Binary Authorization policy that requires attestation.

B.Create an attestation note and attestor in Binary Authorization.

C.Configure an Artifact Registry repository with a vulnerability scanning policy.

D.Add a constraint to the GKE cluster's Binary Authorization policy that restricts the allowed registry to the specific Artifact Registry repository.

E.Create a Cloud KMS key and an attestor in the same project as the repository.

AnswersA, B, D

This is the core policy to require signed images.

Why this answer

The three requirements: a Binary Authorization policy requiring attestation, an attestor (with note), and a policy constraint to restrict allowed registries.

Full explanation →

706

MCQmedium

A security team wants to ensure that all service account key creation events in their organization are logged and alerted on. Which logging feature should they use?

A.Enable System Event audit logs for the IAM service.

B.Enable Data Access audit logs for the IAM service.

C.Enable Access Transparency logs for the IAM service.

D.Enable Admin Activity audit logs for the IAM service.

AnswerD

Admin Activity logs record all administrative actions, including creating keys.

Why this answer

Admin Activity audit logs capture operations that modify the configuration or metadata of resources, such as creating or deleting service account keys. Since the question asks about logging key creation events, Admin Activity logs are the correct choice because they record all administrative actions, including service account key creation, by default and cannot be disabled. Data Access audit logs, by contrast, track data-level operations like reading or writing data, not administrative changes.

Exam trap

Google Cloud often tests the distinction between Admin Activity and Data Access logs, where candidates mistakenly choose Data Access for any security-related logging, not realizing that key creation is an administrative action, not a data access operation.

How to eliminate wrong answers

Option A is wrong because System Event audit logs are not a valid log type in Google Cloud; the correct log categories are Admin Activity, Data Access, and Access Transparency. Option B is wrong because Data Access audit logs record operations that read or modify user-provided data, such as reading objects in Cloud Storage, not administrative actions like creating service account keys. Option C is wrong because Access Transparency logs capture actions taken by Google personnel when accessing your data, not actions performed by your own service accounts or administrators.

Full explanation →

707

MCQhard

A security engineer wants to enable Access Transparency for their organization. After enabling it in the Admin Console, they notice that some access logs are missing. What is the most likely reason?

A.Access Transparency only logs access by Google personnel, not by third-party vendors.

B.Access Transparency must be enabled for each individual project, not just the organization.

C.The service being accessed does not support Access Transparency.

D.The IAM policy for the organization does not grant the required permissions.

AnswerC

Access Transparency is supported only by certain services; unsupported services will not produce logs.

Why this answer

Access Transparency logs are only generated for services that support Access Transparency and have the feature enabled. At the time of writing, not all GCP services support Access Transparency. If the missing logs are for unsupported services, they will not appear.

Full explanation →

708

MCQeasy

Which Google Cloud SIEM solution ingests logs from various sources, normalizes them into the Unified Data Model (UDM), and allows detection using YARA-L rules?

A.Chronicle

B.Cloud Logging

C.BigQuery

D.Security Command Center

AnswerA

Chronicle is the SIEM that uses UDM and YARA-L.

Why this answer

Chronicle is Google Cloud's SIEM solution that ingests logs, normalizes them into UDM, and enables detection rules with YARA-L. Security Command Center is a security posture management tool, not a SIEM. Cloud Logging is for log storage and analysis, not SIEM.

BigQuery is a data warehouse.

Full explanation →

709

MCQhard

You are designing a multi-tier application with a frontend and backend. The frontend instances are in subnet A (10.0.1.0/24), and the backend instances are in subnet B (10.0.2.0/24). Both subnets are in the same VPC. You want to allow the frontend to communicate with the backend on TCP port 8080, but the backend must not be able to initiate connections to the frontend. Additionally, the backend must be able to send patches to the internet. Which set of firewall rules should you implement?

A.Ingress rule on frontend: allow tcp:8080 from backend's service account; Egress rule on backend: allow all to internet

B.Ingress rule on backend: allow tcp:8080 from subnet A; Egress rule on backend: allow all to internet

C.Ingress rule on frontend: allow tcp:8080 from subnet B; Egress rule on backend: allow all to internet

D.Ingress rule on backend: allow tcp:8080 from subnet A; Egress rule on frontend: deny all to internet

AnswerB

Correct: Ingress on backend allows frontend-initiated traffic only. Egress on backend allows backend to reach internet for patches. No rule allows backend to initiate to frontend.

Why this answer

The frontend in subnet A initiates connections to the backend on TCP port 8080, so an ingress rule on the backend allowing traffic from subnet A permits this. An egress rule on the backend allowing all traffic to the internet enables patch downloads. This setup prevents the backend from initiating connections to the frontend, as no egress rule on the backend targets the frontend, and no ingress rule on the frontend allows unsolicited traffic from the backend.

Exam trap

Google Cloud often tests the distinction between ingress and egress rules and the direction of traffic flow; the trap here is that candidates mistakenly place the ingress rule on the frontend (thinking it needs to 'receive' the connection) instead of on the backend, which actually receives the connection from the frontend.

How to eliminate wrong answers

Option A is wrong because it places the ingress rule on the frontend, which would allow the backend to initiate connections to the frontend, violating the requirement that the backend must not initiate connections to the frontend; also, service accounts are not typically used in VPC firewall rules for subnet-level traffic. Option C is wrong because it places the ingress rule on the frontend allowing traffic from subnet B, which would permit the backend to initiate connections to the frontend, again violating the requirement. Option D is wrong because it denies all egress traffic from the frontend, which would block the frontend from sending requests to the backend (since egress is denied), and the backend still needs an egress rule to reach the internet for patches, which is missing.

Full explanation →

710

MCQeasy

A company needs to enforce that all incoming traffic to their HTTPS load balancer must use TLS 1.2 or higher. Which SSL policy setting should they configure on the target HTTPS proxy?

A.Set the minimum TLS version to 1.3 only

B.Set the minimum TLS version to 1.2 and cipher profile to MODERN

C.Set the minimum TLS version to 1.0 and cipher profile to RESTRICTED

D.Use a self-managed certificate with TLS 1.2 enforcement

AnswerB

This ensures that only TLS 1.2 or higher is accepted. MODERN profile supports TLS 1.2 and 1.3.

Why this answer

SSL policies allow you to set the minimum TLS version. To require TLS 1.2 or higher, set the minimum TLS version to 1.2. The cipher profile can be set to MODERN or RESTRICTED, but the key is the minimum TLS version.

Full explanation →

711

MCQmedium

A security engineer needs to configure firewall rules to allow traffic from a set of compute instances to a set of backend instances. The engineer wants to use a method that is more secure and scalable than using network tags. Which approach should they use?

A.Use firewall rules with source service accounts and target service accounts

B.Use hierarchical firewall policies

C.Use firewall rules with source tags and target tags

D.Use network firewall policies

AnswerA

Service accounts provide identity-based security that is immutable and more scalable than tags.

Why this answer

Service accounts as firewall rule targets are preferred over network tags because they are immutable, tied to the identity of the instance, and reduce dependency on tag management. This approach is more secure and scalable.

Full explanation →

712

MCQhard

An organization uses Cloud VPN tunnels to connect multiple VPCs. They need to record all network metadata for compliance audits without affecting throughput. What is the most effective approach?

A.Enable VPC Flow Logs on all subnets and export logs to a centralized BigQuery dataset.

B.Install a third-party packet inspection appliance in each VPC.

C.Configure Packet Mirroring to mirror all VPN traffic to a collector.

D.Use Cloud Logging to capture VPN tunnel logs from Cloud Router.

AnswerA

VPC Flow Logs provide metadata with negligible performance overhead and are suitable for compliance auditing.

Why this answer

VPC Flow Logs capture metadata of all network flows with minimal performance impact, and exporting to BigQuery enables analysis. Option B is resource-intensive and may impact throughput. Option C only captures VPN tunnel status, not traffic metadata.

Option D mirrors traffic, which can be costly and impact performance.

Full explanation →

713

Multi-Selectmedium

A company is using Assured Workloads with the FEDRAMP_HIGH regime. They need to restrict where resources can be created and monitor for compliance violations. Which TWO settings should they configure? (Choose 2)

Select 2 answers

A.Access Transparency logs

B.Data residency controls

C.Resource location restrictions

D.Google personnel access restrictions

E.Compliance monitoring (drift detection)

AnswersC, E

This restricts resource deployment to allowed regions.

Why this answer

Resource location restrictions limit the regions where resources can be deployed. Compliance monitoring (or compliance drift monitoring) alerts when resources violate policies. Google personnel access restrictions control internal access, and Access Transparency logs provide logs.

Data residency is similar to resource location.

Full explanation →

714

MCQhard

A company has a GKE cluster with a Kubernetes Service Account (KSA) that needs to access Cloud Storage. They want to bind the KSA to a Google Cloud service account (GCP SA) so that pods running under the KSA inherit the GCP SA's permissions. They have enabled Workload Identity on the cluster. What is the correct step to bind the KSA to the GCP SA?

A.Annotate the KSA with iam.gke.io/gcp-service-account=GCP_SA_EMAIL. No further steps are needed.

B.Create a JSON key for the GCP SA and store it as a Kubernetes secret, then mount it into the pods.

C.Grant the GCP SA the role roles/iam.serviceAccountUser on the KSA.

D.Grant the KSA the role iam.workloadIdentityUser on the GCP SA by running: gcloud iam service-accounts add-iam-policy-binding GCP_SA_EMAIL --member=serviceAccount:PROJECT_ID.svc.id.goog[NAMESPACE/KSA_NAME] --role=roles/iam.workloadIdentityUser

AnswerD

This is the correct IAM binding to allow the KSA to impersonate the GCP SA.

Why this answer

The correct binding is to grant the 'iam.workloadIdentityUser' role on the GCP SA to the KSA's identity. The KSA identity is represented in IAM as the principal 'serviceAccount:PROJECT_ID.svc.id.goog[NAMESPACE/KSA_NAME]'. This allows the KSA to impersonate the GCP SA.

Creating a service account key defeats the purpose of Workload Identity. Adding an annotation to the KSA is necessary but not sufficient; the IAM binding is also required.

Full explanation →

715

Matchingmedium

Match each Cloud KMS key purpose to its description.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Same key for encrypt and decrypt

Public key encrypt, private key decrypt

Private key signs, public key verifies

Periodically generate new key material

Bring your own key (BYOK) into Cloud KMS

Why these pairings

Cloud KMS key purposes include symmetric encryption (same key for encrypt/decrypt), asymmetric signing (private key to sign, public key to verify), and MAC (key for message authentication). Common confusions involve mixing symmetric and asymmetric operations.

Full explanation →

716

MCQhard

An organization wants to enforce that all Compute Engine instances in a project have a specific tag (e.g., 'env=prod') before they can be created. Which approach should be used?

A.Use an organization policy with a list constraint to require a specific tag on Compute Engine instances.

B.Create a Cloud Audit Logs sink and trigger a Cloud Function to delete instances without the tag.

C.Use a hierarchical firewall policy with a tag condition.

D.Create an organization policy with constraint `compute.requireOsLogin` set to true.

AnswerA

Organization policy constraints such as `compute.requireTags` (or custom constraint) can enforce that resources have specific tags.

Why this answer

Use Organization Policy with a constraint that requires tags on resources. The constraint `compute.requireOsLogin` is not related. Resource Manager tags can be enforced via Organization Policy using the `constraints/tags` constraint.

Full explanation →

717

MCQmedium

A security analyst needs to mute a recurring false positive finding in Security Command Center so that it no longer appears in the active findings list. The analyst wants to keep the finding for historical reference. What should they do?

A.Set the finding's state to 'INACTIVE'

B.Create a filter to exclude the finding from view

C.Mute the finding using the SCC console or API

D.Delete the finding from SCC

AnswerC

Muting hides the finding but retains it.

Why this answer

Muting a finding in SCC hides it from active views but retains it for auditing. Muting can be done individually or via mute rules based on properties.

Full explanation →

718

MCQeasy

An organization wants to restrict access to Google Cloud APIs such as BigQuery and Cloud Storage so that only resources within a specific VPC network can call these APIs, and no traffic from other VPCs or on-premises networks is allowed. Which Google Cloud service should they use?

A.Firewall Rules

B.Identity-Aware Proxy

C.Cloud Armor

D.VPC Service Controls

AnswerD

VPC Service Controls use service perimeters to restrict API access to resources within a VPC, preventing unauthorized access from other networks.

Why this answer

VPC Service Controls create service perimeters that restrict access to Google Cloud APIs based on the requesting network's context. This prevents data exfiltration and ensures only resources in the specified VPC can access the APIs.

Full explanation →

719

MCQhard

A security engineer needs to block traffic from all IP addresses in a specific geographic region from reaching an HTTPS load-balanced application. The application uses Cloud Load Balancing with an external HTTPS load balancer. Which approach should the engineer use?

A.Create a VPC firewall rule that denies ingress from the region's IP ranges.

B.Use Identity-Aware Proxy (IAP) to block access based on the user's location.

C.Configure a Cloud CDN policy to block traffic from certain regions.

D.Create a Cloud Armor security policy with a geo-based deny rule and attach it to the load balancer.

AnswerD

Correct: Cloud Armor can inspect client IPs even behind a load balancer and apply geo-blocking rules.

Why this answer

Cloud Armor security policies can be attached to external HTTPS load balancers to filter traffic based on geolocation. The engineer can create a Cloud Armor security policy with a rule that uses the geo-tag to deny traffic from the specified region.

Full explanation →

720

MCQhard

A security team needs to enforce that only requests originating from a corporate IP range (203.0.113.0/24) can access a Cloud Storage bucket containing sensitive data. They have created a custom IAM role with storage.objects.get permission and attached a condition that requires the request to have a specific IP address. However, some legitimate users outside the IP range are unable to access the data. What is the most likely cause?

A.Users must use a VPN to be assigned a corporate IP, but some are not connected.

B.The condition uses the attribute 'request.network' instead of 'source.ip'.

C.The bucket ACL is set to deny all access by default.

D.The IAM condition evaluates after authentication, and users are already authenticated; the condition is not restricting based on source IP correctly because the condition is on the user's identity, not the request's source IP.

AnswerD

IAM conditions can restrict by source IP, but if misconfigured (e.g., using wrong attribute or not applying to the correct principal), they may not work; the most likely cause is that the condition is not properly written to check the source IP.

Why this answer

IAM conditions on a custom role binding are evaluated after the user is authenticated and are based on the user's identity attributes (such as the user's email or group membership). To restrict access based on the request's originating IP address, the condition must reference the attribute `request.source.ip`. If the condition instead checks an identity attribute (e.g., `resource.name` or `request.auth`), it will not enforce the IP restriction.

As a result, legitimate users outside the corporate IP range are blocked because the condition evaluates something about their identity that they do not satisfy, rather than checking their IP address.

Exam trap

Google Cloud often tests the distinction between IAM condition attributes for request (e.g., source.ip) and identity (e.g., user.ip). Candidates may overlook that using an identity attribute like user.ip does not enforce the request's originating IP, leading to incorrect access control.

How to eliminate wrong answers

Option A is wrong because the issue is not about VPN connectivity; the condition is supposed to restrict access based on source IP, but if the condition is misconfigured, even users with a corporate IP via VPN may be blocked or allowed incorrectly. Option B is wrong because 'request.network' is not a valid attribute for IAM conditions in Google Cloud; the correct attribute for source IP is 'source.ip', so using 'request.network' would cause a syntax error or be ignored, not partially block users. Option C is wrong because bucket ACLs are separate from IAM policies; if the ACL is set to deny all, no one would access the bucket, but the problem states that some legitimate users outside the IP range are unable to access, implying that the ACL is not the primary issue.

Full explanation →

721

Matchingmedium

Match each CVE or security concept to its description.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Log4j remote code execution vulnerability

Heartbleed OpenSSL vulnerability

Apache Struts2 remote code execution

Windows CryptoAPI spoofing vulnerability

BlueKeep RDP remote code execution

Why these pairings

Correct matches: CVE-2017-0144 (EternalBlue) exploits SMB; CVE-2021-44228 (Log4Shell) targets Log4j; CVE-2014-0160 (Heartbleed) leaks OpenSSL memory; buffer overflow is a general memory corruption. Distractors swap descriptions between CVEs.

Full explanation →

722

MCQmedium

A multinational organization must ensure that data for European users is stored only within the European Union to comply with GDPR. They use Cloud Storage and BigQuery. Which design should they implement?

A.Use Cloud DLP to inspect and tag data for European origin.

B.Use VPC Service Controls to create a perimeter around European resources.

C.Set an organization policy with constraints/gcp.resourceLocations to restrict resource creation to EU regions.

D.Use Cloud Armor with geo-based access control to restrict access from non-EU locations.

AnswerC

Organization policies can enforce that resources like buckets and datasets are created only in allowed locations.

Why this answer

The organization policy constraint `gcp/resourceLocations` is the only design that proactively prevents data from being stored outside the EU. By setting this constraint to allow only EU regions (e.g., `europe-west1`, `europe-west4`), any attempt to create a Cloud Storage bucket or BigQuery dataset in a non-EU region will be denied at the API level, ensuring GDPR compliance by design.

Exam trap

Google Cloud often tests the distinction between data access control and data residency enforcement; the trap here is confusing geo-based access controls (Cloud Armor) or data exfiltration prevention (VPC Service Controls) with the ability to restrict where data is physically stored, which requires a resource location policy.

How to eliminate wrong answers

Option A is wrong because Cloud DLP inspects and classifies data but does not enforce storage location; it only tags data for discovery, not for residency control. Option B is wrong because VPC Service Controls create a security perimeter around resources to prevent data exfiltration, but they do not restrict where resources can be created or stored; a bucket could still be created in a non-EU region within the perimeter. Option D is wrong because Cloud Armor with geo-based access control restricts user access based on geographic location, but it does not control where data is physically stored; data could still reside outside the EU.

Full explanation →

723

MCQeasy

A company uses Cloud Storage buckets to store customer uploads. Recently, a customer reported that a file they uploaded yesterday is missing. The bucket has object versioning enabled. The security team wants to investigate how the file went missing and whether any other files have been affected. The company's compliance requirements mandate that all object deletions must be logged and reviewed. What should the admin do first to investigate the missing file?

A.Check the access logs in the Storage bucket's logs section.

B.Use gsutil ls -a to list all versions of objects in the bucket.

C.Enable Object Lifecycle Management to restore deleted objects.

D.Check Cloud Logging for storage.googleapis.com/object_delete events.

AnswerD

Cloud Logging logs object deletions by default; this provides the time, user, and method of deletion, which is essential for investigation.

Why this answer

Checking Cloud Logging for storage.googleapis.com/object_delete events is the most direct way to determine if the file was deleted and by whom. Option A is incorrect because access logs in the Storage bucket's logs section may not be enabled and do not specifically show delete events. Option B is incorrect because listing versions only shows existing versions but does not reveal who deleted the object.

Option C is incorrect because Object Lifecycle Management automates deletion policies but does not assist in investigating past deletions.

Full explanation →

724

MCQmedium

Refer to the exhibit. A Cloud Run service fails to start and shows the above error. What is the most likely cause?

A.The container requires more memory than allocated

B.The PORT environment variable is not defined in the container

C.The application is configured to listen on a different port than the one specified by PORT

D.The number of concurrent requests exceeds the container's limit

AnswerC

Cloud Run injects PORT; the container must bind to that port. If the app listens on another port, it fails to start.

Why this answer

The error explicitly states the container is not listening on the port defined by PORT. Cloud Run expects the container to bind to the port specified in the PORT env var (default 8080). Option A is wrong; insufficient memory causes different errors.

Option B is wrong; the error is about listening, not the variable missing. Option D is wrong; concurrent requests are runtime limits, not startup issues.

Full explanation →

725

MCQmedium

A security team wants to explicitly deny access to a Cloud Storage bucket for all users except the bucket owner. Currently, there are allow policies at the project level granting Storage Object Viewer to all users. What is the most efficient way to implement this?

A.Create an Organization Policy that denies access to the bucket for all users except the owner.

B.Modify the project-level role to include a condition that only allows the bucket owner.

C.Remove the project-level Storage Object Viewer role and grant it only to the bucket owner.

D.Create an IAM deny policy on the bucket with a deny rule for all principals (principalSet: allUsers) and an exception for the bucket owner.

AnswerD

IAM deny policies explicitly deny and can exclude principals.

Why this answer

Google Cloud IAM deny policies explicitly deny access to resources, overriding any allow policies. By creating a deny rule on the bucket with `principalSet: allUsers` as the denied principal and an exception for the bucket owner, you effectively block all users except the owner, regardless of project-level allow roles. This is the most efficient approach as it does not require modifying existing project-level policies or removing roles.

Exam trap

Google Cloud often tests the misconception that removing an allow role is sufficient to deny access, but in cloud IAM, explicit deny policies are required to override inherited allow policies, especially when project-level roles grant broad access.

How to eliminate wrong answers

Option A is wrong because Organization Policies are used to enforce constraints on resource usage (e.g., location restrictions), not to manage IAM access control for specific resources like a bucket. Option B is wrong because modifying the project-level role with a condition would require complex condition logic and still apply to all resources in the project, not just the bucket; it also does not explicitly deny access. Option C is wrong because removing the project-level role and granting it only to the bucket owner would affect all buckets in the project and does not explicitly deny access to other users; it only removes the allow, which is less secure than an explicit deny.

Full explanation →

726

Multi-Selectmedium

A company wants to use Cloud Audit Logs to monitor for security incidents. They need to retain logs for 6 months for analysis and then archive them for 5 years. Which TWO steps should they take?

Select 2 answers

A.Create a log sink to Cloud Storage with the Archive storage class and Bucket Lock retention of 5 years.

B.Rely on the default 400-day retention in Cloud Logging.

C.Enable Data Access logs for all services.

D.Create a log sink to Pub/Sub and store in Cloud SQL.

E.Create a log sink to BigQuery with a table expiration of 6 months.

AnswersA, E

Provides immutable, cost-effective archival.

Why this answer

Create a log sink to BigQuery for short-term analysis (6 months) with a table expiration. Create another sink to Cloud Storage with an archive class and a retention policy for long-term archival. A single sink cannot do both.

Pub/Sub is not archival. Default retention is only 400 days.

Full explanation →

727

MCQeasy

A startup is deploying a containerized application on Google Kubernetes Engine (GKE). The application is stateless and experiences variable traffic patterns, with periodic spikes during promotional events. The startup wants to minimize costs while ensuring the application can handle the variable load without performance degradation. They also prefer to automate scaling as much as possible. Which GKE configuration should they choose?

A.Use a cluster with node auto-repair and a fixed node pool.

B.Use a cluster with node auto-provisioning and preemptible nodes.

C.Use a cluster with a single zone and regular nodes.

D.Use a cluster with regional persistent disks for pods.

AnswerB

Node auto-provisioning adds nodes as needed, and preemptible nodes cost less than regular instances, ideal for stateless, fault-tolerant workloads.

Why this answer

Node auto-provisioning automatically scales the node pool based on pod resource requests, ensuring the cluster can handle variable traffic spikes without manual intervention. Preemptible nodes are significantly cheaper than regular nodes, reducing costs. This combination meets the startup's requirements for cost minimization and automated scaling.

Option A is incorrect because a fixed node pool does not automatically scale to meet variable demand. Option C is incorrect because a single zone may not provide sufficient resources during spikes and regular nodes are more expensive. Option D is incorrect because regional persistent disks are for stateful applications and increase cost.

Full explanation →

728

MCQhard

During a security incident, a security engineer needs to revoke a compromised service account's access across all resources immediately. However, the service account has many roles across different projects. What is the most effective immediate step?

A.Remove all IAM policies that include the service account.

B.Disable the service account.

C.Disable the service account key.

D.Delete the service account from the project.

AnswerB

Disabling the service account instantly revokes all access while preserving policies.

Why this answer

Disabling the service account immediately revokes all access across all projects without removing IAM policies, allowing quick recovery by re-enabling it later. Option A (removing all IAM policies) is time-consuming and can break dependencies. Option C (disabling the key) only prevents key-based authentication but the service account can still be used from VM instances with service accounts attached.

Option D (deleting the account) is irreversible and requires recreating and reassigning roles.

Full explanation →

729

Multi-Selectmedium

A company is deploying a PCI DSS-compliant application on Google Cloud. They need to ensure that the cardholder data environment (CDE) is isolated and that only authorized services can communicate. Which TWO services should they use? (Choose 2)

Select 2 answers

A.Cloud IDS

B.Cloud Armor

C.Cloud NAT

D.VPC Service Controls

E.Cloud VPN

AnswersB, D

Cloud Armor is a WAF that protects the web application.

Why this answer

VPC Service Controls create a secure perimeter around the CDE resources, preventing data exfiltration. Cloud Armor provides web application firewall capabilities to protect the application. Cloud NAT is for outbound connectivity, Cloud IDS is for intrusion detection, and Cloud VPN is for site-to-site VPN, not isolation.

Full explanation →

730

MCQeasy

An organization uses Cloud Identity to manage users and groups. They want to synchronize their existing on-premises Active Directory with Cloud Identity. Which tool should they use?

A.Third-party SAML identity provider

B.Google Cloud Directory Sync (GCDS)

C.Identity Platform

D.Cloud Workflows

AnswerB

GCDS syncs AD with Cloud Identity.

Why this answer

Google Cloud Directory Sync (GCDS) is the correct tool because it is specifically designed to synchronize users, groups, and aliases from an on-premises Active Directory (or LDAP server) into Cloud Identity without requiring federation. GCDS maps AD attributes to Cloud Identity fields and runs on a scheduled basis to keep the cloud directory in sync, making it the appropriate choice for this use case.

Exam trap

Google Cloud often tests the distinction between directory synchronization (GCDS) and federation (SAML IdP), so the trap here is that candidates may confuse synchronizing user objects with setting up single sign-on, leading them to choose a SAML identity provider instead of GCDS.

How to eliminate wrong answers

Option A is wrong because a third-party SAML identity provider is used for federated authentication (single sign-on), not for synchronizing directory data from Active Directory into Cloud Identity. Option C is wrong because Identity Platform is a customer identity and access management (CIAM) service for adding authentication to applications, not a tool for syncing on-premises directories with Cloud Identity. Option D is wrong because Cloud Workflows is an orchestration service for automating workflows and API calls, not a directory synchronization tool.

Full explanation →

731

MCQhard

A company has a hybrid cloud setup with a Cloud VPN tunnel to an on-premises network. They want to ensure that traffic from on-premises to a specific VPC subnet is routed through a specific next hop appliance for inspection. How can they achieve this?

A.Use Policy-based routing

B.Create a route with a next hop to the appliance's internal IP and a high priority

C.Create a route with a next hop of the internal load balancer

D.Create a static route with a next hop of the VPN gateway

AnswerB

This directs traffic to the appliance for inspection before it reaches the destination subnet.

Why this answer

Creating a static route with a next hop set to the appliance's internal IP and a high priority ensures that traffic from on-premises to the specific VPC subnet is forwarded to the inspection appliance before reaching its destination. In a hybrid cloud setup with Cloud VPN, the VPN gateway is the default next hop for on-premises traffic, but a higher-priority route overrides this, directing traffic to the appliance for security inspection. This leverages route priority (lower numerical value = higher priority) to enforce traffic steering without modifying the VPN tunnel itself.

Exam trap

Google Cloud often tests the misconception that policy-based routing (PBR) is the only way to steer traffic to a specific next hop, but in cloud VPC environments, static routes with priority are the correct and supported method, and PBR is not available as a VPC route option.

How to eliminate wrong answers

Option A is wrong because policy-based routing (PBR) is typically used for source/destination-based traffic steering at the router level, but in a cloud VPC environment like Google Cloud or AWS, PBR is not natively supported for VPC routes; instead, static routes with priorities are the standard mechanism. Option C is wrong because an internal load balancer distributes traffic across multiple instances and does not act as a transparent next hop for inspection; using it would bypass the intended single appliance and could cause asymmetric routing or inspection failure. Option D is wrong because creating a static route with a next hop of the VPN gateway would simply send traffic back through the VPN tunnel, defeating the purpose of routing it through the inspection appliance; the VPN gateway is the default path for on-premises traffic, not a way to insert an inspection hop.

Full explanation →

732

MCQmedium

A company is using Security Command Center (SCC) Standard tier and wants to detect threats like crypto mining attacks and anomalous IAM activity in their GCP environment. Which built-in service should they enable?

A.Event Threat Detection

B.Security Health Analytics

C.Web Security Scanner

D.VM Threat Detection

AnswerA

Event Threat Detection is a Premium SCC service that monitors logs for malicious activity, including crypto mining.

Why this answer

Event Threat Detection is a premium tier service that detects threats such as crypto mining and suspicious IAM activity. Security Health Analytics is misconfigurations. Web Security Scanner is for web apps.

VM Threat Detection is also premium but for VMs.

Full explanation →

733

Multi-Selectmedium

A security team wants to automatically detect anomalies in user behavior across Google Workspace and Google Cloud. Which TWO Security Command Center features can help?

Select 2 answers

A.Event Threat Detection

B.VM Threat Detection

C.Compliance monitoring (Premium tier)

D.Anomaly Detection (Standard tier)

E.Security Health Analytics

AnswersA, D

Event Threat Detection detects anomalous IAM activity and suspicious behavior in Google Cloud, making it suitable for identifying anomalies in user behavior.

Why this answer

Event Threat Detection uses machine learning to identify anomalous IAM activity and suspicious behavior in Google Cloud, including patterns that may indicate compromised accounts or malicious activity. Anomaly Detection (Standard tier) uses machine learning to detect anomalies in user and resource activity across both Google Workspace and Google Cloud. Together, they provide coverage for detecting anomalies in user behavior across the organization.

Exam trap

Candidates may mistakenly choose Compliance monitoring (Premium tier) because it can detect unusual patterns, but it is designed for compliance violations, not user behavior anomalies. Event Threat Detection is a better choice for detecting anomalous IAM activity and user behavior in Google Cloud, while Anomaly Detection covers both Workspace and Cloud.

Full explanation →

734

MCQhard

Your organization has a hybrid network with an on-premises data center connected to Google Cloud via a Dedicated Interconnect. The on-premises network uses RFC 1918 addresses (10.0.0.0/8) and Google Cloud VPC has a subnet in 10.1.0.0/16. You've configured a Cloud Router with BGP to exchange routes. Recently, you set up a new VPC with a subnet in 10.2.0.0/16 and peered it with the first VPC using VPC Network Peering. You notice that on-premises traffic destined to 10.2.0.0/16 is being dropped. You verify that the firewall rules allow the traffic and that BGP routes for 10.2.0.0/16 are not advertised on-premises. What should you do to enable connectivity from on-premises to the new VPC?

A.Set up a Cloud VPN tunnel between the new VPC and on-premises.

B.Configure the Cloud Router to advertise the 10.2.0.0/16 range via custom route advertisement.

C.Add a firewall rule in the new VPC allowing all traffic from 10.0.0.0/8.

D.Create a Shared VPC and attach the new VPC as a service project.

AnswerB

Custom route advertisements on Cloud Router propagate the peering range to on-premises.

Why this answer

The Cloud Router uses BGP to advertise routes to the on-premises network via the Dedicated Interconnect. By default, only VPC subnet routes are advertised; custom route advertisements must be explicitly configured to propagate the peered VPC's subnet (10.2.0.0/16) to on-premises. This ensures the on-premises routers learn the route and can forward traffic to the new VPC.

Exam trap

The trap here is that candidates assume VPC Network Peering automatically shares routes with on-premises networks via Interconnect, but in reality, peered VPC routes are not propagated to on-premises unless explicitly advertised through Cloud Router custom route advertisements.

How to eliminate wrong answers

Option A is wrong because a Cloud VPN tunnel is unnecessary when a Dedicated Interconnect already exists; the issue is route advertisement, not connectivity method. Option C is wrong because firewall rules are not the problem (they already allow traffic); the root cause is missing route propagation, not a missing allow rule. Option D is wrong because Shared VPC is used for centralized administration of multiple projects, not for enabling route exchange between a peered VPC and an on-premises network via Interconnect.

Full explanation →

735

Multi-Selecthard

A company must comply with regulatory requirements that restrict data access by Google Cloud support and engineering staff. They need to log all Google admin access to their data and also require explicit approval before access is granted. Which TWO features should they combine? (Choose two.)

Select 2 answers

A.Access Approval

B.Data Loss Prevention

C.VPC Service Controls

D.Access Transparency

E.Audit Logs

AnswersA, D

Allows customers to approve or deny Google support access requests.

Why this answer

Access Transparency provides logs of Google admin access to customer content. Access Approval allows customers to approve or deny Google support access requests. Together, they satisfy the requirement for logging and approval.

The other options: Audit Logs record customer project actions, not Google admin access. Data Loss Prevention is for data inspection. VPC Service Controls are for network perimeters.

Full explanation →

736

MCQmedium

A security analyst wants to detect when a user creates a Compute Engine instance with a public IP address in a sensitive project. What is the best method?

A.Create a Cloud Function that triggers on instance creation events.

B.Enable Data Access audit logs and filter for insert calls.

C.Use Cloud Logging with a log-based metric and alert.

D.Use Cloud Asset Inventory to create a feed for instance creation.

AnswerC

Log-based metrics on Admin Activity audit logs allow real-time alerting on specific conditions.

Why this answer

Cloud Logging with a log-based metric and alert enables real-time detection by monitoring compute.instances.insert log entries for external IPs. Option A is incorrect: Cloud Functions can trigger on instance creation but require custom logic and may have latency. Option B is incorrect: Data Access audit logs track data access, not admin operations like instance creation.

Option D is incorrect: Cloud Asset Inventory is not real-time and better suited for compliance checks, not immediate alerting.

Full explanation →

737

MCQmedium

A security engineer needs to block traffic to a set of VMs from specific IP addresses and also apply rate limiting for HTTP traffic. The VMs are behind a global external HTTPS load balancer. Which service should they use?

A.Cloud IDS

B.Cloud Armor

C.VPC firewall rules

D.Network firewall policies

AnswerB

Cloud Armor provides IP blocking and rate limiting for HTTP(S) load balancers.

Why this answer

Cloud Armor security policies can be attached to load balancers to provide WAF capabilities, including IP allow/deny lists and rate limiting. This is the appropriate service for this scenario.

Full explanation →

738

MCQmedium

A multinational corporation is required to protect sensitive data in BigQuery using column-level encryption. They want to use a customer-managed key stored in Cloud KMS. What is the correct approach?

A.Use Cloud DLP to de-identify columns in transit.

B.Use Cloud HSM to store the key and apply bucket-level encryption.

C.Use Cloud KMS to create an AEAD key and use BigQuery SQL functions to encrypt/decrypt.

D.Use Customer-Supplied Encryption Keys (CSEK) with BigQuery.

AnswerC

BigQuery has AEAD.ENCRYPT/DECRYPT functions that integrate with Cloud KMS.

Why this answer

BigQuery supports column-level encryption and decryption using AEAD (Authenticated Encryption with Associated Data) keys created in Cloud KMS. The `AEAD.ENCRYPT` and `AEAD.DECRYPT` SQL functions allow you to encrypt specific columns at rest, using a customer-managed key that you control in Cloud KMS, ensuring that only authorized users with access to the key can decrypt the data.

Exam trap

Google Cloud often tests the distinction between encryption services (Cloud KMS, Cloud HSM, CSEK) and their applicable scopes (bucket-level vs. column-level), so the trap here is assuming that any key management service can be used for BigQuery column-level encryption without understanding that only Cloud KMS with AEAD SQL functions is supported.

How to eliminate wrong answers

Option A is wrong because Cloud DLP de-identifies data in transit or at rest using techniques like masking or tokenization, but it does not provide column-level encryption with a customer-managed key stored in Cloud KMS; DLP is a data loss prevention service, not a column-level encryption solution. Option B is wrong because Cloud HSM is a hardware security module that can store keys, but bucket-level encryption applies to Cloud Storage buckets, not to BigQuery columns; BigQuery does not use bucket-level encryption for column-level protection. Option D is wrong because Customer-Supplied Encryption Keys (CSEK) are used for encrypting Compute Engine resources and Cloud Storage objects, not for BigQuery column-level encryption; BigQuery does not support CSEK for column-level encryption.

Full explanation →

739

Multi-Selectmedium

A security engineer needs to allow a group of external auditors to view all resources in a project but not modify anything. They must also prevent the auditors from viewing sensitive data in BigQuery datasets. Which TWO IAM bindings should the engineer configure? (Choose two.)

Select 2 answers

A.Grant roles/viewer on the project to the auditors group

B.Grant roles/bigquery.dataViewer on the project to the auditors group

C.Create a deny policy at the project level that denies bigquery.tables.getData for the auditors group

D.Grant roles/iam.securityReviewer on the project to the auditors group

E.Remove the auditors group from all IAM bindings and grant them roles/browser only

AnswersA, C

This grants read access to all resource configurations, but includes BigQuery data access.

Why this answer

To grant read-only access to resources (configurations) without data access, you can grant roles/viewer on the project. However, roles/viewer includes bigquery.tables.getData, which allows reading table data. To prevent that, you must also add a deny policy to block bigquery.tables.getData.

Alternatively, you can use a custom role, but the question asks for IAM bindings.

Full explanation →

740

MCQhard

A company uses VPC Service Controls to protect a service perimeter around BigQuery. They need to allow a specific on-premises application (with static IP 203.0.113.10) to query BigQuery tables within the perimeter, while still blocking other internet traffic. Which configuration should be used?

A.Use Cloud Armor to allow the IP.

B.Create an ingress rule in the service perimeter with an access level that includes the on-premises IP.

C.Add the on-premises IP to the list of allowed IPs in the VPC firewall rules.

D.Set up a VPN connection and include the on-premises VPC in the perimeter.

AnswerB

This allows the specific IP to access BigQuery while respecting the perimeter.

Why this answer

Create an ingress rule in the service perimeter that allows access from the on-premises IP (using access level) to BigQuery. Access levels can be IP-based, so create an access level that includes 203.0.113.10, and use that in the ingress rule.

Full explanation →

741

MCQeasy

A DevOps team wants to automatically scale a managed instance group based on CPU utilization. Which metric should they use in the autoscaler?

A.'compute.googleapis.com/instance/cpu/usage_time'

B.'compute.googleapis.com/instance/cpu/utilization'

C.'compute.googleapis.com/instance/cpu/reserved_cores'

D.'agent.googleapis.com/cpu/utilization'

AnswerB

This is the built-in CPU utilization metric suitable for autoscaling.

Why this answer

The compute.googleapis.com/instance/cpu/utilization metric measures actual CPU usage, suitable for autoscaling.

Full explanation →

742

MCQmedium

A company uses Cloud Audit Logs for compliance. They want to capture all data access events to a Cloud Storage bucket containing sensitive data. What must they enable?

A.System Event audit logs

B.Admin Activity audit logs

C.Access Transparency logs

D.Data Access audit logs with a configuration to log all methods

AnswerD

Data Access audit logs must be enabled for Cloud Storage to record both read and write operations.

Why this answer

To capture all data access events to a Cloud Storage bucket, including API calls that read or write data, you must enable Data Access audit logs and configure them to log all methods. Admin Activity logs record configuration changes, System Event logs capture Google's internal system events, and Access Transparency logs are for requests from Google personnel. Only Data Access audit logs provide records of user and service account data access, making option D correct.

Exam trap

Candidates often confuse Data Access logs with System Event logs. System Event logs capture Google's internal actions on resources (e.g., maintenance), not customer-initiated data accesses. For compliance requiring capture of all data access events, Data Access audit logs with all methods enabled is the correct requirement.

How to eliminate wrong answers

Option A is wrong because System Event audit logs capture non-data-access events like GCP system actions (e.g., automatic resource scaling), not user or service access to data. Option B is wrong because Admin Activity audit logs only record configuration changes (e.g., creating or deleting a bucket), not data reads or writes. Option C is wrong because Access Transparency logs provide visibility into Google personnel access to your data, not customer or application data access events.

Full explanation →

743

MCQhard

A company has multiple VPCs in different projects that need to privately connect to a common internal service (e.g., a managed database) running in a central project. They want to expose this service via Private Service Connect. Which type of PSC endpoint should the consumer VPCs create?

A.Cloud NAT gateway

B.VPN tunnel

C.Producer endpoint (service attachment)

D.Consumer endpoint (forwarding rule with PSC backend)

AnswerD

Consumers create PSC endpoints to connect to the published service.

Why this answer

Consumers create Private Service Connect endpoints (forwarding rules with PSC backends) to connect to a published service. The producer publishes the service via a service attachment.

Full explanation →

744

Multi-Selectmedium

A company must store API keys and database credentials securely in Google Cloud. They need automatic rotation of these secrets every 30 days, with notifications sent to a security team after each rotation. Which services should they use? (Choose TWO).

Select 2 answers

A.Cloud Scheduler

B.Secret Manager

C.Compute Engine

D.Cloud Functions

E.Cloud KMS

AnswersB, D

Secret Manager is the correct service for storing API keys and credentials with built-in automatic rotation and Pub/Sub notifications.

Why this answer

Secret Manager provides a native API for storing secrets and supports automatic rotation via a rotation period and Pub/Sub notifications. Cloud Functions can be triggered by the Pub/Sub message to perform any additional actions (e.g., updating applications). Cloud KMS manages encryption keys, not secrets.

Cloud Scheduler can trigger manual rotation but is not required with automatic rotation. Compute Engine is not a service for secrets management.

Full explanation →

745

MCQeasy

A company that stores protected health information (PHI) in Google Cloud wants to run a BigQuery query to identify and classify sensitive data such as patient names and social security numbers. Which Google Cloud service should they use?

A.Cloud Audit Logs

B.Cloud Key Management Service (Cloud KMS)

C.Cloud Data Loss Prevention (Cloud DLP)

D.BigQuery's built-in data classification

AnswerC

Cloud DLP inspects and classifies sensitive data like PHI and PII.

Why this answer

Cloud Data Loss Prevention (Cloud DLP) is specifically designed to inspect, classify, and de-identify sensitive data. It can be used to scan BigQuery tables and other data sources for PHI, PII, and other sensitive content. Cloud Audit Logs track access, BigQuery itself does not classify data, and Cloud KMS manages encryption keys.

Full explanation →

746

MCQhard

Your company has hundreds of GKE clusters across multiple projects. You need to ensure that all clusters have Container Threat Detection enabled. Which approach is most scalable?

A.Create a new organization policy that enforces Container Threat Detection on all clusters

B.Deploy a DaemonSet that enables Container Threat Detection

C.Write a script using gcloud container clusters update with --enable-threat-detection flag

D.Manually enable Container Threat Detection in each cluster via the Cloud Console

AnswerC

The gcloud command can enable Container Threat Detection on existing clusters; scripting iterates over all clusters.

Why this answer

SCC Premium includes Container Threat Detection. To enable it across clusters, you can use an organization policy or a custom script. Using Terraform or Config Controller to manage clusters as code is scalable.

The most straightforward way: enable SCC Premium at the organization level and then enable Container Threat Detection per cluster via the API or gcloud. A script using gcloud commands can iterate through all clusters.

Full explanation →

747

Multi-Selectmedium

A company uses Active Directory (AD) on-premises and wants to implement SSO for Google Cloud Console access. They want to maintain user lifecycle management (create/disable accounts) from AD. Which TWO components are required?

Select 2 answers

A.Cloud Directory Sync (CDS)

B.SAML 2.0 SSO with Cloud Identity

C.Workload Identity Federation

D.Identity-Aware Proxy (IAP)

E.Cloud VPN

AnswersA, B

CDS syncs users from AD to Google Cloud Directory.

Why this answer

Cloud Directory Sync synchronizes users from AD to Google Cloud Directory. SAML SSO with Cloud Identity allows users to sign in using their AD credentials. Both are needed: CDS for provisioning, SAML for authentication.

Full explanation →

748

MCQhard

A security engineer accidentally deleted a Cloud KMS key version. The key version is in the state DESTROY_SCHEDULED. How long does the engineer have to cancel the destruction before the key material is permanently destroyed?

A.30 days

B.24 hours

C.Immediate destruction, no grace period

D.7 days

AnswerB

The default pending destruction period is 24 hours.

Why this answer

When a key version is scheduled for destruction, it enters a pending destruction grace period. The default grace period is 24 hours, during which the destruction can be canceled. After that, the key material is destroyed and unrecoverable.

Full explanation →

749

Multi-Selecteasy

A security engineer needs to set up access for a new team that will manage Cloud Storage buckets and objects. Which three IAM roles might be appropriate based on least privilege? (Choose three.)

Select 3 answers

A.roles/storage.objectAdmin

B.roles/storage.objectViewer

C.roles/storage.legacyBucketOwner

D.roles/storage.objectCreator

E.roles/storage.admin

AnswersA, B, D

Allows full object management (create, read, update, delete).

Why this answer

(roles/storage.objectAdmin) is correct because it grants full control over objects in Cloud Storage buckets, including listing, reading, creating, and deleting objects, but does not allow modifying bucket-level permissions or deleting buckets. This aligns with least privilege for a team that needs to manage objects without full bucket administration.

Exam trap

Google Cloud often tests the distinction between legacy roles (like storage.legacyBucketOwner) and modern predefined roles, expecting candidates to recognize that legacy roles grant overly broad permissions and should be avoided for least privilege.

Full explanation →

750

Multi-Selecthard

A company uses Cloud DLP to inspect data in Cloud Storage and BigQuery for sensitive information such as credit card numbers and social security numbers. They want to de-identify the data using format-preserving encryption (FPE) so that the masked data retains the same format (e.g., a 16-digit number still looks like a credit card number). Which two configurations should they use? (Choose TWO).

Select 2 answers

A.A de-identification template with BucketingConfig

B.A cryptographic key in Cloud KMS to be used with the FPE transform

C.A de-identification template with DateShiftConfig

D.A de-identification template with MaskingConfig

E.A de-identification template with CryptoReplaceFfxFpeConfig

AnswersB, E

CryptoReplaceFfxFpeConfig requires a wrapping key in Cloud KMS to encrypt the FPE key.

Why this answer

CryptoReplaceFfxFpeConfig performs format-preserving encryption (FPE) based on the FFX mode. It can preserve the format of credit card numbers. The transform must be configured with a cryptographic key from Cloud KMS to ensure the encryption is secure.

BucketingConfig replaces values with a bucket label, not FPE. MaskingConfig replaces characters with a mask character. DateShiftConfig shifts dates by a random number of days.

Full explanation →

Page 10 of 13

All pages

1 2 3 4 5 6 7 8 9 10 11 12 13

Practice PCSE by domain

Target a specific domain to shore up weak areas.

Configuring Access Within a Cloud Solution Environment Ensuring Data Protection Managing Operations in a Cloud Solution Environment Configuring Network Security Supporting Compliance Requirements

See all domains with question counts →