Knowledge + Practice

Google Professional Cloud Security Engineer (PCSE) — Questions 751–825

960 questions total · 13pages · All types, answers revealed

Take a mock exam Exam hub

Page 11 of 13

751

MCQhard

Refer to the exhibit. A user jane@example.com receives a 403 Access Denied error when trying to list objects in a Cloud Storage bucket. What is the most likely cause?

A.The IAM condition restricts access to requests originating from the 10.0.0.0/24 IP range

B.Jane does not have the storage.objects.list permission

C.The bucket is in a different project

D.The IAM policy is too permissive and conflicts with other policies

AnswerA

The condition checks the 'x-forwarded-for' header starts with '10.0.0.', so requests from other IPs are denied.

Why this answer

The IAM policy includes a condition that restricts access to requests originating from the 10.0.0.0/24 IP range. If jane@example.com is accessing the bucket from an IP outside this range, the condition fails and access is denied, resulting in a 403 error. Option B is incorrect; the role assigned to Jane includes the storage.objects.list permission, so lack of permission is not the issue.

Option C is incorrect; there is no indication that the bucket is in a different project. Option D is incorrect; the policy is restrictive, not permissive, and there is no conflict with other policies.

Full explanation →

752

Multi-Selectmedium

An organization wants to detect and respond to potential data exfiltration attempts via VPC Flow Logs. They plan to export VPC Flow Logs to BigQuery for analysis. Which TWO actions should they take to enable this? (Choose TWO.)

Select 2 answers

A.Create a log sink with a filter for compute.googleapis.com/vpc_flows and destination BigQuery.

B.Set up a Cloud Function to copy logs from Cloud Logging to BigQuery.

C.Create a BigQuery view to filter VPC Flow Logs.

D.Enable Data Access logs for Compute Engine.

E.Enable VPC Flow Logs on the subnet.

AnswersA, E

This exports the flow logs to BigQuery.

Why this answer

To export VPC Flow Logs to BigQuery, you need to create a log sink that filters for VPC Flow Logs and exports to BigQuery. The sink must be configured with a destination of BigQuery. Enabling Data Access logs is not required for VPC Flow Logs.

Full explanation →

753

Multi-Selecthard

An organization must comply with ITAR regulations. They use Assured Workloads with the ITAR regime. Which THREE controls are automatically enforced by this regime? (Choose three.)

Select 3 answers

A.VPC Service Controls automatically configured

B.Use of Customer-Managed Encryption Keys (CMEK) for applicable services

C.Data residency in the US only

D.Cloud Audit Logs retention set to 10 years

E.Access Transparency and Access Approval enabled to restrict Google personnel access

AnswersB, C, E

CMEK is enforced for services that support it, ensuring customer control over encryption keys.

Why this answer

Assured Workloads for ITAR enforces data residency, personnel access restrictions, and encryption with CMEK. VPC Service Controls, while important, are not automatically enforced by the regime itself but can be added separately.

Full explanation →

754

Multi-Selectmedium

A company subject to PCI DSS is building a cardholder data environment (CDE) on Google Cloud. They need to encrypt cardholder data at rest and in transit. Which THREE measures should they implement? (Choose three.)

Select 3 answers

A.Enforce TLS 1.2 or higher for data in transit.

B.Implement Cloud KMS to manage encryption keys.

C.Use Customer-Managed Encryption Keys (CMEK) for at-rest encryption.

D.Configure Cloud Armor WAF to inspect traffic.

E.Use VPC Service Controls to isolate the CDE.

AnswersA, B, C

TLS 1.2+ is required by PCI DSS for encrypting data in transit.

Why this answer

PCI DSS requires strong encryption. CMEK allows customer-managed keys for at-rest encryption. TLS 1.2 or higher encrypts data in transit.

Cloud KMS is used to manage encryption keys. Cloud Armor is a WAF, not encryption. VPC Service Controls provide network segmentation, not encryption.

Cloud HSM is a hardware-backed key storage, but the question asks for measures that encrypt data; CMEK, TLS, and Cloud KMS are directly related to encryption.

Full explanation →

755

MCQhard

An organization has multiple GCP projects under a folder. They want to prevent all users from creating service account keys in any project under that folder. They also want to allow exceptions for a specific project where key creation is needed. Which approach should they take?

A.Create a custom role that excludes the permission to create keys and assign it to all users.

B.Remove the roles/iam.serviceAccountKeyAdmin role from all users.

C.Use an IAM deny policy on the folder to deny the permission to create service account keys.

D.Apply the organization policy constraint 'constraints/iam.disableServiceAccountKeyCreation' at the folder level and set an exception for the specific project.

AnswerD

This constraint disables key creation; exceptions can be made with conditional policies or separate project-level policies.

Why this answer

Organization policies can be set at the folder level with an enforce: true condition, and then an exception can be made for a specific project using a conditional policy or by setting a different policy on that project. IAM deny policies cannot disable the API for all users. Custom roles cannot disable key creation globally.

Removing roles is impractical.

Full explanation →

756

MCQeasy

An organization wants to prevent data exfiltration from a Google Cloud project by restricting the copying of data from Cloud Storage to external IPs. Which Google Cloud service should they use?

A.Cloud Armor

B.IAM

C.VPC Service Controls

D.Cloud Data Loss Prevention (DLP)

AnswerC

VPC Service Controls create a security perimeter that prevents data from being copied to external IPs.

Why this answer

VPC Service Controls (C) is correct because it allows you to define security perimeters around Google Cloud services like Cloud Storage, preventing data exfiltration by blocking access from external IPs. By creating a service perimeter, you can enforce that data can only be accessed from within a specified VPC network or on-premises network via Private Google Access, effectively restricting copying to external IP addresses.

Exam trap

Google Cloud often tests the distinction between IAM (identity-based access) and VPC Service Controls (network-based perimeter security), so candidates mistakenly choose IAM thinking it can block external IPs, but IAM lacks the network context to enforce such restrictions.

How to eliminate wrong answers

Option A is wrong because Cloud Armor is a web application firewall (WAF) that protects against DDoS and application-layer attacks, not a tool for restricting data exfiltration based on IP origin. Option B is wrong because IAM controls who (identities) can access resources but does not control how data is transferred or restrict access based on network context (e.g., external IPs). Option D is wrong because Cloud Data Loss Prevention (DLP) is used for inspecting, classifying, and redacting sensitive data, not for enforcing network-level access controls to prevent exfiltration.

Full explanation →

757

MCQmedium

A healthcare startup is using Google Cloud to process Protected Health Information (PHI) for a clinical study. They are HIPAA-compliant and use Cloud Storage with CMEK. They also use BigQuery to run analytics on de-identified data. The security team notices that some PHI data appears in BigQuery query results. Upon investigation, they find that a data engineer created a BigQuery table that directly references the Cloud Storage bucket containing PHI without using the de-identification pipeline. The startup needs to prevent any direct access to Cloud Storage from BigQuery unless it goes through the pipeline. They also need to ensure that any new datasets are automatically subject to the same restrictions. What should they do?

A.Enable Access Transparency logs and set up alerts for any direct access to Cloud Storage.

B.Use DLP API to automatically de-identify data in Cloud Storage before BigQuery reads it.

C.Use IAM conditions to restrict access to the Cloud Storage bucket only from the service account used by the pipeline.

D.Create a VPC Service Control perimeter around the pipeline project, and use an organization policy to require that Cloud Storage buckets be in a perimeter.

AnswerD

VPC Service Controls block direct access from BigQuery to Cloud Storage unless both are in the same perimeter.

Why this answer

VPC Service Controls create a security perimeter around the pipeline project, preventing data exfiltration and unauthorized access to Cloud Storage from BigQuery unless the request originates from within the perimeter. The organization policy requiring Cloud Storage buckets to be in a perimeter ensures that any new datasets are automatically subject to the same restrictions, enforcing the de-identification pipeline as the only allowed path.

Exam trap

Google Cloud often tests the distinction between detective controls (logging) and preventive controls (perimeters), leading candidates to choose logging or IAM-based solutions that cannot enforce the 'no direct access' requirement across all new datasets.

How to eliminate wrong answers

Option A is wrong because Access Transparency logs only provide audit logs of access, not preventive controls; they cannot block direct access from BigQuery to Cloud Storage. Option B is wrong because the DLP API de-identifies data but does not enforce access control policies; it would require manual integration and does not automatically restrict new datasets. Option C is wrong because IAM conditions can restrict access to a specific service account, but they do not prevent BigQuery from directly referencing the Cloud Storage bucket if the service account used by BigQuery has permissions; they also do not automatically apply to new datasets.

Full explanation →

758

MCQhard

A global e-commerce company uses Google Cloud to host its platform. They store customer payment data in Cloud SQL and use Cloud Storage for backups. Currently, they rely on Google-managed encryption keys. A new compliance requirement mandates that all encryption keys must be stored in a hardware security module (HSM) and rotated every 30 days. Additionally, they need to retain backup data for 7 years, during which the keys used to encrypt the backups must be available for decryption. They have created a Cloud HSM key ring and a key with a rotation period of 2592000 seconds (30 days). After configuring Cloud SQL and Cloud Storage to use the Cloud HSM key, they notice that backups older than 30 days cannot be decrypted. The company's security engineer verified that the key versions are still present. What is the most likely cause and how should it be resolved?

A.The key material was imported incorrectly. Delete the key ring and recreate it using an external HSM.

B.The automatic backups in Cloud SQL are encrypted with the primary key version at backup time, but the backup restore functionality does not automatically use the latest key version. Update the backup configuration to use the current primary key version for decryption.

C.The rotation period of 30 days is too short for key retention. Disable automatic rotation and use manual key rotation every 30 days while retaining all versions.

D.Cloud Storage does not support Cloud HSM keys for object encryption. Switch to customer-supplied encryption keys (CSEK).

AnswerB

Cloud SQL restore requires referencing the correct key version; re-associating the backup with the latest key version allows decryption.

Why this answer

Cloud SQL backups are encrypted with the primary key version at the time of backup creation. When restoring a backup, Cloud SQL does not automatically use the latest key version; it attempts to decrypt using the key version that was primary at backup time. Since the key is rotated every 30 days, backups older than 30 days were encrypted with a previous primary key version.

Even though the key versions are still present in Cloud HSM, the backup restore operation fails because it does not automatically reference the correct historical key version. The fix is to explicitly update the backup configuration to point to the current primary key version, which allows Cloud SQL to locate and use the appropriate key version for decryption.

Exam trap

Google Cloud often tests the misconception that key rotation automatically updates all existing encrypted data, when in reality each encryption operation uses the key version that was primary at that time, and decryption requires explicit reference to the correct historical version.

How to eliminate wrong answers

Option A is wrong because the key material was not imported incorrectly; the security engineer verified that key versions are present, and Cloud HSM supports both imported and generated keys. The issue is not about import method but about key version referencing during restore. Option C is wrong because the rotation period of 30 days (2592000 seconds) is exactly what the compliance requires; disabling automatic rotation would violate the 30-day rotation mandate, and manual rotation does not solve the decryption problem since the root cause is that Cloud SQL does not automatically use the correct key version for older backups.

Option D is wrong because Cloud Storage does support Cloud HSM keys for object encryption via CMEK; switching to CSEK would not address the backup decryption issue and would introduce additional key management complexity.

Full explanation →

759

MCQhard

A security team wants to audit all actions performed by users on a critical Cloud Storage bucket. They have enabled Data Access audit logs. However, they notice that read requests are not being logged. What should they do to ensure all read requests are logged?

A.Enable Access Transparency logs for the project.

B.Assign the Storage Legacy Bucket Reader role to the bucket.

C.Configure bucket-level logging to record all access requests.

D.Enable VPC Flow Logs for the network.

AnswerC

Bucket-level logging can log all requests, including reads, regardless of audit log configuration.

Why this answer

Bucket-level logging captures all access requests, including read operations, by recording detailed logs for each request made to the bucket. Data Access audit logs, while enabled, may not log all read requests due to exclusion filters or default configuration limitations, whereas bucket-level logging provides comprehensive access records directly from Cloud Storage.

Exam trap

Google Cloud often tests the distinction between Cloud Audit Logs (which can be filtered or excluded) and bucket-level logging (which records all requests), leading candidates to mistakenly think enabling Data Access audit logs alone is sufficient for all read logging.

How to eliminate wrong answers

Option A is wrong because Access Transparency logs are designed to log actions taken by Google Cloud support or engineering staff, not user read requests on a bucket. Option B is wrong because assigning the Storage Legacy Bucket Reader role controls permissions but does not enable logging; it only grants read access to the bucket. Option D is wrong because VPC Flow Logs capture network traffic metadata (e.g., IP flows) but do not log application-level read requests to Cloud Storage buckets.

Full explanation →

760

Multi-Selecthard

Which THREE are capabilities of Assured Workloads? (Choose three.)

Select 3 answers

A.Location-based access controls through VPC Service Controls

B.Cloud Shell for browser-based terminal access

C.Cloud Interconnect for dedicated connectivity

D.Access Transparency logs for Google personnel actions

E.Customer-managed encryption keys (CMEK) support

AnswersA, D, E

Assured Workloads can enforce perimeters using VPC Service Controls.

Why this answer

Assured Workloads is a Google Cloud service that helps customers meet compliance requirements (e.g., FedRAMP, PCI DSS) by enforcing a set of security and data residency controls. Option A is correct because VPC Service Controls can be used to create a perimeter around the workload, restricting data access based on location (e.g., only allowing access from within a specific VPC or IP range), which is a key capability for compliance. Option D is correct because Access Transparency logs provide detailed logs of actions taken by Google personnel on customer data, which is critical for audit and compliance.

Option E is correct because Customer-Managed Encryption Keys (CMEK) allow customers to control the encryption keys used to protect their data, a fundamental requirement for many compliance frameworks.

Exam trap

Google Cloud often tests the distinction between general Google Cloud services (like Cloud Shell or Cloud Interconnect) and the specific compliance-enforcing capabilities of Assured Workloads, leading candidates to select broadly useful features that are not part of the Assured Workloads service itself.

Full explanation →

761

Multi-Selecteasy

Which TWO Google Cloud services are serverless compute platforms that let you run code without managing servers?

Select 2 answers

A.Cloud Run

B.Compute Engine

C.Google Kubernetes Engine (GKE)

D.Cloud Functions

E.App Engine

AnswersA, D

Cloud Run is a serverless container platform.

Why this answer

Options A and D are correct. Cloud Run and Cloud Functions are serverless compute services that abstract server management. Option B (Compute Engine) is IaaS.

Option C (Google Kubernetes Engine) is container orchestration. Option E (App Engine) is also serverless but the question asks for TWO; the most commonly cited serverless compute options are Cloud Functions and Cloud Run.

Full explanation →

762

MCQmedium

A company runs a GKE cluster with multiple node pools, including one pool of confidential VMs. The security team wants to ensure that only traffic from the internal VPC (10.0.0.0/8) can reach the nodes' metadata server. Which configuration should be applied?

A.Configure Private Google Access on the subnets.

B.Create a firewall rule that allows outbound traffic from nodes to 169.254.169.254 only from the internal VPC range, and deny all other outbound to that IP.

C.Enable IAP TCP forwarding on the cluster.

D.Apply a VPC Service Controls perimeter to the GKE cluster.

AnswerB

The metadata server IP is 169.254.169.254; firewall rules can restrict outbound access to this IP.

Why this answer

The metadata server for GKE nodes is accessible at the link-local IP 169.254.169.254. To restrict access to this server to traffic originating only from the internal VPC range (10.0.0.0/8), you must create a firewall rule that allows outbound traffic from the nodes to 169.254.169.254 only from that range, and then deny all other outbound traffic to that IP. This ensures that only workloads within the internal VPC can query instance metadata, preventing external or unauthorized pods from accessing sensitive metadata.

Exam trap

Google Cloud often tests the misconception that Private Google Access or VPC Service Controls can restrict metadata server access, but the metadata server is a link-local service that must be controlled via egress firewall rules targeting the specific IP 169.254.169.254.

How to eliminate wrong answers

Option A is wrong because Private Google Access enables on-premises or VM instances without external IPs to reach Google APIs and services, but it does not restrict access to the metadata server (169.254.169.254), which is a link-local address and not subject to Private Google Access. Option C is wrong because IAP TCP forwarding allows authorized users to establish TCP connections to VM instances without public IPs, but it does not control traffic to the metadata server from within the VPC. Option D is wrong because VPC Service Controls perimeters restrict data exfiltration from Google Cloud services like BigQuery or Cloud Storage, but they do not apply to the instance metadata server, which is a link-local service outside the VPC perimeter.

Full explanation →

763

MCQeasy

A company wants to use a Google Cloud load balancer with an SSL certificate that is automatically provisioned and renewed. Which type of certificate should they use?

A.Google-managed certificate

B.Certificate Manager with a self-managed certificate

C.Certificate Authority Service

D.Self-managed certificate

AnswerA

Google-managed certificates are automatically provisioned and renewed.

Why this answer

Google-managed SSL certificates are automatically provisioned, renewed, and managed by Google for use with load balancers. This is the simplest option for automatic management.

Full explanation →

764

MCQmedium

A company wants to provide private connectivity from its on-premises network to Google Cloud APIs (e.g., BigQuery, Cloud Storage) without traversing the public internet. They have an existing Dedicated Interconnect connection. Which solution should they use?

A.Cloud NAT

B.Cloud VPN with VPC peering

C.Private Service Connect

D.VPC Service Controls

AnswerC

PSC provides private endpoints for Google APIs, accessible via interconnect.

Why this answer

Private Service Connect (PSC) allows private access to Google APIs via private endpoints using internal IP addresses. With Dedicated Interconnect, on-premises traffic can reach these endpoints without going over the internet.

Full explanation →

765

Multi-Selectmedium

Which THREE of the following are best practices for managing service accounts in Google Cloud?

Select 3 answers

A.Use the principle of least privilege when granting roles to service accounts.

B.Assign a single service account to all Compute Engine instances for simplicity.

C.Avoid creating and downloading service account keys if possible; use workload identity federation or other alternatives.

D.Add service accounts to a Google Group to manage permissions.

E.Enable automatic key rotation for service account keys.

AnswersA, C, E

Least privilege reduces risk.

Why this answer

The principle of least privilege is a fundamental security best practice in Google Cloud IAM. Granting only the minimal roles necessary to a service account reduces the attack surface and limits potential damage from compromised credentials. This aligns with Google's recommended approach for managing identities in cloud environments.

Exam trap

While service accounts can be added to Google Groups, this is not a best practice because it can lead to unintended privilege escalation and makes managing permissions more complex. It is simpler and more secure to assign roles directly to service accounts.

Full explanation →

766

MCQmedium

A security engineer wants to restrict access to Cloud Storage buckets such that only workloads running on Compute Engine VMs in a specific VPC can read data. The VMs are managed by multiple GKE clusters and autoscaling instance groups. Which approach BEST enforces this restriction?

A.Configure a Cloud Armor security policy to block requests to Cloud Storage from non-VPC IPs.

B.Create a firewall rule that denies all egress traffic from the VPC to Cloud Storage IP ranges except through a proxy VM.

C.Create a VPC Service Controls service perimeter with an ingress rule that allows access from the VPC network.

D.Use IAM conditions on the Cloud Storage bucket to restrict access based on VPC network tags.

AnswerC

This approach restricts access to Cloud Storage from outside the perimeter and allows only requests originating from the specified VPC.

Why this answer

Use VPC Service Controls to create a service perimeter around the Cloud Storage API, with an ingress rule allowing requests from the specific VPC (using VPC network source) and VMs using the appropriate service accounts. VPC Service Controls prevent data exfiltration by restricting access to Google-managed services from outside the perimeter.

Full explanation →

767

MCQhard

You are designing network security for a multi-region GKE cluster with Pods that need to communicate across regions over a private network. The cluster uses VPC-native mode. Which Google Cloud networking feature should you use to ensure low-latency and secure inter-region Pod-to-Pod communication without traversing the public internet?

A.Cloud VPN with dynamic routing

B.Private Service Connect

C.VPC Flow Logs

D.Cloud Interconnect

AnswerD

Incorrect. Cloud Interconnect is designed for hybrid connectivity between on-premises networks and Google Cloud, not for inter-region communication within Google's network.

Why this answer

In a VPC-native GKE cluster, inter-region Pod-to-Pod communication automatically uses Google's internal backbone, requiring no additional networking feature. None of the provided options (Cloud VPN, Private Service Connect, VPC Flow Logs, Cloud Interconnect) are designed for this purpose; Cloud Interconnect is for hybrid connectivity, Cloud VPN traverses the public internet, Private Service Connect is for accessing Google services, and VPC Flow Logs is for monitoring. Therefore, no provided option is correct.

Exam trap

Candidates often assume Cloud Interconnect is needed for private inter-region traffic within GCP, but GKE's VPC-native mode already routes traffic over Google's internal network, making dedicated features unnecessary. None of the listed options should be selected.

How to eliminate wrong answers

Option A is wrong because Cloud VPN with dynamic routing encrypts traffic over the public internet, which introduces latency and is not designed for low-latency inter-region Pod-to-Pod communication within the same Google Cloud environment. Option B is wrong because Private Service Connect is used to privately access managed services (e.g., Google APIs or third-party services) from a VPC, not for inter-region Pod-to-Pod communication within GKE clusters. Option C is wrong because VPC Flow Logs is a logging feature that captures network flow metadata for monitoring and troubleshooting, not a connectivity solution for routing traffic between regions.

Full explanation →

768

MCQhard

An organization needs to store API keys and database credentials in a secure, centralized service that supports automatic rotation and integrates with Cloud Functions. The solution must provide fine-grained access control at the secret version level. Which service should they use?

A.Cloud Key Management Service (Cloud KMS)

B.Cloud Storage with customer-managed encryption keys

C.Secret Manager

D.Cloud HSM

AnswerC

Secret Manager meets all requirements: secure storage, versioning, automatic rotation, and fine-grained IAM at the version level.

Why this answer

Secret Manager is designed for storing secrets such as API keys and database credentials. It supports versioning, IAM roles with fine-grained access (e.g., secretmanager.versions.access), and automatic rotation via Pub/Sub notifications triggering Cloud Functions.

Full explanation →

769

MCQmedium

A healthcare organization is migrating to Google Cloud and needs to store Protected Health Information (PHI) while maintaining HIPAA compliance. They have executed a Business Associate Agreement (BAA) with Google. Which additional step is required to ensure that PHI is properly classified and protected?

A.Enable Audit Logs for all services that process PHI.

B.Configure Cloud Armor to protect web applications handling PHI.

C.Enable VPC Service Controls and restrict access to Cloud Storage buckets containing PHI.

D.Use Cloud Data Loss Prevention (DLP) to inspect and classify storage buckets containing PHI.

AnswerD

Cloud DLP can inspect and classify sensitive data like PHI, helping the organization apply appropriate controls.

Why this answer

For HIPAA compliance, after signing a BAA, organizations must implement data classification. Cloud DLP provides the ability to discover and classify PHI across GCP services.

Full explanation →

770

MCQmedium

A company is required to perform penetration testing on their Google Cloud infrastructure. According to Google Cloud's policy, which statement is true regarding penetration testing?

A.Customers must use Google's own penetration testing tools, such as Web Security Scanner.

B.No prior approval is needed for testing most services, but denial-of-service (DoS) attacks are not permitted.

C.Prior approval from Google is required for all penetration testing activities.

D.Penetration testing is prohibited on Google Cloud unless it is conducted by a certified third party.

AnswerB

Google's policy allows testing without prior approval for most services, but DoS attacks are explicitly prohibited.

Why this answer

Google Cloud's Acceptable Use Policy permits penetration testing on most services without prior approval, but DoS attacks are forbidden.

Full explanation →

771

MCQmedium

An organization wants to use Security Command Center to detect misconfigurations in their Google Cloud resources. They need a service that can automatically check for common security issues like open firewall ports and IAM policy violations. Which SCC feature should they enable?

A.Anomaly Detection

B.Event Threat Detection

C.Security Health Analytics

D.Web Security Scanner

AnswerC

SHA automatically scans resources for misconfigurations.

Why this answer

Security Health Analytics (SHA) is the SCC built-in scanner that checks for misconfigurations such as open firewall ports, overly permissive IAM roles, and other security best practices. Web Security Scanner targets web app vulnerabilities. Event Threat Detection is for threat detection.

Anomaly Detection identifies unusual behavior.

Full explanation →

772

MCQeasy

A security analyst needs to investigate a potential breach in a Compute Engine instance. They want to create an offline forensic copy of the disk without affecting the running instance. Which action should they take?

A.Create an image from the disk while the instance is running.

B.Use the gcloud compute disks copy command to replicate the disk.

C.Attach a new blank disk to the instance and use dd to clone the data.

D.Stop the instance and create a snapshot of the boot disk.

AnswerD

Stopping ensures a consistent snapshot; the snapshot can be used for forensics without affecting the original instance.

Why this answer

Creating a snapshot is the correct method to create a point-in-time copy of a persistent disk for forensic analysis. The snapshot can be used to create a new disk for analysis. Stopping or creating an image modifies the instance state or does not preserve all data.

Full explanation →

773

MCQeasy

An organization needs to store API keys and database credentials in a central, auditable service with versioning and IAM access control. Which GCP service should they use?

A.Cloud HSM

B.Secret Manager

C.Cloud DLP

D.Cloud KMS

AnswerB

Secret Manager is the correct service for storing and managing secrets with versioning and IAM.

Why this answer

Secret Manager is purpose-built for storing secrets like API keys, certificates, and database passwords. It provides versioning, IAM policies (e.g., secretmanager.versions.access), and automatic rotation with Pub/Sub notifications.

Full explanation →

774

Multi-Selecthard

A company uses BigQuery to store sensitive data and wants to implement data masking using policy tags. They have three user groups: data_engineers (full access), data_analysts (masked PII), and data_scientists (masked financial data). Which THREE steps should they take?

Select 3 answers

A.Publish the taxonomy to make the policy tags available for use.

B.Create a taxonomy in Cloud Data Catalog with policy tags for PII and financial data.

C.Apply only one policy tag per column.

D.Enable Cloud Audit Logs to track policy tag usage.

E.Define data masking rules using BigQuery's conditional access on the policy tags.

AnswersA, B, E

Taxonomy must be published before policy tags can be used.

Why this answer

After creating a taxonomy with policy tags in Cloud Data Catalog, you must publish the taxonomy to make those policy tags available for use in BigQuery. Publishing associates the taxonomy with the project and allows BigQuery to enforce data masking rules based on the policy tags applied to columns.

Exam trap

Google Cloud often tests the misconception that only one policy tag can be applied per column, but BigQuery supports multiple tags per column, and the most restrictive masking rule is enforced.

Full explanation →

775

Multi-Selecthard

A security engineer needs to ensure that all Compute Engine instances in an organization are created with specific CMEK (Customer-Managed Encryption Key) for disk encryption. The engineer wants to enforce this at the organization level. Which three actions are required? (Choose three.)

Select 3 answers

A.Create a Cloud KMS key ring and encryption key.

B.Enable Customer-Supplied Encryption Keys (CSEK) for all instances.

C.Apply the policy constraint at the organization level.

D.Ensure the Compute Engine API is disabled for all projects.

E.Create a custom organization policy constraint using the Organization Policy Service.

AnswersA, C, E

A CMEK key must exist to be referenced in the constraint.

Why this answer

To enforce CMEK use, you need to create a custom organization policy constraint that requires the CMEK key resource name. Enabling CMEK via CSEK is different. The constraint must be applied at the organization level.

The key must be created in Cloud KMS. The compute engine API must be enabled for policy enforcement.

Full explanation →

776

MCQmedium

A developer is troubleshooting a Cloud Run service that needs to read from a Cloud Storage bucket. The service runs as the compute engine default service account. The service account has been granted the Storage Object Viewer role at the project level, but the service still gets permission denied errors. What is the most likely cause?

A.The bucket uses uniform bucket-level access, which overrides IAM.

B.The service account was not granted access to the specific bucket.

C.The Cloud Run service is using a different service account than the one modified.

D.The Cloud Run service requires the Storage Admin role.

AnswerC

Cloud Run services must have a service account explicitly assigned; it does not use the compute engine default SA.

Why this answer

Cloud Run uses the runtime service account specified in the revision, not the compute engine default SA. The developer must explicitly set the service account when deploying, and grant it appropriate roles. The compute engine default SA is for Compute Engine VMs, not Cloud Run.

Full explanation →

777

Multi-Selecthard

A security team is designing access controls for a multi-tenant SaaS application on Google Kubernetes Engine (GKE). Each tenant has a separate namespace. They want to ensure that a DevOps team can manage deployments across all namespaces, but cannot modify secrets in the 'tenant-alpha' namespace. Which THREE Kubernetes RBAC resources should be created? (Choose THREE)

Select 3 answers

A.A RoleBinding in namespace 'tenant-alpha' that binds the ClusterRole to the DevOps team.

B.A ClusterRole that grants permissions to manage secrets across all namespaces.

C.A RoleBinding in namespace 'tenant-alpha' that binds a Role granting secret modification to the DevOps team.

D.A ClusterRole that grants permissions to manage deployments, services, and ingresses across all namespaces, but does not include secrets.

E.A Role in namespace 'tenant-alpha' that grants permissions to modify secrets, bound to a separate group of tenant administrators.

AnswersA, D, E

This binds the ClusterRole to the DevOps team in the specific namespace.

Why this answer

Creates a ClusterRole (option D) that grants permissions to manage deployments, services, and ingresses across all namespaces but does not include secrets. Option A creates a RoleBinding in the 'tenant-alpha' namespace that binds this ClusterRole to the DevOps team, granting them those permissions within that namespace only. To extend the same permissions to all other namespaces, a ClusterRoleBinding (not listed among the options) binding the same ClusterRole to the DevOps team at cluster scope must also be created.

Without it, the DevOps team cannot manage deployments outside 'tenant-alpha'. Option E creates a Role in 'tenant-alpha' that grants modify permissions on secrets, bound to a separate group of tenant administrators via its own RoleBinding. The combination of A, D, and E is the best selection from the given choices, but note that it does not fully meet the requirement unless an additional ClusterRoleBinding is created.

Exam trap

Google Cloud often tests the distinction between RoleBindings and ClusterRoleBindings, and the trap here is that candidates may think a ClusterRole can only be bound via a ClusterRoleBinding, but a RoleBinding can bind a ClusterRole to grant its permissions within a single namespace.

Full explanation →

778

MCQhard

A security administrator wants to receive near-real-time logs whenever a Google Cloud support engineer accesses their customer content. Which GCP service provides this capability?

A.Access Transparency

B.Cloud Audit Logs (Admin Activity)

C.Cloud Security Command Center

D.Cloud Audit Logs (Data Access)

AnswerA

Access Transparency provides logs of Google admin access to customer content.

Why this answer

Access Transparency provides near-real-time logs of actions taken by Google personnel when accessing customer content. It is part of the Assured Workloads offering and can be enabled for supported services.

Full explanation →

779

MCQmedium

A development team uses Cloud Secret Manager to store database credentials for an application running on Compute Engine. The application reads the secret using the Secret Manager API. After the team rotates the secret by adding a new version and setting it as the latest, the application continues to use the old secret version and fails to authenticate. The application is configured to fetch the secret with version 'latest' at startup. The team checks that the Compute Engine service account has the roles/secretmanager.secretAccessor role on the secret. What is the most likely cause of the issue?

A.Enable the new secret version by setting its state to 'enabled' via the Cloud Console, gcloud, or API.

B.Grant the service account the roles/secretmanager.secretAccessor at the project level instead of on the secret resource.

C.Update the application to use the specific version ID of the new secret instead of the 'latest' label.

D.Add an IAM condition on the secret that restricts access to only the latest version.

AnswerA

New versions are created disabled; they must be enabled to be accessible.

Why this answer

When a new secret version is added via Cloud Secret Manager, it is created in the 'disabled' state by default. Even if it is set as the 'latest' version, the application cannot access it until the version is explicitly enabled. The application fetches the secret using the 'latest' label, which points to the disabled version, causing authentication failure.

Enabling the new version resolves the issue.

Exam trap

Google Cloud often tests the misconception that setting a new version as 'latest' automatically makes it accessible, ignoring the default disabled state of newly added secret versions.

How to eliminate wrong answers

Option B is wrong because granting the role at the project level would not fix the issue; the service account already has the required role on the secret, but the secret version itself is disabled. Option C is wrong because using a specific version ID would still fail if that version is disabled; the core problem is the version state, not the label. Option D is wrong because adding an IAM condition does not affect the enabled/disabled state of a secret version; it only controls access based on attributes like resource tags or time, not version state.

Full explanation →

780

MCQmedium

Refer to the exhibit. A security engineer has created this IAM policy for a Cloud KMS key. The service account my-sa is used by a Compute Engine VM to encrypt data before storing it in Cloud Storage. User alice needs to decrypt the data for analysis. Which statement is true?

A.User alice can both encrypt and decrypt.

B.User alice needs the Cloud KMS CryptoKeyEncrypter role to encrypt.

C.The service account can encrypt but cannot decrypt.

D.The service account can both encrypt and decrypt.

AnswerC

It has only the CryptoKeyEncrypter role.

Why this answer

The IAM policy grants the service account my-sa the Cloud KMS CryptoKey Encrypter role, which allows it to encrypt but not decrypt. User alice is granted the Cloud KMS CryptoKey Decrypter role, which allows her to decrypt but not encrypt. Therefore, the service account can only encrypt, and user alice can only decrypt, making option C correct.

Exam trap

Google Cloud often tests the misconception that a service account used for encryption must also be able to decrypt, or that a user with decrypt permissions can also encrypt, when in fact Cloud KMS enforces strict role separation between encrypt and decrypt operations.

How to eliminate wrong answers

Option A is wrong because user alice is only granted the Cloud KMS CryptoKey Decrypter role, which does not include encrypt permissions; she cannot encrypt. Option B is wrong because user alice already has the Cloud KMS CryptoKey Decrypter role, which is sufficient for decryption, but she does not need the Cloud KMS CryptoKeyEncrypter role to encrypt because she is not performing encryption; the service account handles encryption. Option D is wrong because the service account is only granted the Cloud KMS CryptoKey Encrypter role, which explicitly excludes decrypt permissions; it cannot decrypt.

Full explanation →

781

MCQhard

Refer to the exhibit. A security administrator is troubleshooting why a user cannot access a BigQuery dataset. The user analyst@example.com is not a member of data-team@example.com. The user is trying to query a table in the dataset. What is the most likely reason for the denial?

A.The user needs to be added as a dataOwner to query tables.

B.The user has the role roles/bigquery.dataViewer, which does not allow querying tables; it only allows viewing dataset metadata.

C.The dataset policy includes a condition that the user does not satisfy.

D.The table itself might have additional restrictions such as row-level security.

AnswerB

dataViewer is insufficient for querying.

Why this answer

The role roles/bigquery.dataViewer only grants permission to view dataset metadata (e.g., table names, schema) but does not include the bigquery.tables.getData permission required to actually query table rows. Since the user is not a member of data-team@example.com and has only this role, any query attempt will be denied with an access denied error.

Exam trap

Google Cloud often tests the misconception that a role named 'dataViewer' implies the ability to view actual data, when in fact it only grants metadata visibility, not the ability to query table rows.

How to eliminate wrong answers

Option A is wrong because 'dataOwner' is not a standard BigQuery role; the correct role for querying tables is roles/bigquery.dataEditor or roles/bigquery.dataViewer with the bigquery.tables.getData permission, and adding a user as a dataOwner would not grant query access. Option C is wrong because the question states the user is trying to query a table in the dataset, and there is no mention of a condition in the dataset policy; the most likely reason is the insufficient role, not a condition failure. Option D is wrong because row-level security is an additional restriction that applies after the user already has table-level query access; the primary denial here is due to lack of the bigquery.tables.getData permission, not row-level security.

Full explanation →

782

MCQmedium

An organization wants to ensure that all new resources created in Google Cloud are restricted to a specific set of regions to meet data residency requirements. Which policy should they use?

A.Configure the `gcp.resourceLocations` organization policy constraint

B.Define a service perimeter using VPC Service Controls

C.Use IAM conditions to deny access outside approved regions

D.Enable Data Residency in Cloud Console settings

AnswerA

This policy directly restricts the regions where resources can be created.

Why this answer

The org policy constraint `gcp.resourceLocations` restricts resource creation to the specified locations. This is the correct method to enforce data residency for resources globally.

Full explanation →

783

MCQmedium

A company uses Cloud KMS to manage encryption keys for data at rest. They want to automatically rotate a symmetric key every 90 days. The key is used to encrypt Cloud Storage objects and BigQuery tables. What is the correct approach to achieve automatic rotation?

A.Use a Cloud Function to rotate the key every 90 days via the Cloud KMS API.

B.Set the rotation period on the key to 90 days and ensure the key purpose is ENCRYPT_DECRYPT.

C.Create a Cloud Scheduler job to manually rotate the key every 90 days.

D.Set the rotation period on the key ring to 90 days.

AnswerB

Setting rotation period on the key itself enables automatic rotation. ENCRYPT_DECRYPT is required for symmetric encryption.

Why this answer

In Cloud KMS, you can set a rotation period on a key. Automatic rotation creates a new key version at the specified interval. The key must have purpose ENCRYPT_DECRYPT for symmetric encryption.

Manual rotation is not automatic, and setting a rotation period on key rings is not possible.

Full explanation →

784

MCQeasy

Which Security Command Center (SCC) tier provides built-in compliance monitoring for standards like CIS and PCI DSS?

A.Neither; compliance monitoring is part of Cloud Audit Logs

B.Both Standard and Premium

C.Premium tier

D.Standard tier

AnswerC

Premium tier includes compliance monitoring for standards like CIS, PCI DSS, and others.

Why this answer

Compliance monitoring is a feature of SCC Premium tier. Standard tier includes Security Health Analytics but not compliance monitoring. Event Threat Detection is also Premium.

Full explanation →

785

MCQmedium

An organization needs to de-identify a BigQuery column containing US Social Security Numbers (SSNs) by replacing them with a consistent token that can be reversed if needed. Which Cloud DLP de-identification transform should they use?

A.BucketingConfig

B.MaskingConfig

C.CryptoReplaceFfxFpeConfig

D.DateShiftConfig

AnswerC

This transform uses FPE to create reversible, format-preserving tokens (e.g., SSN-like tokens).

Why this answer

CryptoReplaceFfxFpeConfig uses Format-Preserving Encryption (FPE) to replace sensitive data with a token that preserves the original format (e.g., 9 digits) and is reversible with the same key. BucketingConfig replaces with a range, MaskingConfig masks characters, and DateShiftConfig shifts dates.

Full explanation →

786

Multi-Selecthard

A company wants to use service account keys for an on-premises application that needs to authenticate to Google Cloud APIs. Which two practices should they follow to minimize security risks? (Choose TWO.)

Select 2 answers

A.Allow end users to download and use service account keys directly.

B.Enable automatic key generation and disable any unused keys.

C.Store the service account key in the application's source code for easy access.

D.Rotate service account keys regularly and store them in a secure secret management system.

E.Use a single service account key for all environments to simplify management.

AnswersB, D

Automating key generation ensures uniqueness, and disabling unused keys reduces attack surface.

Why this answer

Enabling automatic key generation ensures that keys are created with strong cryptographic standards and that unused keys are promptly disabled, reducing the attack surface. This practice aligns with Google Cloud's recommendation to minimize the number of active keys and to avoid manual key management errors.

Exam trap

Google Cloud often tests the misconception that storing keys in source code is acceptable for convenience, or that a single key across environments simplifies management, when in fact both practices drastically increase security risk.

Full explanation →

787

Multi-Selectmedium

A financial institution must meet SOX compliance requirements for audit trail integrity. Which THREE measures should they implement to ensure Cloud Audit Logs are immutable and securely stored?

Select 3 answers

A.Use VPC Service Controls to prevent exfiltration of logs.

B.Use customer-managed encryption keys (CMEK) with Cloud KMS for audit logs.

C.Export logs to Cloud Storage and apply a retention policy with a lock.

D.Set up Cloud IAM roles to restrict who can read audit logs.

E.Store logs in a Cloud Logging bucket with a retention policy locked via the Logs Retention API.

AnswersB, C, E

CMEK ensures only authorized keys can decrypt logs.

Why this answer

Using customer-managed encryption keys (CMEK) with Cloud KMS ensures that audit logs are encrypted with keys under the customer's control, preventing unauthorized decryption even by Google. This satisfies SOX requirements for data integrity and confidentiality, as the logs cannot be tampered with or accessed without the key.

Exam trap

Google Cloud often tests the distinction between access control (IAM, VPC Service Controls) and immutability (retention locks, CMEK), leading candidates to confuse preventing unauthorized access with preventing tampering or deletion.

Full explanation →

788

MCQhard

A company has a Shared VPC environment with multiple service projects. The security team wants to ensure that all Compute Engine VMs in service projects are only accessible via IAP TCP forwarding for SSH management, and direct external access is completely blocked. They have already applied an organization policy constraint that denies the attachment of external IP addresses to new VMs. However, there are several existing VMs that still have public IP addresses assigned. The team wants to remove the public IPs from these existing VMs without causing downtime for any ongoing SSH sessions or disrupting the applications running on them, but they must ensure the VMs can still reach the internet if needed (for example, to download updates). What should the team do?

A.Delete each VM and recreate it without a public IP address.

B.First, deploy a Cloud NAT gateway for the VPC and subnet, then remove the public IP from each VM; the VMs will use Cloud NAT for outbound internet access.

C.Detach the public IP from each VM in the console, and then create a new private IP for the VM.

D.For each VM, use the gcloud command to delete the public IP and assign a new private IP from the same subnet.

AnswerB

Cloud NAT provides outbound internet without public IPs and can be set up without VM downtime. Then public IPs can be safely removed.

Why this answer

Cloud NAT provides outbound internet access for private VMs without requiring public IPs, and removing the public IP from an existing VM does not interrupt running SSH sessions or applications—the VM continues running with its internal IP. After deploying Cloud NAT for the VPC and subnet, you can safely remove the public IP from each VM, and the VM will use Cloud NAT for outbound connections (e.g., downloading updates). This approach satisfies the security requirement of blocking direct external access while maintaining outbound connectivity and avoiding downtime.

Exam trap

Google Cloud often tests the misconception that simply removing a public IP and assigning a new private IP (options C and D) will somehow preserve internet access, but without Cloud NAT or a similar outbound gateway, private VMs cannot reach the internet.

How to eliminate wrong answers

Option A is wrong because deleting and recreating VMs would cause downtime for applications and terminate any ongoing SSH sessions, which violates the no-downtime requirement. Option C is wrong because simply detaching the public IP in the console without first setting up Cloud NAT would leave the VM without any outbound internet access, breaking the requirement that VMs can still reach the internet for updates. Option D is wrong because using gcloud to delete the public IP and assign a new private IP does not provide outbound internet access; the VM would lose connectivity to the internet unless Cloud NAT or another outbound mechanism is configured first.

Full explanation →

789

Multi-Selectmedium

An organization wants to restrict the creation of service accounts to only certain projects. Which two approaches can achieve this? (Choose two.)

Select 2 answers

A.Use a deny policy to block service account creation in all projects except the allowed ones.

B.Create a custom role with iam.serviceAccounts.create permission and assign it to a group, then use IAM conditions to restrict the resource to specific projects.

C.Grant the roles/iam.serviceAccountAdmin role only to users in the allowed projects.

D.Use an organization policy with constraint constraints/iam.disableServiceAccountCreation set to True at the org level, and then create a folder policy to allow creation in specific folders.

E.Create a separate organization for the allowed projects.

AnswersB, D

IAM conditions can limit the scope of a role to specific projects.

Why this answer

Two correct approaches: (B) Create a custom role with the iam.serviceAccounts.create permission and assign it to a group with IAM conditions restricting resource to specific projects, and (D) Use an organization policy with constraint constraints/iam.disableServiceAccountCreation set to True at the org level, then create a folder policy to allow creation in specific folders.

Exam trap

Be careful: Option A (deny policy) is not directly applicable because deny policies cannot block individual API methods like service account creation. Option C (granting roles/iam.serviceAccountAdmin only to users in allowed projects) does not restrict creation by project; it only limits who can create, not where.

Full explanation →

790

MCQmedium

A pharmaceutical company uses Google Cloud to process clinical trial data subject to HIPAA. They must ensure that only authorized applications can access the data, even if credentials are compromised. Which security control should they implement?

A.Use Workload Identity Federation to allow workloads to access data without service account keys.

B.Use service account impersonation with IAM conditions to restrict access to specific trusted applications.

C.Create a VPC Service Control perimeter that allows only specific service accounts to access the data.

D.Require users to MFA and use IAM roles to grant access.

AnswerB

Impersonation with conditions limits the use of service accounts to specific callers, reducing blast radius.

Why this answer

Service account impersonation with IAM conditions allows the company to bind access to specific trusted applications by requiring that the caller present a specific service account identity. Even if credentials are compromised, the attacker cannot impersonate that service account unless they also satisfy the IAM conditions (e.g., resource tags, IP ranges, or application identity). This directly addresses the requirement to restrict access to authorized applications only, as per HIPAA's minimum necessary standard.

Exam trap

The trap here is that candidates confuse authentication (who you are) with authorization (what you can do) and pick MFA or VPC perimeters, missing that the question explicitly requires application-level restriction even after credential compromise, which only impersonation with conditions provides.

How to eliminate wrong answers

Option A is wrong because Workload Identity Federation eliminates the need for service account keys but does not restrict access to specific applications; it only authenticates external workloads without keys, so a compromised credential could still be used from any federated identity. Option C is wrong because VPC Service Controls create a security perimeter around resources but do not enforce application-level authorization; they block data exfiltration based on network context, not application identity. Option D is wrong because MFA and IAM roles authenticate users, not applications; if a user's credentials are compromised, the attacker can still access data from any application the user has permission to use, failing the 'only authorized applications' requirement.

Full explanation →

791

MCQmedium

An engineer needs to configure automatic key rotation for a symmetric encryption key in Cloud KMS. They have set the rotation period to 90 days. What happens to the old key material after rotation?

A.The old key version is disabled and can be re-enabled if needed.

B.The old key material is immediately deleted.

C.The old key version remains enabled and can still be used for decryption.

D.The old key material is moved to a pending destruction state for 24 hours.

AnswerC

Old key versions remain enabled and can be used to decrypt data encrypted with them.

Why this answer

When a key is rotated, a new key version is created and becomes the primary. The old version is retained and remains available for decrypting data encrypted with it. Key material is not automatically deleted; it can be disabled or scheduled for destruction separately.

Full explanation →

792

MCQhard

A company uses Google Cloud Directory Sync to synchronize users from an on-premises Active Directory to Cloud Identity. They want to allow federated access from their external identity provider (IdP) that supports SAML 2.0. The IdP should be able to authenticate users from a specific AD domain. What configuration steps are required?

A.Use Workload Identity Federation to map the external IdP to Google Cloud service accounts.

B.Set up SAML SSO in Cloud Identity using Google as the IdP, and configure AD to trust Google's SAML response for the domain.

C.Configure the external IdP as a SAML identity provider in Cloud Identity, map the AD domain, and enable user provisioning via SCIM.

D.Create a custom OAuth 2.0 flow in Cloud Identity to integrate with the external IdP.

AnswerC

The external IdP acts as the SAML IdP, Cloud Identity as the SP. SCIM is optional but not required for authentication.

Why this answer

For federated access with an external SAML 2.0 IdP, configure the external IdP as a SAML identity provider in Cloud Identity, mapping the appropriate domain.

Full explanation →

793

MCQhard

A security engineer wants to ensure that only users from a specific external identity provider (IdP) domain (example.com) can access Google Cloud resources. They have configured SAML SSO with the IdP. However, users from other domains are also able to access resources. What is the most effective way to restrict access to only users from example.com?

A.Set the Organization Policy constraint constraints/iam.allowedPolicyMemberDomains to only allow domain example.com.

B.Use Cloud Identity groups with membership restricted to example.com and grant access to the group only.

C.Configure the IdP to only assert users from example.com.

D.Use IAM Conditions to restrict access to users with a specific claim (e.g., assertion.primary_email ending with @example.com).

AnswerA

This constraint restricts which domains can be used as members in IAM policies, effectively preventing users from other domains from being granted access.

Why this answer

The best approach is to use the Organization Policy constraint 'constraints/iam.allowedPolicyMemberDomains' to restrict which external domains can be members of IAM policies. This prevents users from other domains from being granted roles. Simply blocking at the IdP is not effective because users from other domains could be added as members in IAM.

IAM Conditions can be used on role bindings to restrict access based on the user's domain, but this requires careful application to all policies. The organization policy provides a global enforcement.

Full explanation →

794

MCQmedium

Refer to the exhibit. A Security Engineer is reviewing the IAM policy for a project. An administrator reports that a user named admin@example.com cannot create firewall rules, even though the command should allow it. According to the policy, what is the most likely reason?

A.The security-team group has the 'compute.securityAdmin' role, but the user is not in that group.

B.The user has the 'compute.instanceAdmin.v1' role, which conflicts with network admin permissions.

C.The user has the 'compute.networkAdmin' role, which does not include permission to create firewall rules.

D.The IAM policy has an invalid etag, causing the policy to be rejected.

AnswerC

NetworkAdmin can modify networks but not firewall rules; securityAdmin is needed.

Why this answer

The 'compute.networkAdmin' role in Google Cloud IAM does not include the 'compute.firewalls.create' permission required to create firewall rules. The user has this role, which grants permissions to manage network resources like subnets and routes, but firewall rule creation is a security function that requires the 'compute.securityAdmin' role.

Exam trap

Google Cloud often tests the misconception that 'networkAdmin' implies full control over all network-related resources, including firewalls, when in fact firewall rule management requires a distinct security-focused role.

How to eliminate wrong answers

Option A is wrong because the user is not in the security-team group, but the policy does not indicate that the user's permissions depend on group membership; the issue is the specific role assigned. Option B is wrong because the 'compute.instanceAdmin.v1' role does not conflict with network admin permissions; it is a separate role for managing compute instances, and conflicts are not a factor in IAM—permissions are additive. Option D is wrong because an invalid etag would cause the policy to be rejected during an update, not prevent an existing user from performing an action; the user already has the policy applied.

Full explanation →

795

MCQmedium

A security team wants to analyze VPC Flow Logs to investigate a potential data exfiltration incident. The logs are currently stored in Cloud Logging. What is the MOST efficient method to query and visualize the network traffic patterns?

A.Use Log Analytics in Cloud Logging with SQL queries

B.Enable VPC Flow Logs on a new VM and capture traffic

C.Export logs to Cloud Storage and analyze with a local tool

D.Create a log sink to BigQuery and use BigQuery for analysis

AnswerA

Log Analytics allows SQL queries on logs stored in Logging buckets, enabling analysis without export.

Why this answer

Log Analytics (powered by BigQuery) in Cloud Logging provides SQL-based analysis directly on logs without needing to export.

Full explanation →

796

MCQmedium

A multinational corporation operates multiple Google Cloud projects across several folders. They have a security requirement to enforce that all Cloud Storage buckets are created with uniform bucket-level access enabled and that no bucket has public access. They want to automatically remediate any non-compliant bucket that violates these policies. Currently, they use Organization Policies to enforce uniform bucket-level access, but they still find some buckets with public access due to exceptions. They have Cloud Security Command Center (Cloud SCC) enabled and receive findings about public buckets. The operations team wants to build a solution that automatically disables public access on non-compliant buckets. Which approach should they take?

A.Create a new Organization Policy that denies public access to all buckets.

B.Configure a Cloud Monitoring alert policy that triggers a webhook to a third-party automation tool.

C.Create a Cloud Security Command Center notification channel for public bucket findings, publish to a Pub/Sub topic, and trigger a Cloud Function that removes public IAM bindings from the bucket.

D.Write a script using gsutil and run it daily via Cloud Scheduler to check all buckets and remove public access.

AnswerC

Automates detection and response in near real-time.

Why this answer

Cloud Security Command Center can send notifications for public bucket findings to a Pub/Sub topic, which triggers a Cloud Function that automatically removes public IAM bindings from the bucket in real time. Option A is incorrect because Organization Policies can deny public access but cannot retroactively fix buckets already created with exceptions; they apply at resource creation time. Option B is incorrect because Cloud Monitoring alerts are designed for monitoring metrics and logs, not for directly triggering remediation workflows like Cloud Functions.

Option D is incorrect because running a scheduled script via Cloud Scheduler is not real-time and may leave buckets exposed between runs.

Full explanation →

797

Multi-Selecthard

A company is implementing a zero-trust network architecture on Google Cloud. They want to ensure that all traffic between their on-premises data center and Google Cloud is encrypted and authenticated. Additionally, they need to support high availability across multiple regions. Which two Google Cloud services should they use? (Choose two.)

Select 2 answers

A.Cloud NAT

B.VPC Network Peering

C.Cloud CDN

D.Cloud Interconnect (Dedicated)

E.Cloud VPN

AnswersD, E

Dedicated Interconnect provides high-bandwidth, low-latency connections and supports high availability via multiple VLAN attachments.

Why this answer

Cloud VPN provides encrypted tunnels for secure connectivity between on-premises and Google Cloud. Cloud Interconnect (Dedicated) offers dedicated, low-latency, high-availability connections. Combining both allows encryption over Interconnect (via VPN) and supports high availability across multiple regions.

Option A is incorrect because Cloud NAT is for outbound-only traffic, not encrypted connectivity. Option B is incorrect because VPC Network Peering connects VPCs within Google Cloud, not to on-premises. Option C is incorrect because Cloud CDN is for content delivery, not network connectivity.

Full explanation →

798

Multi-Selectmedium

A security team needs to monitor and log all Google Cloud administrator access to customer data stored in Cloud Storage and BigQuery. They want to receive near-real-time alerts when such access occurs. Which two services should they use together? (Choose TWO).

Select 2 answers

A.Access Transparency

B.Cloud DLP

C.Cloud KMS

D.Cloud Audit Logs

E.Cloud Functions

AnswersA, D

Access Transparency logs provide details of Google admin access to customer content.

Why this answer

Access Transparency provides logs of Google admin access to customer content. These logs are delivered to the customer's Cloud project. Cloud Audit Logs can be used to route Access Transparency logs to Pub/Sub, and then Cloud Functions can process them for alerts.

Cloud Monitoring can create alerting policies based on log metrics. Cloud DLP is for data inspection, not for logging access. Cloud KMS is for key management.

Full explanation →

799

MCQmedium

An engineer needs to ensure that only VMs with a specific service account (sa-prod@project.iam.gserviceaccount.com) can access a Cloud Spanner instance. They want to control this at the network level, not using IAM. Which VPC firewall rule configuration should they use?

A.Egress rule with source service account 'sa-prod'

B.Ingress rule with target service account 'sa-prod'

C.Egress rule with target service account 'sa-prod'

D.Ingress rule with source tag 'sa-prod'

AnswerC

Egress rules can be applied to VMs using a specific service account as the target.

Why this answer

Firewall rules can target service accounts for egress rules. Since the VMs initiate connections to Spanner, an egress rule with target service account is appropriate.

Full explanation →

800

MCQeasy

A company needs to retain critical financial records for 7 years to comply with SEC regulations. They choose to store the records in Cloud Storage. Which feature should they enable to ensure the records cannot be deleted or overwritten before the retention period expires?

A.Enable bucket-level IAM conditions.

B.Configure an object lifecycle rule to delete objects after 7 years.

C.Use Cloud KMS to encrypt objects and destroy the key after 7 years.

D.Apply a retention policy and lock the bucket using Bucket Lock.

AnswerD

Retention policy with Bucket Lock enforces WORM compliance, making objects immutable until the retention period ends.

Why this answer

Object Retention Lock in Cloud Storage allows you to set a retention policy on a bucket, which uses a WORM (Write Once Read Many) model. Once an object is stored, it cannot be deleted or overwritten until the retention period expires. Bucket Lock locks the retention policy, preventing changes.

IAM conditions and lifecycle rules do not enforce immutability.

Full explanation →

801

MCQmedium

An organization needs to restrict access to Cloud Storage buckets so that only requests from a specific range of IP addresses (e.g., corporate VPN) are allowed. They also want to block all other IPs. Which combination of services should they use?

A.IAM conditions with source IP

B.Firewall rules with source IP

C.VPC Service Controls with an IP-based access level

D.Cloud Armor with IP allow list

AnswerC

Access levels in VPC Service Controls can be IP-based, and a service perimeter enforces that only requests from those IPs are allowed.

Why this answer

VPC Service Controls create a service perimeter that, combined with an access level based on IP addresses, can restrict access to Google Cloud services such as Cloud Storage to only those IPs. The access level defines the allowed IP ranges.

Full explanation →

802

MCQhard

An engineer needs to grant a group of external auditors read-only access to all resources in a specific project. The auditors authenticate via an external SAML 2.0 IdP. What is the most secure and efficient way to set this up?

A.Create individual Google accounts for each auditor and assign them the Viewer role.

B.Configure IAP with the external IdP and grant access to the project's resources through IAP.

C.Use Cloud Directory Sync to sync the auditors from the external IdP as Google Groups, then grant the group Viewer role.

D.Create a custom role with read-only permissions and assign it to each auditor individually.

AnswerC

Cloud Directory Sync can synchronize groups from the IdP. Granting the group the Viewer role is efficient and maintains group membership in the IdP.

Why this answer

The correct approach is to create a Google Group and configure SAML SSO for Cloud Identity. Then, grant the Google Group the 'Viewer' role at the project level. The auditors authenticate via SAML and become members of the group, inheriting the permissions.

Full explanation →

803

Multi-Selectmedium

An organization wants to use Web Security Scanner to find vulnerabilities in their web application. Which TWO finding types can Web Security Scanner detect?

Select 2 answers

A.Cross-site scripting (XSS)

B.Insecure deserialization

C.Server-side request forgery (SSRF)

D.Outdated libraries

E.SQL injection

AnswersA, D

Web Security Scanner detects XSS vulnerabilities.

Why this answer

Web Security Scanner detects XSS, mixed content, outdated libraries, and other common web vulnerabilities, but not SQL injection or SSRF.

Full explanation →

804

MCQeasy

A developer is running a batch job on Compute Engine that needs to read data from Cloud Storage. What is the recommended way to authenticate the VM to Cloud Storage without managing keys?

A.Use the Compute Engine default service account and grant it the roles/storage.objectViewer role.

B.Create a service account key, download it to the VM, and use it with gcloud auth.

C.Add the user's personal credentials to the VM and use them.

D.Use Application Default Credentials (ADC) from a service account key stored in Secret Manager.

AnswerA

The default service account is automatically attached to the VM. Granting it the Storage role allows the VM to read objects without key management.

Why this answer

The best practice is to use the Compute Engine default service account and grant it the appropriate Storage roles. This avoids managing keys and uses the VM's identity tied to the service account.

Full explanation →

805

Multi-Selecthard

A security engineer is designing a data residency strategy for a healthcare organization that must keep all data within the European Union. They plan to use Assured Workloads to meet this requirement. Which THREE additional controls should they implement to further enforce data residency and protect data? (Choose three.)

Select 3 answers

A.Organization policy constraint gcp.resourceLocations set to allow only European regions.

B.VPC Service Controls to prevent data exfiltration to non-approved regions.

C.Cloud HSM to store encryption keys.

D.Cloud DLP to scan for sensitive data.

E.Access Transparency logs to monitor Google personnel access to data.

AnswersA, B, E

This restricts resource creation to specified European regions.

Why this answer

To enforce data residency, you can use Organization Policy constraints to restrict resource locations, VPC Service Controls to prevent data exfiltration, and Access Transparency to monitor Google personnel access. Cloud HSM is about key storage, not residency; Data Loss Prevention is about data classification, not residency.

Full explanation →

806

MCQmedium

A company needs to ensure that all data stored in Cloud Storage is encrypted at rest using keys that they generate and manage themselves. They also need to rotate the keys every 90 days. Which encryption option should they use?

A.Customer-supplied encryption keys (CSEK)

B.Cloud External Key Manager (Cloud EKM)

C.Google-managed encryption keys (GMEK)

D.Customer-managed encryption keys (CMEK) using Cloud KMS

AnswerD

CMEK allows customers to manage their own keys in Cloud KMS, including automatic rotation on a schedule.

Why this answer

CMEK gives customers control over key lifecycle, including automatic rotation every 90 days.

Full explanation →

807

Multi-Selecthard

A company needs to comply with the General Data Protection Regulation (GDPR). They are using BigQuery to store personal data. Which THREE measures should they implement to meet GDPR requirements?

Select 3 answers

A.Enable audit logs via Cloud Audit Logs to track access to personal data.

B.Use Cloud KMS to encrypt individual columns containing personal data.

C.Store data in a multi-region location like 'EU' to ensure availability across regions.

D.Use Cloud DLP to classify and de-identify sensitive columns before loading into BigQuery.

E.Enable data deletion by using DML statements to remove personal data when requested.

AnswersA, D, E

Audit logs are necessary for demonstrating compliance.

Why this answer

Cloud Audit Logs provide a comprehensive, immutable record of all administrative and data access activities in BigQuery, which is essential for demonstrating GDPR compliance through accountability and traceability. By enabling audit logs, the company can track who accessed personal data, when, and from where, fulfilling the GDPR requirement to maintain records of processing activities.

Exam trap

Google Cloud often tests the misconception that encryption (like Cloud KMS) is a primary GDPR measure for BigQuery, when in reality BigQuery's default encryption already meets encryption requirements, and the focus should be on access control, auditability, and data lifecycle management.

Full explanation →

808

MCQhard

An organization uses VPC Service Controls to protect BigQuery datasets. They need to allow a specific on-premises application, which uses a static IP address, to query a BigQuery dataset inside the service perimeter. Which configuration is required?

A.Create a Cloud Armor rule to allow the on-premises IP

B.Use Private Google Access for the on-premises network

C.Create an ingress rule in the service perimeter with the on-premises IP as the source

D.Add the on-premises IP to an access level and create an egress rule

AnswerC

An ingress rule with the source IP allows traffic from that IP into the perimeter for specified services.

Why this answer

VPC Service Controls allow ingress rules to permit traffic from specific IP ranges into a perimeter. By creating an ingress rule that allows the on-premises IP and specifies the BigQuery API, the on-premises application can access the dataset.

Full explanation →

809

Multi-Selectmedium

An organization wants to enforce data loss prevention (DLP) for sensitive data stored in Cloud Storage. Which THREE of the following Google Cloud services can be used together to inspect, classify, and automatically redact sensitive data in Cloud Storage? (Choose three.)

Select 3 answers

A.BigQuery

B.Cloud Storage

C.Dialogflow CX

D.Cloud Data Loss Prevention (DLP) API

E.Cloud Functions

AnswersB, D, E

Cloud Storage stores the data and can store inspection results or redacted copies.

Why this answer

Cloud Storage is the target data repository where sensitive data resides, making it a necessary component of the DLP workflow. The Cloud Data Loss Prevention (DLP) API inspects and classifies the data, and Cloud Functions can be triggered by Cloud Storage events to automatically redact or transform the sensitive content before it is stored or accessed.

Exam trap

Google Cloud often tests the misconception that BigQuery is required for DLP on Cloud Storage, but BigQuery is only needed if you are analyzing structured tables; for object-level inspection and redaction in Cloud Storage, the combination of Cloud Storage, Cloud DLP API, and Cloud Functions is the correct serverless pipeline.

Full explanation →

810

MCQeasy

A company needs to store PII in Google Cloud and comply with GDPR data residency requirements. What is the primary Google Cloud feature to enforce data residency?

A.Organization policies

B.Cloud Data Loss Prevention

C.Cloud KMS

D.VPC Service Controls

AnswerD

VPC Service Controls allow you to create perimeters that restrict data movement and access based on location, supporting data residency compliance.

Why this answer

VPC Service Controls (option D) is the primary Google Cloud feature to enforce data residency because it allows you to define perimeters that restrict data movement and access to specific Google Cloud services within a chosen region. By creating a VPC Service Controls perimeter, you can prevent data from being copied or accessed outside of the allowed geographic boundaries, directly addressing GDPR data residency requirements. This is achieved through context-aware access policies that block egress of data to unauthorized regions, even if an attacker gains access to a project.

Exam trap

Google Cloud often tests the misconception that Organization policies (option A) are sufficient for data residency, but in reality, they only restrict resource creation locations, not data movement or access, which is why VPC Service Controls is the correct answer for enforcing residency at the data plane level.

How to eliminate wrong answers

Option A is wrong because Organization policies are used to set constraints on resource usage (e.g., restricting resource locations or disabling service creation), but they do not enforce data residency by controlling data movement or access at the network level; they are a higher-level governance tool, not a data residency enforcement mechanism. Option B is wrong because Cloud Data Loss Prevention (DLP) is designed to inspect, classify, and de-identify sensitive data (like PII) but does not enforce geographic restrictions on where data can be stored or processed; it focuses on data protection, not residency. Option C is wrong because Cloud KMS manages encryption keys for data at rest and in transit but has no capability to restrict data to a specific region or prevent data from leaving a geographic boundary; it is a key management service, not a data residency control.

Full explanation →

811

MCQmedium

A company uses Organization Policies to restrict resource locations. They want to allow resources only in 'us-central1' and 'europe-west1'. They also need to allow a specific project to use 'us-east1' for a temporary workload. What is the correct organization policy configuration?

A.Set an organization policy with constraint 'gcp.resourceLocations' and allowed values 'us-central1' and 'europe-west1'. On the specific project, set a policy with allowed values 'us-central1', 'europe-west1', and 'us-east1'.

B.Set an organization policy with constraint 'gcp.resourceLocations' and denied values 'asia-*', 'australia-*', etc. On the specific project, set a policy with allowed values 'us-east1'.

C.Set an organization policy with constraint 'gcp.resourceLocations' and allowed values 'us-central1', 'europe-west1'. Use tags to mark the project and create a conditional policy that adds 'us-east1' when the tag is present.

D.Set an organization policy with constraint 'gcp.resourceLocations' and allowed values 'us-central1', 'europe-west1'. On the specific project, set a policy with denied values 'us-east1'.

AnswerA

Correct hierarchy: org policy restricts, project policy allows additional location.

Why this answer

Organization Policies with the 'gcp.resourceLocations' constraint enforce location restrictions hierarchically. By setting allowed values at the organization level to 'us-central1' and 'europe-west1', all projects inherit these restrictions. Overriding the policy on the specific project by adding 'us-east1' to the allowed list creates a more permissive policy that still respects the organization-level constraints, allowing the temporary workload in 'us-east1'.

Exam trap

Google Cloud often tests the misconception that project-level policies merge with organization-level policies, when in reality they override the parent policy entirely, requiring the allowed list to include all permitted locations.

How to eliminate wrong answers

Option B is wrong because using denied values with wildcards like 'asia-*' is overly broad and does not explicitly allow the required locations; it also fails to guarantee that only 'us-central1' and 'europe-west1' are allowed, and adding 'us-east1' as an allowed value on the project would conflict with the deny-all approach. Option C is wrong because tags and conditional policies are not supported with the 'gcp.resourceLocations' constraint; this constraint only supports hierarchical override via allowed/denied lists, not tag-based conditions. Option D is wrong because setting denied values 'us-east1' on the specific project would explicitly block 'us-east1', which contradicts the requirement to allow it for the temporary workload.

Full explanation →

812

MCQhard

A company uses Chronicle as their SIEM. They need to ingest logs from an on-premises firewall that does not support direct integration with Chronicle. What is the recommended approach to ingest these logs?

A.Use the firewall's syslog capabilities to send logs directly to a Chronicle endpoint.

B.Export firewall logs to Cloud Storage and then create a BigQuery external table for Chronicle.

C.Use a Cloud Function to pull logs from the firewall and push them to Chronicle via API.

D.Install a Chronicle forwarder on a local server to collect and forward logs to Chronicle.

AnswerD

The forwarder is the standard way to ingest third-party logs.

Why this answer

Chronicle provides forwarders (software agents) that can be installed on a machine to collect logs from various sources like firewalls and forward them to Chronicle. The forwarder normalizes logs into UDM. The forwarder can be deployed on-premises or in a VM.

Full explanation →

813

Multi-Selecteasy

A healthcare organization needs to redact Social Security Numbers (SSNs) from patient records stored in Cloud Storage before sharing them with a research partner. They plan to use Cloud DLP. Which TWO actions should they take to configure the DLP job correctly? (Choose two.)

Select 2 answers

A.Apply a de-identification template that uses the 'redact' transformation on the identified SSNs.

B.Use the built-in infoType detector US_SOCIAL_SECURITY_NUMBER to identify SSNs.

C.Configure Access Transparency logs to track who accesses the objects.

D.Encrypt the objects with a CMEK key before running the DLP inspection.

E.Enable VPC Service Controls to prevent unauthorized access to the bucket.

AnswersA, B

Redact removes the detected sensitive data from the output.

Why this answer

Cloud DLP de-identification templates allow you to specify a 'redact' transformation that completely removes or replaces the matched sensitive data, such as SSNs, from the content. This ensures that the output files shared with the research partner contain no trace of the original SSNs, meeting the redaction requirement.

Exam trap

Google Cloud often tests the distinction between data-level de-identification (DLP transformations) and infrastructure-level security controls (encryption, VPC Service Controls, logging), leading candidates to select options that protect the data at rest or in transit but do not actually redact the sensitive content.

Full explanation →

814

MCQmedium

A healthcare organization is migrating workloads to Google Cloud and needs to process Protected Health Information (PHI) under HIPAA. Which step is required before storing PHI in any GCP service?

A.Enable VPC Service Controls on all projects

B.Sign a Business Associate Agreement (BAA) with Google Cloud

C.Configure Cloud DLP to classify all data

D.Enable Cloud Audit Logs for all services

AnswerB

A BAA is a mandatory contractual agreement between the covered entity and Google Cloud, required before processing PHI.

Why this answer

HIPAA requires a Business Associate Agreement (BAA) with Google Cloud before processing or storing PHI. The organization must sign a BAA with Google, which provides assurances regarding the protection of PHI.

Full explanation →

815

Multi-Selectmedium

A security engineer needs to implement de-identification of sensitive data in a Cloud Storage bucket using Cloud DLP. They want to inspect the data for credit card numbers and then replace them with a tokenized value that preserves the format for downstream processing. Which TWO actions should they take? (Choose two.)

Select 2 answers

A.Use the DateShiftConfig de-identification transform

B.Configure an inspection job with the built-in CREDIT_CARD_NUMBER infoType

C.Use the CryptoReplaceFfxFpeConfig de-identification transform

D.Create a custom infoType for credit card numbers

E.Use the BucketingConfig de-identification transform

AnswersB, C

Inspection identifies the sensitive data. Built-in infotype is sufficient.

Why this answer

To de-identify credit card numbers while preserving format, the engineer should use a DLP inspection job first to identify the sensitive data, then apply a de-identification transform using CryptoReplaceFfxFpeConfig which replaces the data with a token that preserves the format. The other options: BucketingConfig groups values, DateShiftConfig shifts dates, and using a custom infoType is not necessary if the built-in CREDIT_CARD_NUMBER works.

Full explanation →

816

MCQeasy

A multinational organization must store customer data only in specific geographic regions to comply with data residency regulations. They use Cloud Spanner for their primary database. What should they do to enforce that data is stored only in approved regions?

A.Apply an organization policy with a constraint that restricts the location of Cloud Spanner resources to approved regions.

B.Create a Cloud Spanner instance in the desired region and configure a backup in a different region for disaster recovery.

C.Configure a VPC Service Controls perimeter to restrict access to Cloud Spanner.

D.Use Cloud Spanner with data residency constraints by selecting a multi-region configuration that includes only approved regions.

AnswerA

Organization policies can enforce location restrictions on resources.

Why this answer

Organization policies with resource location constraints allow you to enforce that Cloud Spanner instances are created only in approved geographic regions. This policy is evaluated at resource creation time and prevents the deployment of Spanner instances outside the specified regions, directly addressing data residency compliance requirements.

Exam trap

Google Cloud often tests the distinction between data residency enforcement (location constraints) and access control (VPC Service Controls) or data protection (backups), leading candidates to confuse network perimeters with geographic storage restrictions.

How to eliminate wrong answers

Option B is wrong because creating an instance in one region and a backup in another does not enforce data residency; the primary data could still be stored in a non-approved region. Option C is wrong because VPC Service Controls restrict network access to Cloud Spanner, not the geographic location where the data is stored. Option D is wrong because selecting a multi-region configuration that includes only approved regions does not prevent the instance from being placed in a non-approved region if the configuration is not restricted; the organization policy is needed to enforce the constraint.

Full explanation →

817

MCQmedium

A DevOps team wants to automatically provision and renew SSL certificates for a global HTTPS load balancer. Which certificate management option should be used?

A.Create a Google-managed certificate directly on the load balancer and configure a cron job to check renewal.

B.Use Certificate Manager with a DNS authorization to create a Google-managed certificate.

C.Use a third-party CA and upload the certificate with a longer validity.

D.Upload a self-managed certificate and configure a cron job to renew it.

AnswerB

Certificate Manager can create Google-managed certificates that auto-renew.

Why this answer

Google-managed SSL certificates automatically provision and renew certificates for domains hosted on Google Cloud, ideal for load balancers without manual intervention.

Full explanation →

818

MCQmedium

A security engineer needs to store database credentials and API keys securely in GCP. The solution must support automatic rotation of secrets at a defined schedule and trigger a Cloud Function after each rotation to update dependent applications. Which service should they use?

A.Secret Manager

B.Cloud KMS

C.Cloud DLP

D.Cloud Storage

AnswerA

Secret Manager stores secrets, supports automatic rotation with Pub/Sub notifications to trigger Cloud Functions.

Why this answer

Secret Manager supports versioning, IAM access, and automatic rotation with Pub/Sub notifications. Cloud Functions can subscribe to the Pub/Sub topic to perform post-rotation tasks. Cloud KMS manages keys, not secrets.

Cloud DLP is for data loss prevention. Cloud Storage is not designed for secret management with rotation.

Full explanation →

819

MCQmedium

A security team wants to use Web Security Scanner to find vulnerabilities in their web application hosted on Compute Engine. They need to scan the public-facing URL weekly and receive a report of findings. Which configuration is required?

A.Install the Web Security Scanner agent on the VM

B.Create a managed scan in Security Command Center with the target URL and schedule

C.Use gcloud compute instances scan command

D.Deploy the application to App Engine, then enable Web Security Scanner

AnswerB

Managed scans in SCC allow you to set a target URL and schedule.

Why this answer

Web Security Scanner requires a managed scan target (URL) to be configured. Scans can be scheduled. It does not require an App Engine or GKE; it can scan any public URL.

The scan is managed by Google Cloud and reports findings to SCC.

Full explanation →

820

MCQeasy

A company wants to ensure that all data stored in Cloud Storage buckets is encrypted with a customer-managed key (CMEK) that is managed in Cloud KMS. The security team requires that only authorized applications can access the key. Which configuration step should be taken to achieve this?

A.Use a customer-supplied encryption key (CSEK) instead of CMEK.

B.Grant the Cloud KMS CryptoKey Encrypter/Decrypter role to the Cloud Storage service account at the Cloud KMS key resource.

C.Create a bucket with default encryption set to use a CMEK, and grant the service account the Cloud KMS Admin role.

D.Grant the Cloud KMS CryptoKey Encrypter/Decrypter role to the Cloud Storage service account at the project level.

AnswerB

This grants the minimum required permission at the specific key.

Why this answer

Cloud Storage uses its own Google-managed service account to interact with Cloud KMS when encrypting or decrypting data with a CMEK. By granting the Cloud KMS CryptoKey Encrypter/Decrypter role to the Cloud Storage service account at the specific key resource, you authorize only that service account to use the key, ensuring that only authorized applications (via Cloud Storage) can access the key. This follows the principle of least privilege and meets the security team's requirement.

Exam trap

Google Cloud often tests the distinction between granting roles at the project level versus the resource level, and the trap here is that candidates mistakenly think granting the role at the project level is sufficient, but that would allow any bucket in the project to use the key, violating the 'only authorized applications' requirement.

How to eliminate wrong answers

Option A is wrong because CSEK (customer-supplied encryption key) is not managed in Cloud KMS; instead, the customer provides the key directly in each request, and Google does not store the key, which contradicts the requirement for a customer-managed key in Cloud KMS. Option C is wrong because granting the Cloud KMS Admin role to the Cloud Storage service account provides full administrative control over the key (including deletion and rotation), which is excessive and violates the principle of least privilege; the service account only needs the Encrypter/Decrypter role. Option D is wrong because granting the role at the project level would allow any Cloud Storage bucket in the project to use the key, potentially enabling unauthorized applications or buckets to access the key, which does not satisfy the requirement that only authorized applications can access the key.

Full explanation →

821

MCQmedium

A user is unable to SSH into an instance that has the tag 'ssh-access' and an internal IP 10.0.0.2. The user's IP is 198.51.100.1. What is the most likely reason?

A.The instance is not using the correct service account

B.The instance does not have an external IP

C.The user's IP is not in the allowed source range

D.The firewall rule is disabled

AnswerC

The rule's sourceRanges only includes 203.0.113.0/24, not the user's IP.

Why this answer

The firewall rule only allows SSH from the source range 203.0.113.0/24. The user's IP (198.51.100.1) is not in that range, so the connection is denied.

Full explanation →

822

MCQeasy

Which IAM role should be assigned to a user who needs to manage Cloud Storage objects in a specific project, but should not be able to create or delete buckets?

A.roles/storage.legacyBucketReader

B.roles/storage.admin

C.roles/storage.objectViewer

D.roles/storage.objectAdmin

AnswerD

Correct. This role allows full management of objects (create, read, update, delete) without allowing bucket creation or deletion.

Why this answer

The correct role is roles/storage.objectAdmin. This role grants full control over Cloud Storage objects, including the ability to read, write, update, and delete objects, but it does not allow any operations on buckets (create, delete, or configure). The user needs to manage objects (which includes write and delete operations) but should not be able to create or delete buckets.

Storage Object Admin fits this requirement. Option C, roles/storage.objectViewer, only provides read-only access and does not allow management. Option B, roles/storage.admin, provides full control over both buckets and objects, including create and delete permissions.

Option A, roles/storage.legacyBucketReader, only allows reading bucket metadata, not objects.

Exam trap

A common trap is confusing Storage Object Admin (which allows object creation and deletion) with the ability to manage buckets. Object Admin does not allow bucket operations such as create, delete, or update bucket configurations.

Full explanation →

823

MCQeasy

Which GCP service provides managed intrusion detection by analyzing mirrored network traffic and using threat signatures from Palo Alto Networks?

A.Security Command Center

B.Chronicle

C.Cloud IDS

D.Cloud Armor

AnswerC

Cloud IDS provides managed network threat detection using Palo Alto Networks.

Why this answer

Cloud IDS is a managed intrusion detection service that uses packet mirroring to inspect traffic and applies Palo Alto Networks threat signatures.

Full explanation →

824

MCQeasy

A security engineer wants to ensure that all API calls to Google Cloud services are logged for audit purposes. Which service should they enable?

A.VPC Flow Logs

B.Cloud Audit Logs

C.Cloud NAT Logs

D.Firewall Rules Logging

AnswerB

Cloud Audit Logs record all API calls and administrative actions.

Why this answer

Cloud Audit Logs record administrative and data access activities. Other logs serve different purposes.

Full explanation →

825

MCQhard

A large enterprise has a security command center that uses SIEM to analyze logs. They are migrating to Google Cloud and want to export all Cloud Audit Logs (Admin Activity, Data Access, and System Events) from all projects into a centralized BigQuery dataset for analysis. They also need to ensure logs are available within 5 minutes of being generated. Which sink configuration should they use?

A.Create an aggregated sink at the organization level that includes all projects and uses a BigQuery dataset as destination, with inclusion filters for all audit log types.

B.Create a single aggregated sink at the organization level that uses a Pub/Sub topic as destination, and have a subscriber stream logs into BigQuery.

C.Create a sink in each project that exports Audit Logs to a shared BigQuery dataset.

D.Enable logging export using Cloud Logging's beta feature to stream logs to an external SIEM via syslog.

AnswerA

Aggregated sinks can export logs from all projects under the organization to a single BigQuery dataset.

Why this answer

An aggregated sink at the organization level can export logs from all projects within the organization to a single BigQuery dataset. Inclusion filters allow you to specify which log types (Admin Activity, Data Access, System Events) to export. Logs are typically available in BigQuery within seconds (near real-time), meeting the 5-minute requirement.

Option B is incorrect because using Pub/Sub adds latency and complexity without benefit when the final destination is BigQuery. Option C is incorrect because creating per-project sinks is inefficient and harder to manage. Option D is incorrect because exporting to an external SIEM via syslog does not centralize logs in BigQuery as required.

Full explanation →

Page 11 of 13

All pages

1 2 3 4 5 6 7 8 9 10 11 12 13

Practice PCSE by domain

Target a specific domain to shore up weak areas.

Configuring Access Within a Cloud Solution Environment Ensuring Data Protection Managing Operations in a Cloud Solution Environment Configuring Network Security Supporting Compliance Requirements

See all domains with question counts →