Courseiva

Google Professional Cloud Security Engineer (PCSE) — Questions 76–150

960 questions total · 13pages · All types, answers revealed

Take a mock examExam hub
Page 1

Page 2 of 13

Page 3
76
MCQeasy

Your organization wants to monitor and audit IAM permission changes in real time. Which type of Cloud Audit Log is enabled by default and cannot be disabled?

A.Admin Activity audit logs
B.Data Access audit logs
C.System Event audit logs
D.Policy Denied audit logs
AnswerA

Admin Activity logs are enabled by default and cannot be disabled. They log API calls and administrative actions that modify the configuration or metadata of resources.

Why this answer

Admin Activity audit logs record API calls and administrative actions that modify the configuration or metadata of resources. They are enabled by default and cannot be disabled, making them ideal for monitoring IAM permission changes.

Full explanation →
77
Multi-Selecthard

Which TWO of the following are true regarding Cloud Audit Logs?

Select 2 answers
A.Data Access audit logs are enabled by default for all services.
B.Admin Activity audit logs are enabled by default and cannot be disabled.
C.Cloud Audit Logs are retained indefinitely unless a retention policy is set.
D.Cloud Audit Logs include monitoring metrics for log volume.
E.System Event audit logs record non-human administrative actions and are enabled by default.
AnswersB, E

Default on for all projects.

Why this answer

Options B and E are correct. Admin Activity audit logs are enabled by default and cannot be disabled. System Event audit logs are also enabled by default and record non-human administrative actions.

Option A is incorrect because Data Access audit logs are disabled by default and must be explicitly enabled. Option C is incorrect because Cloud Audit Logs have a default retention period of 400 days, not indefinite. Option D is incorrect because Cloud Audit Logs provide logs, not monitoring metrics for log volume.

Full explanation →
78
Multi-Selecteasy

A security engineer is designing data protection for Cloud Storage. Which TWO methods can be used to enforce encryption at rest for objects? (Choose TWO.)

Select 2 answers
A.Setting a bucket-level default encryption with a CMEK key.
B.Enabling VPC Service Controls.
C.Applying a retention policy.
D.Using a bucket policy that requires the x-goog-encryption header for uploads.
E.Using an Organization Policy to enforce CMEK at the project level.
AnswersA, E

This ensures all objects uploaded to the bucket are encrypted with the specified CMEK key.

Why this answer

Setting a bucket-level default encryption with a CMEK (Customer-Managed Encryption Key) ensures that all new objects written to the bucket are encrypted at rest using a key managed by the customer in Cloud KMS. This enforces encryption at rest at the bucket level, meeting the requirement.

Exam trap

Google Cloud often tests the distinction between encryption at rest (server-side) and encryption in transit or client-side encryption, leading candidates to mistakenly choose options like D that enforce client-side headers rather than server-side encryption at rest.

Full explanation →
79
MCQhard

A company is using VPC Service Controls to protect their Google Cloud Storage buckets. They want to allow a specific instance to access a bucket from within a VPC. What networking configuration is required?

A.The instance must have a public IP
B.A VPC peering connection to Google services
C.A Cloud NAT gateway
D.Private Google Access must be enabled on the subnet
AnswerD

Private Google Access allows instances with internal IPs to reach Google APIs through Google's private network.

Why this answer

VPC Service Controls require Private Google Access to be enabled on the subnet so that the instance can access Google APIs using its internal IP address.

Full explanation →
80
MCQhard

A company uses Cloud DLP to scan a BigQuery table containing customer data. They want to de-identify credit card numbers so that the first 12 digits are masked with 'X' and the last 4 digits remain visible. Which de-identification transform should they use?

A.DateShiftConfig
B.MaskingConfig
C.BucketingConfig
D.CryptoReplaceFfxFpeConfig
AnswerB

MaskingConfig can mask characters with a specified character and range; e.g., mask last 12 characters leaving last 4 unmasked.

Why this answer

MaskingConfig with a masking character 'X' and a character mask range from -12 to -1 (or similar) can achieve this. However, for consistent de-identification of credit card numbers, the CryptoReplaceFfxFpeConfig with an appropriate range might be used, but it preserves format. The direct mask is MaskingConfig.

The correct answer is MaskingConfig as it allows masking specific character ranges. The other options: DateShiftConfig shifts dates, BucketingConfig groups values, and CryptoReplaceFfxFpeConfig preserves format but does not mask.

Full explanation →
81
MCQmedium

A financial services company must store customer transaction records for 7 years to comply with SEC regulations. They currently use Cloud Storage with a lifecycle rule that deletes objects after 365 days. The compliance team needs to ensure that records are immutable and cannot be deleted or modified before the retention period expires. What should the security engineer do?

A.Apply a retention policy to each object individually using object holds.
B.Use VPC Service Controls to restrict access to the bucket to only authorized compliance personnel.
C.Modify the lifecycle rule to delete objects after 2555 days instead of 365 days.
D.Enable Bucket Lock on the bucket and configure a retention policy of 7 years.
AnswerD

Bucket Lock enforces a retention policy that prevents object deletion or modification until the retention period expires, overriding lifecycle rules.

Why this answer

Bucket Lock is the only Google Cloud Storage feature that enforces immutability by preventing object deletion or modification for a specified retention period. By enabling Bucket Lock and configuring a 7-year retention policy, the company ensures compliance with SEC regulations, as objects cannot be deleted or overwritten even by the bucket owner or lifecycle rules. This overrides the existing 365-day lifecycle rule because retention policies take precedence over lifecycle deletion actions.

Exam trap

Google Cloud often tests the distinction between access controls (like VPC Service Controls or IAM) and data immutability features, leading candidates to confuse restricting access with enforcing retention.

How to eliminate wrong answers

Option A is wrong because object holds (e.g., retention holds) are temporary and can be removed by users with appropriate permissions, so they do not guarantee immutable compliance for the full 7-year period. Option B is wrong because VPC Service Controls control network access but do not prevent deletion or modification of objects by authorized users or lifecycle rules, so they do not enforce immutability. Option C is wrong because modifying the lifecycle rule to 2555 days only delays deletion; it does not prevent manual deletion or overwriting of objects, and lifecycle rules can be changed or removed at any time, failing to meet the immutability requirement.

Full explanation →
82
MCQhard

Alice has the role roles/storage.objectAdmin on the bucket my-bucket via the IAM policy shown. She is unable to access the object gs://my-bucket/reports/data.csv. What is the most likely reason?

A.The condition restricts access to objects with a prefix 'uploads/', and the requested object is under 'reports/'.
B.The bucket has a retention policy that prevents access to objects older than a certain period.
C.The condition uses the wrong resource attribute; it should be resource.name.startsWith('my-bucket/uploads/').
D.Alice does not have the storage.objects.get permission on the bucket.
AnswerA

The condition resource.name.startsWith('projects/_/buckets/my-bucket/objects/uploads/') only allows access to objects whose path starts with 'uploads/'. The object 'reports/data.csv' does not match.

Why this answer

The IAM policy condition uses the `resource.name.startsWith('my-bucket/uploads/')` condition key, which restricts the `storage.objects.get` permission to objects whose name starts with `uploads/`. The requested object `gs://my-bucket/reports/data.csv` is under the `reports/` prefix, so the condition evaluates to false, denying access. This is the most likely reason Alice cannot access the object.

Exam trap

Google Cloud often tests the nuance that IAM conditions can silently override explicit allow permissions, leading candidates to overlook the condition and incorrectly blame missing permissions or unrelated bucket policies.

How to eliminate wrong answers

Option B is wrong because a retention policy prevents deletion or modification of objects, not read access; it does not block `storage.objects.get`. Option C is wrong because the condition already uses `resource.name.startsWith` correctly; the issue is the prefix value, not the attribute. Option D is wrong because the IAM policy explicitly grants `storage.objects.get` on the bucket, but the condition overrides that grant for objects not matching the prefix.

Full explanation →
83
Multi-Selectmedium

A company wants to use Cloud KMS to encrypt data in Cloud Storage with a key that is automatically rotated every 30 days. They also want to ensure that the key material is stored in a HSM. Which TWO resources must they create? (Choose two.)

Select 2 answers
A.A Cloud HSM key ring
B.A key with purpose EXTERNAL
C.A key ring with protection level software
D.A cryptographic key with protection level HSM
E.A Cloud HSM cluster
AnswersA, D

The key ring groups keys and can be created with HSM protection level.

Why this answer

To use CMEK with Cloud HSM, the engineer needs to create a Cloud HSM key ring (which is a resource that groups keys) and a cryptographic key with protection level HSM. The key ring is created first, then the key is created within it. The other options: a key ring with software protection level would not use HSM; a Cloud KMS key is created within a key ring, so both are needed.

Full explanation →
84
MCQhard

A company wants to enforce that all Cloud Storage buckets created in their organization have a retention policy for compliance. If a bucket is created without a retention policy, it should be automatically remediated. Which approach should they use?

A.Use an Organization Policy with a constraint to require a retention policy on all buckets and use Cloud Asset Inventory to enforce remediation.
B.Use Cloud DLP to scan buckets and add retention policies automatically.
C.Use Security Command Center to find non-compliant buckets and manually apply retention policies.
D.Use Cloud Audit Logs to detect bucket creation and trigger a Cloud Function to set a retention policy.
AnswerA

Organization policies can enforce the requirement, and Cloud Asset Inventory can detect violations and trigger remediation via Cloud Functions.

Why this answer

Organization policies with a constraint can enforce that all buckets have a retention policy. However, if a bucket is created without one, Cloud Asset Inventory can detect the violation and trigger a Cloud Function to apply a default retention policy.

Full explanation →
85
MCQeasy

A security team needs to centrally manage secrets for multiple Google Cloud projects. Which solution should they use?

A.Hardcode secrets in application code and use IAM with access scopes
B.Use Cloud Key Management Service (Cloud KMS) to store and manage secrets
C.Use Secret Manager
D.Store secrets in encrypted Cloud Storage buckets
AnswerC

Secret Manager is purpose-built for storing, rotating, and managing secrets with fine-grained access control.

Why this answer

Secret Manager provides a centralized and secure solution for storing and managing secrets across multiple Google Cloud projects. It supports automatic versioning, fine-grained access control, and secret rotation. Option A is wrong because hardcoding secrets in application code is insecure and makes management difficult.

Option B is wrong because Cloud Key Management Service (Cloud KMS) is designed for managing encryption keys, not secrets; although it can encrypt secrets, it does not provide native secret storage or versioning. Option D is wrong because storing secrets in encrypted Cloud Storage buckets lacks built-in secret management features, such as version history, expiration, and audit logging, and requires additional tooling to manage access.

Full explanation →
86
MCQeasy

Your company is deploying a multi-tier application in a single VPC with two subnets: web (10.0.1.0/24) and db (10.0.2.0/24). The web instances need to connect to a private Cloud SQL instance (MySQL) that is provisioned in a service project. The Cloud SQL instance has a private IP address 10.0.3.5 assigned using private services access. You have established VPC peering between your VPC and the service producer VPC (the Google-managed VPC hosting Cloud SQL). You verified that the peering connection is in 'ACTIVE' state. The web instances can reach internet sites, but connections to the Cloud SQL instance (using the MySQL client) are timing out. The db instances do not need to connect to Cloud SQL. What is the most likely cause and recommended solution?

A.Configure the VPC peering connection to export custom routes from your VPC to the service producer VPC.
B.Re-create the VPC peering connection because it might be misconfigured.
C.Change the Cloud SQL instance to use a public IP and allowlist your web subnet.
D.Set up Cloud NAT for the web subnet to enable outbound connections.
AnswerA

Exporting custom routes ensures the service VPC knows how to reach your subnets for return traffic.

Why this answer

The web instances are timing out when connecting to the Cloud SQL private IP (10.0.3.5) because the VPC peering connection is not exporting custom routes from your VPC to the service producer VPC. By default, VPC peering does not export custom routes (including the subnet routes for 10.0.1.0/24 and 10.0.2.0/24) unless explicitly configured. Without these routes, the Cloud SQL instance cannot send response traffic back to the web instances, causing the TCP handshake to fail (SYN sent, SYN-ACK never received).

Enabling 'Export custom routes' on the peering connection from your VPC to the service producer VPC resolves this by advertising your subnet routes to the Cloud SQL host VPC.

Exam trap

Google Cloud often tests the misconception that an 'ACTIVE' peering status guarantees full connectivity, but the trap here is that route exchange is not automatic for custom routes — candidates overlook the need to explicitly export custom routes for return traffic.

How to eliminate wrong answers

Option B is wrong because the peering connection is already in 'ACTIVE' state, which indicates it is correctly configured at the peering level; re-creating it would not solve the missing route export issue. Option C is wrong because using a public IP for Cloud SQL would expose the database to the internet, violating the requirement for a private connection, and it would not address the underlying routing problem caused by missing custom route exports. Option D is wrong because Cloud NAT is used for outbound internet access from private instances, but the issue here is bidirectional routing between the web subnet and the Cloud SQL private IP; Cloud NAT does not help with VPC peering route advertisement.

Full explanation →
87
MCQmedium

An engineer needs to allow HTTP traffic from instances tagged 'web-server' to instances tagged 'app-server' on port 8080 within the same VPC. Which firewall rule should be created?

A.Egress rule from 'web-server' to 'app-server' allowing tcp:8080
B.Ingress rule for 'web-server' with source tag 'app-server' allowing tcp:8080
C.Egress rule for 'app-server' with destination tag 'web-server' allowing tcp:8080
D.Ingress rule for 'app-server' with source tag 'web-server' allowing tcp:8080
AnswerD

This rule allows inbound traffic to 'app-server' instances from 'web-server' instances on port 8080.

Why this answer

Create an ingress rule targeting 'app-server' that allows tcp:8080 from source tag 'web-server'. Tags are used for both source and target to control traffic between instance groups.

Full explanation →
88
MCQhard

An organization has a hierarchical firewall policy at the organization level that denies all ingress traffic from the internet. A project team needs to allow HTTP traffic from the internet to a specific VM. How should they achieve this?

A.Add a VPC firewall rule allowing HTTP from 0.0.0.0/0
B.Remove the VM from the organization hierarchy
C.Create a project-level hierarchical firewall policy with a rule allowing HTTP from 0.0.0.0/0 and a lower priority number than the org-level deny
D.Use Cloud Armor to allow the traffic
AnswerC

A lower-level hierarchical policy with higher priority (lower number) can override a higher-level policy rule.

Why this answer

Hierarchical firewall policies cannot be overridden at lower levels; they are always evaluated first. Since the org-level policy denies all internet ingress, the only way to allow HTTP is to create a hierarchical policy at a lower level (folder or project) that allows it, but those are also part of the hierarchy and are evaluated after org-level. Actually, hierarchical policies can be overridden by a lower-level policy with a higher priority, but the org-level policy has no higher priority? In GCP, hierarchical firewall policies are evaluated in order of precedence: organization > folder > project.

A policy at a lower level can override a higher-level policy if it has a higher priority (lower number) and is an allow rule. So the project team can create a project-level hierarchical policy with a higher priority (e.g., 100) allowing HTTP from 0.0.0.0/0, which will override the org-level deny (priority 1000).

Full explanation →
89
MCQeasy

Your company runs a data analytics platform on Google Cloud that processes sensitive financial data. Data is ingested from various sources into a Cloud Storage bucket, then processed by Dataflow jobs, and final results are stored in BigQuery. You have implemented the following security controls: - VPC Service Controls perimeter around the project - Cloud KMS CMEK for all storage services - IAM conditions restricting access based on tags - Cloud Audit Logs enabled for all services Recently, an auditor discovered that a compromised service account was able to read data from the Cloud Storage bucket even though it was outside the VPC Service Controls perimeter. The auditor reviewed the logs and found that the access came from a Compute Engine instance that was running within the same project. What is the most likely reason the VPC Service Controls perimeter did not block this access?

A.The VPC Service Controls perimeter allows access from resources within the same project, even if they are outside the perimeter.
B.The Cloud KMS key used for encryption was not bound to the perimeter.
C.The Cloud Audit Logs were not enabled for the Cloud Storage bucket, so the access was not logged.
D.The VPC Service Controls perimeter was not configured to include the Cloud Storage bucket.
AnswerA

VPC Service Controls only block access from outside the perimeter; resources within the same project are considered inside and allowed by default.

Why this answer

VPC Service Controls perimeters are designed to prevent data exfiltration by blocking access from networks outside the perimeter, but they explicitly allow access from resources within the same project, even if those resources are not inside the perimeter. In this scenario, the compromised service account was used by a Compute Engine instance running in the same project, so the access was permitted by design. This is a known behavior: VPC Service Controls do not restrict access between resources that share the same Google Cloud project, regardless of whether the requesting resource is inside or outside the perimeter.

Exam trap

The trap here is that candidates assume VPC Service Controls block all cross-resource access within a project, but Google tests the specific exception that resources in the same project are always allowed, regardless of perimeter boundaries.

How to eliminate wrong answers

Option B is wrong because Cloud KMS CMEK keys are not bound to VPC Service Controls perimeters; the perimeter controls access at the network layer, not the encryption layer. Option C is wrong because the auditor already reviewed the logs and found the access, so Cloud Audit Logs were clearly enabled and working. Option D is wrong because the Cloud Storage bucket was included in the perimeter (the perimeter was configured around the project, which includes all services in that project), but the access was allowed due to the same-project exception.

Full explanation →
90
MCQeasy

An engineer notices that traffic on port 80 is not reaching instances with the tag 'http-server'. The instances have external IPs and are in the default VPC. What could be the reason?

A.The sourceRanges does not include the instance's public IP.
B.The targetTags are not applied to the instances.
C.A deny rule with a lower priority number (higher priority) exists and blocks the traffic.
D.The direction should be EGRESS.
AnswerC

A deny rule with higher priority can override this allow rule.

Why this answer

A deny rule with a lower priority number (higher priority) will override the allow rule for port 80, blocking traffic. Option A is incorrect because sourceRanges refers to allowed source IPs, not the instance's public IP. Option B is incorrect because if the targetTags are not applied, the rule would not affect those instances, but the issue is specifically about traffic not reaching instances with the tag 'http-server', implying the allow rule exists but is overridden.

Option D is incorrect because direction should be INGRESS for incoming traffic, not EGRESS.

Full explanation →
91
Multi-Selecteasy

Which THREE components are customer responsibilities under the Google Cloud Shared Responsibility Model for IaaS? (Choose 3.)

Select 3 answers
A.Security of virtual network controls
B.Security of application code
C.Physical security of data centers
D.Security of the hypervisor
E.Security of guest operating system
AnswersA, B, E

Customers configure firewall rules, VPCs, etc.

Why this answer

Under the IaaS shared responsibility model, the customer is responsible for configuring and managing virtual network controls such as firewalls, route tables, and network ACLs. Google Cloud provides the underlying network infrastructure, but the customer must secure traffic flows and access policies within their VPC.

Exam trap

Google Cloud often tests the misconception that physical security or hypervisor security is a shared responsibility, when in fact these are exclusively the provider's domain under IaaS.

Full explanation →
92
MCQhard

A company must comply with PCI DSS requirements that mandate the use of a hardware security module (HSM) for key storage. They plan to use Cloud KMS for key management. Which implementation meets compliance?

A.Use Cloud External Key Manager (EKM) with an external HSM.
B.Create a Cloud HSM key ring and use Cloud KMS with protection level 'HSM'.
C.Use Customer-Supplied Encryption Keys (CSEK) stored in an on-premises HSM.
D.Create keys in Cloud KMS using the default software protection level.
AnswerB

Cloud HSM provides HSM-backed key storage in Cloud KMS.

Why this answer

PCI DSS requires that cryptographic keys be stored in a hardware security module (HSM) to ensure tamper resistance. Cloud HSM provides a FIPS 140-2 Level 3 validated HSM directly integrated with Cloud KMS, allowing you to create keys with the 'HSM' protection level that are generated and stored within the HSM hardware, meeting compliance without managing external infrastructure.

Exam trap

Google Cloud often tests the distinction between using an external HSM (EKM) versus a native Cloud HSM, where candidates mistakenly think that any HSM integration satisfies PCI DSS, but the key is that the keys must be stored and managed within a validated HSM that is directly integrated with the key management service.

How to eliminate wrong answers

Option A is wrong because Cloud External Key Manager (EKM) allows you to use an external HSM for key storage, but it does not store keys within Google Cloud's HSM; instead, it references keys held in your external HSM, which adds operational complexity and may not satisfy PCI DSS requirements if the external HSM is not properly validated or managed. Option C is wrong because Customer-Supplied Encryption Keys (CSEK) are used for encrypting data at rest in Google Cloud Storage, not for key management within Cloud KMS, and storing them in an on-premises HSM does not integrate with Cloud KMS's key management lifecycle or meet PCI DSS requirements for key storage in a validated HSM. Option D is wrong because the default software protection level stores keys in software-based key storage, which does not meet PCI DSS's mandate for hardware-based key storage in an HSM.

Full explanation →
93
Matchingmedium

Match each security command center tier to its capabilities.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Free, includes basic vulnerability scanning and findings

Paid, includes threat detection, event threat detection, and container threat detection

Paid, includes all Premium features plus security posture, asset inventory, and compliance

Built-in vulnerability scanning and misconfiguration detection

Detects threats from Cloud Logging and DNS logs

Why these pairings

Security Command Center has two main tiers: Standard and Premium. Standard provides basic security health and recommendations, while Premium adds advanced threat detection, event-based findings, and more. Common mistakes include swapping the feature sets.

Full explanation →
94
Multi-Selecthard

An organization wants to enforce that all Compute Engine instances must use a specific service account. Which three steps are necessary? (Choose three.)

Select 3 answers
A.Create a custom role with compute.instances.create permission.
B.Grant the service account the needed roles on the project.
C.Create the service account in the project.
D.Set an organization policy constraint compute.restrictServiceAccountUsage to allow only that service account.
E.Grant the compute.instanceAdmin role to the service account.
AnswersB, C, D

The SA needs permissions to perform its intended tasks.

Why this answer

The service account must be granted the necessary IAM roles on the project (or specific resources) to perform its intended actions. Without these grants, even if the service account is enforced, it will lack permissions to interact with Compute Engine resources. This step ensures the service account has the required access, such as compute.instanceAdmin or custom roles, to manage instances.

Exam trap

Google Cloud often tests the distinction between enforcing a service account (via organization policy) and granting permissions to that service account (via IAM roles), leading candidates to mistakenly include steps like creating custom roles or granting instanceAdmin to the service account as part of the enforcement process.

Full explanation →
95
MCQmedium

Your company uses Security Command Center (SCC) Standard tier and wants to detect threats like cryptocurrency mining or anomalous network behavior in real-time. You need to recommend an upgrade to SCC Premium tier and configure the appropriate module. Which SCC Premium module should be enabled?

A.Container Threat Detection
B.Event Threat Detection
C.Web Security Scanner
D.Security Health Analytics
AnswerB

ETD detects threats from logs, including cryptomining, which is exactly the requirement.

Why this answer

Event Threat Detection (ETD) monitors logs (e.g., Cloud Audit Logs, DNS, network) and uses machine learning to detect threats like cryptomining, C2 communication, and data exfiltration. It provides real-time detection and is a Premium tier feature.

Full explanation →
96
Multi-Selectmedium

A company wants to allow a third-party auditor to view their organization's IAM policies and logs but not make any changes. Which two predefined roles should be granted? (Choose two.)

Select 2 answers
A.roles/iam.securityReviewer
B.roles/iam.securityAdmin
C.roles/monitoring.viewer
D.roles/logging.viewer
E.roles/iam.roleViewer
AnswersA, D

Grants read-only access to IAM policies.

Why this answer

Options A and D are correct. roles/iam.securityReviewer grants read access to IAM policies, and roles/logging.viewer grants read access to logs. Option B (roles/iam.securityAdmin) includes write permissions, which is excessive for a read-only auditor. Option C (roles/monitoring.viewer) provides read access to monitoring data but not logs.

Option E (roles/iam.roleViewer) only allows viewing custom roles, not IAM policies or logs.

Full explanation →
97
Multi-Selectmedium

A company is using Cloud KMS with software keys for encryption. They want to increase security by using an HSM backend without changing their existing key rings or key names. Which TWO steps should they take? (Choose two.)

Select 2 answers
A.Create a new key ring and migrate all keys to it.
B.Change the protection level of the existing key version to HSM using the API.
C.Delete the existing software key versions and recreate them with HSM protection.
D.Create a new key version with the protection level set to HSM.
E.Update the key's default protection level to HSM.
AnswersD, E

You can create a new key version with the desired protection level; the existing software versions remain for decryption.

Why this answer

To switch a key from software to HSM backend, you need to create a new key version with the protection level HSM, and then update the key's default protection level to HSM so that future versions are also HSM-backed. You cannot change the protection level of an existing key version.

Full explanation →
98
MCQeasy

A financial institution is required to retain records of all transactions for 7 years under regulatory compliance. They are using Cloud Storage for archive data and need to ensure that objects cannot be deleted or overwritten during the retention period. Which feature should they use?

A.Object lifecycle management
B.Bucket-level IAM conditions
C.Bucket-level versioning
D.Retention Policy with Retention Lock
AnswerD

Retention Policy with a locked retention period prevents object deletion or modification, meeting the 7-year WORM requirement.

Why this answer

Cloud Storage Object Retention Lock with a retention policy enforces a WORM (Write Once Read Many) state, preventing object deletion or modification for a specified duration. This meets regulatory retention requirements.

Full explanation →
99
MCQmedium

A security engineer needs to automatically remediate a high-severity finding in Security Command Center. The remediation involves restarting a Compute Engine instance. What is the recommended approach?

A.Configure a log sink to Cloud Functions and parse logs for the finding.
B.Use a Compute Engine startup script to check SCC and restart.
C.Create a Cloud Function triggered by a Pub/Sub notification from SCC, and use the Compute Engine API to restart the instance.
D.Use Cloud Scheduler to periodically check SCC and restart instances.
AnswerC

SCC can send notifications to Pub/Sub, which triggers a Cloud Function that performs the remediation action.

Why this answer

SCC notifications to Pub/Sub and Cloud Functions is the standard pattern for automated remediation.

Full explanation →
100
MCQmedium

A security engineer needs to archive Cloud Audit Logs for regulatory compliance for 7 years. The logs should be immutable and cost-effective. Which solution should they choose?

A.Export logs to Pub/Sub and store them in a Cloud Spanner table with 7-year TTL.
B.Export logs to Cloud Storage using a sink, and enable Bucket Lock with retention policy.
C.Export logs to BigQuery and set a 7-year table expiration.
D.Use the default log retention of 400 days and copy logs to a persistent disk snapshot.
AnswerB

This provides immutable, durable, and low-cost archival storage for the required duration.

Why this answer

Cloud Storage with the Archive storage class and retention policy using Bucket Lock provides immutable, low-cost storage for long-term archival. Logging exports can be configured via a sink to write logs to a bucket with these settings. BigQuery is not suitable for long-term archival due to cost; Pub/Sub is for streaming; Cloud Spanner is transactional and expensive.

Full explanation →
101
MCQmedium

An administrator needs to restrict which external identities can be used to access Google Cloud resources. The organization uses SAML federation with an external identity provider. Which organization policy constraint should be used?

A.constraints/iam.allowedPolicyMemberDomains
B.constraints/iam.disableServiceAccountKeyCreation
C.constraints/compute.requireShieldedVm
D.constraints/iam.disableCrossProjectServiceAccountUsage
AnswerA

This constraint limits the domains that can be used in IAM policies.

Why this answer

The constrain constraints/iam.allowedPolicyMemberDomains restricts which domains can be granted IAM roles. By setting this to the domain of the external IdP, the administrator ensures only federated identities from that domain can be used.

Full explanation →
102
Multi-Selecteasy

A developer wants to allow a CI/CD pipeline running on GitHub Actions to deploy resources to a GCP project without using service account keys. Which two components are needed? (Choose two.)

Select 2 answers
A.A Workload Identity Pool and Provider configured for GitHub.
B.A Google service account with the iam.workloadIdentityUser role.
C.A Cloud Build trigger to run the workflow.
D.A Cloud KMS key to encrypt the workflow.
E.A service account JSON key stored as a GitHub secret.
AnswersA, B

This is the identity federation setup.

Why this answer

Workload Identity Federation allows GitHub Actions to exchange GitHub OIDC tokens for GCP service account impersonation. You need to set up a workload identity pool and provider for GitHub. The GitHub Actions workflow must be configured to use the OIDC token and request impersonation of a service account.

Full explanation →
103
Multi-Selectmedium

A company wants to detect and block SQL injection attacks targeting their web application hosted on Compute Engine behind a Cloud Load Balancer. Which TWO steps should they take? (Choose TWO.)

Select 2 answers
A.Enable Cloud Armor adaptive protection to detect and block suspicious patterns.
B.Deploy Cloud IDS in the VPC to inspect packets for SQLi patterns.
C.Enable Cloud Armor on the load balancer with the OWASP ModSecurity CRS rule set.
D.Configure VPC firewall rules to deny traffic on port 443.
E.Use VPC Service Controls to restrict access to the backend instances.
AnswersA, C

Adaptive Protection uses ML to detect attacks including SQLi.

Why this answer

Cloud Armor preconfigured rules (like OWASP ModSecurity CRS) can detect SQLi, and enabling adaptive protection provides ML-based anomaly detection. Cloud IDS is for network-level threats, not WAF; VPC firewall rules don't inspect application payloads.

Full explanation →
104
Multi-Selecthard

A healthcare company stores de-identified patient data in BigQuery for analytics. They must comply with HIPAA and ensure that re-identification is not possible. They also need to be able to join data on a per-patient basis for longitudinal studies. Which TWO strategies should they implement? (Choose 2)

Select 2 answers
A.Use Cloud DLP to mask patient identifiers consistently across all tables.
B.Apply differential privacy to all queries using the Differential Privacy library in BigQuery.
C.Enable BigQuery column-level security to restrict access to identifiers.
D.Store patient identifiers in a separate, access-controlled dataset and join using SQL.
E.Use Cloud DLP to tokenize patient identifiers with a consistent token.
AnswersA, E

Consistent masking (e.g., hashing) allows joins while protecting identities.

Why this answer

Tokenization or consistent masking allows longitudinal joins while de-identifying data. Other methods either risk re-identification or break join capability.

Full explanation →
105
Multi-Selecthard

An organization wants to enforce that all egress traffic from a VPC to the internet must go through a Cloud NAT gateway for logging and IP management. They also need to block all other direct outbound traffic. Which THREE steps should they take? (Choose THREE.)

Select 3 answers
A.Enable Private Google Access on the subnet
B.Delete the default route (0.0.0.0/0) from the VPC
C.Add a firewall rule to allow egress to 0.0.0.0/0
D.Add a firewall rule to deny egress to 0.0.0.0/0 (except NAT's IP range)
E.Create a Cloud NAT gateway and assign it to the subnet
AnswersB, D, E

Removing the default route prevents direct internet egress.

Why this answer

To force traffic through Cloud NAT, you need to remove the default route (0.0.0.0/0), create a route that only allows traffic to the NAT gateway's IP range (or use a more specific route), and then add a deny egress rule for all other internet traffic.

Full explanation →
106
MCQeasy

A web application behind an HTTPS load balancer is experiencing a high volume of malicious requests with SQL injection patterns. The security team wants to block these requests with minimal latency impact. Which Cloud Armor feature should they use?

A.Rate limiting per IP
B.Custom rules with CEL expressions
C.Preconfigured WAF rules (OWASP ModSecurity CRS)
D.Adaptive Protection
AnswerC

The CRS includes rules to detect and block SQL injection, XSS, and other web attacks.

Why this answer

Cloud Armor provides preconfigured WAF rules, including the OWASP ModSecurity Core Rule Set (CRS), which includes SQL injection detection rules. Enabling this set blocks SQL injection attempts.

Full explanation →
107
Multi-Selectmedium

A company is using Cloud Data Loss Prevention (DLP) to inspect and de-identify sensitive data in Cloud Storage. They want to classify data using infoTypes and apply de-identification techniques. Which TWO actions should they take?

Select 2 answers
A.Create custom infoTypes for all sensitive data.
B.Use the DLP API to inspect the storage for sensitive data.
C.Apply de-identification transformations such as masking or tokenization.
D.Store de-identification templates in Cloud KMS.
E.Use VPC Service Controls to restrict access to the data.
AnswersB, C

DLP API can scan and classify data using infoTypes.

Why this answer

The DLP API's `inspect` method is the primary mechanism to scan Cloud Storage objects for sensitive data patterns defined by infoTypes. Option C is correct because after inspection, de-identification transformations like masking or tokenization are applied via the DLP API's `deidentify` method to redact or replace sensitive content. Together, these two actions form the standard workflow for classifying and protecting data in Cloud Storage using Cloud DLP.

Exam trap

Google Cloud often tests the misconception that VPC Service Controls or Cloud KMS are directly involved in the DLP inspection and de-identification process, when in fact they are separate security services for perimeter control and key management, respectively.

Full explanation →
108
MCQmedium

A financial firm uses Cloud Deployment Manager to manage their Google Cloud infrastructure. They have a strict change management policy requiring that all infrastructure changes in the production environment must be reviewed and approved by a senior engineer before being applied. Currently, developers can modify the Deployment Manager configurations directly, leading to unapproved changes. The company wants to enforce this policy without impacting development agility. What should they implement?

A.Use Deployment Manager snapshots to roll back changes if needed.
B.Set up Cloud Audit Logs to monitor changes and alert on unauthorized modifications.
C.Use organization policies to restrict access to the Deployment Manager service.
D.Use a CI/CD pipeline with Cloud Build and require approval gates.
AnswerD

A CI/CD pipeline enforces a workflow where changes go through review and approval before deployment, satisfying the policy.

Why this answer

A CI/CD pipeline with Cloud Build can include manual approval gates that block deployments until approved. This enforces the change review policy while allowing development to proceed in non-production environments. Option A is incorrect because Deployment Manager snapshots allow rollback but do not prevent unapproved changes.

Option B is incorrect because Cloud Audit Logs only monitor changes after they occur; they do not block unauthorized modifications. Option C is incorrect because organization policies that restrict access to Deployment Manager would also block legitimate development work, reducing agility. Therefore, a CI/CD pipeline with approval gates is the best solution.

Full explanation →
109
MCQeasy

Your organization requires that all egress traffic from a VPC network be inspected by a third-party security appliance before leaving the network. The appliance is deployed in a separate VPC. What is the most scalable and maintainable way to route traffic through the appliance?

A.Use Cloud Interconnect to connect the two VPCs and configure BGP to advertise a default route from the appliance VPC.
B.Use Private Google Access to route traffic through the appliance.
C.Deploy the appliance in a separate VPC and create a route with next hop as the appliance's internal IP, and tag the VMs that need inspection.
D.Deploy the appliance in a separate VPC and use VPC Network Peering with route export/import to redirect traffic.
AnswerC

This is the recommended pattern: use instance-level routes with next hop to the appliance.

Why this answer

It uses a route with a next hop of the appliance's internal IP, combined with VM tags to selectively route egress traffic through the appliance. This approach is scalable and maintainable as it avoids complex peering or interconnect setups, and tags allow granular control without modifying routes for every VM.

Exam trap

Google Cloud often tests the misconception that VPC Network Peering with route export/import is the simplest way to route traffic between VPCs, but the trap here is that peering creates a full mesh of routes, which can cause asymmetric routing and does not allow selective egress-only inspection without additional complex filtering.

How to eliminate wrong answers

Option A is wrong because Cloud Interconnect is a dedicated connection to on-premises networks, not between VPCs, and BGP advertising a default route from the appliance VPC would require complex routing policies and does not inherently inspect egress traffic. Option B is wrong because Private Google Access allows VMs without external IPs to access Google APIs and services, not to route traffic through a third-party security appliance in another VPC. Option D is wrong because VPC Network Peering with route export/import would redirect all traffic between the VPCs, but it does not provide a mechanism to selectively route only egress traffic through the appliance; it would also route ingress traffic, causing asymmetric routing and potential inspection bypass.

Full explanation →
110
MCQhard

A gaming company must comply with the Children's Online Privacy Protection Act (COPPA). They use BigQuery to store user data, including age. They want to automatically classify and restrict access to data of users under 13. Which approach should they take?

A.Create a Cloud Data Catalog tag template for age and assign tags to columns, then use IAM to restrict access based on tags.
B.Store user data in Cloud Storage with uniform bucket-level access and use IAM to restrict access based on age.
C.Use DLP API to inspect BigQuery tables and apply de-identification or restriction policies.
D.Use VPC Service Controls to limit access to the BigQuery dataset from only approved IP ranges.
AnswerC

DLP can classify and automatically transform or restrict access to sensitive data.

Why this answer

The DLP API can inspect BigQuery tables for sensitive data (like age) and apply de-identification techniques such as masking or tokenization, or set access restrictions based on classification. Option A is wrong because Data Catalog tags only provide metadata, not enforcement; IAM cannot dynamically filter rows based on tag values. Option B is wrong because Cloud Storage is not suitable for structured querying of user data and uniform bucket-level access does not allow row-level filtering.

Option D is wrong because VPC Service Controls restrict network-level access but do not inspect data content or enforce row-level restrictions.

Full explanation →
111
MCQeasy

A company is moving sensitive data to Google Cloud and must comply with GDPR data minimization principles. They want to ensure that only the minimum necessary data is collected and processed. Which Google Cloud service should they use to automatically identify and redact sensitive data before storage?

A.Cloud Composer
B.Cloud Data Fusion
C.Cloud Dataprep
D.Cloud Data Loss Prevention (DLP)
AnswerD

DLP inspects and de-identifies sensitive data to minimize data collection.

Why this answer

Cloud Data Loss Prevention (DLP) is the correct service because it provides native capabilities to inspect, classify, and automatically redact sensitive data (e.g., PII, credit card numbers) before storage, directly supporting GDPR data minimization. It uses built-in infoType detectors and can be integrated with Cloud Storage, BigQuery, and other services to apply de-identification transformations such as masking, tokenization, or deletion at ingestion time.

Exam trap

Google Cloud often tests the distinction between data transformation/ETL tools (Cloud Data Fusion, Cloud Dataprep) and a dedicated data loss prevention service (Cloud DLP), expecting candidates to recognize that only DLP provides automated sensitive data identification and redaction out of the box without requiring custom coding or external integrations.

How to eliminate wrong answers

Option A is wrong because Cloud Composer is a managed workflow orchestration service based on Apache Airflow, not a data inspection or redaction tool; it cannot automatically identify or redact sensitive data. Option B is wrong because Cloud Data Fusion is a fully managed data integration and ETL service that can transform data but lacks built-in sensitive data detection and automated redaction capabilities; it would require custom plugins or external calls to DLP for such functionality. Option C is wrong because Cloud Dataprep is a data preparation and cleaning service (based on Trifacta) that focuses on structuring and transforming data visually, but it does not natively include automated sensitive data identification or redaction; it would need to integrate with DLP for that purpose.

Full explanation →
112
MCQmedium

A financial institution is required to store customer transaction data within the European Union to comply with GDPR data residency requirements. They want to prevent users from creating resources in any region outside the EU. Which organization policy constraint should they use?

A.constraints/compute.vmExternalIpAccess
B.constraints/gcp.resourceLocations
C.constraints/iam.allowedPolicyMemberDomains
D.constraints/sql.restrictAuthorizedNetworks
AnswerB

This constraint defines the allowed resource locations.

Why this answer

The organization policy constraint gcp.resourceLocations restricts the locations where Google Cloud resources can be created. By setting a list of allowed locations (e.g., europe-west1, europe-west4), resources cannot be created in non-EU regions.

Full explanation →
113
Multi-Selectmedium

Which TWO options are valid methods to secure data in transit between an on-premises data center and a Google Cloud VPC?

Select 2 answers
A.Private Google Access
B.Dedicated Interconnect with MACsec
C.Cloud VPN with IPsec
D.VPC Network Peering
E.Internal HTTPS Load Balancing
AnswersB, C

Provides encryption at Layer 2 for dedicated connections.

Why this answer

Dedicated Interconnect with MACsec (Media Access Control Security) provides encryption at Layer 2, securing data in transit over the dedicated connection between your on-premises data center and Google Cloud VPC. MACsec uses GCM-AES-128 or GCM-AES-256 encryption to protect all traffic on the link, ensuring confidentiality and integrity without the overhead of IPsec.

Exam trap

Google Cloud often tests the distinction between connectivity methods (like Private Google Access or VPC Peering) and actual encryption mechanisms, leading candidates to confuse access control or internal routing with data-in-transit security.

Full explanation →
114
MCQmedium

A company has an organization policy that disables service account key creation (constraints/iam.disableServiceAccountKeyCreation). However, a legacy application requires a service account key to authenticate. What should the engineer do to satisfy this requirement while following best practices?

A.Create a service account key and use it despite the policy, then document the exception
B.Use workload identity federation to authenticate the legacy application without keys
C.Create a custom role that includes iam.serviceAccountKeys.create and assign it to the service account
D.Remove the organization policy constraint to allow key creation
AnswerB

Workload identity federation allows keyless authentication from external workloads, meeting the requirement without violating the policy.

Why this answer

The best practice is to avoid service account keys entirely. Use workload identity federation if the application runs outside GCP, or use Workload Identity for GKE if it runs in GKE. If the application must use keys, you can request an exception by creating a custom organization policy with a condition or by using the policy simulator to test, but the preferred approach is to eliminate key usage.

Full explanation →
115
MCQmedium

A company assigns roles to Google Groups to simplify management. They have a group called data-engineers@example.com that needs access to BigQuery datasets. Instead of adding each user individually, they want to grant the group roles/bigquery.dataViewer at the project level. After granting the role, a new member added to the group reports they cannot query a dataset. What is the most likely reason?

A.The dataset is in a different project than the one where the role was granted.
B.The user needs to be added directly to the dataset's access control list.
C.The dataset has been configured with private access control that overrides the project-level IAM.
D.The group does not have the necessary permissions because BigQuery does not support IAM groups.
AnswerA

If the dataset is in another project, the IAM role must be granted on that project or dataset.

Why this answer

IAM roles granted at the project level apply only to resources within that project. If the BigQuery dataset resides in a different project, the group's project-level role does not grant access to that dataset. The user would need either a role granted at the dataset's project level or direct dataset-level permissions.

Exam trap

Google Cloud often tests the misconception that project-level IAM roles grant access to all resources across all projects in the organization, when in fact they are scoped to the specific project where the role is assigned.

How to eliminate wrong answers

Option B is wrong because adding the user directly to the dataset's ACL is not necessary if the group already has a project-level role that should grant access; the issue is the dataset being in a different project, not the need for direct user ACLs. Option C is wrong because private access control (e.g., Authorized Views or dataset-level ACLs) can restrict access, but it does not override project-level IAM; rather, it works in conjunction with IAM, and the scenario describes a missing access issue, not an override. Option D is wrong because BigQuery fully supports IAM groups; groups can be granted roles at the project or dataset level, and the group itself is a valid principal in IAM policies.

Full explanation →
116
Multi-Selecthard

A company is implementing confidential VMs with Shielded VM and data encryption. Which two actions must be taken to ensure data protection for confidential compute workloads?

Select 2 answers
A.Use vTPM for key management.
B.Enable Secure Boot and Measured Boot.
C.Use customer-managed encryption keys (CMEK) for persistent disk encryption.
D.Use a Confidential VM instance with an N2D machine series.
E.Use Cloud HSM to protect the encryption keys for the encrypted memory.
AnswersA, B

vTPM is used for secure key storage and attestation.

Why this answer

VTPM (virtual Trusted Platform Module) provides hardware-based key management for confidential VMs, enabling secure generation, storage, and attestation of encryption keys used for memory encryption and disk encryption. This ensures that only authorized code can access the keys, protecting data at rest and in use.

Exam trap

Google Cloud often tests the distinction between data-at-rest encryption (CMEK, Cloud HSM) and data-in-use protection (confidential VMs with vTPM and Secure Boot), leading candidates to mistakenly select C or E for memory encryption.

Full explanation →
117
MCQhard

A security engineer notices that a service account has been assigned the roles/iam.serviceAccountUser role at the project level. What actions can a user with this role perform?

A.Create new service accounts in the project.
B.Impersonate the service account to access resources.
C.Delete the service account.
D.View the service account's keys.
AnswerB

Correct. The roles/iam.serviceAccountUser role specifically grants permission to impersonate a service account and use its permissions.

Why this answer

The roles/iam.serviceAccountUser role allows a user to impersonate a service account (via gcloud or API) and use its permissions to access resources. It does not allow creating, deleting, or viewing keys of service accounts. This aligns with the requirement that the team should not be able to delete the service, as the role lacks deletion permissions.

Full explanation →
118
MCQmedium

A company wants to enforce that all new Cloud Storage buckets are created in only the europe-west1 region. Which organization policy constraint should they use?

A.constraints/storage.uniformBucketLevelAccess
B.constraints/compute.requireOsLogin
C.constraints/gcp.resourceLocations
D.constraints/iam.disableServiceAccountCreation
AnswerC

This constraint restricts where resources can be created; it can be set to allow only europe-west1.

Why this answer

The organization policy constraint gcp.resourceLocations restricts the locations where resources can be created. By setting this constraint with a list of allowed locations (e.g., europe-west1), new buckets can only be created in those regions.

Full explanation →
119
MCQmedium

A security administrator wants to ensure that only requests coming through Identity-Aware Proxy (IAP) can access a backend service running on Compute Engine. Which configuration is required?

A.Use a VPN between IAP and backend.
B.Configure Cloud Armor to block non-IAP traffic.
C.Configure the backend service to require IAP credentials.
D.Set firewall rules to allow only traffic from IAP proxy IP ranges.
AnswerD

This restricts access to only IAP requests.

Why this answer

Identity-Aware Proxy (IAP) uses a fixed set of Google-owned IP ranges to forward authenticated and authorized requests to backend services. By configuring VPC firewall rules to allow ingress only from these IAP proxy IP ranges, the administrator ensures that any traffic not originating from IAP is blocked, effectively restricting access to IAP-authorized requests only.

Exam trap

The trap here is that candidates often confuse application-layer authentication (IAP JWT validation) with network-layer access control (firewall rules), leading them to choose option C, but the question specifically asks for the configuration to ensure only requests coming through IAP can access the backend, which at the network level is achieved by restricting source IPs to IAP proxy ranges.

How to eliminate wrong answers

Option A is wrong because a VPN between IAP and the backend is not supported; IAP is a Google Cloud service that proxies traffic from the internet, and it does not establish VPN tunnels to backends. Option B is wrong because Cloud Armor is a web application firewall (WAF) that filters HTTP/S traffic based on rules (e.g., OWASP signatures), but it cannot natively inspect whether a request originated from IAP; it would require custom header validation, which is not the primary recommended method. Option C is wrong because the backend service itself does not 'require IAP credentials'; IAP validates identity and authorization at the proxy layer, and the backend service must be configured to trust IAP-signed JWTs (via the IAP-issued JWT audience), not to directly require credentials.

Full explanation →
120
Multi-Selecthard

A company is setting up Cloud NAT for a subnet that hosts compute instances. They want to ensure high availability and efficient use of IPs. Which TWO configurations should they apply? (Choose TWO.)

Select 2 answers
A.Create a separate Cloud NAT gateway for each zone in the region.
B.Disable IP masquerading to preserve source IPs.
C.Specify at least two NAT IPs, each from different zones for redundancy.
D.Reserve static external IP addresses and assign them to the Cloud NAT.
E.Use dynamic NAT IPs so that Google-managed allocation is used.
AnswersC, D

Multiple IPs across zones provide HA if a zone fails.

Why this answer

Options C and D provide high availability and efficient IP management. By specifying at least two NAT IPs from different zones (C), you ensure redundancy if one zone fails. By reserving static external IPs (D), you avoid losing IPs when instances are restarted.

Option A is inefficient because one NAT gateway per region suffices; zone-level gateways add complexity. Option B disables masquerading, which is not recommended for typical NAT usage. Option E uses dynamic IPs which may change, reducing reliability.

Full explanation →
121
Multi-Selecthard

A security architect is designing an IAM hierarchy for a large organization. The requirements are: 1) Development projects should inherit a policy that allows Compute Engine access. 2) Production projects should not have Compute Engine access. 3) Audit team must be able to read all resources across all projects. Which three IAM policy placements are correct? (Choose three.)

Select 3 answers
A.Grant the development team roles/compute.admin at the folder level for the development folder.
B.Grant the audit team roles/viewer at the organization level.
C.Grant the production team roles/compute.admin at the folder level for the production folder, then create a deny policy at the org level to block Compute Engine.
D.Place a deny policy at the production folder level to block Compute Engine access.
E.Grant the audit team roles/viewer at each project level.
AnswersA, B, D

Inherited by all projects in the development folder.

Why this answer

Grant the development team roles/compute.admin at the development folder level (A) allows development projects to inherit Compute Engine access. Grant the audit team roles/viewer at the organization level (B) allows them to read all resources across all projects. Placing a deny policy at the production folder level (D) blocks Compute Engine access for production projects.

This meets all requirements.

Full explanation →
122
MCQmedium

A company has a VPC with subnet-a (10.0.1.0/24) and subnet-b (10.0.2.0/24). They enabled Private Google Access on subnet-a. Instances in subnet-a can access Google APIs and services using private IPs. However, instances in subnet-b cannot reach Google APIs even though subnet-b has a default route to the internet through a NAT gateway. What is the likely cause?

A.Subnet-b does not have a default route to the internet.
B.Cloud NAT is not configured for subnet-b.
C.Firewall rules are blocking traffic to googleapis.com.
D.Private Google Access is not enabled on subnet-b.
AnswerD

Correct: must enable per subnet.

Why this answer

Private Google Access is a per-subnet setting that allows instances with only private IPs to reach Google APIs and services through the VPC's default internet gateway, without needing public IPs or NAT. Since subnet-b does not have Private Google Access enabled, its instances cannot use this feature even though they have a default route to the internet via a NAT gateway; the NAT gateway only provides outbound internet access for public IP destinations, not the private IP ranges used by Google APIs.

Exam trap

Google Cloud often tests the misconception that a NAT gateway or internet gateway alone is sufficient for accessing Google APIs, when in fact Private Google Access must be explicitly enabled on each subnet that requires it.

How to eliminate wrong answers

Option A is wrong because subnet-b has a default route to the internet through a NAT gateway, as stated in the question. Option B is wrong because Cloud NAT is not required for Private Google Access; Private Google Access uses the VPC's default internet gateway, not a NAT gateway, and the question already states subnet-b has a NAT gateway. Option C is wrong because there is no indication of firewall rules blocking traffic to googleapis.com; the issue is specifically about the subnet-level Private Google Access setting, not firewall rules.

Full explanation →
123
MCQeasy

A developer is creating a Cloud Function that needs to access a Cloud SQL database. They have granted the function's service account the Cloud SQL Client role. However, the function still gets permission denied. What is the most likely issue?

A.The service account needs the Cloud SQL Admin role instead.
B.The Cloud SQL instance is not configured with an authorized network that includes the function's IP range, or the function is not using the Cloud SQL Auth proxy.
C.The function must use a VPN to connect to Cloud SQL.
D.The function needs to be in the same region as the Cloud SQL instance.
AnswerB

Networking must allow the connection via Cloud SQL Auth proxy.

Why this answer

The most likely issue is that the Cloud SQL instance is configured with an authorized network that does not include the function's IP range, or the function is not using the Cloud SQL Auth proxy. Cloud Functions do not have static IP addresses by default, so they cannot be added to an authorized network. The recommended approach is to use the Cloud SQL Auth proxy, which handles authentication via IAM (the Cloud SQL Client role) and does not require authorized networks.

Without the proxy, the function would need a VPC connector to access the database via private IP. Option A is incorrect because the Cloud SQL Client role is sufficient for the proxy; Cloud SQL Admin is unnecessary. Option C is incorrect because VPN is not required when using the proxy or private IP.

Option D is incorrect because Cloud Functions do not need to be in the same region as Cloud SQL; they can connect across regions using the proxy.

Full explanation →
124
MCQmedium

A healthcare organization is required to protect Protected Health Information (PHI) stored in Cloud Storage. They want to automatically detect and redact PHI before storing it. Which Google Cloud service should they use?

A.Cloud Armor
B.Cloud Data Loss Prevention (DLP)
C.VPC Service Controls
D.Security Command Center
AnswerB

Cloud DLP provides built-in detectors for PHI and can be configured to automatically redact or de-identify data in Cloud Storage, meeting HIPAA requirements.

Why this answer

Cloud DLP can inspect Cloud Storage buckets for sensitive data like PHI and redact or de-identify it automatically using its inspect and transform pipeline.

Full explanation →
125
MCQeasy

A company uses Organization Policies to restrict public IP addresses on Compute Engine instances. An engineer created a new project and cannot launch any instances because the organization policy denies external IPs. However, the engineer needs to launch a bastion host with an external IP. What should they do?

A.Request that the organization policy be removed at the org level.
B.Use a VM with a NAT gateway instead.
C.Add an exception to the organization policy for the project.
D.Create a new folder with a different policy and move the project.
AnswerC

Organization policies can be overridden at a lower level by adding an exception.

Why this answer

Organization Policies can have exceptions at the project level, allowing a bastion host with an external IP while still enforcing the policy on other resources. Option A is incorrect because removing the policy at the org level would affect all projects. Option B is incorrect because a NAT gateway does not provide an external IP for inbound connections.

Option D is incorrect because moving the project to a different folder with a different policy is more complex and unnecessary when a project-level exception is available.

Full explanation →
126
MCQeasy

A financial services company is deploying a new payment processing system on Google Cloud that must comply with PCI DSS. The system processes credit card data. The security team has implemented encryption at rest and in transit, and uses Private Google Access for VPC communication. During a PCI assessment, the assessor points out that the company is missing a critical control: the need to regularly scan the external IP addresses of the VMs for vulnerabilities. What should the company do to address this requirement?

A.Use Security Command Center Premium to perform vulnerability scanning.
B.Deploy Cloud IDS to perform active vulnerability scanning on external IPs.
C.Enable Cloud Armor to block all traffic and thus eliminate the need for scanning.
D.Set up a third-party vulnerability scanner (e.g., Nessus) from the Cloud Marketplace and run scans against external IPs.
AnswerD

A third-party ASV scanner is standard for PCI DSS.

Why this answer

PCI DSS Requirement 11.2 mandates that external-facing IP addresses be scanned for vulnerabilities at least quarterly and after any significant change. Deploying a third-party scanner like Nessus from the Cloud Marketplace allows the company to run authenticated or unauthenticated scans against the external IPs of their VMs, meeting the specific requirement. Google Cloud does not provide a native active vulnerability scanning service for external IPs; Security Command Center Premium and Cloud IDS focus on asset discovery and threat detection, not active scanning of external endpoints.

Exam trap

Google Cloud often tests the misconception that Google Cloud's native security tools (like Security Command Center or Cloud IDS) can replace the need for a dedicated external vulnerability scanner, but PCI DSS explicitly requires active scanning of external IPs, which only a third-party or ASV scanner can perform.

How to eliminate wrong answers

Option A is wrong because Security Command Center Premium provides continuous monitoring, asset inventory, and findings from built-in scanners like Web Security Scanner, but it does not perform active vulnerability scanning of arbitrary external IP addresses; it relies on agent-based or API-based assessments for internal VMs. Option B is wrong because Cloud IDS is a network threat detection service that inspects traffic for malicious activity using packet mirroring, not an active vulnerability scanner that probes external IPs for CVEs. Option C is wrong because Cloud Armor is a web application firewall that blocks traffic based on rules, but it does not eliminate the need for vulnerability scanning; PCI DSS requires active scanning regardless of traffic filtering, and blocking all traffic would break the payment processing system.

Full explanation →
127
MCQhard

A healthcare organization stores PHI in BigQuery tables with row-level access policies. They need to ensure that data is automatically de-identified when exported to Cloud Storage for analytics. What is the most scalable solution with minimal manual intervention?

A.Set up VPC Service Controls to prevent data exfiltration and rely on access controls.
B.Create a scheduled query in BigQuery that exports data using a view with de-identification functions.
C.Use Cloud DLP API to scan and de-identify the export file after it is written to Cloud Storage.
D.Use BigQuery data masking to define de-identification policies, then export the masked data directly.
AnswerD

Dynamic data masking applies policies at query time, automatically de-identifying exports.

Why this answer

BigQuery data masking allows you to define column-level de-identification policies that are applied automatically at query time. When you export the masked data directly using an export job, the de-identification is enforced without additional scripting or post-processing, making it the most scalable and low-maintenance solution for PHI protection.

Exam trap

Google Cloud often tests the distinction between access control (VPC Service Controls) and data de-identification, leading candidates to choose network-level solutions (Option A) when the requirement is specifically about transforming the data content.

How to eliminate wrong answers

Option A is wrong because VPC Service Controls prevent data exfiltration at the network perimeter but do not de-identify the data itself; the exported PHI would remain fully readable. Option B is wrong because scheduled queries that export via a view with de-identification functions require manual creation and maintenance of the view and the schedule, and the de-identification logic must be re-applied if the schema changes, increasing operational overhead. Option C is wrong because scanning and de-identifying the file after it is written to Cloud Storage introduces a window where raw PHI exists in the bucket, and it requires an additional DLP job that must be triggered and managed, reducing scalability and increasing latency.

Full explanation →
128
MCQhard

A company uses Cloud KMS to protect encryption keys for various applications. They need to ensure that keys are automatically rotated every 90 days and that the rotation does not require re-encrypting all data. Which key type and rotation strategy should they use?

A.Use a symmetric key with automatic rotation period set to 90 days.
B.Use an asymmetric key and set the rotation period to 90 days.
C.Use an asymmetric key and manually create a new version every 90 days.
D.Use a symmetric key and manually create a new version every 90 days.
AnswerA

Symmetric keys support automatic rotation, and old versions remain for decryption.

Why this answer

Symmetric keys are used for encryption/decryption of data at rest, and Cloud KMS supports automatic key rotation by creating a new key version at a specified interval (e.g., 90 days). Because Cloud KMS uses key versions and the key material is never exposed, existing ciphertext remains decryptable using the old key version, so no re-encryption is required. This meets the requirement for automatic rotation without data re-encryption.

Exam trap

Google Cloud often tests the misconception that automatic rotation requires re-encrypting data, or that asymmetric keys are suitable for bulk encryption, leading candidates to choose manual rotation or asymmetric key options.

How to eliminate wrong answers

Option B is wrong because asymmetric keys are typically used for digital signatures or key exchange, not for bulk data encryption, and automatic rotation of asymmetric keys would require re-encrypting data or re-signing. Option C is wrong because manual creation of a new version every 90 days does not satisfy the requirement for automatic rotation, and asymmetric keys still do not avoid re-encryption for data encryption use cases. Option D is wrong because manual creation of a new version every 90 days is not automatic rotation; the requirement explicitly states 'automatically rotated'.

Full explanation →
129
Multi-Selecthard

Which THREE are valid considerations when designing cross-organization access for Cloud Storage? (Choose three.)

Select 3 answers
A.Uniform bucket-level access disables ACLs, simplifying cross-org access management.
B.Signed URLs require the requester pays configuration to be enabled.
C.You can grant IAM roles to a principal from another Google Cloud organization.
D.VPC Service Controls must be configured to allow cross-org IAM policies.
E.Organization Policy constraints can prevent sharing resources with external principals.
AnswersA, C, E

Uniform access ensures only IAM policies control access.

Why this answer

Uniform bucket-level access disables Access Control Lists (ACLs) and relies solely on IAM permissions for bucket access. This eliminates the complexity of managing both ACLs and IAM across organizations, making cross-org access management simpler and more consistent.

Exam trap

Google Cloud often tests the misconception that Signed URLs require requester pays, but in reality, they are independent features; the trap is confusing the cost-bearing mechanism with the access delegation mechanism.

Full explanation →
130
MCQeasy

A financial institution wants to encrypt data in Cloud Storage using keys that they rotate monthly through Cloud KMS. Which key management option should they use?

A.Customer-Managed Encryption Keys (CMEK)
B.Google-managed encryption keys
C.Default encryption at rest
D.Customer-Supplied Encryption Keys (CSEK)
AnswerA

CMEK allows full control via Cloud KMS, including rotation.

Why this answer

CMEK allows customers to manage and rotate keys in Cloud KMS. Option B (Google-managed encryption keys) does not allow customer rotation. Option C (Default encryption at rest) uses Google-managed keys and cannot be rotated by customers.

Option D (CSEK) requires customer-supplied keys per request and does not support rotation.

Full explanation →
131
MCQeasy

An organization uses Cloud DLP to inspect BigQuery tables for sensitive data. They want to automatically remove credit card numbers before the data is accessed by analysts but still allow the raw data for auditing purposes. Which DLP technique should they use?

A.De-identification transform with masking
B.Re-identification transform with tokenization
C.De-identification transform with redact
D.De-identification transform with replacement
AnswerC

Redact completely removes the sensitive data from the output.

Why this answer

The 'De-identification transform with redact' completely removes sensitive data (like credit card numbers) from the output, ensuring analysts never see the raw values while the original data remains intact in the source BigQuery table for auditing. This aligns with the requirement to automatically strip sensitive content before access, without altering the stored data.

Exam trap

Google Cloud often tests the distinction between 'redact' (complete removal) and 'masking' or 'replacement' (partial or substituted data), trapping candidates who confuse removal with obfuscation or who incorrectly think tokenization is a re-identification technique.

How to eliminate wrong answers

Option A is wrong because masking (e.g., showing only the last four digits) still exposes partial sensitive data, which violates the requirement to remove credit card numbers entirely from analyst access. Option B is wrong because re-identification transforms are not a DLP technique; tokenization is a de-identification method that replaces sensitive data with a token, but the question demands removal, not reversible replacement, and 're-identification' implies restoring the original, which is the opposite of the goal. Option D is wrong because replacement (e.g., substituting with a static value like 'REDACTED') still leaves a placeholder that could be confused with real data or inadvertently expose patterns, whereas redact completely omits the field or value, providing stricter removal.

Full explanation →
132
Multi-Selecthard

A security team is designing an incident response workflow for container threats detected by Security Command Center Premium. They want to automatically capture forensic evidence from compromised GKE nodes. Which THREE steps should they include? (Choose THREE.)

Select 3 answers
A.Export the container image from Artifact Registry for analysis.
B.Collect pod logs and container logs from the node using kubectl logs.
C.Immediately drain and delete all pods on the node.
D.Delete the compromised node pool to prevent further damage.
E.Take a snapshot of the node's boot disk.
AnswersA, B, E

The image may contain vulnerabilities or malware.

Why this answer

When a container threat is detected, the team should capture evidence by taking snapshots of persistent disks, collecting pod logs from the node, and exporting container logs. Deleting the cluster or creating a new node pool would destroy evidence.

Full explanation →
133
MCQeasy

A security engineer needs to ensure that all customer data stored in Cloud Storage is encrypted at rest using keys that the organization manages and rotates themselves. Which encryption option should they use?

A.Customer-supplied encryption keys (CSEK)
B.Google-managed encryption (GMEK)
C.Customer-managed encryption keys (CMEK) using Cloud KMS
D.Cloud HSM
AnswerC

CMEK allows customers to manage and rotate their keys via Cloud KMS.

Why this answer

Customer-managed encryption keys (CMEK) using Cloud KMS is the correct choice because it allows the organization to create, manage, and rotate their own encryption keys for Cloud Storage data at rest, while still leveraging Google's infrastructure for encryption. CMEK uses Cloud KMS to wrap the data encryption keys (DEKs) with a customer-managed key encryption key (KEK), ensuring the organization retains control over key lifecycle operations such as rotation, disabling, and destruction, meeting the requirement for self-managed key rotation.

Exam trap

Google often tests the distinction between CMEK and CSEK, where candidates mistakenly choose CSEK because they think 'customer-supplied' implies full control, but they overlook that CSEK does not support persistent key management or rotation, which is a core requirement in this scenario.

How to eliminate wrong answers

Option A is wrong because Customer-supplied encryption keys (CSEK) require the customer to provide the raw encryption key with each API call, and Google does not store the key; this option does not support automated key rotation and is not suitable for persistent key management at rest. Option B is wrong because Google-managed encryption (GMEK) uses keys that Google creates and rotates on behalf of the customer, which does not satisfy the requirement for the organization to manage and rotate keys themselves. Option D is wrong because Cloud HSM is a hardware security module service that can be used to protect CMEK keys, but it is not an encryption option itself; it is a backing key store for CMEK, and selecting it alone does not provide the key management and rotation capabilities required.

Full explanation →
134
Multi-Selecthard

A security team is configuring Cloud Armor to protect a web application. They need to block requests that contain SQL injection patterns, block requests from a known malicious IP list, and limit requests from any single IP to 2000 requests per minute. Which THREE actions must they take? (Choose three.)

Select 3 answers
A.Create a custom rule with a deny action for the malicious IP list using a CEL expression
B.Create a single rule that combines SQLi detection, IP blocking, and rate limiting using CEL
C.Enable the preconfigured rule set for SQL injection (OWASP ModSecurity CRS)
D.Enable Cloud Armor Managed Protection Plus for automatic IP reputation
E.Create a rate limiting rule with a threshold of 2000 requests per minute per IP
AnswersA, C, E

You can use a deny list rule to block specific IP addresses.

Why this answer

To implement these requirements, you need to enable the preconfigured SQL injection rule set, create a custom rule with an IP allow/deny list for the malicious IPs, and create a rate limiting rule. Cloud Armor does not have a built-in list of malicious IPs; you must provide the list. The rate limiting is configured as a separate rule with action 'rateBasedThrottle'.

Full explanation →
135
Multi-Selecthard

A security team needs to inspect all egress traffic from Compute Engine instances for malware using a third-party security appliance. They want to deploy the appliance in a separate VPC and route all egress traffic through it. Which THREE components are required? (Choose 3)

Select 3 answers
A.VPC peering between the application VPC and the appliance VPC
B.Custom route for 0.0.0.0/0 with next hop to an internal load balancer
C.Cloud VPN tunnel between VPCs
D.Internal load balancer in the appliance VPC
E.Cloud NAT gateway
AnswersA, B, D

Required for traffic to cross VPCs if appliance is in a separate VPC.

Why this answer

Use a custom route to direct default egress traffic to the appliance, which is an internal load balancer (ILB) forwarding to the appliance instances. The appliance must be deployed in a different VPC, and VPC peering or Network Connectivity Center connects the VPCs. However, the simplest is to use an ILB in the same VPC as the instances, but the requirement says separate VPC.

So use VPC peering. The three required: custom route for default route (0.0.0.0/0) with next hop to ILB, an internal load balancer forwarding traffic to the appliance, and VPC peering (or VPN) to connect the VPCs. Alternatively, if using the same VPC, peering not needed.

But given separate VPC, peering is needed.

Full explanation →
136
MCQmedium

A company wants to allow a Compute Engine VM to access a Cloud SQL instance without exposing the SQL instance to the internet. The VM is in the same VPC but different subnet. Which configuration is required?

A.Use the Cloud SQL Proxy on the VM and a public IP for the Cloud SQL instance.
B.Configure VPC peering between the VM's subnet and the Cloud SQL instance's VPC.
C.Create a private IP for the Cloud SQL instance using Private Services Access, grant the VM's service account the Cloud SQL Client role, and ensure the VM is in the same VPC.
D.Add a firewall rule allowing ingress from the VM's IP to the Cloud SQL instance's internal IP.
AnswerC

This setup provides private connectivity and IAM authorization.

Why this answer

Cloud SQL requires a private services access connection and the VM must have the cloudsql.client role to connect. Option A is wrong because the Cloud SQL Proxy can be used but requires a public IP if not within the VPC. Option B is wrong because VPC peering alone does not grant IAM permissions.

Option D is wrong because a firewall rule is not sufficient without IAM.

Full explanation →
137
MCQmedium

A government agency requires FedRAMP High compliance for their Google Cloud deployment. Which service should they use to create a compliant environment with pre-configured controls?

A.Cloud HSM
B.VPC Service Controls
C.Security Command Center
D.Assured Workloads
AnswerD

Assured Workloads automates the creation of a compliant environment for FedRAMP, HIPAA, etc., with pre-built controls and continuous monitoring.

Why this answer

Assured Workloads is the correct service because it enables customers to create a Google Cloud environment that is pre-configured to meet specific compliance requirements, including FedRAMP High. It automatically applies a set of controls (e.g., data residency, encryption key management, and access restrictions) based on the chosen compliance regime, reducing the manual effort needed to achieve and maintain certification.

Exam trap

Google Cloud often tests the misconception that a single security tool (like Cloud HSM or VPC Service Controls) is sufficient for full compliance, when in reality Assured Workloads is the only option that provides a holistic, pre-configured compliance environment.

How to eliminate wrong answers

Option A is wrong because Cloud HSM is a hardware security module service that provides FIPS 140-2 Level 3 validated key management, but it does not create a pre-configured compliant environment or enforce broader FedRAMP controls like data residency or access boundaries. Option B is wrong because VPC Service Controls provides a security perimeter to prevent data exfiltration from VPC services, but it is a single control mechanism, not a comprehensive environment that pre-configures all FedRAMP High requirements. Option C is wrong because Security Command Center is a security and risk management platform that provides visibility, threat detection, and compliance reporting, but it does not automatically deploy a pre-configured compliant environment; it monitors and assesses existing configurations.

Full explanation →
138
MCQmedium

A company wants to allow an external auditor to view all IAM policies in a project but not modify them. The auditor's Google account is from a different domain. Which IAM role should be assigned?

A.roles/iam.roleViewer
B.roles/viewer
C.roles/iam.securityReviewer
D.roles/securityAdmin
AnswerC

Correct: allows viewing IAM policies and security settings.

Why this answer

The roles/iam.securityReviewer role grants permission to view IAM policies and other security settings without write access. roles/viewer does not include iam.roles.list or iam.policies.get. roles/iam.roleViewer only lists roles, not policies. roles/securityAdmin includes write permissions.

Full explanation →
139
Multi-Selectmedium

A security team is setting up Binary Authorization for their GKE clusters. They want to enforce that only images signed by an approved attestor can be deployed. Which TWO of the following are required for this setup?

Select 2 answers
A.Create an attestor in Binary Authorization.
B.Enable Vulnerability Scanning on Artifact Registry.
C.Disable the default 'Allow All' policy.
D.Create a Container Analysis note for each image.
E.Create a Cloud KMS key pair and associate it with the attestor.
AnswersA, E

Required to define who can attest to an image.

Why this answer

Binary Authorization requires creating an attestor and associating it with a Cloud KMS key pair for signing verification. The attestor's public key must be added to the Binary Authorization policy. A Container Analysis note is used to store attestations, but it is not a separate requirement for the policy itself; it is used when creating attestations.

Disabling vulnerability scanning is not required.

Full explanation →
140
MCQhard

A healthcare organization uses Cloud DLP to scan a Cloud Storage bucket containing medical records. They want to inspect for sensitive data such as patient names and SSNs, but only on new objects added after a certain date. Which DLP configuration should they use?

A.Use Cloud Functions to trigger DLP inspection on new object creation events
B.Create a DLP job trigger with a schedule that runs daily and scans the entire bucket
C.Use BigQuery to query the bucket and then scan the results with DLP
D.Create a DLP job trigger with a schedule and set `cloud_storage_options.time_filter` to scan only objects after a date
AnswerA

Cloud Functions can respond to Cloud Storage events and call DLP to inspect the new object.

Why this answer

The correct approach is to use Cloud Functions triggered by Cloud Storage object finalize events. When a new object is added, the Cloud Function invokes the Cloud DLP API to inspect only that object. This provides real-time scanning of new data without rescanning the entire bucket.

Option D is incorrect because DLP job triggers do not support a `time_filter` parameter to limit scans to objects after a specific date; they scan the entire bucket or a defined subset on a schedule.

Full explanation →
141
MCQmedium

A company uses Cloud Functions to process employee data and wants to ensure that personally identifiable information (PII) is redacted from log output. Which approach should they take?

A.Use Cloud Audit Logs to capture all access and redact at analysis.
B.Use Cloud DLP API to inspect and redact the log message before writing to Cloud Logging.
C.Create a Logging sink with an exclusion filter to drop logs containing PII.
D.Enable VPC Service Controls to prevent PII from leaving the VPC.
AnswerB

DLP can de-identify text in application logic.

Why this answer

The Cloud DLP API can be integrated directly into a Cloud Function to inspect and redact PII from log messages before they are written to Cloud Logging. This ensures that sensitive data never appears in the logs, which is the most secure approach. Using Cloud DLP at the point of log generation prevents any exposure, rather than relying on post-hoc analysis or filtering.

Exam trap

Google Cloud often tests the distinction between reactive filtering (exclusion sinks) and proactive redaction (DLP API), and the trap here is that candidates mistakenly believe a Logging sink can redact data when it can only drop entire log entries, not modify their content.

How to eliminate wrong answers

Option A is wrong because Cloud Audit Logs capture access events but do not provide a mechanism to redact PII from the log output; redaction would require a separate analysis step, which does not prevent PII from being stored in logs. Option C is wrong because a Logging sink with an exclusion filter drops entire log entries containing PII, but this is a reactive approach that still allows PII to be written to Cloud Logging before the filter is applied, and it may also drop legitimate logs that happen to contain PII. Option D is wrong because VPC Service Controls control data exfiltration at the network perimeter but do not inspect or redact log content; they cannot prevent PII from appearing in logs generated within the VPC.

Full explanation →
142
Multi-Selecteasy

Which TWO organization policies can help enforce compliance with data residency requirements?

Select 1 answer
A.constraints/storage.uniformBucketLevelAccess
B.constraints/iam.disableServiceAccountCreation
C.constraints/gcp.resourceLocations
D.constraints/gcp.restrictTrustedDomains
E.constraints/compute.requireShieldedVm
AnswersC

This policy restricts where resources can be created, ensuring data stays in allowed regions.

Why this answer

The `constraints/gcp.resourceLocations` organization policy restricts the physical location where Google Cloud resources can be created, directly enforcing data residency requirements. Option D is incorrect because `constraints/gcp.restrictTrustedDomains` controls which domains can be used in IAM policies, which is about identity management, not data location. No other option enforces data residency.

Exam trap

Google Cloud often tests the distinction between security controls (like Shielded VM or uniform bucket access) and compliance controls (like resource location restrictions), so candidates mistakenly pick options that sound security-related but do not enforce data residency.

Full explanation →
143
Multi-Selecthard

Which TWO of the following are true regarding Cloud Identity and Access Management (IAM) conditions?

Select 2 answers
A.IAM conditions can restrict access based on the current date and time.
B.IAM conditions are supported for all Google Cloud resources.
C.IAM conditions can be applied to a role binding that supports all resources.
D.IAM conditions can restrict access based on resource tags.
E.IAM conditions can restrict access based on the user's email domain.
AnswersA, D

DateTime conditions are supported.

Why this answer

IAM conditions support temporal attributes, including date/time restrictions, using the `request.time` attribute. This allows policies to grant access only during specific hours or days, such as allowing access only during business hours. The condition is expressed using the Common Expression Language (CEL) syntax, e.g., `request.time.getHours("America/New_York") >= 9 && request.time.getHours("America/New_York") <= 17`.

Exam trap

Google Cloud often tests the misconception that IAM conditions can restrict access based on user attributes like email domain or group membership, but in reality, conditions only support resource and request attributes, not principal attributes.

Full explanation →
144
MCQeasy

A data engineer wants to use Cloud DLP to scan a Cloud Storage bucket for personally identifiable information (PII). Which resource should they create to run this scan?

A.Create an InspectTemplate
B.Create a JobTrigger
C.Create a DeidentifyTemplate
D.Create a DlpJob
AnswerD

A DlpJob executes the inspection or de-identification operation on the specified data.

Why this answer

Cloud DLP uses 'DlpJob' or 'InspectJob' to scan data. A 'DlpJob' can be created to inspect content in Cloud Storage, BigQuery, or Datastore. A job trigger can schedule scans, but the scan itself is a job. 'DeidentifyTemplate' and 'InspectTemplate' are configuration templates, not the scan execution.

Full explanation →
145
MCQmedium

A company uses Google Workspace and wants to allow users to authenticate to a third-party SaaS application using their Google credentials. The SaaS application supports SAML 2.0. What should the administrator configure?

A.Workload Identity Federation
B.SAML 2.0 SSO in Google Admin Console
C.Cloud Identity-Aware Proxy (IAP)
D.OAuth 2.0 consent screen
AnswerB

Google Workspace can act as a SAML 2.0 identity provider to grant SSO to third-party apps.

Why this answer

Google Workspace supports SAML 2.0 federation. The admin would set up a custom SAML app in the Google Admin console, configuring the IdP (Google) and SP (SaaS app) metadata.

Full explanation →
146
MCQmedium

An organization has set up IAP to protect a web application running on Compute Engine. The application needs to know the authenticated user's email address for logging. How can the application securely obtain this information?

A.Read the user's email from the instance's metadata server.
B.Extract the email from the X-Goog-Authenticated-User-Email header after verifying the JWT signed by IAP.
C.Use the Cloud Logging API to query the most recent IAP access logs.
D.Call the IAP API to retrieve the user identity.
AnswerB

IAP sets signed headers with the user's identity; the application must verify the JWT to trust the header.

Why this answer

IAP passes the authenticated user's identity to the backend application via signed HTTP headers (X-Goog-Authenticated-User-Email, X-Goog-Authenticated-User-Id). The application should verify the JWT signature of the IAP token (using Google's public keys) to trust these headers. The headers cannot be spoofed if the application verifies the JWT.

Using Cloud Logging is not for real-time identity. The metadata server does not provide IAP user identity. The IAP API is for managing IAP configuration, not for retrieving user identity per request.

Full explanation →
147
MCQmedium

An organization wants to allow an external identity provider (IdP) that supports OpenID Connect (OIDC) to access GCP resources. They want to avoid creating and managing service account keys. What should they use?

A.Use Cloud Identity Platform to federate the external IdP.
B.Create a service account key and share it with the external IdP.
C.Use a VPN tunnel to connect the external IdP to GCP and use internal IPs.
D.Configure Workload Identity Federation to allow the external IdP to impersonate a service account.
AnswerD

Workload Identity Federation enables keyless authentication for workloads running outside GCP.

Why this answer

Workload Identity Federation allows an external identity provider (IdP) that supports OpenID Connect (OIDC) to impersonate a GCP service account without requiring service account keys. This enables the external IdP to obtain short-lived, scoped tokens directly from GCP, eliminating the need to create, store, or rotate long-lived keys.

Exam trap

The trap here is that candidates confuse Cloud Identity Platform (which is for end-user federation) with Workload Identity Federation (which is for non-human workloads like external IdPs), leading them to pick Option A.

How to eliminate wrong answers

Option A is wrong because Cloud Identity Platform is primarily for customer-facing identity and access management (e.g., end-user authentication), not for federating external IdPs to allow them to access GCP resources as a service account. Option B is wrong because creating and sharing a service account key directly violates the requirement to avoid managing keys; it introduces long-lived credentials that must be securely stored and rotated. Option C is wrong because a VPN tunnel only provides network-level connectivity, not identity federation; it does not enable the external IdP to obtain GCP credentials or impersonate a service account.

Full explanation →
148
MCQeasy

Which Security Command Center tier provides Event Threat Detection and Container Threat Detection?

A.Both tiers
B.Standard tier
C.Premium tier
D.Neither tier, they are separate services
AnswerC

Premium tier adds these threat detection capabilities.

Why this answer

These threat detection services are available only in the Premium tier of Security Command Center. The Standard tier includes Security Health Analytics, Web Security Scanner, and Anomaly Detection. Compliance monitoring is also Premium-only.

Full explanation →
149
MCQmedium

An engineer needs to allow a specific service account from another project to access a Cloud Storage bucket in the current project. The engineer wants to use the principle of least privilege. Which IAM role should be granted directly on the bucket to the service account?

A.roles/storage.objectViewer on the bucket
B.roles/storage.legacyBucketReader on the bucket
C.roles/storage.objectAdmin on the bucket
D.roles/storage.admin on the project
AnswerA

Provides read-only access to objects, which is least privilege for reading.

Why this answer

Grant the predefined role `roles/storage.objectViewer` to the service account. This role provides read-only access to objects in the bucket.

Full explanation →
150
Multi-Selectmedium

A company is migrating a PCI DSS-compliant application to GCP. They need to meet encryption requirements for cardholder data. Which TWO options satisfy PCI DSS encryption requirements? (Choose two.)

Select 2 answers
A.Use SHA-1 for SSL certificates.
B.Use Cloud External Key Manager (EKM) with a supported partner.
C.Use default Google encryption keys (Google-managed) for data at rest.
D.Use TLS 1.2 for data in transit.
E.Use TLS 1.0 for data in transit.
AnswersB, D

Cloud EKM allows use of customer-managed keys from an external key manager, meeting PCI DSS encryption requirements.

Why this answer

PCI DSS requires strong encryption; TLS 1.2+ is required for data in transit, and CMEK for data at rest provides customer-managed keys that meet compliance.

Full explanation →
Page 1

Page 2 of 13

Page 3

All pages

12345678910111213

Practice PCSE by domain

Target a specific domain to shore up weak areas.

Configuring Access Within a Cloud Solution EnvironmentEnsuring Data ProtectionManaging Operations in a Cloud Solution EnvironmentConfiguring Network SecuritySupporting Compliance Requirements
See all domains with question counts →