Knowledge + Practice

Google Professional Cloud Security Engineer (PCSE) — Questions 226–300

960 questions total · 13pages · All types, answers revealed

Take a mock exam Exam hub

Page 4 of 13

226

MCQhard

A company uses VPC Service Controls to protect a project containing BigQuery datasets. They have an ingress rule that allows traffic from an on-premises network via a Cloud VPN tunnel. The on-premises IP range is 10.0.0.0/8. However, users on-premises are still getting access denied errors when querying BigQuery. The VPC Service Controls perimeter is in dry-run mode. What is the most likely cause?

A.The perimeter is in dry-run mode, which blocks all traffic until the rule is finalized.

B.The ingress rule does not include the on-premises user identities or service accounts.

C.The dry-run mode only applies to egress rules, not ingress.

D.Cloud VPN is not a supported access method for VPC Service Controls.

AnswerD

Cloud VPN is supported as a source network in ingress rules.

Why this answer

In dry-run mode, VPC Service Controls logs violations but does not enforce them, so a missing identity in the ingress rule would not cause access denied errors. The most likely cause is that Cloud VPN is not a supported access method for VPC Service Controls; on-premises traffic via VPN must use a different mechanism such as Private Google Access or Cloud Interconnect. Therefore, even if the ingress rule is correctly configured, the traffic from the VPN tunnel is not recognized by the perimeter, leading to denial.

Full explanation →

227

MCQeasy

A company is deploying a new application that will process credit card data and must comply with PCI DSS. They plan to use Google Cloud services. Which service should they use to detect and redact sensitive data stored in Cloud Storage buckets?

A.Cloud Key Management Service (KMS)

B.VPC Service Controls

C.Cloud Audit Logs

D.Cloud Data Loss Prevention (DLP)

AnswerD

DLP can scan and redact sensitive data.

Why this answer

Cloud Data Loss Prevention (DLP) is the correct service because it is specifically designed to inspect, classify, and redact sensitive data such as credit card numbers (PANs) in Cloud Storage buckets. It uses built-in infoType detectors (e.g., `CREDIT_CARD_NUMBER`) to identify PCI DSS-protected data and can automatically apply de-identification transformations like redaction or masking to comply with PCI DSS requirements.

Exam trap

Google Cloud often tests the distinction between data protection services that handle encryption (KMS) versus those that handle content inspection and redaction (DLP), leading candidates to mistakenly choose KMS when the question explicitly asks about detecting and redacting sensitive data.

How to eliminate wrong answers

Option A is wrong because Cloud Key Management Service (KMS) manages encryption keys for data at rest, but it does not inspect, detect, or redact sensitive data content; it only handles cryptographic operations. Option B is wrong because VPC Service Controls provide a security perimeter to prevent data exfiltration via network boundaries, but they cannot scan or redact sensitive data within storage objects. Option C is wrong because Cloud Audit Logs record administrative and access activities for compliance auditing, but they have no capability to detect or redact sensitive data fields in stored files.

Full explanation →

228

MCQmedium

A security engineer needs to ensure that all Google Cloud API calls in the organization are logged and retained for 7 years for compliance. Admin Activity logs are enabled by default but retention is limited. Which combination of actions should the engineer take?

A.Create a log sink with _Required log view filter to export Admin Activity logs to Cloud Storage with a retention policy of 7 years.

B.Create a log sink to export Admin Activity logs to BigQuery and set the table expiration to 7 years.

C.Enable Data Access logs for all services and set a custom retention period of 7 years on the log bucket.

D.Enable the 'Admin Activity logs' retention to 7 years in the Logging settings.

AnswerA

The _Required log view includes Admin Activity logs. Exporting to Cloud Storage allows archiving with retention policies.

Why this answer

Admin Activity logs are enabled by default but cannot be retained beyond the default period (400 days for audit logs). To retain for 7 years, you must use a log sink to export them to Cloud Storage (which can be configured with retention policies). BigQuery is for analysis, not archival.

The default retention cannot be changed.

Full explanation →

229

MCQmedium

A company runs a containerized application on Google Kubernetes Engine (GKE) that reads from a Cloud Storage bucket encrypted with a customer-managed key (CMEK) in Cloud KMS. The application uses a dedicated Google service account with the roles/storage.objectViewer role and a Cloud KMS CryptoKey Decrypter binding on the key. After a scheduled key rotation, the application started receiving '403 Access Denied' errors when accessing objects. The Cloud KMS key has multiple versions. The service account's IAM permissions have not changed. What is the most likely cause and the appropriate fix?

A.In Cloud KMS, enable the new key version and ensure it is set as primary.

B.Create a new key ring and migrate the service account to use a new key.

C.Disable the old key version and re-encrypt all objects with the new key version.

D.Ensure the service account has the 'Cloud KMS CryptoKey Decrypter' role on the key, which applies to all key versions, including the old version used for encryption.

AnswerD

The role on the key grants access to all versions; if it was previously granted only on a specific version, the old version may have lost access during rotation.

Why this answer

In Cloud KMS, IAM permissions are evaluated at the key level, not per key version. When a key is rotated, the new primary version is automatically enabled, but the old version remains active for decrypting data encrypted with it. The service account already has the 'Cloud KMS CryptoKey Decrypter' role on the key, which grants permission to decrypt with any version of that key.

The 403 error likely occurred because the application's client library or configuration was explicitly referencing the old key version ID, which may have been disabled or is no longer primary, but the IAM binding on the key itself is sufficient. The fix is to ensure the service account has the role on the key (which it does) and that the application uses the key resource name (not a specific version) to allow automatic use of the correct version.

Exam trap

Google Cloud often tests the misconception that key rotation requires updating IAM permissions or that old key versions become unusable, when in fact IAM bindings on the key cover all versions and old versions remain active for decryption unless explicitly disabled.

How to eliminate wrong answers

Option A is wrong because enabling a new key version and setting it as primary does not fix a permission issue; the new version is already enabled by default upon rotation, and the problem is not about version availability but about how the application references the key. Option B is wrong because creating a new key ring and migrating the service account is unnecessary and disruptive; the existing key ring and key are still valid, and the service account's permissions on the key are unchanged. Option C is wrong because disabling the old key version would break decryption of objects still encrypted with that version, and re-encrypting all objects is an extreme, unnecessary step that does not address the root cause of the 403 error, which is a permission or configuration issue, not a key version mismatch.

Full explanation →

230

MCQmedium

A company uses Cloud Functions with a service account that has the role 'roles/cloudfunctions.invoker' to allow unauthenticated invocation. They want to change this so that only authenticated requests from a specific Cloud Scheduler job can invoke the function. The Cloud Scheduler job runs in the same project and uses a service account with the role 'roles/cloudscheduler.serviceAgent'. The security engineer updates the Cloud Function's ingress settings to 'Allow internal traffic only' and removes the 'allUsers' invoker binding. However, the Cloud Scheduler job now fails with a 403 error. What should the engineer do to fix this?

A.Grant the Cloud Scheduler's service account the role 'roles/cloudfunctions.invoker' on the Cloud Function.

B.Add 'allAuthenticatedUsers' as an invoker to the Cloud Function.

C.Change the ingress setting to 'Allow all traffic'.

D.Set the Cloud Function's ingress setting to 'Allow internal traffic only' and ensure the Cloud Scheduler job's region is the same as the function's region.

AnswerA

This grants the specific service account permission to invoke the function.

Why this answer

A is correct because the Cloud Scheduler job uses a service account to authenticate its requests. By default, Cloud Scheduler does not automatically have permission to invoke a Cloud Function. Granting the Cloud Scheduler's service account the 'roles/cloudfunctions.invoker' role on the Cloud Function explicitly authorizes that identity to invoke the function, even when the function's ingress is set to 'Allow internal traffic only' and the 'allUsers' binding is removed.

Exam trap

Google Cloud often tests the misconception that internal traffic settings alone control access, when in fact IAM permissions are always required for authenticated invocation, and 'Allow internal traffic only' only restricts network-level access, not IAM authorization.

How to eliminate wrong answers

Option B is wrong because adding 'allAuthenticatedUsers' would allow any authenticated Google Cloud identity (including users outside the project) to invoke the function, which does not restrict invocation to only the specific Cloud Scheduler job. Option C is wrong because changing the ingress setting to 'Allow all traffic' would allow requests from the internet, defeating the purpose of restricting to internal traffic and the specific scheduler job. Option D is wrong because ensuring the same region does not resolve the 403 error; the error is due to missing IAM permissions on the Cloud Function, not a regional mismatch.

Full explanation →

231

MCQhard

A financial services company is deploying a multi-region application on Google Kubernetes Engine (GKE) and needs to comply with PCI DSS. They must ensure that cardholder data is encrypted in transit between pods in different clusters. What is the MOST secure way to achieve this?

A.Configure TLS for each service using a Cloud Load Balancing with SSL policies.

B.Enable Anthos Service Mesh with mutual TLS (mTLS) across clusters.

C.Use HTTPS between services by configuring ingress with a Google-managed SSL certificate.

D.Use VPC Network Peering to connect the clusters and rely on the internal network encryption.

AnswerB

mTLS in a service mesh provides encryption and authentication for inter-pod traffic.

Why this answer

Anthos Service Mesh with mutual TLS (mTLS) provides authenticated and encrypted communication between pods across different GKE clusters, meeting PCI DSS encryption-in-transit requirements. mTLS ensures that each side of the connection presents a certificate, verifying identity and encrypting traffic at the application layer, which is more secure than relying solely on network-level encryption. This approach also integrates with GKE's multi-cluster service mesh capabilities, allowing fine-grained policy enforcement across clusters.

Exam trap

Google Cloud often tests the misconception that network-level encryption (e.g., VPC peering or internal Google Cloud encryption) is sufficient for compliance, but PCI DSS requires application-layer encryption (e.g., TLS/mTLS) for cardholder data in transit between pods.

How to eliminate wrong answers

Option A is wrong because configuring TLS for each service using Cloud Load Balancing with SSL policies only encrypts traffic at the load balancer edge, not between pods in different clusters; internal pod-to-pod traffic would remain unencrypted unless additional measures are taken. Option C is wrong because using HTTPS between services by configuring ingress with a Google-managed SSL certificate only secures external ingress traffic, not east-west traffic between pods across clusters. Option D is wrong because VPC Network Peering provides network connectivity but does not inherently encrypt traffic between pods; it relies on Google's internal network encryption, which may not satisfy PCI DSS's explicit requirement for application-layer encryption of cardholder data in transit.

Full explanation →

232

MCQmedium

An organization uses Security Command Center Premium tier. They want to receive notifications when a finding of type 'Cryptomining' is detected in their Compute Engine instances. What should they configure?

A.Container Threat Detection and an email alert

B.Security Health Analytics and a Cloud Storage bucket

C.Web Security Scanner and a Cloud Function

D.Event Threat Detection and a Pub/Sub notification config

AnswerD

Event Threat Detection (Premium) identifies cryptomining activity, and a notification config sends findings to Pub/Sub.

Why this answer

Event Threat Detection (Premium) detects cryptomining. You set up a notification config in SCC to send findings of that type to Pub/Sub.

Full explanation →

233

MCQeasy

What is the purpose of Cloud HSM?

A.To manage secrets such as API keys and passwords

B.To provide FIPS 140-2 Level 3 validated hardware security for key material

C.To automatically rotate encryption keys

D.To encrypt data at rest using Google-managed keys

AnswerB

Cloud HSM provides hardware-backed key storage with FIPS 140-2 Level 3 validation.

Why this answer

Cloud HSM is a managed hardware security module (HSM) service that provides FIPS 140-2 Level 3 validated security for cryptographic keys. It allows you to generate, store, and manage keys in a tamper-resistant hardware device.

Full explanation →

234

Multi-Selectmedium

Which TWO of the following are valid methods for sending traffic between VPC networks in Google Cloud? (Choose two.)

Select 2 answers

A.Firewall rules in each VPC

B.Subnet routes

C.Cloud VPN (HA VPN gateway)

D.Cloud NAT

E.VPC Network Peering

AnswersC, E

Correct: creates encrypted tunnels between VPCs.

Why this answer

Cloud VPN (HA VPN gateway) is a valid method for sending traffic between VPC networks because it creates an encrypted tunnel over the public internet using IPsec (IKEv2) to connect two VPCs or an on-premises network to a VPC. It supports dynamic routing via BGP, allowing traffic to flow between VPCs when each VPC has a VPN gateway and the appropriate tunnel configurations.

Exam trap

The trap here is that candidates confuse Cloud NAT or firewall rules as a method for inter-VPC connectivity, when in fact they serve entirely different purposes (outbound NAT and access control, respectively) and cannot route traffic between separate VPC networks.

Full explanation →

235

MCQmedium

A company processes personal data of European Union residents on GCP. They need to ensure that data processing is limited to specific purposes and that data subjects can exercise their rights (access, rectification, erasure). Which actions should they take to comply with GDPR?

A.Use Assured Workloads with EU Regions and Support and enable Access Transparency.

B.Enable data encryption with CMEK and sign a DPA with Google.

C.Sign a DPA with Google, implement data subject request workflows, and use Cloud DLP to classify personal data.

D.Enable VPC Service Controls and restrict data access to EU regions.

AnswerC

DPA is required; data subject rights must be supported; DLP helps identify personal data for compliance actions.

Why this answer

To comply with GDPR, the company must sign a Data Processing Agreement (DPA) with Google, implement data subject rights (like deletion), and document processing purposes. Encryption is encouraged but not a specific GDPR requirement listed in the options.

Full explanation →

236

MCQhard

You have a Compute Engine VM that hosts a custom application. The VM has a tag 'app-server' and is in a VPC network with the following firewall rules (priority order from lowest to highest): Rule 1: Priority 1000, direction INGRESS, source 0.0.0.0/0, target tag 'app-server', protocol tcp:80, action allow Rule 2: Priority 500, direction INGRESS, source 10.0.0.0/8, target tag 'app-server', protocol tcp:80, action deny Rule 3: Priority 2000, direction INGRESS, source 192.168.0.0/16, target tag 'app-server', protocol tcp:80, action allow A user from IP 10.0.0.5 tries to access the application on port 80. Will the request be allowed or denied?

A.Denied, because Rule 2 has a lower priority number and explicitly denies traffic from 10.0.0.0/8

B.Denied, because Rule 3 has a higher priority number and denies traffic from 192.168.0.0/16

C.Allowed, because Rule 1 has a lower priority number and allows all traffic

D.Allowed, because Rule 3 has a higher priority number and allows traffic from 192.168.0.0/16

AnswerA

Correct: Rule 2 has priority 500, which is evaluated before Rule 1 (1000) and Rule 3 (2000). Since it matches, the deny action is applied.

Why this answer

Rule 2 has a priority of 500, which is lower (higher priority) than Rule 1 (priority 1000) and Rule 3 (priority 2000). Since the source IP 10.0.0.5 falls within the 10.0.0.0/8 range, Rule 2 matches first and explicitly denies the traffic. In Google Cloud VPC firewall rules, lower priority numbers are evaluated first, and the first matching rule determines the action.

Exam trap

Google Cloud often tests the misconception that higher priority numbers mean higher precedence, but in Google Cloud VPC firewall rules, lower numeric priority values are evaluated first, so candidates must remember that priority 500 is evaluated before priority 1000.

How to eliminate wrong answers

Option B is wrong because Rule 3 has a higher priority number (2000) and allows traffic from 192.168.0.0/16, but the source IP is 10.0.0.5, which does not match that range; also, Rule 2 with lower priority already denies the traffic. Option C is wrong because Rule 1 has a higher priority number (1000) than Rule 2 (500), so Rule 2 is evaluated first and denies the traffic before Rule 1 is considered. Option D is wrong because Rule 3 has the highest priority number (2000) and applies to a different source range (192.168.0.0/16), so it does not affect traffic from 10.0.0.5.

Full explanation →

237

MCQmedium

A global e-commerce company is using Google Cloud to store customer data subject to GDPR. They have implemented data residency controls to keep data within the EU. However, during a routine audit, the compliance team discovers that some backups of customer data are being replicated to a US region due to a misconfigured backup policy. The data includes personal information. The company must ensure that all data remains within the EU. What should the team do to prevent this from recurring and remediate the current situation?

A.Delete the backups in the US region immediately and reconfigure the backup policy to only use EU regions.

B.Enable Access Transparency for the US backups to monitor access.

C.Use Organization Policies to enforce a constraint that disables the creation of resources outside the EU, and then delete the US backups.

D.Encrypt the US backups with CMEK and leave them in place, as encryption satisfies GDPR.

AnswerC

Enforces data residency and remediates current non-compliance.

Why this answer

Organization Policies allow the company to enforce a resource location constraint (e.g., `constraints/gcp.resourceLocations`), which prevents the creation of any Google Cloud resources outside the EU. This proactively stops misconfigured backups from being replicated to non-EU regions. Deleting the US backups after applying the policy remediates the current GDPR violation by removing the non-compliant data.

Exam trap

Google Cloud often tests the distinction between reactive fixes (deleting data) and proactive controls (Organization Policies), leading candidates to choose Option A because it seems immediate, while overlooking the need for a preventive guardrail.

How to eliminate wrong answers

Option A is wrong because simply deleting the US backups and reconfiguring the policy does not prevent future misconfigurations; it lacks a preventive control like an Organization Policy constraint. Option B is wrong because Access Transparency only logs access to data, it does not prevent data from being stored outside the EU or remediate the existing non-compliance. Option D is wrong because encryption with CMEK does not satisfy GDPR's data residency requirements; GDPR mandates that personal data must remain within the EU, and encryption alone does not change the physical location of the data.

Full explanation →

238

Multi-Selecteasy

A company needs to detect and redact sensitive data such as email addresses and phone numbers from documents stored in Cloud Storage. They plan to use Cloud DLP. Which two resources must they create first? (Choose TWO).

Select 2 answers

A.A DLP job trigger

B.A de-identification template with a redaction transform (e.g., MaskingConfig)

C.An inspection template with infoTypes EMAIL_ADDRESS and PHONE_NUMBER

D.A Cloud KMS key ring

E.A BigQuery dataset

AnswersB, C

The de-identification template specifies how to redact the detected data.

Why this answer

To use Cloud DLP for scanning and redacting, you need two templates: an inspection template that defines what to look for (infoTypes like EMAIL_ADDRESS, PHONE_NUMBER) and a de-identification template that defines how to redact the sensitive data (e.g., using MaskingConfig). Option C is the inspection template, and option B is the de-identification template. You can then create a DLP job that references both templates and targets the Cloud Storage bucket.

A job trigger is for scheduled scans, not mandatory for a one-time job. A key ring is not directly needed for DLP.

Full explanation →

239

MCQmedium

Your organization wants to use Chronicle SIEM to analyze security events from both Google Cloud and on-premises firewalls. They want to normalize firewall logs into a common schema. Which Chronicle feature should they use?

A.Log forwarder

B.Investigation timeline

C.YARA-L rules

D.Unified Data Model (UDM)

AnswerD

UDM normalizes logs into a standard schema regardless of source.

Why this answer

Chronicle's Unified Data Model (UDM) normalizes logs from different sources into a common schema, making it easier to search and analyze. Forwarders can send logs, but normalization is done via UDM parsing.

Full explanation →

240

MCQhard

For PCI DSS compliance, which of the following is required for Cloud KMS keys?

A.Enable automatic rotation with a rotation period set to 90 days

B.Use a separate key per service account

C.Disable key rotation after initial use

D.Key rotation every 30 days

AnswerA

Automatic rotation with a defined period satisfies PCI DSS key rotation requirements.

Why this answer

PCI DSS requirement 3.5.1 mandates that cryptographic keys must be rotated at least every 90 days to limit the impact of a potential key compromise. For Cloud KMS, enabling automatic rotation with a rotation period of 90 days ensures compliance by automating the key rotation process without manual intervention, reducing the risk of human error.

Exam trap

Google Cloud often tests the exact PCI DSS requirement of 90-day rotation, and candidates may mistakenly choose 30 days (option D) thinking more frequent rotation is better, but the question asks for what is 'required', not what is 'allowed'.

How to eliminate wrong answers

Option B is wrong because PCI DSS does not require a separate key per service account; it requires that keys be unique per environment or per function, but a single key can be shared among multiple service accounts if access controls are properly enforced. Option C is wrong because disabling key rotation after initial use violates PCI DSS requirement 3.5.1, which mandates periodic rotation at least every 90 days. Option D is wrong because while 30-day rotation would also meet the PCI DSS requirement, the question specifically asks for the required rotation period, and 90 days is the maximum allowed interval; 30 days is more frequent than required but not incorrect, however the correct answer must match the exact requirement stated in the standard.

Full explanation →

241

MCQmedium

An engineer wants to allow egress traffic from a group of VM instances with a specific service account to a set of IP addresses. They need to choose between using tags or service accounts as targets in a VPC firewall rule. Which approach is recommended for better security and why?

A.Use tags because they are easier to manage and provide the same level of security as service accounts.

B.Use target tags with a network tag that is automatically assigned by a management tool.

C.Either is acceptable; Google recommends using tags for simplicity.

D.Use service accounts because they are managed by IAM and provide a stronger identity-based security model.

AnswerD

Service accounts are IAM-controlled and tied to VM identity, making them more secure.

Why this answer

Service account targets are preferred because they are more secure. Tags can be added or removed by anyone with compute.instances.setTags permission, while service accounts are managed centrally with IAM. Using service accounts ensures that the firewall rule applies based on the identity of the VM, which is harder to spoof.

Full explanation →

242

MCQhard

User user1@domain.com tries to SSH into a Compute Engine instance that has the service account sa1@project.iam.gserviceaccount.com attached. Will the SSH connection succeed? (Assume no other policies)

A.No, because user1 lacks compute.instances.osLogin permission.

B.No, because user1 needs a role such as compute.osLogin to SSH into the instance.

C.Yes, because user1 has iam.serviceAccountUser role on the service account, which is required to use it.

D.Yes, because user1 has compute.viewer role.

AnswerB

The compute.osLogin role (or compute.osAdminLogin) is required for SSH access via OS Login.

Why this answer

SSH access to a Compute Engine instance requires the user to have the compute.osLogin role (or a role that includes compute.instances.osLogin permission) when OS Login is enabled. Without OS Login, the user needs the compute.instances.setMetadata permission to add SSH keys. The service account attached to the instance does not grant SSH access; it only allows the instance to authenticate to Google Cloud APIs.

User1 has no relevant IAM roles for SSH, so the connection will fail.

Exam trap

Google Cloud often tests the misconception that having the iam.serviceAccountUser role on a service account attached to an instance grants SSH access, when in reality it only allows impersonation of the service account for API calls, not interactive login.

How to eliminate wrong answers

Option A is wrong because the permission compute.instances.osLogin is part of the compute.osLogin role, but the question states no other policies, and the user lacks any role that includes this permission; the issue is the missing role, not just the permission name. Option C is wrong because the iam.serviceAccountUser role only allows the user to impersonate the service account (e.g., use it for API calls), not to SSH into the instance; SSH access requires separate compute instance permissions. Option D is wrong because the compute.viewer role provides read-only access to instance metadata and does not grant any SSH-related permissions such as osLogin or setMetadata.

Full explanation →

243

Multi-Selecthard

An organization wants to ensure that only compute instances in a specific VPC can access a Cloud Storage bucket. They also want to prevent the bucket data from being downloaded to an external IP. Which TWO services should they combine? (Choose TWO.)

Select 2 answers

A.IAM conditions restricting access by VPC network

B.Cloud NAT

C.Cloud VPN

D.Private Google Access

E.VPC Service Controls

AnswersA, E

IAM conditions can use the `request.network` attribute to allow access only from a specific VPC network.

Why this answer

IAM conditions allow you to restrict access to a Cloud Storage bucket based on the requester's VPC network, ensuring only compute instances in that specific VPC can access the bucket. VPC Service Controls create a security perimeter around the bucket, preventing data exfiltration to external IPs by blocking unauthorized network paths. Together, they enforce both network-level access restriction and data download prevention.

Exam trap

Google Cloud often tests the misconception that Private Google Access alone can restrict access to a specific VPC, but it only enables connectivity without any access control or exfiltration prevention.

Full explanation →

244

MCQeasy

A company uses Cloud Audit Logs for compliance and needs to ensure that logs are not tampered with. Which feature should they enable?

A.Store logs in Cloud Logging with default retention.

B.Enable Access Transparency logs for the project.

C.Use Cloud Key Management Service to sign audit logs.

D.Set up multiple log sinks to different destinations.

AnswerC

Correct: Cloud KMS can be used to cryptographically sign audit logs. This creates a signature that can be verified later to detect any modifications, ensuring log integrity.

Why this answer

Cloud Key Management Service (Cloud KMS) can be used to sign audit logs, providing a cryptographic integrity check that ensures logs have not been tampered with. Signed logs allow verification of their authenticity and detect any unauthorized changes. Option A is wrong because default retention in Cloud Logging does not prevent tampering; it only sets how long logs are kept.

Option B is wrong because Access Transparency logs record actions by Google personnel, but they do not directly prevent tampering of Cloud Audit Logs. Option D is wrong because sending logs to multiple destinations increases redundancy but does not protect against tampering.

Full explanation →

245

Multi-Selecteasy

A company wants to use Google Cloud Directory Sync (GCDS) to synchronize users and groups from an on-premises Active Directory to Cloud Identity. Which two prerequisites must be met? (Choose two.)

Select 2 answers

A.A service account with the Directory Sync role.

B.An organization policy that allows directory sync.

C.A Cloud Identity or Google Workspace account with super admin privileges.

D.A Compute Engine VM to run the GCDS service.

E.Network connectivity from the GCDS server to the Google servers.

AnswersC, E

GCDS requires super admin credentials to synchronize directory data.

Why this answer

Google Cloud Directory Sync (GCDS) requires a Cloud Identity or Google Workspace account with super admin privileges (Option C) to authenticate and perform synchronization. Additionally, the GCDS server must have network connectivity to Google servers (Option E) to access the Google API endpoints for directory sync.

Full explanation →

246

MCQhard

A company has a Google Cloud organization with several hundred projects. They are using VPC Service Controls to protect sensitive data in BigQuery. They have a service perimeter that includes the projects containing the sensitive datasets. Users in a separate perimeter (perimeter B) need to query a BigQuery dataset in the sensitive perimeter using federated queries from Cloud SQL. The users are authenticated via Cloud Identity and have appropriate IAM roles, but queries are failing. The Cloud SQL instance is in perimeter B. What is the most likely cause?

A.The sensitive perimeter does not have an ingress rule to allow requests from the Cloud SQL service in perimeter B.

B.The Cloud SQL instance must be moved into the sensitive perimeter to access BigQuery.

C.The users do not have the appropriate IAM role on the BigQuery dataset.

D.The BigQuery dataset does not have a corresponding table for export to Cloud SQL.

AnswerA

An ingress rule is required to allow traffic from outside the perimeter.

Why this answer

VPC Service Controls enforce perimeters that block all data access across perimeter boundaries by default. For a Cloud SQL instance in perimeter B to query BigQuery in the sensitive perimeter via federated queries, the sensitive perimeter must have an ingress rule explicitly allowing requests from the Cloud SQL service (or the VPC network) in perimeter B. Without this ingress rule, the request is denied at the perimeter boundary, regardless of IAM permissions.

Exam trap

Google Cloud often tests the distinction between IAM permissions and VPC Service Controls perimeter rules, leading candidates to incorrectly attribute the failure to missing IAM roles when the real issue is the absence of an ingress rule in the perimeter.

How to eliminate wrong answers

Option B is wrong because moving the Cloud SQL instance into the sensitive perimeter would violate the requirement that users in perimeter B need to query the dataset; it also unnecessarily exposes the Cloud SQL instance to the sensitive perimeter's restrictions. Option C is wrong because the question states users have appropriate IAM roles, and the failure is due to perimeter enforcement, not IAM. Option D is wrong because BigQuery federated queries from Cloud SQL do not require a corresponding table for export; the query is executed directly against BigQuery datasets via the BigQuery federated query feature.

Full explanation →

247

MCQmedium

A company has configured a HA VPN between Google Cloud and an on-premises data center using two tunnels with separate Cloud Routers and BGP sessions in active/active mode. Each Cloud Router is configured to learn routes from the on-premises side and advertise VPC subnets. Recently, one of the tunnels experienced a physical link failure and went down. The security team notices that the remaining tunnel is still up and passing traffic, but some routes that were learned via the failed tunnel are no longer present in the routing table of that Cloud Router. The on-premises administrator confirms that the routes are still being advertised from the local router. What is the impact on traffic to the on-premises network?

A.The failed tunnel will automatically be restored by BGP when the link comes back.

B.The Cloud Router will initiate a failover to a secondary BGP session.

C.Traffic destined to subnets only reachable via the failed tunnel will be dropped.

D.All traffic will continue to flow through the remaining tunnel without any disruption.

AnswerC

The missing routes mean those destinations are unreachable until the tunnel recovers or routes are learned via the other tunnel.

Why this answer

In an active/active HA VPN with separate Cloud Routers and BGP sessions, each Cloud Router maintains its own independent routing table. When a tunnel fails, the BGP session associated with that Cloud Router goes down, causing all routes learned via that session to be withdrawn. Even though the on-premises router continues to advertise the routes, the Cloud Router that lost its BGP session will no longer have those routes in its routing table.

Traffic destined to subnets that were only reachable through the failed tunnel will be dropped because the remaining Cloud Router does not have a route for those subnets.

Exam trap

Google Cloud often tests the misconception that active/active HA VPN provides full redundancy for all routes, but in reality, each Cloud Router independently learns routes, and a tunnel failure only drops traffic to subnets unique to that tunnel's BGP session.

How to eliminate wrong answers

Option A is wrong because BGP does not automatically restore a failed tunnel; the tunnel is a separate VPN construct that must be re-established by the underlying IPsec/IKE mechanisms, and BGP only re-establishes the session after the tunnel is up. Option B is wrong because there is no secondary BGP session to failover to; each Cloud Router runs its own independent BGP session, and the failure of one tunnel does not trigger a failover to another session on the same router. Option D is wrong because not all traffic will continue to flow; only traffic to subnets that are reachable via both tunnels will continue, while traffic to subnets unique to the failed tunnel will be dropped.

Full explanation →

248

MCQmedium

A company uses VPC Service Controls to protect data in BigQuery and Cloud Storage. They need to allow a third-party application running outside the service perimeter to query BigQuery datasets within the perimeter. What should they configure?

A.Use private Google Access with a VPC network to allow the third-party.

B.Grant the third-party project access to the perimeter via an access level.

C.Create a service perimeter bridge between the third-party project and the protected project.

D.Set up a VPC peering connection between the third-party VPC and the VPC hosting the resources.

AnswerB

Access levels can be used to allow ingress from external identities or IPs.

Why this answer

VPC Service Controls use access levels to define which client identities, IP addresses, or device characteristics are allowed to access protected resources from outside the service perimeter. By configuring an access level that includes the third-party application's project or IP range, the company can grant explicit, policy-based access to BigQuery datasets without removing the perimeter's data exfiltration protections.

Exam trap

The trap here is that candidates confuse VPC peering or Private Google Access with VPC Service Controls, assuming network-level connectivity is sufficient to bypass API-level perimeter enforcement, when in fact only access levels or perimeter membership can grant external access.

How to eliminate wrong answers

Option A is wrong because Private Google Access enables on-premises or VM instances to reach Google APIs via internal IPs, but it does not bypass VPC Service Controls; the third-party application still needs an access level to be allowed through the perimeter. Option C is wrong because a service perimeter bridge connects two perimeters to allow controlled resource sharing between them, but the third-party application is outside any perimeter, so a bridge does not apply. Option D is wrong because VPC peering connects two VPC networks for private IP communication, but it does not grant access to BigQuery datasets protected by VPC Service Controls, which operate at the API layer and require access levels or perimeter membership.

Full explanation →

249

MCQeasy

A security engineer needs to audit all attempts to access a Cloud Storage bucket, including successful and failed attempts. Which logging option should they enable?

A.Cloud Audit Logs with Data Access

B.Cloud Audit Logs with Admin Read

C.Cloud Monitoring with uptime checks

D.VPC Flow Logs

AnswerA

Data Access logs record all read and write operations on objects, including successful and failed attempts.

Why this answer

Cloud Audit Logs with Data Access logs capture read/write operations on data. Admin Read logs only record configuration changes, not data access. Cloud Monitoring is for metrics, not logs.

VPC Flow Logs are for network traffic, not object-level access.

Full explanation →

250

Multi-Selecthard

A company is designing a secure multi-tenant environment in Google Cloud. Each tenant has its own VPC network and resources. The security team wants to centrally enforce a rule that denies all egress traffic to the internet from tenant VPCs, except for traffic to specific trusted IP ranges for software updates. They also want to ensure that tenant admins cannot override this rule. Which two actions should they take? (Choose two.)

Select 2 answers

A.Create a hierarchical firewall policy at the folder level that denies egress to 0.0.0.0/0 except for the trusted IP ranges.

B.Restrict tenant admins from modifying hierarchical firewall policies by not granting the compute.firewallPolicies.create/update/delete permissions at the organization or folder level.

C.Grant tenant admins the compute.securityAdmin role to manage firewall rules.

D.Use VPC Service Controls to block egress traffic.

E.Create a VPC firewall rule in each tenant project to deny egress traffic.

AnswersA, B

Hierarchical policies apply to all projects below and cannot be overridden by VPC firewall rules.

Why this answer

Hierarchical firewall policies are inherited and cannot be overridden at lower levels. They can be used to enforce mandatory rules. The organization can create a hierarchical firewall policy at the organization or folder level that denies all egress to 0.0.0.0/0 except for the trusted IP ranges.

Additionally, to prevent tenant admins from overriding, they should not grant them the compute.firewallPolicies.update permission or similar. The correct choices are: create a hierarchical firewall policy and restrict permissions to modify firewall policies.

Full explanation →

251

MCQeasy

What is the purpose of Identity-Aware Proxy (IAP) in Google Cloud?

A.To manage API keys for services running on Google Cloud.

B.To authenticate users and enforce access policies for applications and VMs based on identity and context.

C.To provide network-level firewall rules for HTTP traffic.

D.To encrypt data in transit between clients and Google Cloud.

AnswerB

IAP uses identity and context to control access, aligning with zero-trust principles.

Why this answer

IAP provides zero-trust access control for web applications and SSH/RDP connections. It verifies user identity and context (device, location) before granting access, without requiring VPNs.

Full explanation →

252

MCQmedium

An organization uses Cloud Directory Sync to synchronize users from on-premises Active Directory to Cloud Identity. After syncing, a user reports they cannot access a Google Cloud project even though they are a member of the correct AD group. The group has been assigned the roles/compute.admin role on the project. What is the most likely cause?

A.The role was assigned at the organization level instead of the project level

B.The user needs to log out and log back in to refresh their session

C.The user is not a direct member of the group; they are a nested group member

D.The group was not synced as a Google Group; only users were synced

AnswerD

If the group object is not synced, the IAM policy binding to the group will have no effect because the group does not exist in Cloud Identity.

Why this answer

Cloud Directory Sync synchronizes users and groups, but group membership changes may take time to propagate. Additionally, the group must be synced as a Google Group or Cloud Identity group with the proper membership synced. If the group is not recognized in Cloud Identity, the IAM binding will not apply to the users.

Full explanation →

253

MCQhard

A company has a Google Cloud organization with multiple folders representing departments. The security team wants to enforce that all Compute Engine VMs in the organization must have Shielded VM enabled. Which approach should the team use to enforce this requirement?

A.Use VPC Service Controls to restrict VM creation.

B.Apply an organization policy with the constraint constraints/compute.requireShieldedVm at the organization level.

C.Create a deny policy that denies the compute.instances.create permission unless Shielded VM is enabled.

D.Configure a custom role that includes the permission to create VMs only if Shielded VM is enabled.

AnswerB

This enforces Shielded VM across all projects.

Why this answer

Organization policies with constraints can be applied at the organization level and are inherited by all descendants. The constraint constraints/compute.requireShieldedVm enforces Shielded VM on all new VMs. Deny policies are for IAM permissions, not resource configurations.

VPC Service Controls is for data exfiltration prevention.

Full explanation →

254

Multi-Selectmedium

A company wants to protect a web application hosted on Google Cloud from common web attacks like SQL injection and cross-site scripting (XSS). They have deployed a global external HTTPS load balancer. Which TWO services or configurations should they use?

Select 2 answers

A.Cloud Armor security policy with OWASP ModSecurity CRS rule set

B.HTTPS load balancer (already in place)

C.SSL policy with RESTRICTED profile

D.VPC Service Controls

E.Cloud IDS

AnswersA, B

Cloud Armor includes preconfigured rules for SQLi, XSS, etc.

Why this answer

Cloud Armor provides WAF capabilities with preconfigured rules for OWASP Top 10 threats, including SQLi and XSS. Additionally, using an HTTPS load balancer ensures encrypted traffic. For this question, the correct answers are Cloud Armor and enabling HTTPS (which is already done).

But since the load balancer is already HTTPS, the focus is on Cloud Armor. The other options: Cloud IDS is for network threat detection, not WAF; VPC Service Controls is for API access control; SSL policy is for TLS settings.

Full explanation →

255

MCQeasy

Which Google Cloud compliance certification is most relevant for a company that processes credit card transactions and needs to demonstrate secure handling of cardholder data?

A.SOC 2 Type II

B.PCI DSS

C.ISO 27001

D.FedRAMP

AnswerB

PCI DSS is the standard for handling credit card data.

Why this answer

PCI DSS is the Payment Card Industry Data Security Standard, specifically for organizations that handle credit card data. ISO 27001 is an information security management standard, SOC reports are for service organization controls, and FedRAMP is for federal cloud computing.

Full explanation →

256

MCQhard

A company connects their on-premises data center to Google Cloud via Dedicated Interconnect. They have two VLAN attachments (VLAN-A and VLAN-B) to a single VPC. They use BGP over the VLAN attachments with Cloud Router. Both VLAN attachments are in the same region. They want to use both links for active-active traffic and have redundancy. Which BGP configuration is correct?

A.Use a different BGP ASN for each VLAN attachment.

B.Use a single VLAN attachment and rely on link redundancy.

C.Set different MED values for each BGP session to load-balance.

D.Use the same BGP ASN and same MED for both VLAN attachments, and enable ECMP on Cloud Router.

AnswerD

Correct: this allows equal-cost multipath, active-active.

Why this answer

For active-active traffic with two VLAN attachments to the same VPC in the same region, you must use the same BGP ASN on both sessions and enable ECMP (Equal Cost Multi-Path) on Cloud Router. This allows Cloud Router to install multiple equal-cost routes from both BGP sessions, enabling load balancing across both links. Using the same MED value ensures the routes are considered equal, which is required for ECMP to function correctly.

Exam trap

Google Cloud often tests the misconception that different BGP ASNs or MED values are needed for load balancing, but in Google Cloud's Dedicated Interconnect with Cloud Router, active-active requires identical ASN and MED plus explicit ECMP enablement.

How to eliminate wrong answers

Option A is wrong because using a different BGP ASN for each VLAN attachment would cause Cloud Router to treat the routes as coming from different autonomous systems, preventing ECMP from load-balancing across them; Cloud Router requires the same ASN to consider routes as equal-cost candidates. Option B is wrong because a single VLAN attachment does not provide link-level redundancy; you need two separate attachments to protect against failure of one attachment or its underlying circuit. Option C is wrong because setting different MED values would make one route preferred over the other, breaking active-active load balancing; ECMP requires equal MED values to treat routes as equal-cost.

Full explanation →

257

MCQhard

A financial services company must encrypt data at rest in Cloud Storage using keys that are generated and stored on-premises, and Google must never have access to the key material. Which encryption approach should they use?

A.Cloud External Key Manager (EKM) with a key management partner

B.Customer-supplied encryption keys (CSEK)

C.Default Google-managed encryption (GMEK)

D.Customer-managed encryption keys (CMEK) using Cloud KMS

AnswerB

CSEK keys are provided per API call and never stored by Google.

Why this answer

CSEK (Customer-Supplied Encryption Keys) allows you to provide your own keys with each API call, and Google does not store them. This meets the requirement that Google never has access to key material.

Full explanation →

258

Multi-Selectmedium

Which THREE are requirements for HIPAA compliance when using Google Cloud? (Choose three.)

Select 3 answers

A.Use Dedicated Interconnect for network connectivity

B.Enable Data Loss Prevention (DLP) for all data

C.Enable audit logging for all PHI-related activities

D.Sign a Business Associate Agreement (BAA) with Google

E.Encrypt data at rest and in transit using appropriate algorithms

AnswersC, D, E

Audit logs are necessary to track access and changes to PHI.

Why this answer

HIPAA requires covered entities to implement audit controls that record and examine access and other activity in information systems that contain or use electronic protected health information (ePHI). In Google Cloud, enabling audit logging for all PHI-related activities, such as via Cloud Audit Logs (Admin Activity, Data Access, and System Event logs), satisfies this requirement by providing an immutable, tamper-evident record of who accessed what data and when.

Exam trap

Google Cloud often tests the misconception that HIPAA mandates specific technologies (like Dedicated Interconnect or DLP for all data), when in reality HIPAA is technology-neutral and focuses on implementing reasonable and appropriate safeguards, such as encryption and audit logging.

Full explanation →

259

MCQhard

A company uses a shared VPC with multiple service projects. A security administrator created an organization policy with the constraint 'gcp.resourceLocations' to restrict Cloud SQL instance creation to only the 'us-central1' region. The policy is applied at the organization level. A Cloud SQL administrator is using a service account with the predefined role 'roles/cloudsql.admin' (also granted at the organization level) to create instances. Despite the organization policy, the service account successfully creates a Cloud SQL instance in the 'europe-west1' region. The administrator verifies that the organization policy is active and the constraint is enforced. What is the most likely reason the policy is not preventing the creation?

A.The organization policy is set to 'dry-run' mode, so it logs violations but does not deny the operation.

B.The organization policy is applied at the organization level, but the service account's permissions are also at the organization level, causing an override.

C.The service account has the 'Organization Policy Administrator' role, which allows it to bypass constraints.

D.The gcp.resourceLocations constraint does not apply to Cloud SQL instances.

AnswerA

Correct: In dry-run mode, the policy is not enforced, only audited.

Why this answer

The organization policy constraint 'gcp.resourceLocations' can be set to 'dry-run' mode, which logs violations but does not deny the operation. In this scenario, the policy is active and enforced, but if it is in dry-run mode, it will not block the creation of Cloud SQL instances in non-compliant regions. The service account's successful creation in 'europe-west1' indicates that the policy is not actively denying the request, which aligns with dry-run behavior.

Exam trap

Google Cloud often tests the distinction between policy enforcement modes (dry-run vs. live) and the misconception that IAM roles can override organization policy constraints, leading candidates to incorrectly attribute the bypass to permission levels rather than policy configuration.

How to eliminate wrong answers

Option B is wrong because organization policies and IAM permissions are independent; granting a role at the organization level does not override or bypass an organization policy constraint. Option C is wrong because the 'Organization Policy Administrator' role allows managing policies but does not automatically bypass constraints; bypassing requires a specific 'set' or 'unset' of the constraint, not just the role. Option D is wrong because the 'gcp.resourceLocations' constraint explicitly applies to Cloud SQL instances, as documented in Google Cloud's list of supported services.

Full explanation →

260

MCQeasy

A security engineer needs to ensure that all customer data stored in Cloud Storage is encrypted using keys that they manage and rotate on a schedule they control. The keys must be stored in a FIPS 140-2 Level 3 validated HSM. Which encryption approach should they use?

A.Cloud External Key Manager (Cloud EKM)

B.Customer-Managed Encryption Keys (CMEK) with Cloud HSM

C.Customer-Supplied Encryption Keys (CSEK)

D.Google-managed encryption keys (GMEK)

AnswerB

CMEK with Cloud HSM allows the customer to manage keys stored in a FIPS 140-2 Level 3 validated HSM and control rotation.

Why this answer

Customer-Managed Encryption Keys (CMEK) combined with Cloud HSM allow customers to manage their own keys in a FIPS 140-2 Level 3 validated HSM. Google-managed keys do not give customer control, and Customer-Supplied Encryption Keys (CSEK) require the customer to supply the key with each API call and Google does not store the key, which is impractical for many use cases and does not use HSM.

Full explanation →

261

MCQhard

A security team needs to allow a third-party application running on AWS to access a Cloud Storage bucket without using service account keys. The application already uses AWS IAM roles. Which Google Cloud feature should they use?

A.Secret Manager with a service account key

B.Identity-Aware Proxy (IAP)

C.Cloud VPN

D.Workload Identity Federation

AnswerD

Allows AWS workloads to impersonate a GCP SA using AWS IAM roles without keys.

Why this answer

Workload Identity Federation allows the AWS application to exchange its AWS IAM role credentials for Google Cloud temporary security tokens, enabling access to Cloud Storage without managing or storing service account keys. This is the correct approach because it directly addresses the requirement to avoid service account keys while leveraging the existing AWS IAM identity.

Exam trap

The Google Cloud exam often tests the misconception that network-level solutions like Cloud VPN or IAP can solve identity and access management problems, but the key requirement here is identity federation, not network connectivity or application-layer proxy access.

How to eliminate wrong answers

Option A is wrong because Secret Manager with a service account key still requires storing and managing a long-lived service account key, which directly violates the requirement to avoid using service account keys. Option B is wrong because Identity-Aware Proxy (IAP) controls access to web applications and does not provide authentication or authorization for Cloud Storage bucket access via AWS IAM roles. Option C is wrong because Cloud VPN establishes an encrypted network tunnel between AWS and Google Cloud but does not handle identity federation or token exchange for accessing Cloud Storage.

Full explanation →

262

MCQeasy

A security engineer wants to restrict access to a Cloud Storage bucket so that only requests originating from within a specific VPC network can access the bucket. Which Google Cloud service should they use?

A.Identity-Aware Proxy (IAP)

B.VPC Service Controls

C.Firewall rules

D.Cloud Armor

AnswerB

VPC Service Controls use service perimeters to restrict access to Google Cloud services based on context like VPC network.

Why this answer

VPC Service Controls allow you to define a service perimeter that restricts access to Google Cloud services (including Cloud Storage) based on the originating VPC network and identity.

Full explanation →

263

MCQeasy

A security engineer wants to review all IAM permission changes made in the last 30 days. Which type of Cloud Audit Log should they query?

A.Admin Activity logs

B.Data Access logs

C.System Event logs

D.Policy Denied logs

AnswerA

Correct. Admin Activity logs record configuration changes including IAM policy modifications.

Why this answer

Admin Activity logs contain all API calls that modify configurations or metadata, such as IAM policy changes. They are enabled by default and retained for 400 days. Data Access logs would capture read events but not permission changes, System Event logs are for GCP infrastructure actions, and Policy Denied logs record denied requests.

Full explanation →

264

MCQhard

A security engineer notices that a Cloud KMS key was accidentally deleted. The key had a pending destruction period of 24 hours. What is the maximum time window to recover the key after the deletion request?

A.30 days

B.7 days

C.24 hours

D.Immediately after deletion it cannot be recovered

AnswerC

The default pending destruction grace period is 24 hours.

Why this answer

When a key version is destroyed, it enters a 24-hour pending destruction period. During this time, it can be restored. After 24 hours, destruction is permanent and irreversible.

Full explanation →

265

MCQmedium

Which Google Cloud service should be used for long-term archival of Audit Logs that must be immutable and stored for 10 years for compliance?

A.Cloud SQL with backups

B.Cloud Storage with Archive storage class and retention policy

C.BigQuery with time-based partitioning

D.Pub/Sub with message retention

AnswerB

Archive storage class is low-cost for long-term storage, and retention policies prevent deletion.

Why this answer

Cloud Storage with Archive storage class offers the lowest cost for long-term storage, and retention policies enforce immutability.

Full explanation →

266

MCQhard

A Cloud Run service is failing to access a secret from Secret Manager. The service account used by Cloud Run has the roles/secretmanager.secretAccessor role. What is the most likely cause of the error?

A.VPC Service Controls are blocking access to Secret Manager.

B.The service account does not have the iam.serviceAccounts.actAs permission on the Cloud Run service.

C.The secret does not exist in the specified project.

D.The service account does not have access to the 'latest' version of the secret; it needs explicit version access.

AnswerD

The secretmanager.secretAccessor role grants access to specific versions, but 'latest' may require additional permissions if not enabled.

Why this answer

D is correct because Secret Manager requires explicit access to a specific secret version. The `roles/secretmanager.secretAccessor` role grants access to all versions of a secret, but the Cloud Run service must reference a specific version (e.g., 'latest' or a version number) in its configuration. If the service is configured to access the 'latest' version without the `secretmanager.versions.access` permission on that version, access will fail.

The error occurs because the service account lacks the necessary permission to access the 'latest' version, even though it has the role.

Exam trap

Google Cloud often tests the misconception that the `roles/secretmanager.secretAccessor` role grants blanket access to all versions, but in reality, access must be explicitly granted to each version, including 'latest', via the IAM policy on the secret or version.

How to eliminate wrong answers

Option A is wrong because VPC Service Controls block access based on perimeter boundaries, not IAM permissions; if VPC SC were blocking, the error would be a network/perimeter violation, not an IAM permission error. Option B is wrong because the `iam.serviceAccounts.actAs` permission is required for deploying Cloud Run services, not for accessing secrets at runtime; the runtime access to Secret Manager is governed by the service account's IAM roles on the secret. Option C is wrong because if the secret did not exist, the error would be a 'not found' or '404' error, not an access permission error; the question states the service is failing to access the secret, implying the secret exists.

Full explanation →

267

MCQmedium

A company wants to receive real-time notifications when Security Command Center (SCC) detects a high-severity vulnerability in their Google Cloud projects. They need to integrate with their existing SIEM. Which approach should they use?

A.Create a Pub/Sub notification config in SCC for the desired finding types and have the SIEM subscribe to the Pub/Sub topic.

B.Use the SCC API to poll for new findings every minute and push them to the SIEM via a custom script.

C.Enable Event Threat Detection in SCC Premium tier and configure it to stream findings to Cloud Logging via a log sink.

D.Configure SCC to send findings to Cloud Logging and set up a log-based metric that triggers a Cloud Function to send to the SIEM.

AnswerA

SCC supports Pub/Sub notifications for findings, enabling real-time SIEM integration.

Why this answer

SCC findings can be exported to Pub/Sub for real-time integration. The SIEM can subscribe to the Pub/Sub topic. Cloud Logging can also be used but SCC does not directly write findings to Logging.

Cloud Functions alone would require Pub/Sub as trigger.

Full explanation →

268

MCQhard

A company uses Cloud Storage with CMEK. The Cloud KMS key is disabled accidentally by an administrator. What will happen to existing objects encrypted with that key?

A.Objects are automatically re-encrypted with Google-managed keys.

B.Objects become inaccessible immediately.

C.Objects remain accessible until the key is destroyed.

D.Objects become inaccessible after a 24-hour grace period.

AnswerB

Disabling the key immediately prevents decryption of any object encrypted with that key.

Why this answer

When a Cloud KMS key used for CMEK is disabled, Cloud Storage immediately loses the ability to decrypt the encrypted object data and its associated metadata. Without the key, the service cannot serve the object, making it inaccessible for read, write, or delete operations until the key is re-enabled. This is because CMEK objects are encrypted at rest using the customer-managed key, and Cloud Storage does not maintain a cached copy of the key material.

Exam trap

Google Cloud often tests the misconception that disabling a CMEK key has a grace period or that Google will automatically fall back to Google-managed keys, but the correct behavior is immediate inaccessibility with no automatic recovery or re-encryption.

How to eliminate wrong answers

Option A is wrong because Cloud Storage does not automatically re-encrypt CMEK objects with Google-managed keys when the CMEK key is disabled; re-encryption would require explicit action and a new key version. Option C is wrong because objects remain accessible only as long as the key is enabled; disabling the key immediately blocks access, not just when the key is destroyed. Option D is wrong because there is no 24-hour grace period; access is revoked immediately upon key disablement, as the key is required for decryption on every request.

Full explanation →

269

Multi-Selecteasy

Which two Cloud Storage encryption options allow the customer to supply or manage the encryption keys? (Choose two.)

Select 2 answers

A.Default encryption at rest

B.Google-managed encryption keys

C.Cloud HSM keys

D.Customer-Supplied Encryption Keys (CSEK)

E.Customer-Managed Encryption Keys (CMEK)

AnswersD, E

Customer supplies the key material directly.

Why this answer

Customer-Supplied Encryption Keys (CSEK) allow you to supply your own encryption keys for protecting data at rest in Cloud Storage. With CSEK, you provide the key material for each API call, and Google does not store the key on its servers. This option is correct because the customer directly supplies the encryption key.

Exam trap

Google Cloud often tests the distinction between 'supplying' the key (CSEK) versus 'managing' a key that Google generates (CMEK), causing candidates to mistakenly think Cloud HSM keys (which are a CMEK implementation) count as customer-supplied.

Full explanation →

270

MCQmedium

A government agency is migrating to Google Cloud and must comply with FedRAMP requirements. They need to ensure that only FedRAMP authorized Google Cloud services are used in their project. The security team has enabled Organization Policies and created a custom policy to restrict allowed services to a specific list. However, when a developer tries to create a Cloud SQL instance, the operation is denied. The developer receives an error: 'The organization policy constraint compute.restrictNonPdServices is not allowing this resource.' The developer is trying to create a Cloud SQL instance, which is a FedRAMP authorized service. What is the most likely cause of the denial?

A.Cloud SQL instances require a specific region that is not permitted by the policy.

B.The developer does not have the necessary IAM permissions to create Cloud SQL instances.

C.The organization policy is misconfigured and does not include Cloud SQL in the allowed list.

D.The organization policy is blocking all services not in a specific list, and Cloud SQL is not included because it is a data service rather than a compute service.

AnswerC

The error indicates the policy constraint is blocking the resource; Cloud SQL is likely not in the allowed list.

Why this answer

The error message explicitly references the `compute.restrictNonPdServices` organization policy constraint, which is used to restrict the creation of non-Persistent Disk (PD) services. The developer's attempt to create a Cloud SQL instance is denied because the custom policy's allowed list does not include Cloud SQL, even though it is a FedRAMP authorized service. The policy must be updated to include Cloud SQL in the allowed services list for the operation to succeed.

Exam trap

Google Cloud often tests the distinction between organization policy constraints and IAM permissions, and the trap here is that candidates may confuse a policy constraint error with a permissions error, or incorrectly assume that FedRAMP authorization automatically overrides organization policies.

How to eliminate wrong answers

Option A is wrong because the error message does not mention region restrictions; the `compute.restrictNonPdServices` constraint controls service types, not geographic regions. Option B is wrong because the error message explicitly cites an organization policy constraint violation, not an IAM permission issue; IAM errors would produce a different message (e.g., 'Permission denied'). Option D is wrong because Cloud SQL is a managed database service that falls under the scope of the `compute.restrictNonPdServices` constraint, and the error indicates it is being blocked due to the allowed list, not because it is a 'data service'—the constraint applies to all non-PD services, not just compute services.

Full explanation →

271

MCQhard

A company handling credit card information must comply with PCI DSS. They use Cloud KMS with CMEK keys stored in a key ring. During a compliance audit, the auditor asks how keys are protected against unauthorized use by Google. What should the company explain?

A.They store keys in Cloud HSM, which ensures keys never leave the HSM and are bound to a specific project

B.They use customer-supplied encryption keys (CSEK), so Google never has access to keys

C.They use Cloud KMS with CMEK, and the keys are encrypted using Google-managed key encryption keys (KEKs)

D.They enabled Access Approval, so Google must obtain approval before accessing keys

AnswerA

Cloud HSM provides hardware-level protection; keys cannot be exported and are protected against unauthorized access by Google personnel.

Why this answer

Cloud HSM provides a FIPS 140-2 Level 3 validated hardware security module (HSM) where customer-managed encryption keys (CMEK) are generated and used exclusively within the HSM boundary. The keys never leave the HSM in plaintext, and access is bound to the specific Google Cloud project, ensuring that even Google administrators cannot extract or use the keys outside the authorized project context.

Exam trap

Google Cloud often tests the distinction between key storage (Cloud HSM) and key management (Cloud KMS with CMEK), where candidates mistakenly believe that CMEK alone prevents Google access, when in fact only Cloud HSM provides hardware-level isolation that prevents Google from using the keys.

How to eliminate wrong answers

Option B is wrong because customer-supplied encryption keys (CSEK) are used for encrypting data at rest in Google Cloud Storage, not for Cloud KMS key protection; CSEK are provided by the customer and Google does not store them, but the question specifically asks about CMEK keys stored in a key ring, not CSEK. Option C is wrong because Cloud KMS with CMEK does use Google-managed key encryption keys (KEKs) to encrypt the CMEK keys at rest, but this does not prevent Google from having access to the keys; the KEKs are managed by Google, so Google could theoretically decrypt the CMEK keys. Option D is wrong because Access Approval is a feature that allows customers to approve or deny access requests from Google support or engineering personnel, but it does not prevent unauthorized use by Google itself; it only provides a notification and approval workflow for specific access requests, not a technical barrier against Google's underlying access to the keys.

Full explanation →

272

MCQeasy

A company has two VPC networks in the same project: VPC-A (10.0.0.0/16) and VPC-B (172.16.0.0/16). They have established VPC peering between them. An instance in VPC-A needs to communicate with an instance in VPC-B on TCP port 443. What is the minimal firewall configuration needed?

A.Add an ingress firewall rule in VPC-B allowing traffic from 10.0.0.0/16 on port 443.

B.Add an ingress firewall rule in VPC-A allowing traffic from 172.16.0.0/16 on port 443.

C.Add a single firewall rule in the project with source 10.0.0.0/16 and destination 172.16.0.0/16 on port 443.

D.Add an egress firewall rule in VPC-A allowing traffic to 172.16.0.0/16 on port 443.

AnswerA

Ingress rule on the target network is required; default egress allows outbound from source.

Why this answer

VPC peering does not automatically allow traffic; firewall rules must explicitly permit the desired communication. Since the instance in VPC-A initiates the connection to VPC-B, VPC-B's firewall must have an ingress rule allowing traffic from VPC-A's CIDR (10.0.0.0/16) on TCP port 443. This is the minimal configuration because egress rules in VPC-A are implicitly permissive by default in Google Cloud, and only the destination VPC's ingress needs to be opened.

Exam trap

Google Cloud often tests the misconception that VPC peering automatically opens all traffic between the peered networks, leading candidates to think no firewall rules are needed, or that egress rules must be added on the source side.

How to eliminate wrong answers

Option B is wrong because it adds an ingress rule in VPC-A for traffic from VPC-B, but the traffic flows from VPC-A to VPC-B, so VPC-A does not need to allow incoming traffic from VPC-B for this communication. Option C is wrong because Google Cloud firewall rules are applied per VPC network, not as a single project-level rule with both source and destination; they operate on ingress or egress direction, not as a bidirectional filter. Option D is wrong because egress rules in VPC-A are not needed; Google Cloud's default egress allow rule permits all outbound traffic unless explicitly overridden, and the minimal configuration only requires the ingress rule in VPC-B.

Full explanation →

273

MCQeasy

A company wants to grant a support team member the ability to view the IAM policy of a project (who has which roles) without being able to modify it. What is the least privileged predefined role that provides this access?

A.roles/viewer

B.roles/iam.securityAdmin

C.roles/iam.roleViewer

D.roles/iam.securityReviewer

AnswerD

Includes resourcemanager.projects.getIamPolicy and other read permissions for IAM.

Why this answer

The roles/iam.securityReviewer role grants read-only access to IAM policies and permissions across the project, including the ability to view who has which roles, without allowing modifications. This is the least privileged predefined role that provides exactly this access, as it is scoped to security-related read operations only.

Exam trap

Google Cloud often tests the distinction between viewing role definitions (roles/iam.roleViewer) and viewing actual IAM policy bindings (roles/iam.securityReviewer), causing candidates to confuse the two.

How to eliminate wrong answers

Option A is wrong because roles/viewer provides broad read access to all resources in the project, which is more permissive than necessary and includes many permissions beyond IAM policy viewing. Option B is wrong because roles/iam.securityAdmin grants full administrative control over IAM policies, including the ability to modify roles and permissions, which exceeds the requirement of read-only access. Option C is wrong because roles/iam.roleViewer only allows viewing predefined and custom role definitions, not the actual IAM policy bindings (who has which roles) on a project.

Full explanation →

274

Multi-Selectmedium

A company uses Cloud Identity with SAML 2.0 federation from an external IdP. They want to enforce that users must be members of a specific group in the IdP to access GCP resources. Which two configurations are necessary? (Choose two.)

Select 2 answers

A.Create a corresponding group in Cloud Identity and map it to the IdP group.

B.Disable direct user accounts in Cloud Identity.

C.Use IAP to enforce group membership.

D.Create an organization policy to restrict access to only those users.

E.Configure the IdP to send group membership in the SAML assertion.

AnswersA, E

Cloud Identity groups can be used in IAM policies to grant access based on group membership.

Why this answer

To enforce group-based access, you need to create a corresponding group in Cloud Identity and map it to the IdP group (option A) so that IAM policies can reference it. You also need the IdP to send group membership in the SAML assertion (option E) so that Cloud Identity can determine which groups the user belongs to and apply the appropriate IAM policies.

Full explanation →

275

MCQmedium

An organization wants to encrypt data at rest using customer-managed keys on Compute Engine persistent disks. They need to provide the key material with each API call, and Google should never store the key. Which encryption approach should they use?

A.Cloud HSM

B.Google-managed encryption keys (GMEK)

C.Customer-supplied encryption keys (CSEK)

D.Customer-managed encryption keys (CMEK)

AnswerC

CSEK requires the customer to supply the key with each API call and Google never stores it.

Why this answer

Customer-Supplied Encryption Keys (CSEK) allow the customer to provide their own encryption keys, which are used to encrypt data at rest. The keys are provided with each API call and are not stored by Google. CMEK uses Cloud KMS where Google stores the key material (encrypted by HSM).

GMEK is Google-managed. Cloud HSM is a service for managing keys but still stores them.

Full explanation →

276

Multi-Selectmedium

You are a security engineer for a company that runs a critical application on Google Cloud. You need to implement defense in depth for network security. Which TWO of the following are effective network security controls that you should implement?

Select 2 answers

A.OS-level host-based firewalls on each VM

B.VPC firewall rules to restrict traffic between subnets

C.IAM roles to control who can create Compute Engine instances

D.Workload Identity Federation to allow workloads to authenticate to Google APIs

E.Cloud Armor to protect against DDoS and web application attacks

AnswersB, E

VPC firewall rules are a fundamental network security control to filter traffic.

Why this answer

VPC firewall rules (B) are a fundamental network security control that allow you to restrict traffic between subnets based on source/destination IP ranges, protocols, and ports. This implements network segmentation and micro-segmentation, which is a core principle of defense in depth. Cloud Armor (E) provides Web Application Firewall (WAF) capabilities and DDoS protection at the edge of Google's network, filtering malicious traffic before it reaches your VMs or load balancers.

Exam trap

Google Cloud often tests the distinction between network security controls (which filter traffic at the network layer) and host/identity/authentication controls, so candidates mistakenly select IAM or Workload Identity Federation because they think 'access control' equals network security.

Full explanation →

277

MCQmedium

A financial institution is required to use customer-managed encryption keys (CMEK) for all data at rest in Google Cloud. They need to prevent key deletion by anyone except a specific IAM role. What should they do?

A.Enable destroy protection on the key ring

B.Use Organization Policies with a constraint to restrict key destruction

C.Assign the cloudkms.admin role only to a security team

D.Enable key rotation on the Cloud KMS key

AnswerA

Destroy protection prevents deletion of a key ring and its keys until the protection is disabled by an authorized user.

Why this answer

Enabling destroy protection on the key ring prevents any Cloud KMS key within that key ring from being destroyed, regardless of IAM permissions. This is a key ring-level setting that overrides IAM roles, ensuring that only a specific IAM role (e.g., cloudkms.admin) can disable destroy protection and then delete keys, meeting the requirement to restrict key deletion to a specific role.

Exam trap

Google Cloud often tests the misconception that IAM roles alone can prevent key deletion, but the trap here is that destroy protection is a separate, overriding mechanism that must be explicitly enabled at the key ring level to block destruction regardless of IAM permissions.

How to eliminate wrong answers

Option B is wrong because Organization Policies with constraints (e.g., constraints/cloudkms.disableDestroyProtection) can restrict the ability to disable destroy protection, but they do not directly prevent key destruction; they only control the destroy protection setting itself, not the actual deletion of keys. Option C is wrong because assigning the cloudkms.admin role to a security team does not inherently prevent key deletion by others; any user with the cloudkms.admin role can destroy keys unless destroy protection is enabled, and this option does not address the requirement to prevent deletion by anyone except a specific role. Option D is wrong because key rotation on a Cloud KMS key does not prevent deletion; it only automates the creation of new key versions and does not affect the ability to destroy the key or its versions.

Full explanation →

278

MCQhard

An organization uses Cloud Run to deploy microservices. Each microservice needs to authenticate to Cloud Pub/Sub topics. The Security Engineer wants to enforce that each service only uses its own service account and cannot impersonate others. The team also wants to rotate credentials automatically. What is the best practice to achieve this?

A.Assign a dedicated service account to each Cloud Run service with the necessary Pub/Sub publisher role.

B.Configure each Cloud Run service to use the Compute Engine default service account and rely on the metadata server.

C.Use Workload Identity Federation to map each service to a Google service account.

D.Create a service account key for each service and store it in Cloud Secret Manager.

AnswerA

Cloud Run uses the attached service account to obtain short-lived tokens automatically.

Why this answer

Cloud Run allows you to assign a dedicated, per-service service account at deployment time. By granting each service account only the Pub/Sub publisher role on its specific topic, you enforce least-privilege access and prevent impersonation. Cloud Run automatically rotates the short-lived tokens associated with these service accounts via the metadata server, eliminating the need for manual key management.

Exam trap

The trap here is that candidates often confuse the Compute Engine default service account (which is shared and not recommended for production) with the ability to assign dedicated service accounts per Cloud Run service, or they mistakenly think Workload Identity Federation is the correct approach for internal Google Cloud services.

How to eliminate wrong answers

Option B is wrong because using the Compute Engine default service account would give all Cloud Run services the same identity, violating the requirement that each service uses its own service account and cannot impersonate others. Option C is wrong because Workload Identity Federation is designed for external workloads (e.g., on-premises or other clouds) to impersonate Google service accounts, not for internal Cloud Run services that already have native identity support. Option D is wrong because creating and storing service account keys in Cloud Secret Manager introduces long-lived credentials that require manual rotation, contradicting the requirement for automatic credential rotation and increasing the risk of key leakage.

Full explanation →

279

Matchingmedium

Match each compliance framework to its focus area.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Payment card data security

Protected health information privacy and security

Service organization controls for security, availability, etc.

Cloud security for U.S. federal agencies

Information security management system standard

Why these pairings

SOC 2 addresses security, availability, and privacy; HIPAA protects health information. Common confusions involve mixing FedRAMP with SOC 2 and PCI DSS with HIPAA.

Full explanation →

280

MCQmedium

A company notices that some Compute Engine instances are making unexpected outbound connections to suspicious IP addresses. They want to investigate the traffic patterns and identify the source of these connections. Which tool should they use?

A.Cloud Armor

B.Cloud IAM

C.VPC Flow Logs

D.Firewall Rules Insights

AnswerC

VPC Flow Logs record metadata about IP traffic to and from VMs.

Why this answer

VPC Flow Logs capture metadata about network traffic to and from Compute Engine instances, including source/destination IPs, ports, and protocols. By analyzing these logs, the company can identify the specific instances making unexpected outbound connections to suspicious IP addresses, enabling investigation of traffic patterns.

Exam trap

Google Cloud often tests the distinction between tools that log actual traffic (VPC Flow Logs) versus tools that enforce security policies (Cloud Armor) or manage rules (Firewall Rules Insights), leading candidates to confuse 'investigating traffic patterns' with 'blocking traffic' or 'optimizing rules'.

How to eliminate wrong answers

Option A is wrong because Cloud Armor is a web application firewall (WAF) that protects against layer 7 attacks like SQL injection and XSS, not a tool for capturing or analyzing outbound traffic logs. Option B is wrong because Cloud IAM manages access control and permissions for Google Cloud resources, not network traffic monitoring or logging. Option D is wrong because Firewall Rules Insights provides recommendations for optimizing firewall rules (e.g., identifying unused or overly permissive rules), but does not log or report actual traffic flows or connections to specific IP addresses.

Full explanation →

281

MCQmedium

A company wants to use Cloud KMS with a key that is protected by a Hardware Security Module (HSM) and meets FIPS 140-2 Level 3. Which key type should they create in Cloud KMS?

A.HSM key with any purpose

B.External key stored in Cloud HSM

C.Software key with ASYMMETRIC_SIGN purpose

D.Software key with ENCRYPT_DECRYPT purpose

AnswerA

HSM keys are backed by Cloud HSM and meet FIPS 140-2 Level 3.

Why this answer

Cloud KMS offers HSM keys that are generated and protected within an FIPS 140-2 Level 3 certified HSM. When a company requires FIPS 140-2 Level 3 compliance, the only key type that meets this requirement is an HSM key, regardless of its purpose (e.g., symmetric encryption, asymmetric signing). Software keys, even with any purpose, only meet FIPS 140-2 Level 1.

Exam trap

A common mistake is assuming that any key stored in Cloud HSM (including imported external keys) meets FIPS 140-2 Level 3, but only Cloud KMS-generated HSM keys are certified at that level.

How to eliminate wrong answers

Option B is wrong because an 'external key stored in Cloud HSM' refers to a key that is imported from an external key management system and stored in Cloud HSM, but Cloud KSM does not support importing keys into Cloud HSM for FIPS 140-2 Level 3 protection; only Cloud KMS-generated HSM keys meet that level. Option C is wrong because a software key with ASYMMETRIC_SIGN purpose is a software-backed key that only meets FIPS 140-2 Level 1, not Level 3. Option D is wrong because a software key with ENCRYPT_DECRYPT purpose is also software-backed and only meets FIPS 140-2 Level 1, failing the Level 3 requirement.

Full explanation →

282

MCQeasy

For HIPAA compliance, which Google Cloud product provides a business associate agreement (BAA) and a dedicated environment for protected health information?

A.Confidential VMs

B.GKE Security Posture

C.Assured Workloads

D.Cloud Healthcare API

AnswerC

Assured Workloads provides a BAA, location controls, and access transparency for HIPAA compliance.

Why this answer

Assured Workloads is the correct answer because it enables customers to deploy workloads that must comply with HIPAA by providing a BAA-ready environment with enforced controls, including data residency, encryption, and access restrictions. It creates a dedicated folder with pre-configured security and compliance policies, ensuring that protected health information (PHI) is handled in a Google Cloud environment that meets HIPAA requirements.

Exam trap

Google Cloud often tests the misconception that a service-specific API or feature (like Cloud Healthcare API or Confidential VMs) inherently provides HIPAA compliance, when in fact the BAA and dedicated environment are delivered through the overarching compliance framework of Assured Workloads.

How to eliminate wrong answers

Option A is wrong because Confidential VMs provide memory encryption using AMD SEV-ES but do not offer a BAA or a dedicated compliance environment for PHI; they are a hardware-level security feature, not a compliance framework. Option B is wrong because GKE Security Posture is a dashboard for monitoring security configurations in Google Kubernetes Engine clusters, not a service that provides a BAA or enforces HIPAA-specific controls. Option D is wrong because Cloud Healthcare API is a service for ingesting and managing healthcare data, and while it can be used in a HIPAA-compliant manner, it does not itself provide a BAA or a dedicated environment; the BAA is obtained through Assured Workloads or a separate agreement.

Full explanation →

283

MCQmedium

A company handles Controlled Unclassified Information (CUI) and needs to deploy a workload that complies with ITAR (International Traffic in Arms Regulations). They plan to use Assured Workloads. Which compliance regime should they select when creating the Assured Workloads folder?

A.FEDRAMP_HIGH

B.CJIS

C.ITAR

D.IL4

AnswerC

ITAR is the correct regime for workloads subject to International Traffic in Arms Regulations.

Why this answer

For ITAR compliance, the correct regime is 'ITAR'. Assured Workloads supports multiple regimes including FedRAMP, HIPAA, and ITAR. Selecting ITAR enforces controls like personnel access restrictions and data location.

Full explanation →

284

Multi-Selecthard

A company uses Assured Workloads with the FEDRAMP_HIGH regime. They want to enforce resource location restrictions and restrict Google personnel access. Which TWO capabilities should they enable? (Choose two.)

Select 2 answers

A.Data residency restrictions in the Assured Workloads folder.

B.VPC Service Controls.

C.Access Transparency logs.

D.Google personnel access restrictions.

E.Cloud KMS to manage encryption keys.

AnswersA, D

Data residency ensures resources are created only in allowed regions, meeting location restrictions.

Why this answer

Assured Workloads provides data residency controls to ensure resources are deployed in specific regions, and it offers Google personnel access restrictions to limit support access to authorized personnel. Access Transparency logs actions but does not restrict. VPC Service Controls are separate from Assured Workloads.

Cloud KMS is for key management.

Full explanation →

285

Multi-Selectmedium

A company is designing a PCI DSS-compliant environment on Google Cloud. They need to isolate the cardholder data environment (CDE) and log all access to it. Which THREE actions should they take? (Choose 3)

Select 3 answers

A.Place all CDE resources in a dedicated VPC.

B.Use VPC Service Controls to create a perimeter around the CDE project.

C.Enable Data Access audit logs for all CDE services.

D.Use Cloud Load Balancing with SSL policies to enforce TLS 1.3.

E.Deploy Cloud Armor WAF to protect web applications in the CDE.

AnswersA, B, C

A dedicated VPC provides network isolation for the CDE.

Why this answer

Network segmentation (dedicated VPC), data exfiltration prevention (VPC Service Controls), and logging (Data Access audit logs) are key PCI DSS requirements for the CDE.

Full explanation →

286

Multi-Selectmedium

A financial services company uses Security Command Center (SCC) Premium tier to monitor its GCP environment. The security team wants to automatically respond to high-severity threat findings, such as 'Cryptomining' from Event Threat Detection. The response should include isolating the affected VM by removing its external IP and applying a firewall rule to block egress traffic. Which two steps should the team implement? (Choose two.)

Select 2 answers

A.Deploy a Cloud Function that listens on the Pub/Sub topic and uses Compute Engine API to modify the VM's network tags and update firewall rules

B.Create a Security Health Analytics scan to detect similar threats

C.Set up a log sink to export Admin Activity logs to BigQuery

D.Enable VPC Flow Logs for the affected VM's subnet

E.Create a Pub/Sub topic and subscribe SCC findings to it using a notification config

AnswersA, E

Cloud Functions can automate remediation based on SCC findings.

Why this answer

SCC can be integrated with Pub/Sub to send real-time notifications for findings, and Cloud Functions can execute automated remediation actions like modifying VM network tags or applying firewall rules.

Full explanation →

287

MCQhard

A large enterprise is migrating its on-premises Active Directory to Google Cloud using Managed Microsoft AD (Microsoft AD). They have established a VPN connection between their on-premises network and VPC. The domain controllers are fully synced, and users can authenticate from on-premises. However, applications running on Compute Engine VMs in the same VPC as Managed Microsoft AD are failing to authenticate using LDAP. The VMs are Linux-based and configured to use the Managed Microsoft AD domain for authentication via SSSD. The security team has verified that the firewall rules allow TCP/UDP 389 and 636 from the VMs to the Managed Microsoft AD IP addresses. The VMs can resolve the domain name (corp.example.com) to the correct IP of the Managed Microsoft AD domain controllers. What is the most likely cause of the authentication failure?

A.The VMs do not have the required network tag to allow inbound traffic from Managed Microsoft AD.

B.The VPN tunnel does not support LDAP traffic.

C.The DNS resolution returns the on-premises domain controller IP instead of the Managed Microsoft AD IP.

D.The Managed Microsoft AD service account does not have the 'domain controller' IAM role.

AnswerA

Managed Microsoft AD uses firewall rules with target tags. Without the tag, traffic is blocked.

Why this answer

Managed Microsoft AD in Google Cloud uses internal VPC IP addresses for its domain controllers. For Linux VMs using SSSD to authenticate via LDAP, the VMs must be able to initiate outbound LDAP traffic to the Managed Microsoft AD IPs, and the Managed Microsoft AD service must be able to respond. However, Managed Microsoft AD enforces network security by requiring that only VMs with a specific network tag (by default 'allow-ad') can receive inbound traffic from the Managed Microsoft AD service.

Without this tag on the VMs, the Managed Microsoft AD service will drop its response packets, causing authentication failures even though outbound firewall rules are open. The security team verified firewall rules for outbound traffic but missed this inbound tag requirement.

Exam trap

Google Cloud often tests the nuance that Managed Microsoft AD requires a specific network tag on client VMs for inbound LDAP responses, which candidates overlook because they focus only on outbound firewall rules or DNS resolution.

How to eliminate wrong answers

Option B is wrong because VPN tunnels operate at Layer 3 and do not inspect or block specific protocols like LDAP; they simply encapsulate IP packets. Option C is wrong because the question explicitly states that DNS resolution returns the correct IP of the Managed Microsoft AD domain controllers, not the on-premises IP. Option D is wrong because Managed Microsoft AD does not use IAM roles for domain controller permissions; it uses a service account for provisioning, but authentication within the domain is handled by Active Directory itself, not IAM.

Full explanation →

288

Multi-Selecthard

An organization is designing a secure multi-tenant SaaS environment on GKE. They want to isolate tenant workloads using GKE namespaces and IAM. Which two steps should they take? (Choose two.)

Select 2 answers

A.Enable GKE Dataplane V2 for network isolation.

B.Grant cluster-level IAM roles to tenant users.

C.Use Kubernetes RBAC to restrict access within namespaces.

D.Create a separate GKE cluster per tenant.

E.Use Workload Identity to map tenant IAM roles to Kubernetes service accounts.

AnswersC, E

RBAC provides granular namespace-level access control.

Why this answer

Kubernetes RBAC is the native mechanism for controlling access to resources within a namespace. By defining Role and RoleBinding objects, you can precisely restrict which tenant users can perform actions (e.g., get, list, create pods) inside their assigned namespace, ensuring logical isolation without requiring separate clusters.

Exam trap

Google Cloud often tests the distinction between network isolation (Dataplane V2) and access control (RBAC/IAM), leading candidates to confuse traffic filtering with permission boundaries.

Full explanation →

289

Multi-Selectmedium

A security engineer is configuring a VPC Service Controls perimeter to protect a Cloud Storage bucket. They want to allow a specific on-premises network (IP range 203.0.113.0/24) to access the bucket, while still blocking other external networks. Which TWO components must they configure? (Choose TWO.)

Select 2 answers

A.Cloud Armor security policy

B.Service perimeter in enforced mode

C.Ingress rule that permits the access level

D.Access level with IP-based condition

E.Egress rule to allow traffic to the on-premises network

AnswersC, D

Ingress rules allow specified access levels to cross the perimeter.

Why this answer

You need an access level (based on IP) to define the allowed IPs, and an ingress rule to allow traffic from that access level into the perimeter.

Full explanation →

290

MCQhard

A multinational company is using Assured Workloads to meet EU_Regions_and_Support compliance. They need to ensure that only EU-based Google personnel can access the customer's data for support purposes. Which configuration should they enable?

A.Configure Access Transparency and log all support actions.

B.Turn on 'Access Approvals' and set personnel restrictions to EU.

C.Enable VPC Service Controls to restrict data movement.

D.Apply data residency restrictions in the Assured Workloads folder.

AnswerB

Access Approvals with personnel restrictions ensures that only Google personnel in the EU can access customer data for support.

Why this answer

Within Assured Workloads, the 'Google personnel access restrictions' option restricts support access to Google personnel located in specific regions. For EU regimes, this is set to EU. VPC Service Controls prevent data exfiltration but do not control personnel access.

Access Transparency logs show actions, but do not restrict them. Data residency restrictions keep data in specific regions but do not limit Google personnel access.

Full explanation →

291

MCQhard

A company is deploying a PCI DSS-compliant application on Google Cloud. They need to ensure that the Cardholder Data Environment (CDE) is isolated from other resources and that only authorized services can communicate with it. Which combination of controls should they implement?

A.Enable Cloud NAT for outbound internet access from the CDE

B.Implement VPC Service Controls to define a perimeter around the CDE, and use VPC firewall rules to restrict traffic

C.Use Shared VPC with a single network for all environments

D.Use Cloud Armor as the only security measure

AnswerB

VPC Service Controls prevent data exfiltration, and firewall rules restrict network access. This isolates the CDE.

Why this answer

VPC Service Controls create a security perimeter around the CDE, preventing data exfiltration. VPC firewalls control network traffic, and Cloud Armor provides WAF protection. Together, they meet PCI DSS isolation and security requirements.

Full explanation →

292

MCQeasy

Refer to the exhibit. A security engineer sees this configuration for a Cloud Storage bucket. What does this indicate about the encryption of objects in this bucket?

A.Objects are encrypted with Google-managed keys, and the key name is the default.

B.Objects are encrypted with a customer-supplied key (CSEK).

C.Objects are encrypted with an external key from an on-premises HSM.

D.Objects are encrypted with a customer-managed key (CMEK) from Cloud KMS.

AnswerD

The `defaultKmsKeyName` field indicates CMEK.

Why this answer

The exhibit shows `kmsKeyName` set to a Cloud KMS key resource name (e.g., `projects/PROJECT_ID/locations/LOCATION/keyRings/KEY_RING/cryptoKeys/KEY_NAME`). This indicates the bucket is configured with a customer-managed encryption key (CMEK) from Cloud Key Management Service (Cloud KMS), meaning Google uses the specified key to encrypt/decrypt objects, and the customer controls key rotation and access via IAM.

Exam trap

Google Cloud often tests the distinction between CMEK (persistent key reference in bucket config) and CSEK (per-request key, no stored reference), so candidates mistakenly pick CSEK when they see any mention of a custom key, ignoring that the `kmsKeyName` field is a persistent Cloud KMS resource identifier.

How to eliminate wrong answers

Option A is wrong because Google-managed keys are the default encryption (no `kmsKeyName` field is set), but the exhibit explicitly shows a `kmsKeyName` value, so it is not the default. Option B is wrong because customer-supplied encryption keys (CSEK) are provided per API call and are never stored or referenced by a persistent `kmsKeyName` in the bucket configuration; CSEK uses a different header (`x-goog-encryption-key`). Option C is wrong because external keys from an on-premises HSM are not directly supported by Cloud Storage; Cloud Storage only supports CMEK via Cloud KMS (which can use Cloud HSM as a key source, but the key is still managed in Cloud KMS, not an external on-premises HSM).

Full explanation →

293

MCQhard

A company subject to EU GDPR must implement the right to erasure (right to be forgotten) for personal data stored in BigQuery audit logs. The logs include query text that may contain personally identifiable information (PII). What is the correct approach to anonymize or delete PII from BigQuery audit logs?

A.Use Cloud Logging's exclusion filter to prevent PII from being logged in the first place.

B.Enable BigQuery table snapshot and restore to a point before the data was logged.

C.Delete the entire BigQuery dataset containing audit logs when a deletion request is received.

D.Use Cloud DLP to scan and redact PII in the log entries as they are generated, and store redacted logs in BigQuery.

AnswerD

Cloud DLP can be used to inspect and redact sensitive data before storage, enabling compliance with erasure requests without losing log integrity.

Why this answer

Cloud DLP can inspect and redact PII in BigQuery tables, enabling compliance with erasure requests while maintaining audit records.

Full explanation →

294

MCQeasy

An organization wants to grant a team of data analysts the ability to run BigQuery queries and create datasets, but prevent them from deleting datasets or modifying IAM policies. Which predefined IAM role should be assigned?

A.roles/bigquery.dataOwner

B.roles/bigquery.dataViewer

C.roles/bigquery.dataEditor

D.roles/bigquery.jobUser

AnswerC

Allows creating datasets and running queries, but not deleting or managing IAM.

Why this answer

The BigQuery Data Editor role (roles/bigquery.dataEditor) allows creating datasets and running queries, but does not allow deleting datasets or modifying permissions. The Viewer role is read-only, Owner allows deletion and IAM changes, and Job User only allows running jobs without dataset creation.

Full explanation →

295

MCQhard

An organization is configuring a Cloud Storage bucket for a regulated workload. The bucket configuration shown in the exhibit was applied. Which compliance requirement is this configuration primarily designed to address?

A.Data retention and immutability.

B.Encryption at rest using customer-managed encryption keys (CMEK).

C.Access transparency for data access.

D.Data residency within a specific geographic region.

AnswerA

The retentionPolicy with isLocked=true enforces a mandatory retention period, making objects immutable until the retention period expires.

Why this answer

The bucket configuration includes object versioning enabled and a retention policy with a retention period. This combination ensures that objects cannot be deleted or overwritten before the retention period expires, addressing data retention and immutability requirements. This is a common compliance need for regulated workloads where data must be preserved in its original state for a defined duration.

Exam trap

Google Cloud often tests the distinction between bucket-level retention policies (which enforce immutability) and encryption or access control settings, leading candidates to confuse data retention with encryption at rest or data residency.

How to eliminate wrong answers

Option B is wrong because the configuration does not specify any encryption key type (e.g., CMEK, CSEK, or Google-managed keys); encryption at rest is enabled by default but not the primary focus. Option C is wrong because Access Transparency logs are not configured or referenced in the bucket settings; Access Transparency is an organization-level policy, not a bucket-level configuration. Option D is wrong because the bucket does not have a location constraint or a specific region set; the configuration shown does not enforce data residency.

Full explanation →

296

MCQeasy

Which Google Cloud service can automatically classify and de-identify sensitive data such as credit card numbers and health records before it is stored in Cloud Storage?

A.Cloud Audit Logs

B.Cloud Data Loss Prevention (Cloud DLP)

C.Cloud Key Management Service (Cloud KMS)

D.Cloud Asset Inventory

AnswerB

Cloud DLP inspects and de-identifies sensitive data before storage.

Why this answer

Cloud Data Loss Prevention (DLP) is a service that inspects content for sensitive data types (e.g., credit card numbers, PHI) and can de-identify (mask, tokenize, etc.) that data. Cloud KMS manages encryption keys, Cloud Audit Logs records activities, and Cloud Asset Inventory tracks resources.

Full explanation →

297

MCQeasy

A company must implement a data retention policy that prevents any modification or deletion of stored log files for 5 years. Which Cloud Storage feature should they use?

A.Lifecycle management rules

B.Object versioning

C.Bucket locking with a retention policy

D.Object Retention Lock

AnswerC

Bucket locking with a retention policy applies a WORM policy at the bucket level, preventing any modification or deletion of objects for the specified duration. This is the most appropriate feature for a blanket 5-year retention policy on all log files.

Why this answer

Bucket locking with a retention policy allows you to set a WORM (Write Once, Read Many) policy on a bucket, preventing object deletion or modification for a specified duration. This is the correct feature for implementing a 5-year data retention policy that prevents any modification or deletion. Object Retention Lock is an AWS S3 feature, not a GCP feature, so option D is incorrect.

Exam trap

Many candidates confuse object-level retention locks with bucket-level retention policies. The question asks for a policy that prevents modification or deletion of all stored log files, which is best achieved by locking a retention policy on the bucket itself.

Full explanation →

298

Multi-Selecthard

A financial institution needs to comply with GDPR data subject rights. They must ensure that personal data in BigQuery can be anonymized for analytics while still allowing joins on pseudonymized identifiers. Which THREE services or features should they consider? (Choose 3)

Select 3 answers

A.Cloud Functions

B.Cloud KMS

C.Cloud Dataflow

D.Cloud DLP

E.BigQuery SQL functions (e.g., DLP_TOKENIZE)

AnswersC, D, E

Cloud Dataflow can be used to pre-process data with pseudonymization before loading into BigQuery.

Why this answer

Cloud DLP can be used to pseudonymize data (e.g., tokenize). BigQuery's SQL functions like `DLP_TOKENIZE` allow on-the-fly pseudonymization. Cloud Dataflow can be used to pre-process data.

Cloud KMS encrypts but does not pseudonymize. Cloud Functions can be used but is less integrated. Cloud Storage is for storage, not processing.

Full explanation →

299

Multi-Selecteasy

A developer wants to grant a Kubernetes service account in GKE the ability to read objects from a specific Cloud Storage bucket. Which two resources need to be bound together? (Choose two.)

Select 2 answers

A.The Cloud Storage bucket

B.The IAM policy for the bucket

C.The Kubernetes service account

D.The GCP service account

E.The GKE cluster

AnswersC, D

The Kubernetes service account needs to be mapped to the GCP service account via Workload Identity.

Why this answer

The Kubernetes service account is the identity used by pods running in GKE to authenticate to Google Cloud APIs. Option D is correct because a GCP service account is the IAM identity that must be granted permissions on the Cloud Storage bucket via IAM policies. The two are bound together using workload identity federation, which allows the Kubernetes service account to impersonate the GCP service account.

Exam trap

The Google Cloud Professional Cloud Security Engineer exam often tests the distinction between a Kubernetes service account (a cluster-internal identity) and a GCP service account (an IAM identity). Candidates mistakenly think the bucket or the cluster itself can be directly bound to the Kubernetes service account.

Full explanation →

300

Multi-Selecthard

A security engineer is responding to a data breach where an attacker exfiltrated data from a Cloud Storage bucket. Which TWO steps should the engineer take to contain the breach and preserve evidence? (Choose TWO.)

Select 2 answers

A.Disable the bucket's public access.

B.Remove the bucket's IAM policies.

C.Delete the bucket to prevent further exfiltration.

D.Enable Cloud Audit Logs for data access.

E.Create a copy of the bucket's data to a new bucket.

AnswersA, E

Prevents further unauthorized data access.

Why this answer

Disables public access to stop further exfiltration. Option E creates a forensic copy of the data before any changes. Option B removes policies but may disrupt analysis; option D enables logging after the fact, so it won't capture past events; option C deletes the bucket and destroys evidence.

Full explanation →

Page 4 of 13

All pages

1 2 3 4 5 6 7 8 9 10 11 12 13

Practice PCSE by domain

Target a specific domain to shore up weak areas.

Configuring Access Within a Cloud Solution Environment Ensuring Data Protection Managing Operations in a Cloud Solution Environment Configuring Network Security Supporting Compliance Requirements

See all domains with question counts →