Courseiva

Google Professional Cloud Security Engineer (PCSE) — Questions 301–375

960 questions total · 13pages · All types, answers revealed

Take a mock examExam hub
Page 4

Page 5 of 13

Page 6
301
MCQmedium

An organization uses Azure Active Directory as its identity provider. They want to allow employees to access Google Cloud resources using their Azure credentials without provisioning Google Cloud user accounts. Which solution should they implement?

A.Set up SAML 2.0 federation between Azure AD and Google Cloud using Cloud Identity.
B.Create Google Cloud user accounts for all employees and assign IAM roles directly.
C.Use Workforce Identity Federation to allow Azure AD users to authenticate to GCP.
D.Configure Cloud Directory Sync to synchronize Azure AD users to Google Cloud Directory.
AnswerC

Workforce Identity Federation allows Azure AD users to authenticate to GCP without provisioning Google Cloud user accounts, using SAML 2.0 or OIDC.

Why this answer

Workforce Identity Federation allows external identity providers (like Azure AD) to authenticate users via SAML 2.0 or OIDC and map them to Google Cloud resources without provisioning Google user accounts. This is the correct solution for employees using Azure AD credentials.

Full explanation →
302
MCQeasy

Refer to the exhibit. A compliance officer sees this Organization Policy applied at the organization level. Which compliance requirement does this policy primarily address?

A.Encryption key management
B.Data residency
C.Audit logging
D.Access control
AnswerB

The policy limits where resources can be created, ensuring data remains in specified regions to meet residency requirements.

Why this answer

The Organization Policy shown restricts the allowed locations for Compute Engine resources to a specific region (e.g., us-central1). This directly enforces data residency requirements by preventing resources from being created or moved outside of approved geographic boundaries, ensuring that data remains within a particular jurisdiction to comply with regulations like GDPR or HIPAA.

Exam trap

Google Cloud often tests the distinction between organization policies that enforce location restrictions versus other compliance controls like IAM or encryption, leading candidates to confuse data residency with access control or key management.

How to eliminate wrong answers

Option A is wrong because encryption key management is handled by Cloud KMS and key rotation policies, not by location-based organization policies. Option C is wrong because audit logging is governed by Audit Logs configuration and log sinks, not by resource location constraints. Option D is wrong because access control is enforced through IAM roles and policies, not by restricting where resources can be deployed.

Full explanation →
303
MCQeasy

A security administrator needs to ensure that all service account keys older than 90 days are automatically disabled to reduce the risk of key compromise. Which Google Cloud service should be used to implement this policy?

A.Cloud Secret Manager
B.Organization Policy Service
C.Cloud IAM
D.Cloud Key Management Service
AnswerB

Organization policies can set constraints like 'Disable automatic key creation' and 'Key expiry duration'.

Why this answer

Organization Policy Service allows administrators to set organization-wide policies, such as disabling service account key creation or setting key age constraints. Option A (Cloud Secret Manager) is incorrect because it is used for managing secrets like API keys, not service account keys. Option C (Cloud IAM) is incorrect because while IAM manages service account permissions, it does not provide lifecycle policies for keys.

Option D (Cloud Key Management Service) is incorrect because it manages encryption keys, not service account keys.

Full explanation →
304
MCQhard

A company using BigQuery for analytics needs to comply with the right to be forgotten (erasure) under GDPR. A data subject requests deletion of their personal data. What is the correct approach to delete data from BigQuery audit logs that contain the data subject's information?

A.Export audit logs to Cloud Storage and configure a log sink to filter out or redact personal data before it is stored.
B.Use Cloud DLP to scan and redact the audit logs in place within BigQuery.
C.Use a DELETE statement on the audit logs table in BigQuery to remove the records.
D.Set a table expiration on the audit logs dataset to delete all logs after a short period.
AnswerA

This approach allows selective redaction or exclusion of personal data from the exported logs, enabling compliance with erasure requests.

Why this answer

BigQuery audit logs are immutable and cannot be deleted individually. The recommended approach is to export logs to Cloud Storage and use log sinks to filter out or redact personal data before storage.

Full explanation →
305
MCQmedium

A company stores API keys in Secret Manager. They want to automatically rotate the secret every 60 days and have a Cloud Function triggered after each rotation to update dependent services. What is the correct approach?

A.Manually rotate the secret and set a Cloud Scheduler job to invoke the Cloud Function.
B.Use Cloud Scheduler to call the Secret Manager API to add a new version every 60 days, then trigger a Cloud Function via HTTP.
C.Set a rotation period on the secret and directly specify a Cloud Function as a webhook in Secret Manager.
D.Set a rotation period on the secret and configure a Pub/Sub topic for notifications. Create a Cloud Function subscribed to that topic.
AnswerD

This is the correct method: rotation triggers Pub/Sub, Cloud Function acts on it.

Why this answer

Secret Manager can set a rotation period and publish a Pub/Sub message upon rotation. A Cloud Function can subscribe to that topic and execute updates. Directly triggering from Secret Manager is not possible.

Cloud Scheduler is not needed.

Full explanation →
306
MCQmedium

A financial services company uses Cloud Storage to store sensitive customer data. They want to encrypt this data at rest using customer-managed encryption keys (CMEK) and automate key rotation every 90 days. Which approach should they take?

A.Rely on Google-managed encryption keys (default Cloud Storage encryption) and enable key rotation logs for auditing.
B.Create a Cloud KMS key ring and a key with rotation period 90 days. Use the key as CMEK for the Cloud Storage bucket.
C.Configure Cloud External Key Manager (EKM) to manage the encryption key externally and have Cloud Storage use it via CMEK integration.
D.Use customer-supplied encryption keys (CSEK) and implement a custom Cloud Function to rotate keys every 90 days.
AnswerB

This uses Cloud KMS with automatic rotation, meeting the customer-managed and rotation requirements.

Why this answer

Cloud KMS allows you to create a key ring and a key with a defined rotation period of 90 days, which can then be used as a customer-managed encryption key (CMEK) for a Cloud Storage bucket. This satisfies the requirement for customer-controlled key management and automated rotation without custom code.

Exam trap

Google Cloud often tests the distinction between CMEK (customer-managed keys in Cloud KMS with automated rotation) and CSEK (customer-supplied keys per request, no rotation support), leading candidates to mistakenly choose D for its perceived control without recognizing the operational overhead and lack of native rotation.

How to eliminate wrong answers

Option A is wrong because Google-managed encryption keys do not provide customer control over key rotation or auditing of key usage; they are fully managed by Google and cannot be rotated on a custom schedule. Option C is wrong because Cloud External Key Manager (EKM) is designed for keys managed outside Google Cloud, but the question specifies customer-managed keys within Google Cloud, and EKM does not support automated rotation via Cloud KMS policies. Option D is wrong because customer-supplied encryption keys (CSEK) require the customer to provide the key on every API call and do not support automated rotation; implementing a custom Cloud Function for rotation would be complex and error-prone, and CSEK is not integrated with Cloud KMS rotation schedules.

Full explanation →
307
MCQmedium

A multi-national corporation must prevent data exfiltration from a project containing PII for GDPR compliance. They want to restrict access to only allow data transfer within the organization. Which Google Cloud service meets this requirement?

A.Use firewall rules to block all egress traffic except to approved IP ranges.
B.Create a VPC Service Control perimeter that includes the project and restricts access to other perimeters.
C.Set IAM policies to deny the storage.objectViewer role to non-compliant users.
D.Configure Cloud NAT for the VPC to route traffic through a single IP.
AnswerB

VPC Service Controls prevent data exfiltration by blocking access from outside the service perimeter.

Why this answer

VPC Service Controls allow you to define perimeters that protect the resources and data of Google Cloud services. By creating a perimeter that includes the project containing PII, you can restrict data transfer to only within the organization, preventing exfiltration to external networks or unauthorized identities, which directly meets GDPR compliance requirements.

Exam trap

Google Cloud often tests the misconception that network-level controls (firewalls, NAT) are sufficient to prevent data exfiltration from managed services, when in fact API-level controls like VPC Service Controls are required to block data movement through Google Cloud APIs.

How to eliminate wrong answers

Option A is wrong because firewall rules control network traffic at the IP/port level but cannot restrict data exfiltration via Google Cloud APIs or services that bypass the network stack, such as Cloud Storage or BigQuery. Option C is wrong because IAM policies control who can perform actions on resources but do not restrict data movement; a user with valid IAM roles could still exfiltrate data to an external location. Option D is wrong because Cloud NAT provides outbound connectivity with a single IP for VMs but does not restrict data egress to approved destinations or prevent exfiltration via API calls.

Full explanation →
308
MCQeasy

A company is using Cloud SQL for MySQL to store financial data. They need to ensure that all data is encrypted at rest and in transit. What should they do?

A.Use client-side encryption before storing data in Cloud SQL.
B.Enable encryption at rest by checking a box in the Cloud Console.
C.Enable CMEK on the Cloud SQL instance and configure SSL/TLS.
D.Use the default encryption provided by Cloud SQL and enforce SSL/TLS connections.
AnswerD

Cloud SQL encrypts data at rest by default and supports SSL/TLS for in-transit encryption.

Why this answer

Cloud SQL for MySQL automatically encrypts data at rest using AES-256, with no additional configuration required. To protect data in transit, you must enforce SSL/TLS connections by configuring the instance to require SSL and downloading the server certificate for client connections. This combination satisfies both encryption requirements without unnecessary complexity.

Exam trap

Google Cloud often tests the misconception that encryption at rest requires manual enablement or CMEK, when in fact Cloud SQL encrypts all data at rest by default, and the key decision is whether to enforce SSL/TLS for data in transit.

How to eliminate wrong answers

Option A is wrong because client-side encryption is not necessary; Cloud SQL already provides encryption at rest, and client-side encryption would add unnecessary overhead and complexity without improving security. Option B is wrong because encryption at rest is enabled by default in Cloud SQL; there is no checkbox to enable it, and this option ignores the requirement for encryption in transit. Option C is wrong because CMEK (Customer-Managed Encryption Keys) is an optional feature for encryption at rest, not a requirement; the default encryption already meets the need, and while configuring SSL/TLS is correct, CMEK is not needed and adds key management overhead.

Full explanation →
309
MCQeasy

A company stores sensitive customer data in Cloud Storage. They want to ensure that only users with explicit IAM permissions can decrypt the data, and that Google does not have access to the encryption keys. Which encryption option should they use?

A.Customer-managed encryption keys (CMEK)
B.Google-managed encryption keys (GMEK)
C.Default encryption
D.Customer-supplied encryption keys (CSEK)
AnswerD

CSEK keys are not stored by Google; the customer supplies their own keys, and Google does not have access to them.

Why this answer

Customer-supplied encryption keys (CSEK) allow you to provide your own encryption keys, which are used to protect data at rest in Cloud Storage. Google does not store these keys on its servers; they are used only transiently during encryption/decryption operations and then discarded, ensuring that Google cannot access the keys or the decrypted data. This meets the requirement that only users with explicit IAM permissions can decrypt the data, as access to the CSEK must be granted through IAM roles like Storage Object Viewer with the CSEK key.

Exam trap

Google Cloud often tests the distinction between CMEK and CSEK, where candidates confuse 'customer-managed' (CMEK, stored in KMS) with 'customer-supplied' (CSEK, not stored by Google), leading them to incorrectly choose CMEK when the requirement is that Google has no access to the keys.

How to eliminate wrong answers

Option A is wrong because Customer-managed encryption keys (CMEK) are stored and managed in Cloud Key Management Service (KMS), and while you control the key, Google still has access to the key material in KMS, so Google could theoretically decrypt the data. Option B is wrong because Google-managed encryption keys (GMEK) are fully managed by Google, meaning Google has access to the keys and can decrypt the data at any time. Option C is wrong because Default encryption uses Google-managed keys (GMEK) by default, so Google has access to the encryption keys and can decrypt the data.

Full explanation →
310
MCQeasy

A security engineer needs to provide secure SSH access to a Compute Engine instance that has no external IP address. What is the recommended method?

A.Set up VPC peering with the instance's VPC.
B.Create a Cloud NAT to allow inbound SSH.
C.Add a firewall rule allowing SSH from any IP.
D.Use Identity-Aware Proxy (IAP) TCP forwarding.
AnswerD

IAP TCP forwarding establishes an encrypted tunnel to the instance via the IAP service.

Why this answer

Identity-Aware Proxy (IAP) TCP forwarding allows SSH access to instances without external IP addresses. Option A is incorrect because VPC peering connects VPC networks, not provide SSH access. Option B is incorrect because Cloud NAT is for outbound internet access, not inbound SSH.

Option C is incorrect because a firewall rule allowing SSH from any IP would still require the instance to have an external IP address.

Full explanation →
311
MCQeasy

A small startup recently moved their infrastructure to Google Cloud. They have a single project with a few Compute Engine instances running a web application. The security team wants to ensure that all SSH access to the instances is audited and that any failed SSH attempts are alerted in real time. They have enabled OS Login and are using Cloud Identity-Aware Proxy (IAP) for SSH access. However, they are not sure how to capture the audit logs for SSH sessions. What should they do?

A.Enable Data Access audit logs for the IAP service and filter the logs for SSH connection attempts.
B.Enable Serial Port access logs on the instances to capture SSH sessions.
C.Configure Cloud Monitoring to watch for SSH connections via agent metrics.
D.Enable guest attributes on the instances to log SSH attempts.
AnswerA

IAP TCP forwarding generates audit logs that capture connection details.

Why this answer

IAP TCP forwarding logs are available as Admin Activity audit logs, which can be used to audit SSH connections. Failed SSH attempts can be monitored in real time by setting up log-based alerts on these logs. Option B is incorrect because serial port access logs record output to the serial console, not SSH sessions over IAP.

Option C is incorrect because Cloud Monitoring agent metrics are for system metrics, not SSH audit logs. Option D is incorrect because guest attributes are metadata key-value pairs, not for logging SSH attempts.

Full explanation →
312
MCQhard

An organization uses Cloud NAT to allow private instances to access the internet. They notice that some connections are failing intermittently. What is a common cause?

A.The NAT IP address is exhausted because too many concurrent connections.
B.The NAT gateway does not support UDP traffic.
C.The VPC firewall rules block outbound traffic.
D.The instances are in a different region than the NAT gateway.
AnswerA

Port exhaustion from many concurrent connections can cause intermittent failures.

Why this answer

Cloud NAT maps private instances to a public IP address using port address translation (PAT). Each NAT IP supports approximately 64,512 concurrent connections (ports). When many connections are made, ports can be exhausted, causing intermittent failures.

Option B is incorrect because Cloud NAT supports UDP traffic. Option C is unlikely as VPC firewall rules typically allow outbound traffic by default. Option D is incorrect because Cloud NAT is regional and can serve instances in any zone within that region; the instances are in the same region as the NAT gateway.

Full explanation →
313
Multi-Selectmedium

Which TWO options are required to use Cloud DLP to successfully inspect data in a Cloud Storage bucket?

Select 2 answers
A.A service account with roles/storage.objectViewer to read the bucket.
B.A Cloud Function to send each file to the DLP API.
C.The bucket must be in the same project as the DLP job.
D.A Pub/Sub topic to receive inspection results.
E.The bucket must contain only text-based files (e.g., CSV, JSON).
AnswersA, E

DLP needs permission to access the objects.

Why this answer

Cloud DLP requires read access to the Cloud Storage bucket to inspect objects. The service account used by the DLP job must have the roles/storage.objectViewer IAM role, which grants permission to list and read objects without needing to download them. This ensures the DLP API can access the data for content inspection.

Exam trap

Google Cloud often tests the misconception that Cloud DLP requires additional infrastructure like Cloud Functions or Pub/Sub to inspect Cloud Storage, when in fact DLP can directly access buckets with the correct IAM permissions.

Full explanation →
314
MCQeasy

A developer accidentally committed a file containing a service account key to a public GitHub repository. Which action should be taken immediately to invalidate the compromised key?

A.Disable the service account key using IAM.
B.Delete the service account and create a new one.
C.Use Cloud DLP to find and redact the key.
D.Rotate the key using Cloud KMS.
AnswerA

Disabling the key immediately renders it unusable.

Why this answer

Immediately disabling the service account key using IAM (Identity and Access Management) is the fastest way to revoke the compromised credential's access to Google Cloud resources. Disabling the key prevents any further use of that key for authentication, even if it is still present in the public repository. This action does not affect other keys or the service account itself, allowing the developer to later rotate or delete the key without disrupting existing workloads.

Exam trap

Google Cloud often tests the distinction between 'disabling' a key (immediate revocation without side effects) and 'deleting' the service account (overly destructive), and candidates may confuse Cloud KMS (for encryption keys) with IAM (for service account keys).

How to eliminate wrong answers

Option B is wrong because deleting the entire service account would disrupt all workloads and resources that depend on that service account, including other valid keys and IAM bindings, which is an unnecessarily destructive action. Option C is wrong because Cloud DLP is a data loss prevention service used for inspecting and redacting sensitive data in content, but it cannot invalidate or revoke a key that has already been exposed; it only helps find and mask the key in the repository, not stop its use. Option D is wrong because Cloud KMS (Key Management Service) is used for managing encryption keys, not service account keys; rotating a key in Cloud KMS has no effect on a service account's JSON key file, which is a different type of credential.

Full explanation →
315
MCQmedium

A security engineer is configuring access for a service account used by a batch job that runs on Compute Engine. The job needs to read from a BigQuery dataset and write results to Cloud Storage. What is the recommended way to grant these permissions?

A.Use the default compute engine service account and grant it BigQuery Admin (roles/bigquery.admin) and Storage Admin (roles/storage.admin).
B.Create a custom role with bigquery.datasets.get, bigquery.tables.get, bigquery.tables.getData, storage.objects.create, storage.objects.get, and storage.objects.list.
C.Grant the service account the BigQuery Data Owner role (roles/bigquery.dataOwner) and Storage Admin (roles/storage.admin).
D.Grant the service account the BigQuery Data Viewer (roles/bigquery.dataViewer) and Storage Object Viewer (roles/storage.objectViewer).
AnswerB

This custom role follows least privilege, granting only read on BigQuery and write on Storage.

Why this answer

Create a custom role with the required BigQuery and Storage permissions, or use predefined roles: BigQuery Data Viewer (roles/bigquery.dataViewer) and Storage Object Admin (roles/storage.objectAdmin) for write access. The best practice is to use the principle of least privilege: grant only the necessary permissions. Predefined roles are acceptable if they match the needs.

Full explanation →
316
MCQhard

A security team has a Cloud KMS key used for encrypting Cloud Storage objects. They need to ensure that when the key is rotated, old data remains decryptable without manual re-encryption. They also want to minimize the number of key versions. Which approach should they take?

A.Use automatic rotation and disable previous key versions after 30 days.
B.Use automatic rotation and keep one previous key version indefinitely.
C.Use manual rotation and delete old key versions after confirmation that all data has been re-encrypted.
D.Use symmetric key with purpose SYMMETRIC_ENCRYPT_DECRYPT and set rotation period to 0 (never).
AnswerB

This ensures old data remains decryptable and minimizes versions.

Why this answer

Cloud KMS supports automatic key rotation while retaining previous key versions indefinitely. When a key is rotated, new data is encrypted with the latest version, but old data remains decryptable using the previous key version that is kept. This satisfies the requirement of minimizing manual intervention and key version count, as only one previous version is retained.

Exam trap

Google Cloud often tests the misconception that disabling or deleting old key versions is necessary for security, but the correct approach is to retain previous versions to ensure old data remains decryptable without manual re-encryption.

How to eliminate wrong answers

Option A is wrong because disabling previous key versions after 30 days would render old data undecryptable unless it has been re-encrypted, which contradicts the requirement to avoid manual re-encryption. Option C is wrong because manual rotation and deleting old key versions after re-encryption requires manual effort and does not minimize key versions; it also risks data loss if re-encryption is incomplete. Option D is wrong because setting a rotation period to 0 (never) means the key is never rotated, which fails the requirement to rotate keys and does not provide a mechanism to keep old data decryptable after rotation.

Full explanation →
317
MCQhard

A company uses Cloud HSM to protect their cryptographic keys. They need to ensure that the key material never leaves the HSM. Which key purpose is supported by Cloud HSM keys?

A.Only symmetric ENCRYPT_DECRYPT
B.Only MAC purpose
C.All key purposes (ENCRYPT_DECRYPT, ASYMMETRIC_SIGN, ASYMMETRIC_DECRYPT, MAC)
D.Only asymmetric purposes
AnswerC

Cloud HSM supports all key purposes, with key material protected inside the HSM.

Why this answer

Cloud HSM provides FIPS 140-2 Level 3 validated HSM for key material. HSM keys can have purposes ENCRYPT_DECRYPT, ASYMMETRIC_SIGN, ASYMMETRIC_DECRYPT, and MAC. The key material remains inside the HSM cluster and is never exposed to the customer.

Software keys (software-backed) are stored in Cloud KMS but not in HSM.

Full explanation →
318
MCQhard

During a security incident, a forensic investigator needs to analyze a compromised Compute Engine instance without affecting the live environment. The instance has persistent disks with critical data. What is the best first step to preserve evidence?

A.Clone the instance to a new VM.
B.Export the disk image to Cloud Storage.
C.Enable VPC Flow Logs for the instance's network.
D.Create a snapshot of the persistent disks.
AnswerD

Snapshot preserves data without downtime.

Why this answer

Creating a snapshot of the persistent disks preserves a point-in-time copy without affecting the running instance. The snapshot can then be used to create a new disk attached to a forensic VM for analysis. Disk cloning requires stopping the instance.

Full explanation →
319
MCQhard

A company needs to allow developers to create and manage custom IAM roles at the project level, but restrict the permissions that can be added to those roles to a predefined list. What should be used?

A.Grant the developers the IAM Role Administrator role (roles/iam.roleAdmin) and rely on training to only use allowed permissions.
B.Use a custom organization policy constraint to define the allowed permissions for custom roles.
C.Grant the developers the Project IAM Admin role (roles/resourcemanager.projectIamAdmin) and restrict roles via a deny policy.
D.Use the constraint constraints/iam.allowedPolicyMemberDomains to restrict the domains of members who can be assigned roles.
AnswerB

Custom constraints can restrict which permissions can be included in custom roles.

Why this answer

Custom roles can be defined at the organization or project level. To restrict the permissions that can be included, use an organization policy with a custom constraint that specifies allowed permissions for custom roles. Roles Administrator (roles/iam.roleAdmin) allows managing all roles.

Organization policy constraints like constraints/iam.allowedPolicyMemberDomains restrict member domains, not permissions. The correct approach is to create a custom organization policy constraint that limits the permissions that can be added to a custom role.

Full explanation →
320
MCQhard

An engineer is configuring Cloud Armor for an HTTP(S) load balancer and needs to allow traffic only from users who have been authenticated by Identity-Aware Proxy (IAP). The backend service already has IAP enabled. What additional configuration is needed to ensure that only authenticated requests reach the backend?

A.Configure Cloud Armor to allow only traffic from the IP ranges used by IAP
B.Create a Cloud Armor security policy that requires a valid JWT token signed by IAP
C.No additional configuration is needed; IAP already blocks unauthenticated requests
D.Set a firewall rule on the backend instances to allow traffic only from the load balancer's health check IPs
AnswerC

IAP intercepts requests before they reach Cloud Armor and rejects unauthenticated ones.

Why this answer

When IAP is enabled on a backend service, it intercepts all requests and blocks unauthenticated traffic before it reaches the backend. Cloud Armor operates at the edge, but since IAP already enforces authentication at the application layer, no additional Cloud Armor configuration is required to restrict access to authenticated users. The load balancer forwards only requests that have passed IAP authentication to the backend.

Exam trap

The trap here is that candidates overthink the question and assume Cloud Armor must be explicitly configured to work with IAP, when in fact IAP independently blocks unauthenticated traffic at the load balancer level, making additional Cloud Armor rules unnecessary for this specific requirement.

How to eliminate wrong answers

Option A is wrong because IAP does not use fixed IP ranges for its authentication proxy; it uses a global, dynamic set of IPs that are not documented or stable, so relying on IP-based allowlisting in Cloud Armor would be unreliable and is not a supported method for IAP integration. Option B is wrong because Cloud Armor does not natively validate JWT tokens signed by IAP; JWT validation is handled by IAP itself at the application layer, and Cloud Armor security policies cannot inspect or validate JWT tokens for IAP authentication. Option D is wrong because firewall rules on backend instances that allow only load balancer health check IPs are unrelated to IAP authentication; they are used for network-level access control and do not enforce user authentication.

Full explanation →
321
MCQmedium

A company wants to allow its on-premises applications to access Google Cloud resources using short-lived credentials without storing a service account key file. Which solution should they use?

A.Configure Workload Identity Federation between the on-premises identity provider and Google Cloud.
B.Set up a Cloud VPN connection and use private IPs to access resources.
C.Create a service account and download a JSON key file to the on-premises server.
D.Use signed URLs to grant access for each request.
AnswerA

This provides short-lived credentials without keys.

Why this answer

Workload Identity Federation allows on-premises applications to exchange tokens from an external identity provider (IdP) for short-lived Google Cloud access tokens, eliminating the need to store a service account key file. This solution meets the requirement for short-lived credentials and avoids the security risk of long-lived static keys.

Exam trap

Google Cloud often tests the distinction between network-level solutions (VPN) and identity-level solutions (federation), so candidates may incorrectly choose a VPN because it seems like a secure connection, but it does not solve the credential management requirement.

How to eliminate wrong answers

Option B is wrong because a Cloud VPN provides network-level connectivity but does not address authentication or the need for short-lived credentials; it still requires a service account or other identity to authorize access. Option C is wrong because downloading a JSON key file creates a long-lived static credential, which violates the requirement to avoid storing a service account key file and introduces security risks. Option D is wrong because signed URLs are used to grant time-limited access to specific objects in Cloud Storage, not for general access to Google Cloud resources by on-premises applications.

Full explanation →
322
Drag & Dropmedium

Drag and drop the steps to set up Cloud Armor with a WAF rule in the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4

Why this order

Cloud Armor configuration involves creating the policy, defining rules, attaching to a backend, enabling logging, and testing.

Full explanation →
323
MCQhard

A security engineer needs to configure Cloud KMS key rotation so that existing ciphertext can still be decrypted with old key versions, but new encryption uses the latest version. Which key management practice meets this requirement?

A.Set a rotation period on the key; Cloud KMS automatically creates new versions while old versions remain available for decryption.
B.Use a single key and manually update its material every 90 days.
C.Create a new key version manually and disable the previous version after a grace period.
D.Create a new key every rotation and delete the old key after confirming re-encryption.
AnswerA

Cloud KMS key rotation creates new versions; old versions stay enabled for decryption.

Why this answer

Cloud KMS supports key rotation by creating new key versions while retaining all previous versions. When you set a rotation period, Cloud KMS automatically generates a new version at the specified interval, and the key's primary version (used for new encryption) is updated. Old key versions remain enabled and available for decryption of existing ciphertext, ensuring that data encrypted with older versions can still be decrypted without manual intervention.

Exam trap

Google Cloud often tests the misconception that key rotation requires manual management or that old key versions must be disabled or deleted to enforce security, but the correct practice is to retain old versions for decryption while using the latest version for new encryption.

How to eliminate wrong answers

Option B is wrong because manually updating the key material every 90 days does not create separate key versions; it replaces the existing key material, which would break the ability to decrypt ciphertext encrypted with the previous material. Option C is wrong because disabling the previous key version after a grace period would prevent decryption of any ciphertext encrypted with that version, violating the requirement that old ciphertext remains decryptable. Option D is wrong because deleting the old key after re-encryption is not a rotation practice; it requires manual re-encryption of all data and introduces risk of data loss if re-encryption is incomplete, and it does not leverage Cloud KMS's built-in versioning for seamless decryption of old ciphertext.

Full explanation →
324
MCQeasy

A company must ensure that only authorized users can access sensitive data in Cloud Storage for PCI DSS compliance. They have configured a bucket with uniform bucket-level access. Which IAM policy should they use to grant access to a security team?

A.Bind the security team to roles/storage.objectViewer at the bucket level.
B.Bind the security team to roles/storage.legacyBucketReader at the bucket level.
C.Use ACLs to give the security team READ access to the bucket.
D.Bind the security team to roles/storage.admin at the project level.
AnswerA

Provides read-only access to objects, following least privilege.

Why this answer

The 'Storage Object Viewer' role grants read-only access to objects, which is sufficient for security monitoring. Option B is wrong because the admin role grants full access, violating least privilege. Option C is wrong because bucket-level access is already uniform, so ACLs are not needed.

Option D is wrong because the bucket admin role gives full control, which is excessive.

Full explanation →
325
MCQeasy

A junior developer created a service account with the roles/storage.admin role and downloaded a JSON key. What is the best practice to improve security?

A.Delete the key and use workload identity federation.
B.Rotate the key every 30 days.
C.Use a user-managed service account instead.
D.Restrict the key's usage with IP allowlists.
AnswerA

Workload identity federation allows authentication without keys, improving security.

Why this answer

The best practice is to delete the long-lived JSON key and use workload identity federation, which allows resources to assume a service account identity without a key. This eliminates the risk of key leakage or compromise. Option A is correct.

Option D (IP allowlists) adds some protection but does not remove the vulnerability of the key itself. Option B (rotation) reduces the exposure window but still uses keys. Option C (user-managed service account) is not relevant.

Full explanation →
326
MCQmedium

A company has multiple VPC networks that need to communicate privately. They are evaluating VPC peering and Shared VPC. Which statement correctly describes a limitation of VPC peering compared to Shared VPC?

A.VPC peering cannot route traffic to an on-premises network via VPN
B.VPC peering does not support firewall rules
C.VPC peering does not support transitive peering
D.VPC peering requires all networks to be in the same project
AnswerC

This is a key limitation. Shared VPC allows all projects in the same host project to communicate directly.

Why this answer

VPC peering does not support transitive peering, meaning if networks A and B are peered, and A and C are peered, B cannot communicate with C through A. Shared VPC does not have this limitation.

Full explanation →
327
Multi-Selecteasy

A company needs to comply with GDPR requirements for data subject rights. They must be able to provide data subjects with access to their personal data and rectify inaccuracies. Which TWO Google Cloud services can assist with these requirements? (Choose two.)

Select 2 answers
A.Cloud Data Loss Prevention (Cloud DLP)
B.BigQuery
C.Cloud Key Management Service (Cloud KMS)
D.Cloud Audit Logs
E.Cloud Storage
AnswersA, B

Cloud DLP helps discover and classify personal data, supporting access and rectification requests.

Why this answer

Cloud DLP can be used to locate and classify personal data across Google Cloud services, helping to fulfill data subject access requests. BigQuery can be used to query and analyze data, allowing retrieval of personal data for access requests. Cloud Audit Logs track access but do not provide data.

Cloud Storage is a storage service but does not directly assist with access/rectification. Cloud KMS is for key management.

Full explanation →
328
MCQmedium

Refer to the exhibit. A security engineer runs this command to check bucket permissions. What is the most significant security issue?

A.The domain example.com has viewer access, which may be too broad.
B.The legacy role 'roles/storage.legacyBucketReader' is used.
C.The bucket allows public read access via 'allUsers' in both ACL and legacy role.
D.Uniform bucket-level access is disabled, allowing ACLs.
AnswerC

AllUsers gives access to anyone on the internet.

Why this answer

The command output shows that the bucket has both an ACL granting 'allUsers' READER access and a legacy bucket role 'roles/storage.legacyBucketReader' assigned to 'allUsers'. This means the bucket is publicly readable via two independent mechanisms, which is the most significant security issue as it exposes all objects to the internet without authentication.

Exam trap

Google Cloud often tests the distinction between a legacy role being used (which is not inherently insecure) versus that role being granted to 'allUsers' (which creates public access), causing candidates to incorrectly select Option B because they focus on the role name rather than the principal it is assigned to.

How to eliminate wrong answers

Option A is wrong because the domain example.com having viewer access is not inherently a security issue; it is a specific domain restriction that limits access to authenticated users from that domain, which is more restrictive than public access. Option B is wrong because the legacy role 'roles/storage.legacyBucketReader' is not a security issue by itself; it is a valid role that provides read access to bucket metadata, and the problem is that it is granted to 'allUsers', not the role's existence. Option D is wrong because uniform bucket-level access being disabled is a configuration choice that allows ACLs, but it is not the most significant security issue; the actual exposure comes from the combination of public ACL and public legacy role assignment.

Full explanation →
329
MCQmedium

An organization handles ITAR-controlled data and must restrict Google personnel access to the underlying infrastructure. Which Google Cloud product should they use to enforce this restriction?

A.Assured Workloads
B.IAM Conditions
C.VPC Service Controls
D.Cloud HSM
AnswerA

Assured Workloads enforces compliance controls including Access Transparency and Access Approval to restrict and audit Google personnel access.

Why this answer

Assured Workloads includes Access Transparency and Access Approval controls to restrict Google personnel access. When creating an Assured Workload with ITAR regime, these controls are enabled by default.

Full explanation →
330
MCQmedium

A developer needs to deploy an application on Compute Engine that reads from a Cloud Storage bucket. The engineer wants to avoid managing service account keys. What is the recommended approach to grant the necessary permissions?

A.Create a service account, generate a JSON key, and store it on the instance.
B.Use the default Compute Engine service account and grant it the Storage Object Viewer role.
C.Use Application Default Credentials (ADC) without a service account.
D.Create a custom service account, grant it required roles, and attach it to the Compute Engine instance.
AnswerD

This follows the principle of least privilege and avoids key management.

Why this answer

Attaching a custom service account directly to a Compute Engine instance is the recommended approach to avoid managing service account keys. This method uses the instance's metadata to provide credentials via the instance metadata server, eliminating the need to download, store, or rotate JSON key files. The custom service account can be granted only the required roles (e.g., Storage Object Viewer) following the principle of least privilege.

Exam trap

Many candidates think the default Compute Engine service account is the simplest choice, but it often has excessive permissions (e.g., editor role) and is not recommended for production. The correct approach is to create a custom service account with minimal roles and attach it to the instance.

How to eliminate wrong answers

Option A is wrong because generating a JSON key and storing it on the instance introduces security risks and management overhead, directly contradicting the requirement to avoid managing service account keys. Option B is wrong because the default Compute Engine service account typically has overly broad permissions (e.g., project editor role) by default, and granting it Storage Object Viewer does not follow least privilege; moreover, using the default service account is not the recommended approach for production workloads. Option C is wrong because Application Default Credentials (ADC) still require a service account to be attached to the instance or a key file to be provided; ADC is a mechanism for finding credentials, not a substitute for a service account.

Full explanation →
331
Multi-Selecteasy

Which two authentication methods are available for applications to authenticate to Google Cloud APIs without using a service account key? (Choose TWO.)

Select 2 answers
A.API key
B.Compute Engine metadata server default service account token
C.OAuth 2.0 client ID
D.Workload Identity Federation
E.Service account key
AnswersB, D

Instances can use the default service account to get tokens without keys.

Why this answer

The Compute Engine metadata server provides a default service account token that applications running on Compute Engine can use to authenticate to Google Cloud APIs without needing to manage a service account key file. This token is automatically obtained from the metadata server at http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token, and it is rotated automatically by Google, eliminating the need for key storage and rotation.

Exam trap

Google Cloud often tests the distinction between methods that require a key (service account key, OAuth 2.0 client secret) and those that do not (metadata server, Workload Identity Federation), and the trap here is that candidates may incorrectly select API key or OAuth 2.0 client ID because they are familiar with them for user authentication, but they do not satisfy the 'without using a service account key' condition for application-to-API authentication.

Full explanation →
332
MCQhard

A financial institution must store data in specific EU regions to comply with GDPR. They want to prevent users from creating resources in other regions. Which organization policy should they set?

A.Use IAM roles to restrict Compute Engine instance creation
B.Create an Assured Workloads folder with EU data boundary
C.Configure Cloud KMS key ring location constraint
D.Set the `gcp.resourceLocations` constraint at the organization or folder level
AnswerD

This constraint defines the list of allowed resource locations, blocking creation outside those regions.

Why this answer

The `gcp.resourceLocations` organization policy constraint is the correct mechanism to restrict where resources can be created in Google Cloud. By setting this list constraint at the organization or folder level, you can specify allowed locations (e.g., EU regions), and any attempt to create a resource outside those regions will be denied. This directly enforces GDPR data residency requirements without relying on IAM roles or service-specific configurations.

Exam trap

Google Cloud often tests the distinction between IAM-based access control and organization policy constraints, leading candidates to mistakenly choose IAM roles (Option A) when the question is about restricting resource locations rather than user permissions.

How to eliminate wrong answers

Option A is wrong because IAM roles control who can perform actions, not where resources can be created; they cannot enforce geographic restrictions. Option B is wrong because Assured Workloads provides compliance controls for regulated workloads but does not itself restrict resource creation locations; it is a folder-level container with predefined controls, not a location constraint. Option C is wrong because Cloud KMS key ring location constraints only apply to key rings and crypto keys, not to all resource types; they cannot prevent users from creating Compute Engine instances or storage buckets in disallowed regions.

Full explanation →
333
MCQhard

A financial services company runs a PCI DSS-compliant workload on Google Cloud. They use a service account with roles/container.clusterAdmin to manage a GKE cluster. The security team has enabled Binary Authorization with a policy that requires all container images to be signed by a trusted authority. Recently, a developer reported that a new deployment failed with the error: 'Image verification failed: no signature found for digest sha256:abc...'. The image is stored in Artifact Registry and the developer built it using Cloud Build with a trigger that automatically signs images using Cloud KMS. The Cloud Build service account has roles/cloudkms.signerVerifier and roles/binaryauthorization.attestorsViewer. The Binary Authorization policy is configured to require at least one attestation from the trusted attestor. What is the most likely reason for the failure?

A.The Cloud Build service account lacks the roles/binaryauthorization.attestorsEditor role.
B.The container image is stored in a different registry that is not supported by Binary Authorization.
C.The GKE cluster's node service account does not have permission to verify attestations.
D.The Binary Authorization policy requires an attestation from a different attestor that is not configured.
AnswerA

This role is required to create attestations. Without it, the image is never signed, so verification fails.

Why this answer

The Cloud Build service account has roles/cloudkms.signerVerifier and roles/binaryauthorization.attestorsViewer, which allow it to sign images and view attestors, but it lacks the roles/binaryauthorization.attestorsEditor role. Without this role, the service account cannot create or manage attestations in Binary Authorization, so even though the image is signed, no attestation is recorded, causing the policy to fail with 'no signature found'.

Exam trap

Google Cloud often tests the distinction between signing an image (which requires Cloud KMS permissions) and creating an attestation (which requires Binary Authorization attestor editor permissions), leading candidates to overlook the missing attestorsEditor role.

How to eliminate wrong answers

Option B is wrong because Artifact Registry is fully supported by Binary Authorization, and the error indicates the image is stored there. Option C is wrong because the node service account does not need to verify attestations; Binary Authorization enforcement happens at the admission controller level, not via node permissions. Option D is wrong because the policy is configured to require at least one attestation from the trusted attestor, and the issue is that no attestation was created, not that a different attestor is required.

Full explanation →
334
MCQhard

A company uses multiple GCP projects and wants to allow a service account from Project A to initiate Dataflow jobs in Project B. The service account in Project A has the Dataflow Developer role at the organization level. However, it fails with permission denied when trying to submit a job to Project B. What is the most likely issue?

A.The organization policy restricts cross-project access.
B.The service account does not have permission to create Dataflow jobs in Project B because it is not a member of Project B.
C.The Dataflow API is not enabled in Project B.
D.The service account needs the Service Account User role on the Dataflow service account in Project B.
AnswerD

To act as the project's compute service account, the launching service account needs roles/iam.serviceAccountUser.

Why this answer

The service account from Project A has the Dataflow Developer role at the organization level, which grants permissions to create Dataflow jobs, but it still needs the Service Account User role (roles/iam.serviceAccountUser) on the Dataflow service account in Project B. When a Dataflow job is submitted, the job runs as a service account in the target project (Project B), and the caller must have the iam.serviceAccounts.actAs permission on that service account. Without this role, the API call fails with a permission denied error even though the Dataflow Developer role is present.

Exam trap

Google Cloud often tests the distinction between having a role that grants the ability to create a resource (like Dataflow Developer) versus the need for the Service Account User role to act as the service account that runs the resource, which is a subtle but critical IAM permission requirement.

How to eliminate wrong answers

Option A is wrong because organization policies can restrict cross-project access, but the question states the failure is a permission denied error when submitting a job, not a policy violation, and there is no indication that an organization policy is blocking the action. Option B is wrong because the service account does not need to be a member of Project B; it can be granted roles at the organization level or via IAM cross-project permissions, and the Dataflow Developer role at the org level already grants the necessary Dataflow permissions across projects. Option C is wrong because if the Dataflow API were not enabled in Project B, the error would typically be an API not enabled error (e.g., 403 with 'API has not been used'), not a permission denied error; the question explicitly states 'permission denied'.

Full explanation →
335
MCQmedium

An organization wants to enforce that all container images deployed to a GKE cluster must be signed by an approved authority. They have set up Binary Authorization with a policy that requires attestation. Where should the signing key be stored to meet security best practices?

A.Store the private key in a GCS bucket with uniform bucket-level access.
B.Store the private key in Secret Manager.
C.Store the private key in Cloud Key Management Service (Cloud KMS).
D.Store the private key on the developer's workstation.
AnswerC

Cloud KMS is the secure and managed way to store keys for Binary Authorization.

Why this answer

Binary Authorization integrates with Cloud Key Management Service (KMS) to store attestor keys. Cloud KMS provides centralized key management, access control via IAM, and audit logging. Using a key stored in Cloud KMS is the recommended approach.

Full explanation →
336
MCQhard

A Cloud Function that processes financial data is timing out after 60 seconds. The function performs complex calculations and cannot be decomposed further. What is the best solution?

A.Migrate the function to Cloud Run with a longer timeout
B.Change the Cloud Functions runtime from Node.js to Python
C.Increase the allocated memory for the function
D.Increase the Cloud Functions timeout to 120 seconds and optimize the code
AnswerD

Cloud Functions allows timeout up to 60 minutes for HTTP triggers; increasing it and optimizing code addresses the timeout directly.

Why this answer

Cloud Functions provides a configurable timeout, and the maximum timeout for HTTP functions is 60 minutes, so increasing the timeout to 120 seconds is feasible. Additionally, optimizing the code can reduce execution time. Option A is wrong because migrating to Cloud Run adds complexity and does not necessarily resolve a timeout caused by slow code; Cloud Run also has a default timeout of 60 minutes, so it may not be better than simply increasing Cloud Functions timeout.

Option B is wrong because changing the programming language does not inherently reduce execution time; performance depends on the logic and algorithms. Option C is wrong because increasing memory may slightly improve CPU performance but does not extend the timeout limit; the function still times out at 60 seconds if it is not completed.

Full explanation →
337
Multi-Selectmedium

A company wants to ensure compliance with PCI DSS by monitoring access to BigQuery datasets containing sensitive data. They need to log all read operations and enable real-time alerting for anomalous access. Which TWO actions should they take? (Choose TWO.)

Select 2 answers
A.Create a log sink to export BigQuery Data Access logs to Pub/Sub.
B.Enable Admin Activity logs for BigQuery.
C.Enable Data Access logs for BigQuery.
D.Use Security Command Center to detect sensitive data access.
E.Create a BigQuery view to restrict access to sensitive columns.
AnswersA, C

Pub/Sub enables real-time streaming for alerting.

Why this answer

BigQuery Data Access logs record read operations but are not enabled by default. To enable them, you must explicitly enable Data Access logs for BigQuery. For real-time alerting, you can export logs to Pub/Sub and process them with a Cloud Function.

Full explanation →
338
Multi-Selecthard

Which THREE are best practices for managing encryption keys in Google Cloud?

Select 3 answers
A.Enable automatic rotation for keys that are used for encryption.
B.Use key versions and disable old versions instead of deleting them.
C.Use IAM conditions to restrict key usage based on caller IP or time.
D.Import key material from on-premises HSMs to avoid vendor lock-in.
E.Automatically delete old key versions once they expire.
AnswersA, B, C

Rotation limits the amount of data encrypted with a single key.

Why this answer

Cloud KMS supports automatic key rotation, which reduces the risk of key compromise by ensuring that encryption keys are periodically replaced without manual intervention. Automatic rotation creates new key versions at a specified interval (e.g., every 90 days) and automatically uses the latest version for encryption, while decryption can still use older versions. This aligns with the security best practice of limiting the amount of data encrypted under a single key version.

Exam trap

Google Cloud often tests the misconception that deleting old key versions is a security best practice, when in fact it destroys the ability to decrypt legacy data, and they also test the false assumption that importing keys from on-premises HSMs reduces vendor lock-in, when it actually ties you more tightly to the cloud provider's key management APIs.

Full explanation →
339
MCQhard

A company has multiple Google Cloud projects organized under folders by department. The security team wants to enforce a policy that all Compute Engine instances must use Shielded VM features. They need to prevent non-compliant instances from being created. Which action should be taken to enforce this requirement most effectively?

A.Create an IAM deny policy at the organization level that denies the compute.instances.create permission unless the Shielded VM flag is set.
B.Create a custom role that includes the permission to create instances only with Shielded VM, and assign it to all users.
C.Use the Organization Policy Service with the constraint constraints/compute.requireShieldedVm.
D.Implement a service account that only has permission to create instances and use service account impersonation for all instance creation.
AnswerC

This built-in constraint forces Shielded VM to be required when creating instances. It can be applied at the folder level to cover all projects under a department.

Why this answer

Organization Policy constraints are the correct mechanism to enforce requirements across the resource hierarchy. The built-in constraint 'constraints/compute.requireShieldedVm' ensures that any new Compute Engine instance must have Shielded VM features enabled. This policy can be applied at the organization, folder, or project level.

IAM roles or custom roles cannot enforce instance configuration requirements. Service account impersonation is unrelated. Deny policies can deny specific permissions but not enforce Shielded VM settings.

Full explanation →
340
Multi-Selectmedium

Which THREE of the following are best practices for using Cloud DLP to protect sensitive data in BigQuery?

Select 3 answers
A.Use inspection jobs to scan tables and identify sensitive data.
B.Store transformed data in a separate dataset with stricter access controls.
C.Use DLP to classify data and then apply access controls based on data classification.
D.Automatically apply deidentification transformations to sensitive columns.
E.Encrypt the entire BigQuery table using CMEK.
AnswersA, C, D

Inspecting data is a foundational step for data protection.

Why this answer

Cloud DLP inspection jobs can scan BigQuery tables to identify sensitive data types (e.g., PII, credit card numbers) using built-in infoTypes. This is a foundational step before applying any deidentification or access control measures, as it allows you to discover where sensitive data resides.

Exam trap

Google Cloud often tests the distinction between data discovery/inspection (DLP) and data protection mechanisms like encryption (CMEK) or access control (IAM), leading candidates to confuse complementary security controls with DLP-specific best practices.

Full explanation →
341
MCQeasy

A company has a compliance policy requiring that all data at rest in Cloud Storage be encrypted with a Cloud KMS key that is rotated every 90 days. The company uses CMEK with automatic key rotation enabled. An auditor discovers that some older objects in a bucket were created with a previous key version that has since been disabled. The compliance team requires that all objects be re-encrypted with the current key version. The bucket does not have object versioning enabled. What should the security engineer do to remediate this issue?

A.Re-enable the disabled key version in Cloud KMS so that objects can be read with the old key.
B.Use the 'gsutil rewrite -k' command to re-encrypt the objects with the current key version.
C.Enable object versioning on the bucket and delete the non-compliant object versions.
D.Create a new bucket with default encryption set to the current key and copy objects to it.
AnswerB

This command rewrites the object using the bucket's current KMS key, effectively re-encrypting it without changing other properties.

Why this answer

The 'gsutil rewrite -k' command re-encrypts existing objects in Cloud Storage with the current Cloud KMS key version, without requiring object versioning or re-uploading. This directly addresses the compliance requirement to re-encrypt all objects with the current key version, even though the old key version is disabled.

Exam trap

Google Cloud often tests the misconception that re-enabling a disabled key version or copying objects to a new bucket is sufficient for compliance, when in fact only a direct re-encryption operation like 'gsutil rewrite -k' ensures the objects are encrypted with the current key version.

How to eliminate wrong answers

Option A is wrong because re-enabling the disabled key version does not re-encrypt the objects; it only allows decryption with the old key, leaving the objects non-compliant. Option C is wrong because enabling object versioning and deleting non-compliant versions does not re-encrypt the existing objects; it only removes old versions, but the current live objects remain encrypted with the old key. Option D is wrong because creating a new bucket and copying objects does not re-encrypt them with the current key; the copy operation preserves the original encryption unless explicitly re-encrypted, and it is an inefficient workaround compared to the direct rewrite command.

Full explanation →
342
MCQmedium

A company uses Security Command Center (SCC) Premium tier and wants to automatically trigger a Cloud Function to remediate a threat finding. Which approach should they use?

A.Configure SCC to send findings to a Pub/Sub topic, and subscribe a Cloud Function to that topic.
B.Use Cloud Tasks to periodically invoke Cloud Functions after reading findings from Security Command Center API.
C.Create a Cloud Scheduler job that polls SCC findings periodically and invokes Cloud Functions.
D.Export SCC findings to Cloud Storage, and set up a Cloud Function on object finalize.
AnswerA

This is the correct pattern: SCC notifications via Pub/Sub trigger a Cloud Function for automated response.

Why this answer

SCC can send real-time notifications via Pub/Sub when findings of certain types or severities are created. A Cloud Function can subscribe to that topic to perform automated remediation. Cloud Scheduler cannot be triggered by events; Cloud Tasks is for asynchronous task execution but not designed for event-driven triggers from SCC; Logs Router exports logs but does not directly trigger Cloud Functions based on findings.

Full explanation →
343
MCQhard

A company has a VPC with a subnet (10.1.0.0/24) in us-central1. They have a Cloud NAT configured for outbound traffic to the internet. They want instances in this subnet to access a third-party API that is only accessible over the internet and requires a specific static source IP for whitelisting. What is the recommended approach?

A.Assign external IPs to the instances and use network-level access controls.
B.Use Private Google Access to route traffic through Google's network.
C.Reserve a static NAT IP in Cloud NAT and whitelist that IP with the third party.
D.Configure a VPC Service Controls perimeter to restrict egress.
AnswerC

Cloud NAT can use a static external IP that is consistent and can be whitelisted.

Why this answer

Cloud NAT allows instances without external IPs to initiate outbound connections to the internet. By reserving a static NAT IP address in Cloud NAT, you ensure all outbound traffic from the subnet uses a consistent source IP, which can be whitelisted by the third-party API. This meets the requirement for a static source IP without assigning external IPs to individual instances.

Exam trap

The trap here is that candidates may confuse Private Google Access (which only works for Google APIs) with general internet egress, or assume that assigning ephemeral external IPs is sufficient for static whitelisting, ignoring that ephemeral IPs can change on instance restart or stop/start.

How to eliminate wrong answers

Option A is wrong because assigning external IPs to instances would expose them directly to the internet, increasing the attack surface, and does not guarantee a static source IP unless static external IPs are used and managed per instance, which is less scalable and secure than Cloud NAT. Option B is wrong because Private Google Access is designed for accessing Google APIs and services through Google's internal network, not for routing traffic to third-party internet APIs; it does not provide a static source IP for external destinations. Option D is wrong because VPC Service Controls perimeters are used to restrict data exfiltration from Google Cloud services (e.g., Cloud Storage, BigQuery) and do not control outbound internet traffic from compute instances to third-party APIs.

Full explanation →
344
MCQmedium

A company subject to GDPR receives a request from a data subject to delete all personal data from BigQuery audit logs. The logs contain query execution details with user identifiers. How can the company comply with the right to erasure (right to be forgotten)?

A.Create a log sink to export logs to Cloud Storage, then delete the sink and the exported objects
B.Use the Data Subject Request tool in Google Cloud to request erasure of the specific personal data from audit logs
C.Delete the entire BigQuery dataset containing the logs
D.Use Cloud DLP to redact personally identifiable information from the logs
AnswerB

Google provides a Data Subject Request mechanism to request deletion of personal data from logs. Customers cannot delete logs directly.

Why this answer

BigQuery audit logs (Cloud Audit Logs) are immutable and cannot be deleted directly by customers. To comply with erasure requests, the company must use the Data Subject Request tool to request removal, as Google retains logs for 30 days and may need to remove them.

Full explanation →
345
MCQeasy

A company using Google Cloud wants to conduct a penetration test on their infrastructure. According to Google's acceptable use policy, what must they do before testing?

A.Create a separate VPC network for testing
B.Submit a request to Google support for each test
C.Ensure that the tests do not include Denial of Service (DoS) attacks
D.Enable VPC Flow Logs for monitoring
AnswerC

DoS attacks are prohibited without prior approval from Google. Other types of testing are allowed without notification.

Why this answer

Google's policy allows penetration testing on most services without prior approval, as long as the tests are not Denial of Service (DoS) attacks. This applies to common GCP services like Compute Engine, GKE, and Cloud Functions.

Full explanation →
346
MCQmedium

A security engineer notices that some developers are still uploading their own public SSH keys to Compute Engine instances despite the organization policy above being applied to the folder. What is the most likely reason?

A.The policy only applies to projects, not folders.
B.The policy takes 24 hours to propagate to all projects.
C.The policy disables uploading service account keys, not user SSH keys.
D.The policy was applied at the organization level, not the folder level.
AnswerC

The policy name indicates it's for service account keys, not SSH keys.

Why this answer

The organization policy described likely restricts the uploading of service account keys, not user SSH keys. The policy in question is typically the 'Disable service account key upload' constraint (iam.disableServiceAccountKeyUpload), which prevents users from creating or uploading external service account keys. It does not affect the ability to add public SSH keys to Compute Engine instances, which is governed by separate metadata-based mechanisms (e.g., oslogin or instance metadata).

Therefore, developers can still upload their own SSH keys despite the policy being applied.

Exam trap

The trap here is that candidates confuse 'keys' in general (SSH keys vs. service account keys) and assume a policy restricting key uploads applies to all key types, when in fact it only targets service account key operations.

How to eliminate wrong answers

Option A is wrong because organization policies can be applied at the folder level and will propagate to all projects within that folder; the policy does apply to folders, not just projects. Option B is wrong because organization policy propagation is near-instantaneous (typically within minutes), not 24 hours; there is no standard 24-hour delay for such policies. Option D is wrong because the scenario states the policy was applied to the folder, and applying it at the organization level would be even broader, not a reason for it to fail; the issue is the policy's scope (service account keys vs.

SSH keys), not the hierarchical level.

Full explanation →
347
MCQeasy

A security engineer needs to automatically rotate a database password stored in Secret Manager every 60 days. Which approach meets this requirement with minimal operational overhead?

A.Set the secret's `next_rotation_time` to 60 days from now; no further action needed
B.Enable automatic rotation with a 60-day period in Cloud KMS, which will automatically update the secret
C.Use a cron job on Compute Engine to update the secret every 60 days
D.Set the rotation period in Secret Manager to 60 days and configure a Pub/Sub topic to trigger a Cloud Function that generates a new password
AnswerD

This automates rotation with low overhead.

Why this answer

Secret Manager supports automatic rotation with a specified rotation period and Pub/Sub notifications. A Cloud Function can listen for the notification and generate a new password, updating the secret version.

Full explanation →
348
MCQhard

Refer to the exhibit. A developer created the firewall rule to allow HTTPS traffic from the API service account to instances tagged 'api-instances'. However, HTTPS requests from the API server (which runs on an instance with tag 'api-instances' and uses the default compute engine service account) are failing. What is the most likely cause?

A.The rule should have a higher priority to override the default implicit deny.
B.The source instance is using the default compute engine service account, not the specified api-sa.
C.The direction should be EGRESS because the traffic originates from the API server.
D.The rule should use sourceTags instead of sourceServiceAccounts to match the source instance.
AnswerB

This service account mismatch means the source does not match the rule's sourceServiceAccounts, so the traffic is not allowed.

Why this answer

The firewall rule explicitly specifies the source as the API service account (api-sa), but the API server is using the default compute engine service account. In Google Cloud, firewall rules that use sourceServiceAccounts match traffic based on the service account attached to the source instance, not the instance's tags or the service account used by the application. Since the source instance's service account does not match the rule's specified service account, the HTTPS traffic is implicitly denied.

Exam trap

Google Cloud often tests the distinction between service account identity and instance tags, tricking candidates into thinking that tagging the source instance or using the default service account will satisfy a rule that explicitly specifies a different service account.

How to eliminate wrong answers

Option A is wrong because the default implicit deny rule has the lowest priority (65535) and any explicit rule with a higher priority (lower number) will override it; the issue is not about priority but about a mismatch in the source service account. Option C is wrong because the direction should be INGRESS, not EGRESS, as the traffic originates from the API server (source) and is destined for instances tagged 'api-instances' (destination); EGRESS rules control traffic leaving the destination, not incoming requests. Option D is wrong because the rule already uses sourceTags to match the destination instances (via targetTags), but the source is specified via sourceServiceAccounts; using sourceTags instead would not solve the service account mismatch and would not match the source instance's identity.

Full explanation →
349
MCQmedium

A healthcare organization must ensure that only authorized personnel can access Protected Health Information (PHI) stored in Cloud Storage. They need to enforce encryption at rest and control access based on data classification. Which combination of Google Cloud services should they use?

A.Use customer-supplied encryption keys (CSEK) and Cloud Audit Logs.
B.Use Cloud HSM for key management and Cloud DLP to inspect data.
C.Enable Access Transparency and use Organization Policies to restrict resource locations.
D.Use customer-managed encryption keys (CMEK) with Cloud KMS and VPC Service Controls.
AnswerD

CMEK provides key control; VPC Service Controls prevent data exfiltration beyond the perimeter.

Why this answer

It combines customer-managed encryption keys (CMEK) with Cloud KMS to enforce encryption at rest using keys controlled by the organization, and VPC Service Controls to restrict data access based on data classification by creating a security perimeter around Cloud Storage. This ensures that only authorized personnel within the defined perimeter can access PHI, meeting both encryption and access control requirements.

Exam trap

Google Cloud often tests the distinction between encryption key management (CMEK vs. CSEK) and access control mechanisms (VPC Service Controls vs. IAM), where candidates mistakenly choose options that address only one requirement or confuse data inspection (DLP) with access enforcement.

How to eliminate wrong answers

Option A is wrong because customer-supplied encryption keys (CSEK) require the customer to provide and manage the keys themselves, which does not leverage Google Cloud's key management for fine-grained access control, and Cloud Audit Logs only provide logging, not encryption or access enforcement. Option B is wrong because Cloud HSM is a hardware security module for key management, but Cloud DLP is used for inspecting and classifying data, not for controlling access to PHI based on classification. Option C is wrong because Access Transparency provides logs of Google administrator access, and Organization Policies restrict resource locations, but neither enforces encryption at rest nor controls access based on data classification.

Full explanation →
350
MCQhard

You are designing a VPC Service Controls perimeter to protect a project containing BigQuery datasets accessible from a data analytics VPC. You need to allow a specific set of on-premises users (identified by IP range 203.0.113.0/24) to query BigQuery from outside the perimeter, but block all other external access. What is the correct configuration?

A.Remove the on-premises IP range from the project's allowed external IPs list in the VPC Service Controls configuration
B.Create a service perimeter in dry-run mode, then configure a firewall rule in the on-premises VPC to allow egress to BigQuery
C.Create a service perimeter with restricted services including BigQuery. Add an ingress rule that allows access from the identity group containing the on-premises users, with source IP range 203.0.113.0/24 in the access level
D.Create a service perimeter with restricted services, create an access level with IP condition 203.0.113.0/24, and add an ingress rule that allows access from the access level to all identities
AnswerD

This correctly uses an access level for IP restriction and an ingress rule to allow that access level into the perimeter.

Why this answer

VPC Service Controls uses access levels for IP-based restrictions. To allow external access from a specific IP range, you create an access level that includes that IP range, then define an ingress rule in the service perimeter that grants access to that access level. Dry-run mode is for testing, not production enforcement.

Full explanation →
351
MCQmedium

A financial services company must ensure that all data stored in Cloud Storage is encrypted with customer-managed encryption keys (CMEK) that are rotated every 90 days. They have enabled Organization Policy constraints to enforce CMEK. However, some new buckets are still being created without CMEK. What is the most likely cause?

A.VPC Service Controls are blocking the use of CMEK.
B.The buckets are created using a service account that has the CMEK permission but the key ring is not in the same region.
C.The Organization Policy constraint is not applied to the folder that contains the project.
D.The buckets are using the Archive storage class, which does not support CMEK.
AnswerC

If the constraint is not applied to the folder, projects may not inherit it.

Why this answer

Organization Policy constraints are hierarchical and must be applied at the project, folder, or organization level to take effect. If the constraint is applied only at the organization level but the project resides in a folder that does not inherit the policy (or the constraint is not applied to that folder), the policy will not enforce CMEK on buckets created in that project. This explains why new buckets can still be created without CMEK despite the policy being enabled elsewhere.

Exam trap

The trap here is that candidates assume Organization Policy constraints automatically apply to all projects in the organization, but they forget that policies must be inherited through the resource hierarchy and can be overridden or missing at the folder level.

How to eliminate wrong answers

Option A is wrong because VPC Service Controls control data exfiltration and access boundaries, not encryption key enforcement; they do not block the use of CMEK. Option B is wrong because CMEK key rings can be in any region as long as the key is accessible; the key ring region does not prevent CMEK from being applied. Option D is wrong because the Archive storage class fully supports CMEK; all Cloud Storage classes support customer-managed encryption keys.

Full explanation →
352
MCQmedium

A company has deployed a multi-region Kubernetes cluster using GKE. The security team wants to ensure that only pods with a specific service account can access a Cloud Storage bucket containing sensitive data. What is the best practice to achieve this?

A.Store a service account key as a Kubernetes secret and mount it into the pod.
B.Use Workload Identity to bind the Kubernetes service account to a Google service account with appropriate roles on the bucket.
C.Create a bucket ACL that grants read access to the GKE node service account.
D.Create a PersistentVolume with a GCSFuse bucket and use a pod security policy to restrict access.
AnswerB

Workload Identity provides a secure and manageable way to grant access to specific pods.

Why this answer

Workload Identity is the best practice because it allows you to bind a Kubernetes service account (KSA) to a Google service account (GSA) that has been granted specific IAM roles on the Cloud Storage bucket. This eliminates the need to manage and distribute static service account keys, as the pod authenticates directly to Google Cloud APIs using the GSA's identity via a secure token exchange. The GKE node's metadata server is configured to vend tokens for the bound GSA only to pods running with the designated KSA, ensuring that only those pods can access the bucket.

Exam trap

Google Cloud often tests the misconception that static keys (Option A) or node-level permissions (Option C) are acceptable for pod-level access control, when in fact Workload Identity is the recommended and more secure approach for binding pod identities to cloud IAM roles.

How to eliminate wrong answers

Option A is wrong because storing a service account key as a Kubernetes secret and mounting it into the pod introduces a static credential that must be rotated, can be exfiltrated, and violates the principle of least privilege; it is not a best practice for secure access to Cloud Storage. Option C is wrong because granting read access to the GKE node service account would allow all pods running on that node, regardless of their own service account, to access the bucket, which does not restrict access to only pods with a specific service account. Option D is wrong because creating a PersistentVolume with a GCSFuse bucket and using a pod security policy does not provide fine-grained identity-based access control; GCSFuse mounts the bucket using the node's service account by default, and pod security policies control runtime security constraints, not IAM-level access to the bucket.

Full explanation →
353
Multi-Selectmedium

A company needs to grant developers the ability to deploy applications to App Engine, but they should not be able to modify IAM policies. Which two roles should be assigned to the developers? (Choose two.)

Select 2 answers
A.roles/owner
B.roles/appengine.appViewer
C.roles/appengine.appAdmin
D.roles/appengine.serviceAdmin
E.roles/appengine.deployer
AnswersD, E

Service Admin allows managing services and versions, also does not include IAM modification.

Why this answer

The correct roles are App Engine Deployer and App Engine Service Admin. App Engine Admin includes IAM policy modification.

Full explanation →
354
MCQhard

A company has a global HTTPS load balancer and wants to use a self-managed SSL certificate. They have uploaded the PEM-encoded certificate and private key to the load balancer. However, the certificate is about to expire. What is the correct way to renew it without downtime?

A.Create a new SSL certificate resource with the new certificate and key, then update the target HTTPS proxy to use it
B.Use gcloud compute ssl-certificates update to replace the certificate
C.Update the existing SSL certificate resource with the new certificate and key
D.Delete the existing certificate and upload the new one with the same name
AnswerA

Creating a new certificate and updating the proxy is the correct procedure and avoids downtime.

Why this answer

To renew a self-managed certificate, you create a new SSL certificate resource with the updated certificate and key, and then update the load balancer's target HTTPS proxy to use the new certificate. This can be done without downtime by updating the proxy.

Full explanation →
355
MCQmedium

Refer to the exhibit. A compliance officer is reviewing an Access Transparency log entry. Which compliance benefit does this log provide?

A.It shows a user accessing a storage object
B.It provides evidence of data access by Google engineers
C.It tracks encryption key usage
D.It is a Cloud Audit Log for admin activity
AnswerB

Access Transparency logs show when Google employees access your data, which is required for certain compliance certifications.

Why this answer

Access Transparency logs are specifically designed to provide visibility into actions performed by Google personnel (e.g., engineers) on customer data. This log entry shows an operation by a Google support engineer, which directly supports compliance requirements by providing evidence of data access by Google engineers, as required for regulatory audits like SOC 2 or FedRAMP.

Exam trap

Google Cloud often tests the distinction between Access Transparency logs (Google personnel actions) and Cloud Audit Logs (customer actions), so candidates mistakenly choose an option about user access or admin activity instead of recognizing that Access Transparency is unique to Google engineer access.

How to eliminate wrong answers

Option A is wrong because Access Transparency logs do not show user access to storage objects; that is the function of Cloud Audit Logs (e.g., Data Access audit logs). Option C is wrong because encryption key usage is tracked by Cloud Key Management Service (KMS) audit logs, not Access Transparency logs. Option D is wrong because Cloud Audit Logs for admin activity are separate (Admin Activity audit logs), while Access Transparency logs specifically cover actions by Google personnel, not customer admin actions.

Full explanation →
356
MCQmedium

An organization uses Cloud Identity with a third-party IdP via SAML 2.0. A security engineer needs to enforce that all Google Cloud access requires multi-factor authentication (MFA) from the IdP. What is the recommended approach?

A.Create an organization policy constraint requiring the use of security keys for all users.
B.Require MFA in the third-party IdP before it issues SAML assertions.
C.Enable MFA enforcement in the Cloud Identity admin console for all users.
D.Configure a context-aware access level in Access Context Manager that requires MFA, and apply it to Google Cloud resources.
AnswerB

This is the recommended approach: enforce MFA at the IdP so that only authenticated users with MFA can access Google Cloud resources.

Why this answer

The best practice is to configure MFA at the IdP level because the IdP is the authoritative source for authentication. This ensures MFA is enforced before SAML assertion is issued, and it works for all applications relying on that IdP, including Google Cloud. Enforcing MFA on Google Cloud side via IAP or context-aware access is possible but not the recommended primary enforcement for SAML federated users; it should be done at the IdP.

Full explanation →
357
MCQhard

An organization uses SSL policies for their HTTPS load balancer. They need to allow TLS 1.2 and 1.3 only, and use the most secure cipher profile available. Which SSL policy configuration should they choose?

A.minTlsVersion: 1.2, profile: RESTRICTED
B.minTlsVersion: 1.2, profile: MODERN
C.minTlsVersion: 1.2, profile: COMPATIBLE
D.minTlsVersion: 1.3, profile: CUSTOM
AnswerA

RESTRICTED enforces the strongest ciphers with TLS 1.2+.

Why this answer

The 'RESTRICTED' cipher profile enforces strong ciphers (TLS 1.2+), while 'MODERN' allows TLS 1.2 and 1.3 with good security. However, 'RESTRICTED' is the most secure profile that supports TLS 1.2 and 1.3.

Full explanation →
358
MCQmedium

A company wants to allow an application running on an on-premises server to access Cloud Storage without using long-lived service account keys. The on-premises environment uses Azure Active Directory (Azure AD) as its identity provider. Which GCP feature should they use?

A.Service Account Key rotation policy.
B.Workload Identity Federation with Azure AD as an identity provider.
C.Create a custom OAuth 2.0 client ID for the application.
D.Use a VPN between on-premises and GCP, and allow the on-premises server to use a metadata server.
AnswerB

Workload Identity Federation allows keyless authentication using tokens from Azure AD.

Why this answer

Workload Identity Federation supports Azure AD as an external identity provider. The on-premises app can obtain an Azure AD token and exchange it for a GCP service account token, eliminating the need for keys.

Full explanation →
359
MCQmedium

A company has deployed an internal HTTP Load Balancer (ILB) in us-west1 within a Shared VPC. The host project contains the ILB's forwarding rule and the backend service. The backend instances are Compute Engine VMs running in a service project in us-east1. The health checks for the ILB are consistently failing with 'unhealthy' status. The firewall rules in the host project allow ingress from the Google Cloud health checker ranges (130.211.0.0/22 and 35.191.0.0/16) on TCP port 80 to all VMs in the VPC. The backend VMs are running a web server listening on port 80. What is the most likely cause of the health check failures?

A.The ILB's forwarding rule and backends are in different regions.
B.The health checker firewall rule is not applied to the service project.
C.The backend VMs are not in the same project as the ILB.
D.The backend VMs do not have the correct IAM permissions for the ILB.
AnswerA

ILB requires backends to be in the same region as the forwarding rule; otherwise health checks fail.

Why this answer

The internal HTTP Load Balancer (ILB) in Google Cloud requires that the forwarding rule, backend service, and backend instances all reside in the same region. In this scenario, the ILB is deployed in us-west1, but the backend VMs are in us-east1. Cross-region backends are not supported for ILBs, causing health checks to fail because the load balancer cannot route traffic or verify health across regions.

Exam trap

Google Cloud often tests the misconception that health check failures are always due to firewall rules or IAM, when the real issue is the regional constraint of internal load balancers.

How to eliminate wrong answers

Option B is wrong because firewall rules in a Shared VPC are applied at the VPC level (host project) and propagate to all service projects; the health checker ranges are already allowed, so the service project does not need separate rules. Option C is wrong because ILBs in a Shared VPC can have backends in a service project; the backend VMs being in a different project is not inherently a problem. Option D is wrong because IAM permissions are not required for backend VMs to respond to health checks; health checks are network-layer probes that only require the VM to be reachable and listening on the specified port.

Full explanation →
360
MCQmedium

A data subject requests the deletion of their personal data from a Google Cloud project under GDPR. This data is stored in BigQuery audit logs that are retained for 30 days by default. What is the correct approach to fulfill this request?

A.Use the BigQuery DELETE statement to remove the specific rows containing the data subject's information.
B.Submit a request to Google Cloud Support to remove the personal data from the logs.
C.Configure a log sink to exclude the data subject's audit logs and delete the existing logs by deleting the dataset that stores them.
D.Use a Data Loss Prevention (DLP) job to redact the personal data from the audit logs.
AnswerC

By configuring a log sink to filter out the data subject's logs, you can prevent future storage. To delete existing logs, you must delete the dataset or the log entries using the _required log bucket retention controls, but typically you delete the dataset.

Why this answer

BigQuery audit logs are immutable and cannot be modified or deleted individually. The right to be forgotten under GDPR requires deletion of personal data. The only way to comply is to delete the entire log entries or the dataset.

Since the logs are retained for 30 days, you must either delete the specific logs by using a log sink to filter and exclude, or you can delete the entire dataset. However, the simplest approach is to delete the logs after they are no longer needed, but you cannot delete specific rows from BigQuery audit logs. The correct approach is to delete the dataset containing the logs if the logs are no longer needed for compliance; otherwise, you must exclude the data subject's information from future logs and delete existing ones via log routing.

Full explanation →
361
MCQhard

Your organization has a security requirement that all traffic to and from Compute Engine instances must be logged and analyzed. You have enabled VPC Flow Logs for all subnets. However, you notice that flow logs are not capturing all traffic between instances in the same subnet. What is the most likely reason?

A.VPC Flow Logs must be enabled on each individual instance, not on subnets.
B.VPC Flow Logs only capture traffic that crosses subnet boundaries.
C.Traffic to the metadata server (169.254.169.254) is not captured by VPC Flow Logs.
D.VPC Flow Logs sample only 1 out of 10 packets by default.
AnswerC

Metadata server traffic is not captured to reduce noise.

Why this answer

VPC Flow Logs do not capture traffic to the metadata server (169.254.169.254) because that traffic is considered internal infrastructure communication and is excluded from flow log collection by design. This is a documented limitation in Google Cloud, and it explains why some traffic between instances in the same subnet—such as metadata queries—is missing from the logs.

Exam trap

Google Cloud often tests the misconception that VPC Flow Logs capture all traffic, including metadata server communication, when in fact metadata traffic is explicitly excluded from flow log collection.

How to eliminate wrong answers

Option A is wrong because VPC Flow Logs are enabled at the subnet level, not per instance; once enabled on a subnet, all VM instances in that subnet are automatically covered. Option B is wrong because VPC Flow Logs capture traffic within a subnet (east-west) as well as traffic crossing subnet boundaries; they are not limited to cross-subnet traffic. Option D is wrong because VPC Flow Logs sample 1 out of 10 packets only for the 'sampled' metadata field, but all connections are still logged; the sampling does not cause entire flows to be missing.

Full explanation →
362
MCQmedium

A security engineer needs to encrypt data at rest in Cloud Storage using a key that is not managed by Google Cloud. The key must be stored on-premises and provided with each API call for data access. Which encryption approach should be used?

A.Use customer-managed encryption keys (CMEK) with key material imported from an on-premises HSM.
B.Use Cloud KMS with a key stored in an on-premises HSM via Cloud External Key Manager.
C.Use Google-managed encryption keys with an organizational policy to disable automatic encryption.
D.Use customer-supplied encryption keys (CSEK) by providing the key in the request headers.
AnswerD

CSEK allows you to provide your own key with each API call, keeping the key on-premises.

Why this answer

Customer-supplied encryption keys (CSEK) allow you to provide your own AES-256 key with each API call to Cloud Storage. The key is not stored by Google Cloud; it is used only in memory to encrypt/decrypt data and then discarded, meeting the requirement of on-premises key storage and per-API-call key provision.

Exam trap

Google Cloud often tests the distinction between CMEK (key material managed in Cloud KMS) and CSEK (key provided per request), and the trap here is that candidates confuse 'customer-managed' with 'customer-supplied,' assuming CMEK satisfies the 'provided with each API call' requirement when it does not.

How to eliminate wrong answers

Option A is wrong because CMEK with imported key material still stores the key metadata and encrypts the key within Google Cloud KMS, meaning Google manages the key lifecycle and the key is not provided with each API call. Option B is wrong because Cloud External Key Manager (Cloud EKM) uses an external key management service accessible via a network endpoint, but the key is not provided with each API call; instead, Cloud KMS interacts with the external service on your behalf, and the key is not stored solely on-premises. Option C is wrong because Google-managed encryption keys are fully managed by Google Cloud and cannot be disabled via organizational policy; automatic encryption is always enabled, and you cannot supply your own key per API call.

Full explanation →
363
MCQmedium

A company uses Customer-Supplied Encryption Keys (CSEK) for Compute Engine persistent disks. They want to ensure that Google does not store the key material. What must they do?

A.Use the gcloud compute disks create command with the --csek-key-file flag to supply the key, and do not store the key in Cloud KMS.
B.Enable Cloud HSM to protect the key.
C.Set an organization policy to prevent Google from storing keys.
D.Create a Cloud KMS key and use it as a CSEK.
AnswerA

CSEK keys are supplied per API call and not stored by Google.

Why this answer

Customer-Supplied Encryption Keys (CSEK) allow you to provide your own raw AES-256 key material when creating a persistent disk. By using the `gcloud compute disks create` command with the `--csek-key-file` flag, you supply the key directly to the API, and Google uses it only in memory to encrypt the disk; it does not persist the key material on Google's infrastructure. The key file is stored locally by the customer, ensuring Google never retains the key.

Exam trap

The trap here is that candidates often confuse CSEK with CMEK (Customer-Managed Encryption Keys) and assume Cloud KMS or Cloud HSM can be used to satisfy the 'no storage' requirement, but those services inherently store key material within Google's control.

How to eliminate wrong answers

Option B is wrong because Cloud HSM is a managed hardware security module service that stores keys within Google's infrastructure, which contradicts the requirement that Google must not store the key material. Option C is wrong because there is no organization policy that can prevent Google from storing keys; CSEK is designed to avoid storage by design, not through policy enforcement. Option D is wrong because creating a Cloud KMS key and using it as a CSEK would mean the key is managed and stored by Google in Cloud KMS, which violates the requirement that Google does not store the key material.

Full explanation →
364
MCQeasy

A company must ensure that all Compute Engine instances use only approved images from a specific project. They want to enforce this using Organization Policy. Which constraint should they use?

A.constraints/compute.restrictImageUsage
B.constraints/compute.restrictAuthorizedDomains
C.constraints/compute.trustedImageProjects
D.constraints/compute.restrictFirewallRules
AnswerA

This constraint restricts which images can be used to create instances.

Why this answer

The correct constraint is `constraints/compute.restrictImageUsage` because it directly controls which images can be used to create Compute Engine instances by specifying a list of allowed projects. This enforces the requirement that only approved images from a specific project are used, blocking instances launched with images from other projects.

Exam trap

Google Cloud often tests the distinction between valid and invalid constraint names, and the trap here is that candidates confuse the non-existent `constraints/compute.trustedImageProjects` with the real `constraints/compute.restrictImageUsage` because the word 'trusted' appears in the documentation for the feature but not in the constraint name.

How to eliminate wrong answers

Option B is wrong because `constraints/compute.restrictAuthorizedDomains` restricts the email domains that can be used for Cloud Identity or G Suite accounts, not image usage. Option C is wrong because `constraints/compute.trustedImageProjects` does not exist as a valid Organization Policy constraint; the correct constraint for trusted images is `constraints/compute.restrictImageUsage`. Option D is wrong because `constraints/compute.restrictFirewallRules` controls the creation of firewall rules, not the images used to launch instances.

Full explanation →
365
Multi-Selecthard

A security administrator needs to deploy a solution that allows a group of developers to access a web application running on Compute Engine behind an internal HTTP load balancer. The solution must enforce access based on user identity and device security status, and must not expose the application to the public internet. Which THREE components are required?

Select 3 answers
A.Cloud NAT
B.Cloud Armor
C.Access Context Manager (Access Levels)
D.Identity-Aware Proxy (IAP)
E.Internal HTTP Load Balancer
AnswersC, D, E

Access levels define device security requirements for IAP.

Why this answer

Identity-Aware Proxy (IAP) provides identity and context-aware access. An internal HTTP load balancer keeps the app private. Context-aware access requires an access level (e.g., based on device policy).

IAP uses access levels to enforce security.

Full explanation →
366
MCQhard

A company has deployed a Cloud Run service that needs to access a Cloud SQL database. They have configured a service account for the Cloud Run service and granted it the Cloud SQL Client role. However, the application is receiving 'Permission denied' errors when trying to connect to the database. The database has a private IP and is in a VPC. What is the most likely cause?

A.The service account lacks the cloudsql.instances.connect permission.
B.Cloud Run cannot reach the private IP because it is not connected to the VPC via Serverless VPC Access.
C.The service account is not authorized in the Cloud SQL instance's IAM policy.
D.The Cloud SQL instance requires a public IP for Cloud Run to connect.
AnswerB

Serverless VPC Access is required to allow Cloud Run to reach resources on a VPC network.

Why this answer

Cloud Run services run in a Google-managed environment that is not automatically connected to a VPC. To reach a Cloud SQL instance with a private IP, the Cloud Run service must use Serverless VPC Access to establish a VPC connector, which enables direct traffic to the private IP. Without this connector, the service cannot route to the private IP, resulting in 'Permission denied' errors even though the IAM permissions are correct.

Exam trap

Google Cloud often tests the misconception that IAM permissions alone are sufficient for private IP access, when in fact network connectivity via Serverless VPC Access is required for Cloud Run to reach resources inside a VPC.

How to eliminate wrong answers

Option A is wrong because the Cloud SQL Client role includes the cloudsql.instances.connect permission, so the service account does have it. Option C is wrong because the Cloud SQL Client role already authorizes the service account in the Cloud SQL instance's IAM policy; no additional authorization is needed. Option D is wrong because Cloud Run can connect to a private IP via Serverless VPC Access, and a public IP is not required.

Full explanation →
367
MCQmedium

A company runs a batch processing workload on Compute Engine VMs for 6 months. They want to reduce costs without sacrificing performance. Which option should they implement?

A.Switch to preemptible VMs
B.Use sole-tenant nodes to share resources across projects
C.Migrate to custom machine types to eliminate wasted resources
D.Purchase committed use discounts for the relevant machine types and regions
AnswerD

CUDs offer up to 57% discount for stable workloads with a commitment, directly reducing costs.

Why this answer

Committed use discounts (CUDs) provide significant discounts in exchange for a 1- or 3-year commitment, ideal for steady-state workloads like a 6-month batch processing job. Option A is wrong because preemptible VMs are not suitable for long-running batch jobs due to termination risk. Option B is wrong because sole-tenant nodes isolate VMs but do not reduce costs.

Option C is wrong because custom machine types may optimize resource use but do not offer discounts like CUDs.

Full explanation →
368
Multi-Selecthard

A security administrator needs to grant a team of developers the ability to deploy applications to a GKE cluster, but only to specific namespaces. The developers should not be able to modify cluster-level resources or IAM policies. Which three steps should the administrator take? (Choose THREE.)

Select 3 answers
A.Create a Kubernetes Role in the namespace with permissions to create and manage pods and services.
B.Grant the developers the Kubernetes Engine Developer role (roles/container.developer) at the project level.
C.Create a ClusterRole and ClusterRoleBinding for the namespace.
D.Grant the developers the Kubernetes Engine Cluster Viewer role (roles/container.clusterViewer) at the project level.
E.Create a RoleBinding in the namespace that binds the developers' group to the Role.
AnswersA, B, E

Namespace-scoped role for developers.

Why this answer

A Kubernetes Role defines permissions within a specific namespace, and granting permissions to create and manage pods and services aligns with the requirement to deploy applications without cluster-level access. This ensures developers can only interact with resources in the designated namespace, adhering to the principle of least privilege.

Exam trap

The trap here is that candidates often confuse the project-level IAM roles (like roles/container.developer) with Kubernetes RBAC roles, assuming one is sufficient for namespace-scoped access, but both are required: IAM for cluster access and RBAC for namespace-level permissions.

Full explanation →
369
MCQhard

A company needs to meet a regulatory requirement that cryptographic keys for data at rest in Google Cloud must be managed in an on-premises HSM and never leave the HSM. Google Cloud services should be able to use those keys for encryption/decryption. Which solution should they implement?

A.Use Cloud HSM to protect keys imported from on-premises HSM.
B.Use Cloud External Key Manager (EKM) to connect to the on-premises HSM.
C.Use Cloud KMS with automatic key rotation and store key versions on-premises.
D.Use customer-supplied encryption keys (CSEK) for each service.
AnswerB

Cloud EKM enables Google Cloud services to use keys from an external HSM without the key leaving the HSM.

Why this answer

Cloud External Key Manager (EKM) allows you to use keys managed in a supported external key management system, such as an on-premises HSM, for Google Cloud services. The keys are used by Google Cloud for encryption and decryption but never leave the external HSM, satisfying the regulatory requirement that keys must remain on-premises.

Exam trap

Google Cloud often tests the distinction between key location (where the key material resides) and key usage (which service performs the crypto operation), leading candidates to choose Cloud HSM (Option A) because it sounds like a managed HSM, but it fails the 'keys never leave the HSM' requirement since the HSM is in Google Cloud, not on-premises.

How to eliminate wrong answers

Option A is wrong because Cloud HSM is a Google-managed HSM service; keys imported into Cloud HSM would be stored and managed within Google Cloud, not kept exclusively on-premises. Option C is wrong because Cloud KMS with automatic key rotation stores key versions within Google Cloud, not on-premises, and does not provide a mechanism to keep keys exclusively in an on-premises HSM. Option D is wrong because customer-supplied encryption keys (CSEK) are provided per service and are stored in Google Cloud for the duration of the operation, violating the requirement that keys never leave the on-premises HSM.

Full explanation →
370
MCQeasy

A security engineer is reviewing a log entry in Cloud Logging with the above filter. The engineer wants to understand why this specific log entry was generated. Which action most likely caused this log entry?

A.An SSH login attempt failed due to incorrect credentials
B.A firewall rule blocked incoming traffic to the instance
C.An IAM policy change granted a user compute.instances.start access
D.A user stopped the Compute Engine instance
AnswerD

Stopping an instance generates an activity log entry.

Why this answer

The log entry was generated because a user stopped the Compute Engine instance. In Cloud Logging, instance lifecycle events such as STOP, START, or RESET are recorded with the method `compute.instances.stop`. This specific log entry matches the filter criteria (e.g., `protoPayload.methodName="v1.compute.instances.stop"`), indicating that the action was a stop operation, not a failure or policy change.

Exam trap

The trap here is that candidates may confuse the log entry's method name with a security-related event (like failed SSH or firewall block) because they overlook that the filter explicitly targets Compute Engine instance operations, not network or IAM events.

How to eliminate wrong answers

Option A is wrong because an SSH login failure would generate a log entry related to `ssh` or `oslogin` authentication, not a Compute Engine instance stop event. Option B is wrong because a firewall rule blocking traffic would produce a log entry under VPC firewall rules or packet rejection, not an instance lifecycle method. Option C is wrong because an IAM policy change granting `compute.instances.start` access would be logged under `google.iam.admin.v1.SetIamPolicy` or similar IAM methods, not `compute.instances.stop`.

Full explanation →
371
Matchingmedium

Match each IAM role to its typical use case.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Full management of Compute Engine resources

Read-only access to Cloud Storage objects

Manage service accounts and keys

Manage Cloud KMS keys and key rings

Manage organization policies

Why these pairings

Correct matches: Viewer (read-only), Editor (edit but no permissions), Owner (full control). Billing Admin handles billing, Security Admin handles IAM.

Full explanation →
372
MCQmedium

A company is using Cloud Composer (Airflow) to orchestrate data pipelines. A DAG is failing with a 'Task received SIGTERM' error. What is the most likely cause?

A.The worker node was preempted
B.The task exceeded its execution timeout
C.The task ran out of memory
D.The Airflow scheduler crashed
AnswerB

Airflow sends SIGTERM to tasks that exceed their execution timeout.

Why this answer

SIGTERM is sent when a task exceeds its execution timeout. Other causes produce different signals.

Full explanation →
373
MCQmedium

A security engineer is using Cloud Asset Inventory to find all Compute Engine instances that are not labeled with a 'compliance' label. Based on the exhibit, which instance(s) are missing the compliance label?

A.Both instances
B.instance-2 only
C.Neither instance
D.instance-1 only
AnswerB

instance-2 lacks compliance label.

Why this answer

The exhibit shows that instance-1 has a 'compliance' label with a value of 'true', while instance-2 has no 'compliance' label at all. Cloud Asset Inventory can query assets using label filters; the absence of the 'compliance' label on instance-2 means it fails the compliance labeling requirement. Therefore, only instance-2 is missing the compliance label.

Exam trap

Google Cloud often tests the distinction between a label that exists (even with an empty value) and a label that is completely absent, leading candidates to incorrectly assume that a missing label is the same as a label with a false or empty value.

How to eliminate wrong answers

Option A is wrong because both instances are not missing the compliance label; instance-1 has the label, so only one instance is missing it. Option C is wrong because instance-2 clearly lacks the 'compliance' label, so it is not true that neither instance is missing it. Option D is wrong because instance-1 does have the 'compliance' label, so it is not missing the label; the missing instance is instance-2 only.

Full explanation →
374
MCQhard

A company has a VPC with two subnets: subnet-a (10.0.1.0/24) and subnet-b (10.0.2.0/24). They have a firewall appliance (internal IP 10.0.1.100) that inspects all traffic between subnets. They configure a policy-based route to redirect traffic from subnet-a to subnet-b to the appliance. However, traffic from subnet-a to subnet-b still goes directly. What is missing?

A.Compute Engine instances must have a custom route table to use policy-based routes.
B.A VPC route with priority 1000 (direct routing between subnets) is overriding the policy-based route with a lower priority.
C.A firewall rule is required to allow traffic to be redirected to the appliance.
D.The policy-based route must have the next hop IP set to the appliance's external IP.
AnswerB

The default VPC routes have priority 1000; if the policy-based route has a higher priority number, it is overridden.

Why this answer

B is correct because VPCs have an implicit default route for subnet-to-subnet traffic with a priority of 1000, which is higher than the priority of a policy-based route (typically 2000). Since the policy-based route has a lower priority (higher numerical value), the default route takes precedence, causing traffic to bypass the firewall appliance. To override this, the policy-based route must have a priority lower than 1000 (e.g., 500) to be preferred.

Exam trap

Google Cloud often tests the misconception that policy-based routes automatically override default VPC routes, but the trap is that the default subnet-to-subnet route has a higher priority (1000) than the policy-based route (2000), so candidates must remember to set a lower priority on the policy-based route to make it effective.

How to eliminate wrong answers

Option A is wrong because Compute Engine instances do not require custom route tables; policy-based routes are applied at the VPC level and affect all instances in the source subnet without needing per-instance configuration. Option C is wrong because firewall rules control whether traffic is allowed or denied, not the routing path; the issue is about route selection, not firewall permissions. Option D is wrong because the next hop for a policy-based route redirecting traffic to an internal appliance must be the appliance's internal IP (10.0.1.100), not its external IP, as traffic between subnets stays within the VPC and does not traverse the internet.

Full explanation →
375
MCQmedium

A security administrator wants to prevent users from disabling Shielded VM on existing Compute Engine instances. Which IAM permission should they deny?

A.compute.instances.setMetadata
B.compute.instances.setMachineResources
C.compute.instances.updateShieldedVmConfig
D.compute.instances.update
AnswerC

This permission specifically controls the ability to update Shielded VM settings on an existing instance.

Why this answer

The permission compute.instances.updateShieldedVmConfig controls the ability to update the Shielded VM configuration (enable/disable) on an existing instance. Denying this permission will prevent users from changing Shielded VM settings on instances. The permission compute.instances.setMetadata is for metadata changes, compute.instances.update is for general updates, and compute.instances.setMachineResources is for changing machine types.

Full explanation →
Page 4

Page 5 of 13

Page 6

All pages

12345678910111213

Practice PCSE by domain

Target a specific domain to shore up weak areas.

Configuring Access Within a Cloud Solution EnvironmentEnsuring Data ProtectionManaging Operations in a Cloud Solution EnvironmentConfiguring Network SecuritySupporting Compliance Requirements
See all domains with question counts →