Courseiva

Google Professional Cloud Security Engineer (PCSE) — Questions 451–525

960 questions total · 13pages · All types, answers revealed

Take a mock examExam hub
Page 6

Page 7 of 13

Page 8
451
MCQmedium

A security engineer wants to encrypt data at rest in Cloud Storage using a key that Google manages but the customer can control the key material. They need to rotate the key automatically every 90 days. Which encryption option should they choose?

A.Google default encryption (GMEK)
B.Customer-Supplied Encryption Keys (CSEK)
C.Customer-Managed Encryption Keys (CMEK) via Cloud KMS
D.Cloud HSM
AnswerC

CMEK lets you control key material in Cloud KMS and set automatic rotation (e.g., every 90 days).

Why this answer

Customer-Managed Encryption Keys (CMEK) using Cloud KMS allow customers to manage their own key material and configure automatic rotation (minimum 24h, but typically set to 90 days). GMEK is Google-managed (no customer control), CSEK requires customer to supply key with each API call (Google never stores it), and Cloud HSM is a key management service but still uses CMEK integration for rotation.

Full explanation →
452
MCQhard

A security engineer created the following IAM policy for a service account. The service account reports that it cannot access objects in bucket 'my-bucket'. What is the most likely cause?

A.The condition is too restrictive and blocks all objects.
B.The service account lacks the storage.buckets.get permission.
C.The role is missing storage.objects.list permission.
D.The condition uses 'projects/my-project' but resource.name uses the numeric project ID.
AnswerD

This is the common mistake; resource.name contains project number, not project ID.

Why this answer

The condition in the policy uses `resource.name.startsWith('projects/my-project')`, but the `resource.name` attribute for Google Cloud Storage objects uses the numeric project ID (e.g., `projects/123456789`), not the project name. This causes the condition to never evaluate to true, effectively denying all access to the bucket's objects. Option D correctly identifies this mismatch as the root cause.

Exam trap

Google Cloud often tests the subtle difference between project name and numeric project ID in IAM conditions, tricking candidates who assume the human-readable name works everywhere in GCP resource identifiers.

How to eliminate wrong answers

Option A is wrong because the condition is not inherently too restrictive; it is syntactically valid but uses the wrong identifier (project name vs. numeric ID), which prevents any object from matching the condition. Option B is wrong because `storage.buckets.get` is a bucket-level permission (for retrieving bucket metadata), not required for accessing objects within the bucket; the error is about object access, not bucket retrieval. Option C is wrong because `storage.objects.list` is needed to list objects, but the service account reports it cannot access objects, implying a broader denial; the condition mismatch would block both list and get operations, making the role/permission issue secondary.

Full explanation →
453
MCQmedium

A government agency requires that all compute resources for a project are physically located in the United States (US) to comply with FedRAMP. The project contains Compute Engine instances, Cloud Storage buckets, and BigQuery datasets. Which configuration ensures that all future resources are created in the US?

A.Configure VPC Service Controls with a perimeter that only allows access from US-based IP addresses.
B.Assign the Compute Admin role to a security admin and restrict them to only create resources in US regions.
C.Set an Organization Policy on the folder containing the project with constraint constraints/gcp.resourceLocations set to allowedLocations list of US regions.
D.Use Cloud KMS with a key from a US-based location and require that all resources use that key.
AnswerC

This policy restricts resource creation to specified locations, applicable to all resources in that folder.

Why this answer

The Organization Policy constraint `constraints/gcp.resourceLocations` enforces that all future resources in the project (Compute Engine instances, Cloud Storage buckets, BigQuery datasets) are created only in the allowed US regions. This policy is evaluated at resource creation time and prevents any resource from being provisioned outside the specified locations, directly meeting the FedRAMP requirement for physical location in the US.

Exam trap

Google Cloud often tests the misconception that IAM roles or VPC controls can enforce resource location, when in reality only Organization Policy constraints provide that enforcement at creation time.

How to eliminate wrong answers

Option A is wrong because VPC Service Controls restrict data exfiltration and access based on IP addresses, but they do not enforce the physical location where resources are created; resources could still be provisioned outside the US. Option B is wrong because assigning the Compute Admin role with a restriction to only create resources in US regions is not a supported IAM feature; IAM roles do not have built-in region-scoping capabilities, and such a restriction would require custom logic or Organization Policies. Option D is wrong because Cloud KMS key location does not enforce the physical location of the resources using the key; a resource could be created in a non-US region and still use a US-based KMS key for encryption.

Full explanation →
454
MCQhard

A government contractor uses Google Cloud with Assured Workloads. They need to ensure that data stored in BigQuery is encrypted with keys generated and stored in a Cloud HSM key ring located in a specific region. The keys must be rotated every 90 days. Which approach meets these requirements?

A.Create a Cloud HSM key ring in the desired region, create a key with a rotation period of 90 days, and use that key to protect the BigQuery dataset via CMEK.
B.Use Cloud KMS with a software key and enable automatic rotation of 90 days.
C.Create a Cloud HSM key ring and manually rotate keys every 90 days.
D.Use Cloud External Key Manager (EKM) with an external key management partner.
AnswerA

Cloud HSM keys can be used for CMEK, and rotation is automated.

Why this answer

It uses a Cloud HSM key ring in the desired region, which meets the requirement for hardware-backed key generation and storage. Setting a rotation period of 90 days on the key satisfies the rotation requirement, and using that key as a customer-managed encryption key (CMEK) for BigQuery ensures data is encrypted with the specified key.

Exam trap

Google Cloud often tests the distinction between Cloud HSM and Cloud KMS software keys, where candidates may overlook that only Cloud HSM provides hardware-backed key storage, or confuse automatic rotation with manual rotation, leading them to choose a less secure or non-compliant option.

How to eliminate wrong answers

Option B is wrong because it uses a software key, not a Cloud HSM key, so the keys are not generated and stored in hardware, failing the requirement for Cloud HSM. Option C is wrong because it suggests manual rotation every 90 days, but the requirement can be met with automatic rotation, and manual rotation is error-prone and not the recommended approach for compliance. Option D is wrong because Cloud External Key Manager (EKM) uses an external key management partner, not Cloud HSM, so the keys are not generated and stored in a Cloud HSM key ring.

Full explanation →
455
MCQeasy

A company wants to provide secure access to an internal web application hosted on Compute Engine without exposing it to the public internet. Which Google Cloud service should they use?

A.Cloud NAT
B.Cloud Storage signed URLs
C.Identity-Aware Proxy (IAP)
D.Cloud Load Balancing
AnswerC

IAP authenticates users and authorizes access to applications through a secure tunnel.

Why this answer

Identity-Aware Proxy (IAP) is the correct choice because it provides a centralized authentication and authorization layer for applications accessed via HTTPS, allowing you to enforce access control policies based on user identity and context without requiring a VPN or public IP exposure. IAP works with Cloud Load Balancing to verify user credentials before allowing traffic to reach the Compute Engine instance, effectively securing the internal web application from the public internet.

Exam trap

The trap here is that candidates often confuse Cloud NAT or Cloud Load Balancing as security controls, mistakenly thinking NAT hides the instance or that load balancing alone provides access control, when in fact neither authenticates users or prevents public exposure without IAP.

How to eliminate wrong answers

Option A is wrong because Cloud NAT provides outbound internet connectivity for private instances (source network address translation) but does not control inbound access or authenticate users, so it cannot secure an internal web application from public exposure. Option B is wrong because Cloud Storage signed URLs grant time-limited access to specific objects in Cloud Storage buckets, not to a Compute Engine-hosted web application, and they are designed for object-level access, not application-level authentication. Option D is wrong because Cloud Load Balancing distributes traffic across instances but does not inherently authenticate users or restrict access; without IAP, it would still expose the application to the public internet if configured with external IPs.

Full explanation →
456
MCQmedium

A company uses Active Directory (AD) on-premises and wants to synchronize user accounts to Google Cloud Identity for SSO with SAML 2.0. They require automatic user provisioning and de-provisioning. Which Google Cloud tool should they use?

A.Cloud Identity Platform
B.Google Workspace Admin SDK
C.Cloud Identity-Aware Proxy (IAP)
D.Cloud Directory Sync (CDS)
AnswerD

CDS synchronizes users and groups from AD/LDAP to Google Cloud Directory automatically.

Why this answer

Cloud Directory Sync (CDS) is the tool that synchronizes users from Active Directory or LDAP to Google Cloud Directory. It handles automatic provisioning and de-provisioning based on AD changes. SAML SSO is configured separately, but CDS is for directory sync.

Full explanation →
457
MCQeasy

A developer needs to deploy a Cloud Run service that will read from a Cloud Pub/Sub topic. What is the least privileged IAM role to grant to the Cloud Run service's service account?

A.roles/pubsub.subscriber on the topic resource
B.roles/pubsub.viewer
C.roles/pubsub.subscriber
D.roles/pubsub.publisher
AnswerC

Subscriber allows pulling messages from a subscription.

Why this answer

The Cloud Run service needs only the ability to pull (subscribe to) messages from the Pub/Sub topic. The `roles/pubsub.subscriber` role grants the `pubsub.subscriptions.consume` and `pubsub.subscriptions.get` permissions required to read messages, and when applied at the topic resource level (as implied by the option), it allows the service account to create and manage a subscription on that topic. This is the least privileged role that enables the read operation without granting unnecessary permissions like publishing or viewing all topics.

Exam trap

Google Cloud often tests the distinction between granting roles on a topic versus a subscription, and candidates mistakenly choose 'roles/pubsub.subscriber on the topic resource' (Option A) because they think the subscriber role applies to the topic, when in fact it must be bound to a subscription to allow message consumption.

How to eliminate wrong answers

Option A is wrong because `roles/pubsub.subscriber` on the topic resource is not a valid IAM role binding; the subscriber role must be granted on a subscription, not a topic, to allow message consumption. Option B is wrong because `roles/pubsub.viewer` only provides read-only access to metadata (e.g., list topics, get IAM policies) and does not include the `pubsub.subscriptions.consume` permission needed to actually read messages. Option D is wrong because `roles/pubsub.publisher` grants the `pubsub.topics.publish` permission, which is for writing messages to the topic, not reading them, and would be overprivileged for a service that only reads.

Full explanation →
458
MCQmedium

An organization uses Binary Authorization to enforce that only images signed by an approved attestor are deployed in GKE. They want to allow a specific set of images from a trusted registry to bypass the policy. Which Binary Authorization policy type should they use?

A.Deny All
B.Allow All
C.Require Attestation
D.Allow by Registry
AnswerC

This policy requires attestation for all images except those explicitly exempted via a breakglass or exception rule.

Why this answer

Binary Authorization supports policy types like 'Require Attestation', 'Allow All', and 'Deny All'. To allow specific images while requiring attestation for others, they would use 'Require Attestation' with an exception list. There is no 'Allow by Registry' built-in type.

Full explanation →
459
Multi-Selecthard

A security engineer needs to ensure that service account keys are not used in production workloads. They want to enforce this across the entire organization. Which TWO controls should they implement?

Select 2 answers
A.Use a custom organization policy constraint to enforce service account key rotation (max age 90 days)
B.Use VPC Service Controls to restrict the IAM API
C.Use the built-in constraint constraints/iam.disableServiceAccountKeyCreation
D.Use a deny policy to deny the permission iam.serviceAccountKeys.create
E.Use IAM roles to remove the ability to generate keys for all users
AnswersA, C

A custom constraint can enforce rotation and prevent use of old keys.

Why this answer

The built-in organization policy constraint constraints/iam.disableServiceAccountKeyCreation prevents creation of new keys. A custom organization policy can enforce key rotation and disable use of existing keys older than a certain age.

Full explanation →
460
MCQhard

An organization uses Cloud Identity-Aware Proxy (IAP) to secure access to an internal web application running on Compute Engine. Users are authenticated with Google accounts. Recently, some users report being denied access even though they are in the correct IAP-secured Web App User group. What is the most likely cause?

A.The users are trying to use IAP TCP forwarding instead of HTTPS.
B.The users are not members of the IAP-secured Web App User group.
C.The OAuth consent screen requires approval from an admin.
D.An Access Context Manager access level is configured that the users do not satisfy, such as requiring a corporate device.
AnswerD

Access levels can block access even if the user has the IAP role.

Why this answer

Cloud IAP can be combined with Access Context Manager (ACM) access levels to enforce contextual requirements beyond group membership, such as device policy, IP range, or user identity attributes. If an access level is configured to require a corporate device and the user's device does not meet that policy, IAP will deny access even if the user is in the correct IAP-secured Web App User group. This explains why users who are correctly placed in the group still receive access denials.

Exam trap

The trap here is that candidates assume IAP only checks group membership and overlook the fact that IAP can enforce additional access levels via Access Context Manager, causing them to incorrectly select Option B (group membership) when the users are already in the correct group.

How to eliminate wrong answers

Option A is wrong because IAP TCP forwarding is used for SSH/RDP access to instances, not for web applications; the question specifies an internal web application accessed via HTTPS, so TCP forwarding is irrelevant. Option B is wrong because the question explicitly states that users are in the correct IAP-secured Web App User group, so group membership is not the issue. Option C is wrong because the OAuth consent screen approval is required for the application's OAuth client ID, not for individual user access; once the app is configured and consent is given by an admin, users do not need separate admin approval to authenticate.

Full explanation →
461
MCQmedium

Refer to the exhibit. A security engineer is reviewing a Cloud KMS key. What can be concluded about this key?

A.This key is a customer-managed encryption key (CMEK) but is stored in software.
B.This key is stored in a Hardware Security Module (HSM) and cannot be exported.
C.This key is an external key managed via Cloud EKM.
D.This is a software key managed by Cloud KMS.
AnswerB

The HSM protection level means the key material resides in Cloud HSM and is non-exportable.

Why this answer

The exhibit shows a Cloud KMS key with the purpose 'symmetric encryption' and the protection level 'HSM'. Keys with HSM protection level are stored in a Hardware Security Module, which provides tamper-resistant hardware-based key storage. Additionally, the key is marked as 'Cannot be exported', meaning the key material never leaves the HSM boundary, ensuring it cannot be extracted or copied.

This matches the description of a key stored in an HSM that cannot be exported.

Exam trap

Google Cloud often tests the distinction between protection levels (software vs. HSM) and the concept of exportability, where candidates mistakenly assume that any key in Cloud KMS can be exported or that CMEK always implies software storage.

How to eliminate wrong answers

Option A is wrong because a customer-managed encryption key (CMEK) is a concept in Google Cloud that refers to keys created and managed by the customer within Cloud KMS, but the protection level can be either software or HSM; the exhibit shows 'HSM' protection level, not software. Option C is wrong because Cloud External Key Manager (EKM) is used for keys managed outside Google Cloud, and the exhibit shows a key managed within Cloud KMS, not an external key. Option D is wrong because the protection level is explicitly 'HSM', not 'software', so this is not a software key managed by Cloud KMS.

Full explanation →
462
MCQmedium

An organization wants to enforce that all new projects automatically have a specific set of IAM roles assigned to a security group. What is the best way to achieve this?

A.Create an organization policy that requires the roles to be assigned.
B.Use a Cloud Function triggered by Cloud Asset Inventory to assign the roles when a new project is created.
C.Assign the IAM roles to the security group at the organization level.
D.Use a service account with the Security Admin role to periodically scan and update new projects.
AnswerC

Organization-level IAM policies are inherited by all folders and projects, ensuring every new project gets the bindings.

Why this answer

Use organization policies? No, organization policies enforce constraints on resources, not IAM role bindings. You can use a folder-level IAM policy that applies to all projects in the folder. If all projects are under a folder, assign the roles to the folder.

Alternatively, use a custom script via Cloud Asset Inventory or Deployment Manager. The simplest is to assign IAM roles at the organization level, which are inherited by all projects. So assign the security group the necessary roles at the organization node.

Full explanation →
463
MCQeasy

A security analyst wants to search for a specific IAM role change across all projects in the organization. Which tool can query Cloud Audit Logs across projects?

A.Cloud Shell with gcloud logging read
B.Activity page in the Cloud Console (Home > Activity)
C.Cloud Monitoring dashboard
D.Cloud Logging Logs Explorer with a query that includes all projects in the organization
AnswerD

Logs Explorer can query logs across projects if the analyst has the necessary permissions at the organization level.

Why this answer

Logs Explorer allows querying logs across projects via resource scope, provided the user has the appropriate permissions.

Full explanation →
464
MCQhard

An organization has a hub-and-spoke VPC setup with Shared VPC. The security team wants to enforce a rule that all egress traffic from any project in the organization must pass through a central inspection appliance in the hub VPC. Which firewall configuration approach meets this requirement?

A.Use VPC firewall rules with a deny-all egress rule, then allow egress only from instances running in the hub VPC.
B.Configure private Google Access and VPC Service Controls to restrict egress.
C.Create a hierarchical firewall policy that denies all egress traffic unless it has a specific tag.
D.Set up a default route in each spoke VPC that sends egress traffic to the inspection appliance in the hub, and use firewall rules to allow only that traffic.
AnswerD

Correct: By configuring a default route (0.0.0.0/0) with the inspection appliance as next hop, all egress traffic is forced through it. Firewall rules can then allow only traffic that matches this path.

Why this answer

Hierarchical firewall policies apply to the entire organization, folder, or project and cannot be overridden by VPC firewall rules. They can be used to enforce mandatory inspection. However, they cannot specify next-hop appliances.

To force traffic through an inspection appliance, you need to use a combination of routes and firewall rules. The correct approach is to set up a default route pointing to the inspection appliance as next hop, and use firewall rules to block direct egress unless it goes through the appliance.

Full explanation →
465
MCQeasy

A company has a policy that only specific service accounts can be used on Compute Engine instances. How can this be enforced?

A.Use IAM conditions on the compute.instanceAdmin role to restrict the service account.
B.Use Identity-Aware Proxy (IAP).
C.Use a VPC Service Controls perimeter.
D.Use an organization policy with constraint compute.restrictServiceAccountUsage.
AnswerD

This constraint restricts which service accounts can be attached to Compute Engine instances.

Why this answer

The organization policy constraint `compute.restrictServiceAccountUsage` is specifically designed to enforce which service accounts can be used when creating Compute Engine instances. When applied at the project, folder, or organization level, this constraint allows you to define a list of allowed service accounts (by email or ID), and any attempt to launch an instance with a service account not on that list will be denied by the Resource Manager. This directly enforces the company policy that only specific service accounts are permitted on Compute Engine instances.

Exam trap

Google Cloud often tests the distinction between IAM roles (who can perform actions) and organization policy constraints (what configurations are allowed), so candidates mistakenly choose IAM conditions (Option A) thinking they can filter service accounts, when in reality only the organization policy constraint can enforce a whitelist of permitted service accounts on Compute Engine instances.

How to eliminate wrong answers

Option A is wrong because IAM conditions on the `compute.instanceAdmin` role control who can perform actions on instances (e.g., who can create or modify them), but they do not restrict which service account can be attached to an instance; the service account selection is a property of the instance, not an IAM permission on the user. Option B is wrong because Identity-Aware Proxy (IAP) controls access to SSH, RDP, or web-based applications running on instances, not the service account used by the instance itself; it is a network-level access control, not a service account usage policy. Option C is wrong because VPC Service Controls perimeters protect data exfiltration from Google Cloud services like BigQuery or Cloud Storage by controlling egress, but they do not restrict which service account can be attached to a Compute Engine instance; they operate at the service perimeter level, not the instance configuration level.

Full explanation →
466
MCQhard

A company uses Cloud SQL for MySQL with automated backups. They want to ensure that backup data is encrypted with a key that they manage and rotate on a schedule, separate from the primary database encryption. What should they do?

A.Use Cloud SQL's backup encryption with customer-managed key by specifying a CMEK for backups.
B.Enable CMEK on the Cloud SQL instance, which automatically encrypts backups with the same key.
C.Use CSEK for the Cloud SQL instance and then re-encrypt backups.
D.Export backups to Cloud Storage and apply CMEK on the export bucket.
AnswerA

Cloud SQL allows setting a separate CMEK for backups during instance creation or update.

Why this answer

Cloud SQL allows enabling CMEK for backups separately by specifying a different CMEK key for backup encryption. Enabling CMEK on the instance encrypts both data and backups with the same key. Exporting to Cloud Storage is not automated.

Full explanation →
467
MCQhard

Refer to the exhibit. An operations engineer configured this alert policy to notify when any VM instance in project my-project has high CPU utilization. However, no notifications are received even when CPU is consistently above 90% on multiple instances in us-central1-a. What is the most likely cause?

A.The 'duration' of 0s in the MQL condition prevents the alert from firing because it needs a minimum duration.
B.The alert policy is configured in a different project than the VM instances.
C.The MQL query uses 'group_by' which causes the condition to be evaluated on the aggregate, but the threshold should be applied before grouping.
D.The notification channel is not configured or is invalid.
AnswerB

If the alert policy is in project A but VM instances are in project B, the policy won't see those metrics unless cross-project access is set up.

Why this answer

Alert policies are project-scoped resources. If the VM instances reside in a different project than the one where the alert policy is defined, the policy cannot monitor those instances. The MQL query references the metric `compute.googleapis.com/instance/cpu/utilization` which is only visible within the same project as the monitored resources.

Cross-project monitoring requires additional configuration such as a metrics scope or a separate alert policy in the target project.

Exam trap

Google Cloud often tests the subtle distinction between an alert that fails to fire (scope/resource mismatch) versus an alert that fires but fails to notify (channel issue), leading candidates to incorrectly blame the notification channel when the real problem is that the alert condition is never evaluated against the target resources.

How to eliminate wrong answers

Option A is wrong because a `duration` of 0s is valid and means the condition fires immediately when the threshold is crossed; it does not prevent the alert from firing. Option C is wrong because `group_by` aggregates metrics before evaluation, and applying the threshold after grouping is the correct behavior for aggregate conditions; the threshold does not need to be applied before grouping. Option D is wrong because if the notification channel were invalid or missing, the alert would still fire (its state would change to `firing`), but no notification would be sent; the question states no notifications are received, implying the alert itself is not firing, which points to a monitoring scope issue rather than a channel problem.

Full explanation →
468
MCQhard

A company is deploying a firewall appliance in a VPC to inspect traffic. They create custom routes to direct traffic to the appliance. Which step is necessary to ensure the appliance can forward traffic back?

A.Enable IP forwarding on the appliance instance
B.Use a load balancer
C.Configure the appliance as a next hop in a route
D.Assign a public IP to the appliance
AnswerA

This allows the instance to forward packets it receives.

Why this answer

The firewall appliance instance must have IP forwarding enabled at the OS level (e.g., net.ipv4.ip_forward=1 on Linux) to forward packets between its network interfaces. Without this, the instance will drop any traffic not destined for its own IP address, even if VPC routes direct packets to it. This is a prerequisite for the appliance to act as a transparent or routed next-hop in the VPC routing table.

Exam trap

Google Cloud often tests the distinction between routing configuration (next-hop routes) and the OS-level requirement to actually forward packets, trapping candidates who assume that adding a route alone is sufficient for the appliance to process traffic.

How to eliminate wrong answers

Option B is wrong because a load balancer distributes traffic across multiple targets but does not enable an individual instance to forward packets; it is not a substitute for IP forwarding on the appliance. Option C is wrong because configuring the appliance as a next hop in a route is the step that directs traffic to the appliance, but it does not enable the appliance to forward that traffic back out; IP forwarding must be enabled separately. Option D is wrong because assigning a public IP allows internet-bound traffic to reach the instance but does not affect the kernel’s ability to forward packets between interfaces; IP forwarding is a distinct OS-level setting.

Full explanation →
469
MCQhard

A security team wants to mirror all traffic from a critical VM to a network intrusion detection system (NIDS) appliance running in the same VPC. They need to ensure that the NIDS receives both ingress and egress traffic, and that the original traffic is not impacted. Which solution should they implement?

A.Apply a network tag to the VM and create a firewall rule to copy traffic to the NIDS.
B.Configure the VM to use the NIDS as a proxy for all traffic.
C.Enable VPC Flow Logs on the VM's subnet and forward logs to the NIDS.
D.Create a packet mirroring policy that mirrors traffic from the VM to the NIDS instance.
AnswerD

Correct: Packet Mirroring copies packets for inspection without affecting live traffic.

Why this answer

Packet Mirroring (also known as VPC Packet Mirroring) is the correct solution because it copies all ingress and egress traffic from the VM's network interface (vNIC) to the NIDS instance without affecting the original traffic flow. This is achieved by creating a packet mirroring policy that forwards a copy of the packets to the NIDS, ensuring the VM's performance and connectivity remain unchanged.

Exam trap

Google Cloud often tests the distinction between Packet Mirroring (which copies packets) and VPC Flow Logs (which only log metadata), leading candidates to mistakenly choose VPC Flow Logs because they assume 'logs' provide full traffic visibility.

How to eliminate wrong answers

Option A is wrong because network tags and firewall rules in a VPC can only filter or forward traffic based on IP addresses and ports, but they cannot copy or mirror traffic; they either allow or deny traffic, not duplicate it. Option B is wrong because configuring the VM to use the NIDS as a proxy would require all traffic to be routed through the NIDS, which introduces a single point of failure, adds latency, and alters the original traffic path, violating the requirement to not impact the original traffic. Option C is wrong because VPC Flow Logs capture metadata (e.g., source/destination IP, ports, protocol) but not the actual packet payloads, so the NIDS cannot inspect the full traffic content for intrusion detection.

Full explanation →
470
MCQmedium

A company is using BigQuery to store analytics data and wants to ensure that data is retained for exactly 365 days after ingestion, then automatically deleted. How can they achieve this with minimal operational overhead?

A.Use Cloud Storage Object Lifecycle rules on the data exported to Cloud Storage
B.Set the table expiration to 365 days using the ALTER TABLE SET OPTIONS statement
C.Create a Cloud Function to delete tables older than 365 days
D.Configure a BigQuery scheduled query to delete rows older than 365 days
AnswerB

Setting table expiration automatically deletes the table after 365 days, meeting the requirement with no manual intervention.

Why this answer

BigQuery datasets have a default table expiration setting, but for individual tables, you can set an expiration time. The most efficient way is to set the table expiration to 365 days, which auto-deletes the table after that period.

Full explanation →
471
MCQhard

An organization wants to enforce that all Cloud Storage buckets are created with uniform bucket-level access enabled. Which policy can be used to achieve this?

A.Audit logs to detect non-compliance
B.VPC Service Controls perimeter
C.IAM custom role with permission to enforce uniform access
D.Organization policy with constraint `constraints/storage.uniformBucketLevelAccess`
AnswerD

This constraint enforces uniform bucket-level access at the organization level.

Why this answer

The Organization Policy with the constraint `constraints/storage.uniformBucketLevelAccess` is a native Google Cloud policy that can be applied at the organization, folder, or project level to enforce that all new Cloud Storage buckets are created with uniform bucket-level access enabled. This policy prevents the creation of buckets with fine-grained ACLs, ensuring consistent access control across the organization.

Exam trap

The trap here is that candidates often confuse IAM roles or VPC Service Controls with organization policy constraints, not realizing that only a hierarchical policy constraint can enforce a specific configuration setting at resource creation time, while IAM and VPC controls address different aspects of access and security.

How to eliminate wrong answers

Option A is wrong because audit logs only detect non-compliance after the fact; they do not prevent the creation of buckets without uniform access, so they cannot enforce the policy proactively. Option B is wrong because VPC Service Controls perimeters are designed to restrict data exfiltration and control access to Google Cloud services based on network context, not to enforce bucket-level access control settings like uniform bucket-level access. Option C is wrong because IAM custom roles define permissions for actions (e.g., storage.buckets.create) but cannot enforce a specific configuration setting on bucket creation; enforcement of uniform access requires an organization policy constraint, not an IAM role.

Full explanation →
472
MCQeasy

An organization wants to allow users to authenticate to Google Cloud using their existing Active Directory credentials via SAML 2.0. Which Google Cloud identity service should they configure?

A.Workload Identity Federation
B.Identity-Aware Proxy
C.Cloud Identity
D.Cloud Directory Sync
AnswerC

Supports SAML 2.0 federation with an external IdP.

Why this answer

Cloud Identity or Google Workspace can be configured as a SAML 2.0 service provider (or identity provider) to federate with an external IdP like Active Directory. For SAML 2.0 SSO, Cloud Identity supports integration with external IdPs. Cloud Directory Sync syncs users but doesn't handle SSO.

IAP is for access control, not identity federation.

Full explanation →
473
MCQmedium

A company is migrating on-premises data to Cloud Storage. They have regulatory requirements to encrypt data using keys managed by their on-premises hardware security module (HSM). Which solution should they use?

A.Use Cloud HSM to create and manage keys.
B.Use Cloud External Key Manager (Cloud EKM) to reference keys in their on-premises HSM.
C.Use customer-supplied encryption keys (CSEK) for each object.
D.Use Cloud Key Management Service (Cloud KMS) with a key generated in the cloud.
AnswerB

Cloud EKM allows using externally managed keys for Cloud Storage.

Why this answer

Cloud External Key Manager (Cloud EKM) allows you to use encryption keys stored in a supported on-premises HSM via a partner integration, meeting the regulatory requirement for key management outside of Google Cloud. This solution keeps the key material under your control while enabling Cloud Storage to encrypt data using those keys.

Exam trap

Google Cloud often tests the distinction between where the key is created versus where it is stored and managed; the trap here is assuming Cloud HSM (which is hardware-backed) meets the 'on-premises HSM' requirement, when in fact it is a Google-managed service in Google's infrastructure.

How to eliminate wrong answers

Option A is wrong because Cloud HSM creates and manages keys within Google Cloud, not on your on-premises HSM, so it does not satisfy the requirement for keys managed by your own hardware. Option C is wrong because customer-supplied encryption keys (CSEK) are provided by you but stored and managed by Google Cloud, not in your on-premises HSM; they also require you to supply the key with each API call, which is impractical for ongoing encryption. Option D is wrong because Cloud KMS with a cloud-generated key keeps the key material entirely within Google Cloud, failing the requirement for on-premises HSM management.

Full explanation →
474
MCQmedium

A security engineer needs to prevent users from creating service account keys in a Google Cloud project. The solution must be enforceable across all projects in the organization and should not block other IAM operations. Which approach should they use?

A.Use IAM Conditions to restrict service account key creation to only a specific project.
B.Create a custom role that excludes the permission iam.serviceAccountKeys.create and assign it to all users.
C.Use the Organization Policy Service with the constraint constraints/iam.disableServiceAccountKeyCreation.
D.Create an IAM deny policy at the organization level to deny the permission iam.serviceAccountKeys.create.
AnswerC

This is the correct method. The built-in constraint specifically disables service account key creation across the resource hierarchy.

Why this answer

Organization Policy constraints provide a way to enforce restrictions across the resource hierarchy. The built-in constraint 'constraints/iam.disableServiceAccountKeyCreation' specifically prevents creation of service account keys at the project, folder, or organization level. It does not affect other IAM operations.

IAM deny policies can deny specific permissions but are more complex to manage and apply at the org level for this specific use case. Custom roles are not designed for enforcement across projects. The Organization Policy Service is the correct choice for such organization-wide restrictions.

Full explanation →
475
Multi-Selectmedium

A company needs to meet the EU data boundary requirements for Assured Workloads, ensuring that data processing and storage remain within the European Union. Which TWO configurations are required? (Choose two.)

Select 2 answers
A.Enable Cloud Logging with log sinks in the US.
B.Create an Assured Workloads folder with a location of 'eu'.
C.Enable Access Approval for all projects.
D.Use a CMEK key from a key ring in a non-EU region.
E.Set the organization policy constraint 'gcp.resourceLocations' to allow only EU regions.
AnswersB, E

The Assured Workloads folder must be created in the EU location.

Why this answer

Assured Workloads provides a folder with specific compliance controls. The organization policy constraint gcp.resourceLocations restricts resource creation to allowed regions. The folder itself is created in a specific location (e.g., eu) to enforce the boundary.

Full explanation →
476
MCQmedium

A financial services company must retain audit logs for seven years to meet regulatory requirements. They are using Cloud Audit Logs. Which strategy should they implement to ensure logs are not deleted or modified during the retention period?

A.Export logs to BigQuery and set table expiration to 7 years.
B.Export logs to a Pub/Sub topic, then subscribe and store in a custom database.
C.Export logs to Cloud Storage and apply a retention policy that is locked to prevent deletion.
D.Store logs in the default Cloud Logging bucket and set a retention period of 7 years.
AnswerC

Cloud Storage retention policies with lock ensure objects cannot be deleted or overwritten until retention period expires.

Why this answer

Cloud Storage buckets with a locked retention policy provide immutable storage, preventing any deletion or modification of objects during the retention period. This meets the regulatory requirement for audit logs to be retained for seven years without alteration. Exporting logs to Cloud Storage and locking the retention policy ensures compliance with data retention regulations.

Exam trap

Google Cloud often tests the misconception that the default Cloud Logging bucket can be configured with long retention periods, but in reality, it only supports up to 30 days, and candidates must recognize that exporting to Cloud Storage with a locked retention policy is the only immutable option for multi-year retention.

How to eliminate wrong answers

Option A is wrong because BigQuery table expiration deletes the table after the set time, but it does not prevent modification or deletion of data within the table before expiration; also, BigQuery is not designed for immutable log storage. Option B is wrong because storing logs in a custom database via Pub/Sub does not inherently enforce immutability; the custom database could allow modifications or deletions unless specifically designed with retention locks, which is not guaranteed. Option D is wrong because the default Cloud Logging bucket has a maximum retention period of 30 days for logs, not 7 years, and logs in the default bucket can be deleted or modified by users with appropriate permissions.

Full explanation →
477
MCQeasy

A data engineer wants to classify columns in BigQuery containing sensitive data like email addresses and apply data masking so that users see only masked values (e.g., 'j***@example.com'). Which feature should they use?

A.BigQuery column-level security with policy tags and data masking rules
B.Cloud DLP inspection jobs
C.Cloud IAM roles for BigQuery
D.View with SQL masking
AnswerA

Policy tags classify data, and data masking rules (e.g., EmailMask) apply masking automatically.

Why this answer

BigQuery column-level security with policy tags allows classification, and BigQuery Data Policy with data masking rules (like email masking) applies dynamic masking at query time.

Full explanation →
478
MCQmedium

A company wants to provide private connectivity from its VPC to Google APIs (e.g., Cloud Storage, BigQuery) without using public IPs or NAT. The solution must also support on-premises connectivity via Cloud VPN. Which service should they use?

A.Private Google Access
B.Cloud NAT
C.Private Service Connect
D.Cloud VPN
AnswerC

Private Service Connect endpoints in a VPC provide private IP access to Google APIs, and can be reached from on-premises via Cloud VPN or Interconnect.

Why this answer

Private Service Connect enables private connectivity to Google APIs via internal IPs. It supports both VPC and on-premises (via Cloud VPN or Interconnect) access to Google APIs without traversing the internet.

Full explanation →
479
MCQeasy

A small business stores backup archives in Cloud Storage and wants to encrypt them at rest using a key that is automatically rotated annually. They do not want to manage key material themselves. Which encryption option should they use?

A.Use Google-managed encryption keys (GMEK).
B.Use Cloud KMS customer-managed keys (CMEK) with rotation period.
C.Use Customer-Supplied Encryption Keys (CSEK).
D.Use client-side encryption with a third-party key management service.
AnswerA

GMEK is automatically rotated by Google.

Why this answer

Google-managed encryption keys (GMEK) are automatically rotated and require no customer management. Option B is wrong because CMEK requires customer management. Option C is wrong because CSEK requires the customer to supply and manage keys.

Option D is wrong because client-side encryption is not handled by Google.

Full explanation →
480
Multi-Selecteasy

A startup uses Cloud SQL for MySQL and wants to implement automated daily backups with a 7-day retention period. The database is 50 GB and experiences moderate write traffic. The team wants to minimize cost and operational overhead. Which two actions should they take? (Choose two.)

Select 2 answers
A.Use gcloud sql backups create to take on-demand backups daily
B.Configure point-in-time recovery (PITR) with a 7-day log retention
C.Set up a cron job on a Compute Engine instance to run pg_dump
D.Enable automated backups in Cloud SQL with a 7-day retention period
E.Create a Cloud Function to export the database to Cloud Storage daily using mysqldump
AnswersB, D

PITR enables recovery to any point in time within the retention window and is built into Cloud SQL.

Why this answer

Cloud SQL provides built-in automated backups. Configuring them through the UI or CLI is straightforward and cost-effective. The default backup window can be customized, and retention is set per backup configuration.

Full explanation →
481
MCQeasy

An organization needs to grant a contractor access to a specific project for 30 days, with the ability to start and stop Compute Engine instances but not delete them. Which IAM role should be used?

A.Compute Viewer (roles/compute.viewer)
B.Compute OS Login (roles/compute.osLogin)
C.Compute Admin (roles/compute.admin)
D.Compute Instance Admin (v1) (roles/compute.instanceAdmin.v1)
AnswerD

This role allows starting/stopping instances but not deleting them.

Why this answer

The Compute Instance Admin (v1) role (roles/compute.instanceAdmin.v1) allows starting, stopping, and modifying instances, but not deleting them. It is suitable for this scenario. Compute Admin (roles/compute.admin) allows full control including deletion.

Compute Viewer (roles/compute.viewer) is read-only. Compute Instance Operator (beta) might exist but not standard.

Full explanation →
482
MCQmedium

A security engineer is troubleshooting connectivity issues between two Compute Engine instances in the same VPC but in different subnets. Both instances have internal IPs and are in the same region. The firewall rules allow ingress from 10.0.0.0/8. However, traffic is failing. What is the most likely cause?

A.The instances are using external IPs and the source IP is being NATed.
B.The VPC has dynamic routing mode set to global, causing routing conflicts.
C.The ingress firewall rule is applied to a network tag that is not assigned to the destination instances.
D.There is a firewall rule with a lower priority that denies egress traffic between subnets.
AnswerC

Firewall rules are applied to instances via tags or service accounts; missing tag would block traffic.

Why this answer

Firewall rules in Google Cloud VPC are applied to the destination instance based on network tags, not just the subnet or IP range. If the ingress rule allowing traffic from 10.0.0.0/8 is configured with a target tag that is not assigned to the destination Compute Engine instances, the rule will not apply, and traffic will be dropped. This is a common misconfiguration when using tags to selectively apply firewall rules.

Exam trap

Google Cloud often tests the misconception that firewall rules applied to a subnet or IP range automatically apply to all instances in that subnet, when in reality, network tags are required to target specific instances unless the rule is applied to all instances (target = 'all instances').

How to eliminate wrong answers

Option A is wrong because the question states both instances have internal IPs, and traffic between internal IPs in the same VPC does not go through NAT; NAT only applies when using external IPs or Cloud NAT. Option B is wrong because dynamic routing mode (regional vs. global) affects route advertisement for hybrid connectivity, not internal VPC routing between subnets in the same region; VPC internal routing is always automatic and does not cause conflicts. Option D is wrong because egress traffic between subnets in the same VPC is implicitly allowed by default; a deny egress rule would need to be explicitly configured, and the question does not mention any such rule, making this unlikely.

Full explanation →
483
MCQmedium

A global company must store customer data in a specific geographic region to comply with data residency regulations. The database needs strong transactional consistency and low-latency reads worldwide. Which database solution should they choose?

A.Use Cloud Spanner with a multi-region configuration that includes the required region
B.Use BigQuery with a multi-region dataset
C.Use Cloud SQL with cross-region replication
D.Use Firestore in multi-region mode
AnswerA

Cloud Spanner provides strong consistency, horizontal scaling, and multi-region support to meet residency and performance requirements.

Why this answer

Cloud Spanner is the ideal choice because it provides strong transactional consistency, horizontal scaling, and multi-region configurations that can include the required geographic region for data residency, while also offering low-latency reads globally through its global distribution. Option B (BigQuery) is for analytics, not transactional workloads. Option C (Cloud SQL with cross-region replication) does not provide the same level of consistency and scalability as Cloud Spanner, and replication may have latency.

Option D (Firestore) in multi-region mode offers eventual consistency for some operations, not strong consistency.

Full explanation →
484
MCQmedium

A DevOps team wants to grant a CI/CD pipeline (running on a Compute Engine VM) the ability to restart Compute Engine instances in a specific project. The VM has a service account attached. What is the best practice to grant this permission?

A.Create a custom role with compute.instances.stop and compute.instances.start permissions, and assign it to the service account at the project level.
B.Generate a service account key and use it in the CI/CD system to authenticate.
C.Grant the VM's service account the roles/iam.serviceAccountUser role so it can impersonate another service account that has Compute Admin.
D.Grant the service account the Compute Admin role (roles/compute.admin) at the project level.
AnswerA

Custom roles provide only necessary permissions, following least privilege.

Why this answer

The best practice is to create a custom role with only the required permissions (compute.instances.stop and compute.instances.start) and assign it to the service account.

Full explanation →
485
MCQmedium

A company needs to securely connect two VPC networks from different projects in the same organization. Each VPC has overlapping IP ranges (10.0.0.0/16). They require high throughput and low latency. What is the recommended approach?

A.Re-IP one of the VPC networks to a non-conflicting range and then use VPC Network Peering.
B.Use Dedicated Interconnect to directly connect the two VPCs.
C.Use VPC Network Peering.
D.Use HA VPN with dynamic routing.
AnswerA

Re-IPing resolves the overlap and allows peering, which provides high throughput and low latency.

Why this answer

VPC Network Peering requires non-overlapping IP ranges to establish direct connectivity. By re-IPing one VPC to a non-conflicting range (e.g., 10.1.0.0/16), you eliminate the routing conflict, allowing peering to provide high throughput and low latency via Google's internal backbone, with no bandwidth limits or single points of failure.

Exam trap

Google Cloud often tests the misconception that VPC Network Peering can handle overlapping IP ranges if you use custom route tables or subnets, but in reality, peering requires non-overlapping CIDRs at the VPC level, and no workaround exists within the peering construct itself.

How to eliminate wrong answers

Option B is wrong because Dedicated Interconnect is a hybrid connectivity solution for on-premises to VPC, not for VPC-to-VPC connections within the same organization; it also does not resolve overlapping IP ranges. Option C is wrong because VPC Network Peering directly fails when VPCs have overlapping IP ranges, as routes conflict and traffic cannot be properly forwarded. Option D is wrong because HA VPN with dynamic routing can technically route between overlapping subnets using BGP and prefix-based filtering, but it introduces encryption overhead, higher latency, and throughput limitations compared to peering, making it suboptimal for high-throughput, low-latency requirements.

Full explanation →
486
MCQeasy

A company uses Cloud Armor to protect their HTTP Load Balancer from DDoS attacks. They want to block requests from a specific malicious IP address range, 203.0.113.0/24. Which Cloud Armor policy configuration should they use?

A.Create an allow rule with source IP condition for their own IP ranges and rely on default deny.
B.Create a rule with a 'source-ip' tag set to 'malicious' and assign to the load balancer.
C.Create a deny rule with priority 1000000 for the IP range.
D.Create a deny rule with a source IP condition for 203.0.113.0/24 and set priority to 1000.
AnswerD

Correct: deny rule blocks; priority 1000 is higher than default rules.

Why this answer

Cloud Armor security policies use priority-based rules, where lower numbers indicate higher priority. A deny rule with priority 1000 for the specific IP range 203.0.113.0/24 ensures that traffic from that range is blocked before any lower-priority allow rules are evaluated. This is the standard method to block specific IP ranges while allowing other traffic.

Exam trap

Google Cloud often tests the misconception that higher priority numbers mean higher precedence, or that a default deny rule is automatically in place, leading candidates to choose a low-priority deny rule that would be ineffective.

How to eliminate wrong answers

Option A is wrong because relying on a default deny with only allow rules for your own IP ranges would block all traffic not explicitly allowed, which is overly restrictive and not the intended approach for blocking a specific malicious range. Option B is wrong because Cloud Armor does not support a 'source-ip' tag; tags are used for labeling resources, not for IP-based filtering rules. Option C is wrong because priority 1000000 is the lowest possible priority, meaning the rule would be evaluated last and could be overridden by any higher-priority allow rule, making it ineffective for blocking traffic.

Full explanation →
487
MCQhard

Refer to the exhibit. A company configured this VPC Service Controls perimeter for a PCI DSS project. The compliance auditor notes that BigQuery data can be accessed from outside the perimeter. Which change must be made to restrict access to BigQuery?

A.Set the perimeter enforcement mode to enforced instead of dry run
B.Add storage.googleapis.com to restrictedServices
C.Move BigQuery to a separate perimeter
D.Add allUsers to the perimeter's access levels
AnswerA

A perimeter in dry run mode logs violations but does not block access; it must be set to enforced to restrict BigQuery.

Why this answer

The dry run mode logs violations but does not enforce restrictions, allowing BigQuery data to be accessed from outside the perimeter. Changing the enforcement mode to 'enforced' activates the VPC Service Controls policies, blocking all out-of-perimeter access to the configured services. This directly addresses the auditor's finding by ensuring that only requests from within the perimeter are allowed.

Exam trap

Google Cloud often tests the distinction between 'dry run' and 'enforced' modes, where candidates mistakenly assume that simply adding a service to the perimeter or configuring access levels is sufficient without enabling enforcement.

How to eliminate wrong answers

Option B is wrong because adding storage.googleapis.com to restrictedServices would restrict Cloud Storage, not BigQuery; BigQuery uses bigquery.googleapis.com as its service name. Option C is wrong because moving BigQuery to a separate perimeter does not by itself restrict access from outside the original perimeter — the new perimeter would also need enforcement enabled and proper configuration. Option D is wrong because adding allUsers to the perimeter's access levels would explicitly allow all users, including those outside the perimeter, which is the opposite of what is needed to restrict access.

Full explanation →
488
MCQeasy

A security engineer needs to configure Identity-Aware Proxy (IAP) for a web application running on Compute Engine. The goal is to ensure that only authenticated users from the corporate domain can access the application. What is the first step in the configuration?

A.Configure OAuth 2.0 consent screen and create credentials.
B.Enable IAP on the backend service of the load balancer.
C.Create a firewall rule to allow traffic only from IAP IP ranges.
D.Grant the IAP-secured Web App User role to the corporate domain users.
AnswerA

Correct. Configuring the OAuth consent screen and creating OAuth credentials is the prerequisite step. Without these, IAP cannot authenticate users.

Why this answer

To configure Identity-Aware Proxy (IAP) for a web application on Compute Engine, the first step is to configure the OAuth 2.0 consent screen and create OAuth credentials. This establishes the authentication mechanism that IAP will use to verify user identity. After this, you can enable IAP on the backend service, create access policies, and assign roles.

Attempting to enable IAP before setting up OAuth credentials will result in a configuration error.

Exam trap

A common mistake is to think enabling IAP on the backend service is the first step. However, the OAuth consent screen and credentials must be configured first as they are a prerequisite for IAP to function.

Full explanation →
489
Multi-Selectmedium

A company wants to implement a vulnerability management program for their Google Cloud environment. They need to scan Compute Engine instances for OS vulnerabilities and container images for known vulnerabilities. Which two services should they use? (Choose two.)

Select 2 answers
A.VM Manager (OS patch assessment)
B.Cloud Security Scanner
C.Container Analysis (Artifact Registry vulnerability scanning)
D.Binary Authorization
E.Web Security Scanner
AnswersA, C

VM Manager provides vulnerability assessment for OS packages.

Why this answer

VM Manager patch management can assess and patch OS vulnerabilities on Compute Engine instances. Container Analysis (Artifact Registry) scans container images for vulnerabilities. Web Security Scanner is for web apps.

Binary Authorization is for attestation. Cloud Security Scanner does not exist.

Full explanation →
490
MCQhard

An organization uses Chronicle SIEM to ingest logs from multiple GCP projects and on-premises firewalls. They need to write a detection rule that triggers when an IP address makes more than 100 failed login attempts across different GCP projects within 10 minutes. Which Chronicle feature should they use?

A.Dashboard and alerting
B.Reference list
C.Unified Data Model (UDM)
D.YARA-L detection rule
AnswerD

YARA-L rules can correlate events across multiple data sources and time windows.

Why this answer

YARA-L is the detection language for Chronicle. It allows multi-event correlation across data sources, including timestamps and grouping by source IP. UDM is the data model.

Dashboards are visual. Reference lists are for static data.

Full explanation →
491
Multi-Selectmedium

A company wants to automatically rotate secrets stored in Secret Manager every 30 days. They have set up a Pub/Sub topic and a Cloud Function to perform the rotation. Which TWO actions are required to complete the configuration? (Choose two.)

Select 2 answers
A.Grant the Cloud Functions service account the secretmanager.secretVersionManager role on the secret.
B.Set the rotation period on the secret to 30 days.
C.Create a Cloud Scheduler job to call the Secret Manager API every 30 days.
D.Enable automatic rotation in the Cloud Console by toggling the 'Enable rotation' switch.
E.Configure a Pub/Sub topic on the secret to receive notifications when rotation is triggered.
AnswersB, E

The rotation period tells Secret Manager how often to trigger rotation.

Why this answer

To enable automatic rotation, you need to configure a rotation period and a Pub/Sub topic. The rotation period defines how often the secret is rotated, and the Pub/Sub topic is used to notify the Cloud Function when rotation is due.

Full explanation →
492
MCQhard

A security team needs to apply a security policy that blocks requests to their HTTP load balancer from a specific geographic region (e.g., Country A). Which Cloud Armor feature should they use?

A.Preconfigured WAF rules
B.Custom rules with CEL expressions
C.Adaptive Protection
D.Rate limiting
AnswerB

Custom rules using CEL can match on geographic attributes like origin.region_code.

Why this answer

Cloud Armor supports geolocation-based blocking using custom rules with geographic origin matching (e.g., origin.region_code).

Full explanation →
493
MCQhard

An organization uses a global HTTPS load balancer with a Google-managed SSL certificate. The certificate was automatically provisioned and renewed. Recently, the certificate renewal failed and the site shows a warning. The load balancer's frontend uses the certificate. What is the most likely cause?

A.The load balancer's frontend IP address has changed
B.The certificate has reached its maximum validity period
C.The DNS CNAME record for domain validation is misconfigured or missing
D.The load balancer's SSL policy requires a minimum TLS version that the managed certificate does not support
AnswerC

Managed certificates require DNS records to prove domain ownership; incorrect records prevent renewal.

Why this answer

Google-managed certificates are provisioned using DNS authorization. If the DNS records are misconfigured (e.g., the CNAME record for domain ownership validation is missing or incorrect), renewal will fail. The load balancer settings themselves are typically fine.

Full explanation →
494
Multi-Selectmedium

Which TWO are correct statements about IAM deny policies? (Choose two.)

Select 2 answers
A.Deny policies are prioritized based on the resource hierarchy (organization highest).
B.Deny policies support conditions to restrict when the deny applies.
C.Deny policies can be used to block access for all users except a specific set.
D.Deny policies cannot override an allow policy if the member is explicitly granted.
E.Deny policies can be applied at any resource level including individual resources.
AnswersB, C

Conditions can be added to deny rules.

Why this answer

IAM deny policies support conditions that allow you to specify when the deny should apply, such as based on IP address, date/time, or resource tags. This enables fine-grained control over access restrictions, ensuring that the deny only takes effect under defined circumstances.

Exam trap

Google Cloud often tests the misconception that deny policies can be applied at any resource level, but in Google Cloud, deny policies are only supported at the organization, folder, and project levels, not on individual resources.

Full explanation →
495
MCQhard

During a forensic investigation, you need to analyze a Compute Engine instance that has been compromised. You want to preserve the disk state for analysis without affecting the running instance. Which action should you take?

A.Delete the instance but keep the disk, then attach the disk to a new instance.
B.Create a snapshot of the persistent disk and attach the snapshot to a new instance for analysis.
C.Stop the instance and create a custom image from the boot disk.
D.Use gcloud compute disks export to export the disk to Cloud Storage.
AnswerB

Snapshots capture the disk state at a point in time and can be used to create new disks attached to a forensic VM.

Why this answer

Creating a snapshot is the non-disruptive, best practice for forensic preservation.

Full explanation →
496
MCQhard

An organization has three projects: dev, staging, prod. They use Cloud Build to deploy code. The Cloud Build service account in the dev project needs to deploy to GKE in the prod project. To allow cross-project deployment, what should the Cloud Build service account be granted in the prod project?

A.roles/container.clusterViewer on the prod cluster.
B.roles/container.developer on the prod project.
C.roles/storage.objectViewer on the prod bucket.
D.roles/iam.serviceAccountUser on the GKE node service account in prod.
AnswerB

Grants permissions to deploy to GKE clusters in the prod project.

Why this answer

The Cloud Build service account in the dev project needs to deploy workloads to a GKE cluster in the prod project. The role `roles/container.developer` on the prod project grants the necessary permissions to create, update, and delete pods, deployments, and services within the cluster, which is required for deployment. This role also includes `container.clusters.get` and `container.clusters.update` to interact with the cluster, making it the correct choice for cross-project GKE deployment.

Exam trap

Google Cloud often tests the distinction between read-only, developer, and admin roles in GKE, and the trap here is that candidates confuse `container.clusterViewer` (read-only) with the ability to deploy, or think that granting access to a storage bucket or node service account is sufficient for cross-project GKE deployment.

How to eliminate wrong answers

Option A is wrong because `roles/container.clusterViewer` only allows read-only access to cluster resources (e.g., listing pods, viewing cluster metadata) and does not permit creating or modifying deployments, which is required for deploying code. Option C is wrong because `roles/storage.objectViewer` grants read-only access to objects in a Cloud Storage bucket, which is irrelevant to deploying to GKE; it might be needed for pulling build artifacts but not for cluster operations. Option D is wrong because `roles/iam.serviceAccountUser` on the GKE node service account allows impersonation of that service account (e.g., to run pods as that identity), but it does not grant any permissions to deploy or manage resources on the cluster itself; the Cloud Build service account needs direct cluster permissions, not the ability to impersonate node accounts.

Full explanation →
497
MCQeasy

A company wants to enforce that traffic between two projects in the same organization must go through a central inspection VPC. They need a firewall rule that denies all traffic between the projects except through the inspection VPC. Which type of firewall rule should they use?

A.Cloud IDS
B.VPC Service Controls
C.Network firewall rules in each project
D.Hierarchical firewall policy at the folder level
AnswerD

Hierarchical policies can enforce rules across projects and cannot be overridden, ensuring central inspection.

Why this answer

Hierarchical firewall policies are applied at the folder or organization level and can enforce rules across projects. They are inherited and cannot be overridden by lower-level rules, making them suitable for central enforcement.

Full explanation →
498
Multi-Selectmedium

A security engineer is designing a network security architecture for a multi-project environment. They need to enforce a baseline set of firewall rules across all projects in the organization, but allow individual project teams to add their own specific rules. Which TWO components should they use?

Select 2 answers
A.Project-level VPC firewall rules
B.Network firewall policy
C.Shared VPC
D.Cloud Armor security policy
E.Organization-level hierarchical firewall policy
AnswersA, E

Project teams can add their own rules using VPC firewall rules (or project-level hierarchical policies).

Why this answer

Hierarchical firewall policies can be applied at the organization level to enforce baseline rules. These policies are inherited by all projects. Individual project teams can then create their own VPC firewall rules (or project-level hierarchical policies) that are evaluated after the org-level policies, allowing them to add specific rules without overriding the baseline.

Full explanation →
499
MCQmedium

A government contractor needs to deploy a workload on Google Cloud that complies with FedRAMP High and ITAR (International Traffic in Arms Regulations). They require that Google personnel cannot access the infrastructure and that data residency is restricted to the United States. Which Google Cloud solution should they use?

A.VPC Service Controls with Organization Policies restricting resource location to the US.
B.Cloud HSM with Customer-Managed Encryption Keys (CMEK) stored in a US key region.
C.Assured Workloads with the FEDRAMP_HIGH and ITAR compliance regimes, and enable Google personnel access restrictions.
D.Deploy the workload in a Google Cloud region only available to US government customers (us-gov-west1).
AnswerC

Assured Workloads supports combined compliance regimes and provides access controls to restrict Google personnel.

Why this answer

Assured Workloads provides a consolidated compliance framework that includes FedRAMP, ITAR, and access restrictions.

Full explanation →
500
MCQmedium

Refer to the exhibit. A security engineer configured Data Access audit logs for all services. During a compliance audit, the auditor flags this configuration as deficient. What is the most likely reason?

A.The audit config does not include DATA_WRITE logging
B.ALL_SERVICES includes unsupported services for data access logs
C.The service account is exempted from DATA_READ logs, which may allow unlogged data access
D.The audit config should be applied at the project level, not organization level
AnswerC

Exempting any principal from audit logging reduces visibility and can violate compliance policies that require logging of all data access.

Why this answer

Exempting a service account from DATA_READ logging means data access by that service account is not logged, creating a gap in audit coverage that many compliance frameworks (e.g., PCI DSS) require to be comprehensive.

Full explanation →
501
MCQeasy

A security engineer is tasked with automating the remediation of non-compliant resources in a Google Cloud organization. The organization uses Organization Policy Service to enforce constraints. The engineer needs to automatically disable a specific service (e.g., Compute Engine API) for a project that violates a policy. Which Google Cloud service should be used to trigger this remediation?

A.Cloud Build
B.Cloud Run
C.Cloud Scheduler
D.Cloud Functions
AnswerD

Cloud Functions can be triggered by logs or Pub/Sub messages to perform automated remediation actions.

Why this answer

Cloud Functions is correct because it can be triggered by real-time event notifications (e.g., from Cloud Asset Inventory or Pub/Sub) when a policy violation is detected, and then execute custom code to disable the Compute Engine API via the Service Usage API. This serverless, event-driven model is ideal for automated remediation workflows without managing infrastructure.

Exam trap

Google Cloud often tests the distinction between event-driven (Cloud Functions) and scheduled (Cloud Scheduler) or compute (Cloud Run) services, trapping candidates who confuse scheduled tasks with real-time remediation triggers.

How to eliminate wrong answers

Option A is wrong because Cloud Build is a CI/CD service for building, testing, and deploying artifacts; it is not designed to react to policy violation events or directly disable APIs. Option B is wrong because Cloud Run is a managed compute platform for running containerized applications, not an event-triggered function service; it lacks native integration with Organization Policy violation events. Option C is wrong because Cloud Scheduler is a cron job service for scheduled, not event-driven, execution; it cannot react in real time to policy violations.

Full explanation →
502
MCQhard

An organization wants to allow a group of external auditors read-only access to specific BigQuery datasets in a project, but only during working hours (9 AM to 5 PM). The auditors belong to an external Google Workspace domain. Which IAM configuration should be used?

A.Create a custom role with required permissions on the datasets, grant it to the auditors' group with an IAM condition using request.time between 9 AM and 5 PM.
B.Configure a Cloud Scheduler job to add and remove the auditors' group membership at the required times.
C.Create an Organization Policy with a time constraint on the datasets.
D.Use VPC Service Controls with an access level that allows during working hours.
AnswerA

IAM Conditions support time-based restrictions.

Why this answer

IAM conditions allow you to enforce time-based access using the `request.time` attribute, which can restrict access to specific hours. By granting a custom role with read-only permissions on the BigQuery datasets and attaching a condition that `request.time` falls between 9 AM and 5 PM, the auditors from the external Google Workspace domain will only have access during working hours. This approach is native to IAM and does not require external automation or network-level controls.

Exam trap

The trap here is that candidates often confuse IAM conditions with Organization Policies or VPC Service Controls, thinking time-based access requires a separate service, when in fact IAM conditions with `request.time` provide a native, granular solution.

How to eliminate wrong answers

Option B is wrong because Cloud Scheduler can add/remove group memberships, but it introduces a delay (up to 2 minutes for propagation) and is a workaround rather than a native IAM condition; it also risks leaving access open if the job fails. Option C is wrong because Organization Policies apply to the entire project or organization, not to specific datasets, and they do not support time-based constraints on BigQuery datasets. Option D is wrong because VPC Service Controls restrict access based on network context (e.g., IP ranges, client identity) and do not natively support time-of-day conditions; they are designed for perimeter security, not granular time-based access.

Full explanation →
503
MCQmedium

A user in a Google Cloud organization wants to create a custom IAM role at the project level. Which permission is required to create custom roles?

A.resourcemanager.projects.setIamPolicy
B.iam.roles.create
C.iam.serviceAccounts.create
D.iam.roles.update
AnswerB

This permission allows creation of custom roles.

Why this answer

The permission iam.roles.create is needed to create custom roles. This permission is included in roles like roles/iam.roleAdmin or roles/owner.

Full explanation →
504
MCQhard

A company uses VPC Service Controls to protect sensitive data. They notice that audit logs from a service perimeter are not being exported to a logging bucket inside the same perimeter. What is the likely cause?

A.The logging bucket is not within the service perimeter
B.The logging bucket is within a different VPC
C.The logging bucket is in a different project
D.The logging bucket has a retention policy
AnswerA

Exporting to a bucket outside the perimeter is blocked by the service perimeter.

Why this answer

The logging bucket must be inside the service perimeter for logs to be accessible from within the perimeter. If the bucket is outside, the logs cannot be exported due to the perimeter's data exfiltration protections.

Full explanation →
505
Multi-Selecteasy

Which THREE Google Cloud services can encrypt data at rest?

Select 3 answers
A.Cloud CDN
B.Cloud Storage
C.Cloud SQL
D.Cloud Functions
E.Cloud KMS
AnswersB, C, E

Cloud Storage encrypts objects at rest by default.

Why this answer

Cloud Storage encrypts data at rest by default using server-side encryption (SSE) with either Google-managed keys or customer-managed keys via Cloud KMS. This ensures that all objects stored in buckets are encrypted before being written to disk, protecting data from unauthorized access at the storage layer.

Exam trap

Google Cloud often tests the misconception that all Google Cloud services automatically encrypt data at rest, but services like Cloud CDN and Cloud Functions do not provide native at-rest encryption themselves; they rely on underlying storage services for that capability.

Full explanation →
506
MCQeasy

A company must implement data residency requirements that prohibit storing data outside the European Union. They are using Cloud Bigtable and need to ensure that backups are also stored within the EU. Which configuration should they choose?

A.Create the Bigtable instance with multi-region placement in europe-west1 and europe-west4.
B.Create an instance in a dual-region configuration (e.g., europe-west1 and europe-west4) and use backup policies.
C.Use a single-region instance in europe-west1 with customer-managed encryption keys (CMEK) for backups.
D.Create the Bigtable instance in a single EU region (e.g., europe-west1) and enable automatic backups.
AnswerD

Backups are stored in the same region as the instance, ensuring data stays in the EU.

Why this answer

A single-region Bigtable instance in an EU region (e.g., europe-west1) ensures that all data, including backups, remains within the EU. Enabling automatic backups stores backup data in the same region, satisfying data residency requirements that prohibit storing data outside the EU.

Exam trap

Google Cloud often tests the misconception that multi-region or dual-region configurations are acceptable for data residency, but the trap here is that any replication across regions (even within the EU) can violate strict data residency if the requirement prohibits storing data outside a specific geographic boundary, and backups must be explicitly confined to the same region.

How to eliminate wrong answers

Option A is wrong because multi-region placement replicates data across multiple geographic regions, which could include non-EU locations, violating data residency requirements. Option B is wrong because a dual-region configuration replicates data across two EU regions, but backups may be stored in a separate location not guaranteed to be within the EU, and backup policies do not enforce regional residency. Option C is wrong because customer-managed encryption keys (CMEK) control encryption but do not affect data storage location; backups could still be stored outside the EU if not explicitly configured to stay within the region.

Full explanation →
507
MCQeasy

A user is unable to create a Compute Engine instance using a custom image from a family. What is the missing permission?

A.compute.disks.create on the project
B.compute.instances.create on the project
C.compute.images.get on the image family
D.compute.images.use on the image family
AnswerD

This permission is required to use the image to create an instance.

Why this answer

To create a Compute Engine instance using a custom image from a family, the user needs the `compute.images.use` permission on the image family (or the specific image). This permission allows the user to use the image as a boot disk for new instances. Without it, the instance creation fails even if the user has `compute.instances.create` on the project.

Exam trap

Google Cloud often tests the distinction between project-level permissions (like `compute.instances.create`) and resource-level permissions (like `compute.images.use`), trapping candidates who assume instance creation automatically includes the right to use any image.

How to eliminate wrong answers

Option A is wrong because `compute.disks.create` on the project allows creating persistent disks but does not grant the right to use a specific image family as the source for the boot disk. Option B is wrong because `compute.instances.create` on the project allows creating instances but does not include the permission to use a custom image from a family; that requires an additional resource-level permission. Option C is wrong because `compute.images.get` on the image family only allows viewing image metadata, not using the image to create an instance.

Full explanation →
508
Multi-Selecteasy

A security engineer is configuring VPC Service Controls to protect a service perimeter. Which TWO conditions must be met for a request to be allowed across the perimeter? (Choose TWO.)

Select 2 answers
A.The request is made by an identity that belongs to an allowed domain.
B.The request comes from an allowed IP range.
C.The request is made by a service account that has been granted access.
D.The request includes a valid access context manager access level.
E.The request originates from a project within the perimeter.
AnswersD, E

Access levels are required for both inside and outside requests.

Why this answer

The correct answers are D and E. A request is allowed across a VPC Service Perimeter if it originates from a project within the perimeter (E) and includes a valid Access Context Manager access level (D). These two conditions are required.

Other conditions like allowed domains, IP ranges, or service accounts are not standalone requirements; they are part of access levels or identity-based controls.

Full explanation →
509
Drag & Dropmedium

Drag and drop the steps to set up a Private Google Access for on-premises hosts using Private Service Connect in the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4

Why this order

Private Service Connect requires VPC, endpoint creation, DNS configuration, hybrid connectivity, and testing.

Full explanation →
510
MCQmedium

An organization needs to audit when Google administrators access their customer content stored in GCP. Which service provides near-real-time logs of such access?

A.VPC Flow Logs
B.Cloud Monitoring
C.Cloud Audit Logs
D.Access Transparency
AnswerD

Access Transparency logs Google administrator access to customer data.

Why this answer

Access Transparency provides near-real-time logs when Google staff access customer content, offering visibility into administrative actions.

Full explanation →
511
MCQeasy

An engineer has enabled Private Google Access on the subnet. However, instances in the subnet cannot access Google APIs (e.g., storage.googleapis.com) using their internal IPs. What is the most likely issue?

A.The instances need a public IP
B.The domain needs to be added to a DNS zone
C.Private Google Access requires a VPC connector
D.The instances have no route to the default internet gateway
AnswerB

If using custom DNS, you must create a private zone for googleapis.com to resolve to the private IPs.

Why this answer

Private Google Access allows instances without public IPs to reach Google APIs and services using their internal IPs, but it requires that the DNS resolution for the API domain (e.g., storage.googleapis.com) resolves to the private IP range used by Google's Private Access (199.36.153.8/30). If the domain is not added to a private DNS zone (e.g., googleapis.com) in the VPC, DNS will resolve to public IPs, causing connectivity failure. Option B correctly identifies this missing DNS configuration as the most likely issue.

Exam trap

Google Cloud often tests the misconception that Private Google Access requires a public IP or a VPC connector, when in fact the critical missing piece is the DNS configuration to resolve Google API domains to private IPs.

How to eliminate wrong answers

Option A is wrong because Private Google Access is specifically designed to allow instances without public IPs to access Google APIs; requiring a public IP would defeat its purpose. Option C is wrong because Private Google Access does not require a VPC connector; it uses a special route and DNS configuration within the VPC, not a connector. Option D is wrong because Private Google Access does not rely on a route to the default internet gateway; it uses a default route (0.0.0.0/0) with a next hop of 'default internet gateway' only for public IP access, but for Private Google Access, the route must point to the 'default internet gateway' with the destination being the private IP range 199.36.153.8/30, not the entire internet.

Full explanation →
512
MCQeasy

In the Google Cloud IAM resource hierarchy, which level supports the most granular policy attachment?

A.Folder
B.Organization
C.Project
D.Resource
AnswerD

Resources like Cloud Storage buckets are the most granular level for IAM policy attachment.

Why this answer

Policies can be attached at the organization, folder, project, and resource levels. The most granular is at the resource level, such as a specific Cloud Storage bucket or Compute Engine instance.

Full explanation →
513
MCQeasy

Which type of Cloud Audit Logs must be explicitly enabled and incur additional cost?

A.Admin Activity logs
B.System Event logs
C.Policy Denied logs
D.Data Access logs
AnswerD

Must be explicitly enabled and incur costs for storage and processing.

Why this answer

Data Access logs track read and write operations on resources. They are opt-in, cost extra, and have additional retention costs. Admin Activity logs are free and enabled by default.

System Event logs are also free. Policy Denied logs are generated automatically when access is denied.

Full explanation →
514
Multi-Selectmedium

A Security Engineer is designing access controls for a multi-cloud environment where workloads on Google Cloud need to access on-premises databases. The company wants to use long-lived credentials. Which TWO options are valid approaches? (Choose TWO.)

Select 2 answers
A.Create an OAuth 2.0 client ID for an installed application and use offline access to obtain refresh tokens.
B.Set up a Cloud VPN tunnel and use private IP addresses to access Google Cloud services.
C.Create a service account and use its key to generate short-lived tokens.
D.Create a service account and download its private key for the on-premises application to use.
E.Use Workload Identity Federation to exchange on-premises credentials for Google Cloud tokens.
AnswersA, D

OAuth 2.0 client IDs for installed applications can use refresh tokens that are long-lived.

Why this answer

OAuth 2.0 client IDs for installed applications can be configured for offline access, which returns refresh tokens. These refresh tokens are long-lived (typically do not expire unless revoked) and can be used by on-premises applications to obtain new access tokens for accessing Google Cloud APIs without user interaction. This meets the requirement for long-lived credentials in a multi-cloud environment.

Exam trap

Google Cloud often tests the distinction between long-lived and short-lived credentials, and the trap here is that candidates may confuse Workload Identity Federation (which produces short-lived tokens) with a method for obtaining long-lived credentials, or assume that VPN tunnels solve authentication requirements.

Full explanation →
515
MCQeasy

An organization wants to allow only specific trusted IP ranges to access a web application behind a Cloud Load Balancer. Which Cloud Armor feature should be used?

A.Preconfigured rules for OWASP ModSecurity CRS
B.Geolocation-based access control
C.Custom rules with source IP allow/deny lists
D.Adaptive protection
AnswerC

Cloud Armor custom rules can match on source IP ranges and allow or deny traffic accordingly.

Why this answer

Cloud Armor allows IP allow/deny lists using custom rules. Use a security policy with a rule that allows traffic from specified IP ranges and denies all other traffic.

Full explanation →
516
MCQeasy

A Cloud Function is timing out. What is the maximum timeout for a Cloud Function (1st gen)?

A.60 seconds
B.900 seconds
C.3600 seconds
D.540 seconds
AnswerD

Cloud Functions (1st gen) support up to 540 seconds timeout.

Why this answer

Cloud Functions (1st gen) have a maximum timeout of 540 seconds.

Full explanation →
517
MCQeasy

A company needs to retain audit logs for 7 years to meet regulatory compliance. They are using Cloud Logging. Which log storage strategy should they use to minimize costs while meeting the requirement?

A.Store logs in the _Required log bucket with a custom retention of 7 years.
B.Disable logging for non-critical resources to reduce log volume and retain only essential logs.
C.Use a log sink to export logs to Cloud Storage with a retention policy of 7 years and nearline storage class.
D.Use a log sink to export logs to BigQuery and set the table expiration to 7 years.
AnswerC

Log sinks can export to Cloud Storage, and a retention policy ensures logs are kept for 7 years. Nearline storage class reduces cost.

Why this answer

Exporting logs to Cloud Storage via a log sink allows you to set a bucket retention policy of 7 years, meeting compliance requirements. Using the nearline storage class minimizes costs for logs that are accessed infrequently, as it offers lower storage costs than standard storage while still providing the necessary durability and retention capabilities.

Exam trap

Google Cloud often tests the misconception that the _Required log bucket can be customized for long-term retention, when in fact it is a fixed, system-managed bucket with a default retention period that cannot be extended.

How to eliminate wrong answers

Option A is wrong because the _Required log bucket is a system-managed bucket that cannot have a custom retention period; it retains logs for the default retention (typically 30 days) and is not designed for long-term archival. Option B is wrong because disabling logging for non-critical resources violates the principle of comprehensive audit logging required by many regulations; you must retain logs for all resources that generate audit-relevant data, not just 'essential' ones. Option D is wrong because BigQuery is optimized for analytics and querying, not for long-term, low-cost archival storage; table expiration at 7 years would still incur ongoing storage costs that are higher than Cloud Storage nearline, and BigQuery is not the most cost-effective choice for infrequently accessed audit logs.

Full explanation →
518
Multi-Selectmedium

A user should be able to download and delete objects in a specific Cloud Storage bucket. Which two permissions are required in a custom role? (Choose two.)

Select 2 answers
A.storage.buckets.list
B.storage.objects.delete
C.storage.buckets.get
D.storage.objects.list
E.storage.objects.get
AnswersB, E

Required to delete objects.

Why this answer

To download an object, the user needs `storage.objects.get` permission, which allows reading the object's data and metadata from the bucket. To delete an object, the user needs `storage.objects.delete` permission, which authorizes the removal of the object from the bucket. These two permissions are the minimum required for download and delete operations on objects within a specific Cloud Storage bucket.

Exam trap

Google Cloud often tests the distinction between object-level permissions (like `storage.objects.get` and `storage.objects.delete`) and bucket-level permissions (like `storage.buckets.list` or `storage.buckets.get`), trapping candidates who assume listing or getting bucket metadata is necessary for object operations.

Full explanation →
519
Multi-Selecteasy

Which TWO actions help ensure compliance with data residency requirements in Google Cloud? (Choose two.)

Select 2 answers
A.Configure Organization policy `gcp.resourceLocations` to restrict allowed locations
B.Use Cloud CDN to cache content globally
C.Use VPC Service Controls to create perimeters that restrict data movement
D.Enable Cloud Interconnect for dedicated connectivity
E.Use Cloud VPN for site-to-site encryption
AnswersA, C

Organization policy can enforce that resources are created only in approved regions.

Why this answer

The `gcp.resourceLocations` Organization policy constraint explicitly defines the set of Google Cloud regions where resources can be created. By configuring this policy, an organization can enforce that all resources are provisioned only in approved geographic locations, directly meeting data residency requirements that mandate data remain within specific jurisdictions.

Exam trap

Google Cloud often tests the distinction between data residency controls (which restrict where data is stored) and network connectivity or encryption services (which do not enforce geographic restrictions), leading candidates to mistakenly select Cloud Interconnect or Cloud VPN as solutions for residency compliance.

Full explanation →
520
MCQmedium

A company is using Cloud Armor to protect their HTTP(S) load balancer. They have configured a security policy with a rule to block traffic from a specific IP address (10.0.0.1/32). During testing, they observe that requests from that IP are still reaching the backend. What is the most likely reason?

A.The backend service is configured to bypass Cloud Armor.
B.Cloud Armor does not support blocking specific IP addresses.
C.The security policy is not attached to the backend service.
D.The rule has a lower priority than a default allow rule.
AnswerC

A security policy must be attached to a backend service for its rules to be enforced.

Why this answer

Cloud Armor security policies must be explicitly attached to a backend service to take effect. If the policy is not attached, the rules within it—including the block rule for 10.0.0.1/32—are not evaluated, and traffic flows to the backend as if no policy exists. This is the most common cause when a configured rule appears to be ignored.

Exam trap

Google Cloud often tests the concept that a security policy must be attached to a backend service (or target proxy) to be active; candidates mistakenly assume that creating the policy alone is sufficient to enforce its rules.

How to eliminate wrong answers

Option A is wrong because Cloud Armor does not have a 'bypass' setting on the backend service; the backend service either has a security policy attached or it does not, and there is no mechanism to selectively bypass Cloud Armor for certain traffic. Option B is wrong because Cloud Armor explicitly supports blocking specific IP addresses using CIDR-based rules in security policies, including /32 prefixes. Option D is wrong because the default rule in Cloud Armor is to allow traffic, but if a block rule has a higher priority number (lower priority) than the default allow, the default allow would take precedence; however, the question states the rule is configured, and the most likely reason for the block not working is that the policy is not attached at all, not a priority issue.

Full explanation →
521
MCQmedium

An organization has multiple VPC networks in different projects. They need to centrally manage firewall rules that apply to all VPCs in the organization and ensure that project owners cannot override them. Which solution should they use?

A.Create a hierarchical firewall policy at the organization level
B.Create a network firewall policy and attach it to each VPC network
C.Use Cloud Armor security policies with the load balancers
D.Use VPC firewall rules with tags applied to all VMs across projects
AnswerA

Hierarchical policies are inherited and cannot be overridden by lower-level rules.

Why this answer

Hierarchical firewall policies can be applied at the organization or folder level and are inherited by all VPC networks. They cannot be overridden by lower-level firewall rules. This is the correct solution for centralized, unoverrideable rules.

Network firewall policies are scoped to a single VPC network.

Full explanation →
522
MCQhard

A user with this role tries to create a VM instance with a specific machine type and boot disk image. The creation fails due to missing permissions. Which permission is most likely missing?

A.compute.networks.use
B.compute.images.get
C.compute.machineTypes.get
D.compute.instances.list
AnswerC

Required to read machine type details for instance creation.

Why this answer

When creating a VM instance, the user must have permission to view the machine type definition to verify it exists and is available in the specified zone. The `compute.machineTypes.get` permission is required for this check, and without it, the creation fails even if other permissions are present. This is a prerequisite permission that the Compute Engine API checks before proceeding with instance provisioning.

Exam trap

Google Cloud often tests the misconception that creating a VM only requires broad permissions like `compute.instances.create`, but the trap here is that Google Cloud performs granular, sequential permission checks for each resource referenced in the creation request, and the machine type check is the first one to fail.

How to eliminate wrong answers

Option A is wrong because `compute.networks.use` is needed to attach the VM to a specific VPC network, but the failure occurs before that stage, at the machine type validation step. Option B is wrong because `compute.images.get` is required to read the boot disk image metadata, but the error here is specifically about the machine type, not the image. Option D is wrong because `compute.instances.list` is a read-only permission for listing existing instances and has no role in creating a new VM or validating machine types.

Full explanation →
523
MCQeasy

A company uses Cloud KMS to protect encryption keys for their Cloud SQL databases. They want to rotate keys every 30 days and ensure that old keys are retained for at least 90 days. What is the recommended approach?

A.Use a Cloud KMS key with manual rotation every 30 days and keep all key versions indefinitely.
B.Use Cloud HSM to generate a key and set key version lifecycle to disable after 90 days.
C.Use a Cloud KMS key with automatic rotation period of 30 days and disable old key versions after 90 days.
D.Use customer-supplied encryption keys (CSEK) and rotate them manually.
AnswerC

Automatic rotation and disabling old versions satisfies both requirements.

Why this answer

Cloud KMS supports automatic key rotation with a configurable period (e.g., 30 days), which creates new key versions automatically. To meet the 90-day retention requirement, you can disable old key versions after 90 days using the key version lifecycle policy, ensuring they are not used for encryption but remain available for decryption of older data.

Exam trap

Google Cloud often tests the distinction between automatic rotation (which creates new versions) and key version lifecycle (which manages old versions), and the trap here is assuming that automatic rotation alone handles retention, when in fact you must explicitly configure lifecycle policies to disable or destroy old versions after a specified period.

How to eliminate wrong answers

Option A is wrong because manual rotation every 30 days is operationally burdensome and error-prone, and keeping all key versions indefinitely does not satisfy the requirement to retain old keys for at least 90 days (it retains them forever, which is not the recommended approach). Option B is wrong because Cloud HSM is a hardware security module that can generate keys, but it does not provide a built-in mechanism to set key version lifecycle to disable after 90 days; that lifecycle management is a Cloud KMS feature, not Cloud HSM. Option D is wrong because customer-supplied encryption keys (CSEK) require you to manage and rotate keys manually, which does not leverage Cloud KMS's automatic rotation or lifecycle policies, and CSEK is typically used for Compute Engine, not Cloud SQL.

Full explanation →
524
MCQhard

Which method ensures that Cloud Storage logs are encrypted with a key that is managed on-premises?

A.CMEK
B.Cloud External Key Manager
C.CSEK
D.Default encryption
AnswerB

Cloud External Key Manager uses an external key management partner, keeping keys on-premises.

Why this answer

Cloud External Key Manager (Cloud EKM) allows you to use an external key management system, such as one running on-premises, to manage encryption keys for Cloud Storage. This ensures that the keys used to encrypt your data are never stored in Google Cloud, meeting the requirement of on-premises key management.

Exam trap

Google Cloud often tests the distinction between where the key material is stored (Google Cloud vs. on-premises) rather than who manages the key lifecycle, causing candidates to confuse CMEK (customer-managed but cloud-hosted) with Cloud EKM (customer-managed and on-premises-hosted).

How to eliminate wrong answers

Option A (CMEK) is wrong because Cloud Key Management Service (Cloud KMS) with customer-managed encryption keys (CMEK) still stores the key material within Google Cloud, not on-premises. Option C (CSEK) is wrong because customer-supplied encryption keys (CSEK) are provided by the customer for each API call but are not managed on-premises; they are ephemeral and not stored or managed by a persistent on-premises system. Option D (Default encryption) is wrong because default encryption uses Google-managed keys, which are entirely controlled and stored by Google, not on-premises.

Full explanation →
525
MCQhard

A company uses Cloud SQL for MySQL and needs to automate the rotation of database user passwords every 30 days. They want to store the passwords in Secret Manager and have the application retrieve them at runtime. The application runs on Compute Engine. What is the most secure way to allow the Compute Engine instances to access the secrets?

A.Attach a service account to the Compute Engine instances with the role roles/secretmanager.secretAccessor, and grant that service account access to the specific secret versions.
B.Grant the roles/secretmanager.secretAccessor role to all service accounts in the project.
C.Create a service account key for a dedicated service account, download it to the instance, and use it to access the secret.
D.Store the password in instance metadata and have the application read it from the metadata server.
AnswerA

This follows least privilege and uses short-lived credentials from the metadata server.

Why this answer

It follows the principle of least privilege by attaching a service account with the roles/secretmanager.secretAccessor role directly to the Compute Engine instances and granting that service account access only to the specific secret versions needed. This ensures that the instances can authenticate via the default service account metadata server (using OAuth 2.0 tokens) without exposing any long-lived credentials, and the access is scoped to exactly the secrets required for password rotation.

Exam trap

Google Cloud often tests the misconception that storing secrets in instance metadata is acceptable for security, but the trap here is that metadata is not designed for secrets management and lacks encryption, access control, and audit capabilities that Secret Manager provides.

How to eliminate wrong answers

Option B is wrong because granting roles/secretmanager.secretAccessor to all service accounts in the project violates least privilege and could allow unintended service accounts to access secrets, increasing the attack surface. Option C is wrong because downloading a service account key file to the instance creates a long-lived credential that must be securely stored and rotated, which is less secure than using the instance's attached service account and metadata server for automatic token-based authentication. Option D is wrong because storing passwords in instance metadata is not encrypted at rest by default, is visible to anyone with metadata server access (including other processes on the instance), and does not provide the audit logging and versioning capabilities of Secret Manager.

Full explanation →
Page 6

Page 7 of 13

Page 8

All pages

12345678910111213

Practice PCSE by domain

Target a specific domain to shore up weak areas.

Configuring Access Within a Cloud Solution EnvironmentEnsuring Data ProtectionManaging Operations in a Cloud Solution EnvironmentConfiguring Network SecuritySupporting Compliance Requirements
See all domains with question counts →