Knowledge + Practice

Google Professional Cloud Security Engineer (PCSE) — Questions 526–600

960 questions total · 13pages · All types, answers revealed

Take a mock exam Exam hub

Page 8 of 13

526

MCQeasy

An organization wants to enforce that all new Cloud Storage buckets are created with uniform bucket-level access enabled to simplify access control and meet compliance requirements. What Google Cloud service should they use to enforce this?

A.VPC Service Controls

B.Organization Policies

C.Cloud IAM

D.Cloud Armor

AnswerB

Organization Policies include pre-defined constraints to enforce uniform bucket-level access.

Why this answer

Organization Policies allow administrators to set constraints on Google Cloud resources at the organization, folder, or project level. The `constraints/storage.uniformBucketLevelAccess` constraint can be applied to enforce that all new Cloud Storage buckets are created with uniform bucket-level access enabled, simplifying access control and meeting compliance requirements.

Exam trap

The trap here is that candidates confuse Organization Policies (which enforce configuration rules) with Cloud IAM (which grants permissions), leading them to select Cloud IAM even though it cannot enforce a bucket creation constraint.

How to eliminate wrong answers

Option A is wrong because VPC Service Controls are used to define security perimeters around Google Cloud services to mitigate data exfiltration risks, not to enforce bucket-level access settings. Option C is wrong because Cloud IAM manages who has access to resources (permissions) but cannot enforce configuration constraints like uniform bucket-level access on new buckets. Option D is wrong because Cloud Armor is a web application firewall (WAF) and DDoS protection service for HTTP(S) load balancing, unrelated to Cloud Storage bucket access control.

Full explanation →

527

MCQeasy

An administrator needs to grant a network team the ability to create and manage firewall rules, but not delete VPC networks. Which IAM role should be assigned?

A.roles/compute.networkAdmin

B.roles/compute.securityAdmin

C.roles/compute.viewer

D.roles/compute.admin

AnswerB

Allows managing firewall rules without network deletion.

Why this answer

The roles/compute.securityAdmin role grants permissions to create, modify, and delete firewall rules and SSL certificates, but explicitly excludes permissions to delete VPC networks or modify their configurations. This aligns exactly with the requirement to manage firewall rules without being able to delete VPC networks.

Exam trap

Google Cloud often tests the distinction between networkAdmin and securityAdmin, where candidates mistakenly choose networkAdmin thinking it covers firewall rules, but it actually grants broader VPC management permissions including deletion.

How to eliminate wrong answers

Option A is wrong because roles/compute.networkAdmin provides full control over VPC networks, including the ability to delete them, which exceeds the required scope. Option C is wrong because roles/compute.viewer only allows read-only access to compute resources, with no permissions to create or manage firewall rules. Option D is wrong because roles/compute.admin grants full administrative access to all compute resources, including the ability to delete VPC networks, which violates the restriction.

Full explanation →

528

MCQmedium

A healthcare organization ingests patient data into Cloud Storage and then processes it with Dataflow. They need to de-identify sensitive fields like Social Security numbers before storing in BigQuery. Which approach should they use?

A.Use BigQuery column-level security with data masking.

B.Write custom Dataflow transformations using a Java SDK to redact SSNs.

C.Use Cloud DLP to inspect and transform the data, then store the de-identified results in BigQuery.

D.Use Cloud Data Catalog to tag sensitive columns and rely on access control.

AnswerC

Cloud DLP can automatically identify and de-identify sensitive data.

Why this answer

Cloud DLP inspection and transformation jobs can be integrated with BigQuery and Dataflow to de-identify sensitive data before loading into BigQuery. Option A is wrong because BigQuery column-level security with data masking only masks at query time, not at rest. Option B is wrong because writing custom Dataflow transformations is more error-prone, harder to maintain, and reinvents what Cloud DLP already provides.

Option D is wrong because Cloud Data Catalog only catalogs metadata but does not transform the data.

Full explanation →

529

MCQhard

A company is using Forseti for compliance automation. They need to ensure that all Cloud Storage buckets are encrypted with CMEK and that buckets without CMEK are flagged. Which Forseti scanner should they use?

A.IAM scanner

B.Resource scanner

C.Bucket ACL scanner

D.Location scanner

AnswerD

Location scanner can enforce policies like 'require CMEK' on buckets.

Why this answer

The Location scanner in Forseti is designed to audit resources based on their location or configuration settings, including encryption status. For Cloud Storage buckets, it can check whether CMEK is enabled by evaluating the bucket's encryption configuration against a policy, flagging any that lack CMEK. This makes it the correct scanner for ensuring CMEK compliance.

Exam trap

The trap here is that candidates confuse the Location scanner's name with geographic location auditing, when in fact it audits any resource property defined in the policy library, including encryption settings.

How to eliminate wrong answers

Option A is wrong because the IAM scanner audits Identity and Access Management policies and permissions, not encryption settings on Cloud Storage buckets. Option B is wrong because the Resource scanner inventories and tracks resource metadata and lifecycle, but does not evaluate encryption compliance. Option C is wrong because the Bucket ACL scanner checks Access Control Lists for bucket permissions, not encryption configurations like CMEK.

Full explanation →

530

MCQmedium

An organization uses Active Directory (AD) on-premises and wants to synchronize user accounts and groups to Google Cloud Identity for SSO with SAML 2.0. The AD contains 50,000 users and 10,000 groups. The solution must support automatic provisioning and deprovisioning of users. Which tool should they use?

A.Use SAML 2.0 federation with AD FS to synchronize users.

B.Use Workload Identity Federation to connect AD to Google Cloud.

C.Use the Cloud Identity API to manually create users and groups.

D.Use Google Cloud Directory Sync (GCDS) to synchronize users and groups from AD to Cloud Identity.

AnswerD

GCDS is designed for this exact purpose: one-way sync from AD/LDAP to Google Cloud Directory, including automatic provisioning and deprovisioning.

Why this answer

Google Cloud Directory Sync (GCDS) is the official tool for synchronizing users and groups from Active Directory (or LDAP) to Google Cloud Directory. It supports one-way sync, automatic provisioning, and deprovisioning. SAML SSO is configured separately using an IdP like Active Directory Federation Services (AD FS) or third-party.

Workload Identity Federation is for external workloads (e.g., AWS, Azure) to access GCP resources, not for user identity synchronization. Cloud Identity API can be used programmatically but is not a ready-to-use sync tool. GCDS is the correct answer.

Full explanation →

531

MCQmedium

A company uses Cloud SQL for PostgreSQL and needs to ensure that database backups are retained for 30 days for compliance. They also want to be able to perform point-in-time recovery for the last 24 hours. What configuration should they use?

A.Enable automated backups with a retention of 30 days and enable binary logging (write-ahead logs) for point-in-time recovery.

B.Manually take a full backup every day and store it in Cloud Storage with object lifecycle management set to 30 days.

C.Take daily snapshots of the Compute Engine instance running Cloud SQL.

D.Use Cloud Scheduler to run a script that exports the database to Cloud Storage every hour, and keep the exports for 30 days.

AnswerA

Automated backups provide daily backups; binary logs allow recovery to any point within the retention period.

Why this answer

Cloud SQL automated backups and binary log (WAL) archiving enable point-in-time recovery. Option B is incorrect because export to Cloud Storage is a manual process. Option C is incorrect because snapshots are not supported for Cloud SQL.

Option D is incorrect because manual backups do not provide point-in-time recovery.

Full explanation →

532

MCQhard

A security engineer needs to prevent creation of long-lived service account keys across all projects in an organization. The solution should also block any existing keys older than 90 days. Which approach meets these requirements?

A.Use the built-in constraint constraints/iam.disableServiceAccountKeyCreation and write a custom organization policy to enforce key rotation (max age 90 days).

B.Use a deny policy to deny the permission iam.serviceAccountKeys.create and another deny policy to deny use of keys older than 90 days.

C.Use a custom organization policy constraint to disable key creation and another custom constraint to delete keys older than 90 days.

D.Use a VPC Service Controls perimeter to block access to the IAM API for creating keys.

AnswerB

Deny policies can be applied at the organization level to deny the permission iam.serviceAccountKeys.create, preventing creation of new keys. Additionally, a deny policy with a condition on key age can deny permissions to use existing keys older than 90 days, effectively blocking them.

Why this answer

Deny policies can be used to prevent creation of new service account keys (by denying iam.serviceAccountKeys.create) and to block use of existing keys older than 90 days (by denying permissions like iam.serviceAccountKeys.signBlob with a condition on key age). This directly addresses both requirements: prevention of new long-lived keys and disabling existing keys older than 90 days. Option A only prevents creation of new keys via the built-in constraint but does not affect existing keys; while a custom policy can enforce key rotation on new keys, it cannot block or disable keys that already exist.

Option C fails because custom constraints cannot delete existing resources. Option D does not block key creation via all methods and does not address existing keys.

Exam trap

Google Cloud often tests the misconception that custom organization policies can delete existing resources, when in reality they only enforce conditions on new resource creation or updates, not retroactive actions.

How to eliminate wrong answers

Option B is wrong because deny policies cannot enforce a time-based condition like 'older than 90 days' on existing keys; they only block permission-based actions, not key age. Option C is wrong because custom organization policy constraints cannot delete resources; they can only enforce conditions on creation or update, not retroactively remove existing keys. Option D is wrong because VPC Service Controls block network access to APIs but do not prevent key creation or enforce key age; they are designed for data exfiltration prevention, not IAM key lifecycle management.

Full explanation →

533

MCQhard

An organization is using Assured Workloads to enforce ITAR compliance. They need to ensure that all resources are deployed in specific US regions and that Google personnel access is restricted. They also want to monitor for any configuration changes that violate compliance policies. Which service should they use for monitoring compliance drift?

A.Cloud Asset Inventory

B.Assured Workloads compliance monitoring

C.Security Command Center

D.Cloud Monitoring

AnswerB

Assured Workloads includes built-in monitoring for compliance drift, alerting on policy violations.

Why this answer

Assured Workloads provides a compliance monitoring feature that alerts on policy violations, including resource location and access restrictions. Cloud Monitoring is for performance metrics, Cloud Asset Inventory tracks resources, and Security Command Center provides threat detection but not specific compliance drift monitoring for Assured Workloads.

Full explanation →

534

MCQeasy

A data engineer needs to scan a Cloud Storage bucket for personally identifiable information (PII) such as credit card numbers and social security numbers. The scanning must be performed on a schedule (every week). Which GCP service and resource should they use?

A.Cloud Security Command Center (SCC)

B.Cloud Asset Inventory

C.Cloud Audit Logs

D.Cloud Data Loss Prevention (DLP) with a DLP job trigger

AnswerD

DLP job triggers can run scheduled inspection scans on Cloud Storage.

Why this answer

Cloud DLP can inspect data for sensitive info types. DLP job triggers allow scheduling recurring scans of Cloud Storage, BigQuery, or Datastore. The trigger runs the inspection job based on a schedule.

Full explanation →

535

Multi-Selecteasy

A company is subject to SOC 2 compliance and wants to demonstrate that they have implemented proper access controls on Google Cloud. Which TWO IAM best practices should they follow? (Choose two.)

Select 2 answers

A.Enable multi-factor authentication for all users.

B.Use only predefined roles to ensure consistency.

C.Enable Cloud Audit Logs to monitor access.

D.Use service accounts for human user access.

E.Grant the least privilege necessary using IAM roles.

AnswersA, E

MFA adds a layer of security to user accounts.

Why this answer

SOC 2 requires access controls. The principle of least privilege (granting minimal permissions) and enabling multi-factor authentication (MFA) are key IAM best practices. Using predefined roles is not always best; custom roles may be needed.

Service accounts are for applications, not user access. Cloud Audit Logs track access but are not an IAM best practice per se.

Full explanation →

536

MCQmedium

A company has a security policy that service account keys should not be created. They want to prevent anyone from creating keys for any service account in the organization. Which organization policy constraint should they use?

A.Custom constraint with iam.serviceAccountKeys.create

B.constraints/iam.allowedPolicyMemberDomains

C.constraints/compute.requireShieldedVm

D.constraints/iam.disableServiceAccountKeyCreation

AnswerD

Prevents creation of service account keys.

Why this answer

The `constraints/iam.disableServiceAccountKeyCreation` organization policy constraint explicitly prevents the creation of user-managed service account keys across the entire organization. This aligns with the security policy that service account keys should not be created, as it enforces the use of short-lived credentials or workload identity federation instead of long-lived keys.

Exam trap

The trap here is that candidates confuse the IAM permission `iam.serviceAccountKeys.create` with the organization policy constraint name. In the Google Professional Cloud Security Engineer exam, it's crucial to distinguish between IAM permissions (which allow actions) and organization policy constraints (which enforce restrictions). Option A uses an IAM permission, not an organization policy constraint, leading to an incorrect choice.

How to eliminate wrong answers

Option A is wrong because custom constraints are used for organization policies that are not covered by predefined constraints, but `iam.serviceAccountKeys.create` is a permission, not a constraint; the correct predefined constraint for this purpose is `constraints/iam.disableServiceAccountKeyCreation`. Option B is wrong because `constraints/iam.allowedPolicyMemberDomains` restricts which external domains can be added as members in IAM policies, not service account key creation. Option C is wrong because `constraints/compute.requireShieldedVm` enforces that Compute Engine VMs must use Shielded VM features, which is unrelated to IAM service account key management.

Full explanation →

537

Multi-Selectmedium

A security team wants to enforce SSL/TLS best practices for their HTTPS load balancer. They need to require TLS 1.2 or higher and restrict ciphers to strong ones only. Which TWO actions should they take? (Choose two.)

Select 2 answers

A.Enable Cloud Armor WAF rules

B.Attach the SSL policy to the target HTTPS proxy

C.Create an SSL policy with minTlsVersion = TLS_1_2 and profile = RESTRICTED

D.Set the SSL policy to COMPATIBLE profile

E.Use a Google-managed SSL certificate

AnswersB, C

The policy takes effect when attached to the proxy.

Why this answer

To enforce TLS version and cipher strength, you create an SSL policy. The policy can set the minimum TLS version to 1.2 and the profile to RESTRICTED (which only allows strong ciphers). Then you attach the policy to the load balancer's target HTTPS proxy.

Full explanation →

538

MCQeasy

Which of the following is a benefit of using organization policies over IAM policies for enforcing restrictions on resources?

A.Organization policies can grant permissions to users.

B.Organization policies can restrict resources even if the user has Owner role.

C.Organization policies are applied to identities.

D.Organization policies are easier to audit than IAM policies.

AnswerB

Organization policies override IAM allow policies, so even Owners can be restricted.

Why this answer

Organization policies can enforce restrictions on resources regardless of the IAM roles assigned to users. They are applied to resources, not identities, and are evaluated before IAM policies.

Full explanation →

539

MCQmedium

An organization needs to enforce that all new Cloud Storage buckets are created only in the europe-west1 region to meet data residency requirements. Which method should they use?

A.Assign the roles/storage.admin IAM role with a condition that restricts region.

B.Use Assured Workloads to enforce data residency.

C.Define a bucket policy that allows only europe-west1.

D.Configure an organization policy with the constraint gcp.resourceLocations to allow only europe-west1.

AnswerD

This constraint restricts where resources can be created.

Why this answer

Organization policies with the `gcp.resourceLocations` constraint allow you to restrict the physical location of resources at the organization, folder, or project level. This is the correct method because it enforces that all new Cloud Storage buckets (and other supported resources) can only be created in the specified region, meeting data residency requirements without relying on IAM conditions or bucket-level policies.

Exam trap

Google often tests the distinction between IAM conditions (which control who can act) and organization policies (which control what can be done), leading candidates to choose IAM conditions when the question asks for a blanket enforcement across all users.

How to eliminate wrong answers

Option A is wrong because the `roles/storage.admin` IAM role with a condition can restrict which regions a user can create buckets in, but it does not enforce the restriction on all principals; a user with a different role (e.g., `roles/owner`) could still create buckets outside europe-west1. Option B is wrong because Assured Workloads is designed for compliance with regulatory controls like CMEK or CSEK, not for simple region-based data residency enforcement; it is an overkill and does not directly restrict bucket creation regions. Option C is wrong because bucket policies (Uniform Bucket-Level Access) control access to existing buckets, not the creation of new buckets; they cannot prevent a user from creating a bucket in a different region.

Full explanation →

540

Multi-Selectmedium

A company uses Google Cloud Directory Sync (GCDS) to synchronize users from an on-premises Active Directory to Cloud Identity. The security team wants to ensure that only synchronized users can access Google Cloud resources. Which TWO actions are part of a secure configuration? (Choose two.)

Select 2 answers

A.Enable automatic license assignment for all synchronized users.

B.Configure GCDS to sync user passwords.

C.Create a custom role that allows only synchronized users to access resources.

D.Disable manual user creation in the Cloud Identity admin console.

E.Use the Organization Policy constraint constraints/iam.allowedPolicyMemberDomains to restrict IAM members to the company's domain.

AnswersD, E

This ensures that only synchronized users exist, preventing rogue manual accounts.

Why this answer

Correct actions: 1) Disable the creation of manual users in Cloud Identity to ensure all users come from AD only. 2) Restrict the allowed domains for IAM members to the company's domain (e.g., example.com) using Organization Policy constraint 'constraints/iam.allowedPolicyMemberDomains' to prevent external users from being added. Enabling automatic license assignment is not a security measure. Using the default admin account is not recommended.

Syncing passwords is not recommended; GCDS does not sync passwords.

Full explanation →

541

MCQhard

A security engineer is troubleshooting a connectivity issue between two VPCs connected via VPC Network Peering. VPC-A (project A) has a Compute Engine instance with internal IP 10.1.0.2. VPC-B (project B) has an instance with internal IP 10.2.0.2. The engineer has verified that the peering connection is active and the firewall rules allow ingress from 10.1.0.0/16. However, the instance in VPC-B cannot ping the instance in VPC-A. What is the most likely cause?

A.The VPC-A has a firewall rule that denies ICMP traffic from VPC-B.

B.The VPC-B does not have a route to VPC-A's subnet ranges. Custom route exchange is not enabled on the peering connection.

C.The MTU configuration on the peering connection is set too low.

D.The instance in VPC-B does not have a public IP address.

AnswerB

By default, only subnet routes are exchanged. Custom routes require explicit export/import settings.

Why this answer

The most likely cause is that custom route exchange is not enabled on the VPC Network Peering connection. By default, VPC peering does not exchange custom routes (including subnet routes) unless explicitly enabled. Without this, VPC-B has no route to the 10.1.0.0/16 subnet of VPC-A, so the instance in VPC-B cannot send traffic to 10.1.0.2, even though firewall rules allow ingress.

The peering connection being active only means the link is established, not that routes are automatically propagated.

Exam trap

Google Cloud often tests the misconception that an active peering connection and permissive firewall rules are sufficient for connectivity, when in fact route exchange (especially for custom routes) must be explicitly enabled for traffic to flow between VPCs.

How to eliminate wrong answers

Option A is wrong because the question states that firewall rules allow ingress from 10.1.0.0/16, and a deny rule on VPC-A would be a firewall issue, but the core problem is routing, not firewall. Option C is wrong because MTU configuration on a VPC peering connection is not a configurable parameter; Google Cloud uses a fixed MTU of 1460 bytes for VPC peering, and an MTU mismatch would cause fragmentation issues, not a complete lack of connectivity. Option D is wrong because a public IP address is not required for communication over VPC Network Peering; the instances communicate using internal IPs, and the lack of a public IP is irrelevant for peered VPC connectivity.

Full explanation →

542

MCQeasy

A user receives a "403 Forbidden" error when trying to access a Compute Engine instance via SSH from the Cloud Console. The user has the Compute Admin role on the project. What is the most likely cause?

A.The user does not have the compute.instances.setMetadata permission.

B.The firewall rules do not allow SSH from the user's IP.

C.OS Login is enabled on the instance and the user lacks the osLogin role.

D.The user does not have the roles/iap.tunnelResourceAccessor role.

AnswerD

Cloud Console SSH uses IAP TCP forwarding, which requires this role.

Why this answer

The 403 Forbidden error when using Cloud Console SSH indicates that Identity-Aware Proxy (IAP) TCP forwarding is being used, which requires the roles/iap.tunnelResourceAccessor role. Even with Compute Admin, the user lacks this IAP-specific role, so the request is denied at the IAP layer before reaching the instance.

Exam trap

Google Cloud often tests the misconception that Compute Admin or firewall rules are sufficient for Cloud Console SSH, when in reality IAP requires a distinct role (roles/iap.tunnelResourceAccessor) that is not included in Compute Admin.

How to eliminate wrong answers

Option A is wrong because the compute.instances.setMetadata permission is not required for SSH access via Cloud Console; it is used for modifying instance metadata, not for establishing an SSH connection. Option B is wrong because firewall rules are bypassed when using IAP TCP forwarding, as the connection goes through Google's infrastructure, not directly from the user's IP. Option C is wrong because OS Login controls authentication via SSH keys or IAM roles, but a 403 error from Cloud Console SSH indicates an IAP authorization failure, not an OS Login issue.

Full explanation →

543

MCQeasy

Your organization wants to ensure that no Compute Engine instance can have a public IP address. What is the best way to enforce this policy?

A.Use Cloud Audit Logs to monitor and alert on instances with public IPs

B.Use an Organization Policy with the constraint `compute.vmExternalIpAccess`

C.Use a firewall rule that blocks traffic from 0.0.0.0/0

D.Use a Service Perimeter from VPC Service Controls

AnswerB

Prevents creation of VMs with external IPs.

Why this answer

The Organization Policy constraint `compute.vmExternalIpAccess` is a native Google Cloud policy that can be applied at the project, folder, or organization level to explicitly deny the assignment of external IP addresses to Compute Engine instances. This policy is enforced at the resource creation time, preventing any instance from being launched with a public IP, and it cannot be overridden by project-level IAM permissions, making it the most direct and effective enforcement mechanism.

Exam trap

The trap here is that candidates often confuse reactive monitoring (Cloud Audit Logs) or network-layer controls (firewall rules) with proactive policy enforcement, or they misapply VPC Service Controls, which are for data exfiltration prevention, not for controlling instance-level network interface configurations.

How to eliminate wrong answers

Option A is wrong because Cloud Audit Logs only provide monitoring and alerting after the fact; they do not prevent instances from being created with public IPs, so they cannot enforce a policy proactively. Option C is wrong because a firewall rule blocking traffic from 0.0.0.0/0 would prevent all inbound traffic from the internet, but it does not prevent the instance from having a public IP address assigned, and it would also block legitimate traffic that might be needed for other purposes; the instance would still have a public IP, violating the policy. Option D is wrong because a Service Perimeter from VPC Service Controls is designed to restrict data exfiltration from Google Cloud services like Cloud Storage or BigQuery, not to control whether Compute Engine instances have public IP addresses; it operates at the service perimeter level, not at the instance network interface level.

Full explanation →

544

MCQmedium

An organization needs to scan container images stored in Artifact Registry for vulnerabilities before deployment. They want to use a managed service that integrates with their CI/CD pipeline. Which Google Cloud service should they use?

A.Container Analysis

B.Web Security Scanner

C.Cloud Security Scanner

D.VM Manager patch management

AnswerA

Container Analysis automatically scans images in Artifact Registry for known vulnerabilities.

Why this answer

Artifact Registry integrates with Container Analysis (also known as Artifact Analysis) to automatically scan images for vulnerabilities. This is a managed service that works out-of-the-box for images stored in Artifact Registry. Web Security Scanner is for web applications, VM Manager patch management is for VM patches, and Cloud Security Scanner is not a real service.

Full explanation →

545

MCQeasy

Which Google Cloud service provides near-real-time logs when Google administrators access your customer content?

A.Access Transparency

B.Access Approval

C.Cloud DLP

D.Cloud Audit Logs

AnswerA

Access Transparency logs Google admin access to customer content in near-real-time.

Why this answer

Access Transparency logs provide detailed information about actions taken by Google staff when accessing customer data. Access Approval is a separate feature that requires approval before access. Audit Logs is a broader category.

Cloud DLP is for data loss prevention.

Full explanation →

546

MCQhard

A company uses CMEK with Cloud HSM to encrypt a BigQuery table. The security engineer accidentally deleted the key in Cloud KMS. The key is now in a 'pending destruction' state with a grace period of 24 hours. Which action should the engineer take to restore the key and avoid data loss?

A.Recreate the key with the same name and version

B.Wait for the grace period to expire and then use a backup key

C.Use Access Transparency logs to recover the key material

D.Restore the key by canceling the destruction within the grace period

AnswerD

During the pending destruction state, the key can be restored by cancelling the destruction via Cloud KMS.

Why this answer

When a key is destroyed, it enters a pending destruction state for a default 24-hour grace period. During this period, the key can be restored by cancelling the destruction. After the grace period, the key is permanently destroyed and data encrypted with it becomes inaccessible.

The restore operation is available in Cloud KMS.

Full explanation →

547

MCQhard

A multinational corporation must comply with GDPR and requires that data stored in BigQuery is physically located in the European Union. They have set up BigQuery datasets in the EU region. However, a compliance audit reveals that some queries may process data in the US region due to BigQuery's multi-region behavior. What should the organization do to ensure data remains in the EU?

A.Create BigQuery datasets in a specific European region (e.g., europe-west1) instead of the EU multi-region.

B.Use the EU multi-region dataset and configure VPC Service Controls to restrict access.

C.Enable BigQuery CMEK with keys stored in a European Cloud KMS key ring.

D.Use BigQuery reservations to guarantee that data processing happens in the EU.

AnswerA

Single-region datasets keep data and processing within that region.

Why this answer

Creating a BigQuery dataset in a specific European region (e.g., europe-west1) ensures that all data storage and query processing are physically confined to that single region. In contrast, the EU multi-region (EU) is a geographic entity that includes multiple Google Cloud regions within the European Union, and BigQuery may process data in any of those regions, including potentially outside the EU if the multi-region expands. By using a specific regional dataset, the organization guarantees that data never leaves the designated European location, meeting GDPR's data residency requirements.

Exam trap

Google Cloud often tests the misconception that VPC Service Controls or encryption keys can enforce data residency, but the trap here is that only choosing a specific regional dataset (not a multi-region) physically restricts data processing to a single location.

How to eliminate wrong answers

Option B is wrong because VPC Service Controls restrict network access to resources but do not control the physical location where data is processed; they cannot prevent BigQuery from processing data in a different region within a multi-region. Option C is wrong because Customer-Managed Encryption Keys (CMEK) control encryption at rest but have no impact on where data is processed or stored; the key location does not enforce data residency. Option D is wrong because BigQuery reservations manage slot capacity and query priority, not the geographic location of data processing; they cannot force processing to occur in a specific region.

Full explanation →

548

Multi-Selecthard

Which THREE steps are necessary to meet SOC 2 Type II requirements using Google Cloud?

Select 3 answers

A.Enable Cloud Audit Logs and retain them for at least one year.

B.Ensure all data in transit is encrypted using TLS.

C.Use a single Google Cloud project for all data to simplify auditing.

D.Use Customer-Managed Encryption Keys (CMEK) for all storage services.

E.Set up Cloud Monitoring alerts to continuously monitor security configurations.

AnswersA, B, E

Audit logs provide evidence of controls and are required for SOC 2.

Why this answer

SOC 2 Type II requires evidence of continuous monitoring and retention of audit logs for at least one year to demonstrate effective controls. Enabling Cloud Audit Logs in Google Cloud captures admin activity, data access, and system events, which are essential for audit evidence. Retaining these logs for a minimum of one year aligns with the SOC 2 common criteria for monitoring and response.

Exam trap

Google Cloud often tests the misconception that using a single project simplifies compliance, when in reality SOC 2 requires logical separation and least privilege, which is better achieved with multiple projects or folders; also, candidates may assume CMEK is mandatory for encryption, but Google-managed keys are acceptable for SOC 2.

Full explanation →

549

MCQeasy

Which VPC firewall rule target type is recommended for security because it can be dynamically applied to instances based on their service account?

A.Instance names

B.Subnets

C.Tags

D.Service accounts

AnswerD

Service accounts are dynamic and align with identity-based security.

Why this answer

Service account targets allow rules to be applied based on the instance's service account, enabling dynamic and scalable security policies compared to static network tags.

Full explanation →

550

MCQhard

A company has multiple projects under an organization node. A security engineer needs to deny all principals in the organization from creating service account keys, except for a specific project where it must be allowed. Which approach should be used?

A.Use a custom organization policy constraint to allow key creation only in the specific project, and deny in all others.

B.Create an IAM deny policy at the organization level denying iam.serviceAccountKeys.create, and then create an IAM allow policy at the project level granting the same permission.

C.Create an IAM deny policy at the organization level denying the permission, and create another IAM deny policy at the project level that allows the permission by omitting the deny rule for that project's service accounts.

D.Apply the constraint constraints/iam.disableServiceAccountKeyCreation at the organization level with value True, and then set it to False at the project level.

AnswerC

Deny policies at a lower level can effectively allow by not including the deny rule for specific principals. This is the correct way to create an exception.

Why this answer

The correct approach is to use IAM deny policies (v2). Create an organization-level deny policy that denies iam.serviceAccountKeys.create to all principals. Then, create a project-level deny policy that denies the same permission but includes an exception (via exceptionPrincipals) for the project's service accounts.

Because deny policies are evaluated hierarchically, the project-level policy with exceptions allows the permission for those specific principals while the organization-level policy denies it for everyone else. This is necessary because the boolean organization policy constraint constraints/iam.disableServiceAccountKeyCreation cannot be overridden or have exceptions. Option C is correct.

Full explanation →

551

MCQeasy

A company wants to grant a third-party auditor read-only access to specific BigQuery datasets in a project. The auditor's identity is managed in their own Google Cloud organization. What is the most secure way to grant access?

A.Share the project's service account key with the auditor so they can impersonate it.

B.Use VPC Service Controls to allow access only from the auditor's IP range.

C.Create a service account in the company's project, grant it the BigQuery Data Viewer role, and allow the auditor's organization to use that service account via Workload Identity Federation.

D.Create a Google Group and add the auditor's email addresses, then grant the group the BigQuery Data Viewer role.

AnswerC

Workload Identity Federation allows secure cross-organization access without managing external identities.

Why this answer

It uses Workload Identity Federation to allow the auditor's Google Cloud organization to impersonate a service account in the company's project without sharing a key. This grants read-only access via the BigQuery Data Viewer role while eliminating the risk of long-lived credentials. The auditor's identity is managed externally, and access is granted through a secure, federated trust relationship.

Exam trap

Google Cloud often tests the misconception that sharing a service account key is acceptable for cross-organization access, when in fact Workload Identity Federation is the secure, keyless alternative designed for this exact scenario.

How to eliminate wrong answers

Option A is wrong because sharing a service account key exposes a long-lived, unrotatable credential that violates the principle of least privilege and can be misused or leaked. Option B is wrong because VPC Service Controls restrict network access but do not authenticate the auditor's identity or grant granular dataset-level permissions; they are a perimeter control, not an identity-based access solution. Option D is wrong because adding the auditor's email addresses to a Google Group assumes the auditor's identities are managed within the same Google Cloud organization or as Google Accounts, which is not the case here; external identities cannot be added directly to a Google Group without federation.

Full explanation →

552

Multi-Selectmedium

Your VPC has a default firewall rule that allows SSH (TCP port 22) from all sources. You need to allow HTTP traffic (TCP port 80) only from instances tagged 'web-servers' to the target instances, and block all other inbound traffic including SSH. Which TWO steps should you take?

Select 2 answers

A.Modify the default-allow-ssh rule to set its source filter to an empty range.

B.Create a firewall rule with priority 65535 allowing all traffic from 0.0.0.0/0.

C.Delete the default-allow-ssh rule.

D.Create a firewall rule with priority 1000 allowing ingress from instances with tag 'web-servers' on TCP port 80.

E.Create a firewall rule with priority 1000 allowing ingress from instances with tag 'web-servers' on TCP port 443.

AnswersC, D

This removes the default allow for SSH, which is necessary to block SSH traffic.

Why this answer

Deleting the default-allow-ssh rule removes the rule that permits SSH from all sources (0.0.0.0/0), which is necessary to block all inbound SSH traffic as required. Option D is correct because creating a firewall rule with priority 1000 that allows ingress on TCP port 80 from instances tagged 'web-servers' explicitly permits HTTP traffic only from the desired source, and since lower priority numbers are evaluated first, this rule will be applied before any higher-numbered (lower priority) default rules.

Exam trap

Google Cloud often tests the misconception that you can simply modify or override a default rule by adding a higher-priority deny rule, but in Google Cloud VPC, firewall rules are allow-only (no explicit deny rules), so the only way to block traffic allowed by a default rule is to delete that rule or change its source filter to a non-matching range.

Full explanation →

553

MCQmedium

A security engineer needs to run a penetration test against their Google Cloud environment. According to Google's Acceptable Use Policy, which of the following is true regarding penetration testing?

A.Penetration testing is not allowed against any Google Cloud resources.

B.Denial of Service (DoS) testing is allowed with prior notification to Google.

C.Penetration testing is allowed without prior approval for most services, but DoS attacks are prohibited.

D.All penetration tests require prior approval from Google Cloud Support.

AnswerC

Google's policy permits most penetration tests without prior approval, but DoS attacks are not allowed.

Why this answer

Google's policy allows customers to conduct penetration tests against their own infrastructure without prior approval for most services, provided the tests do not involve denial of service (DoS) attacks. DoS testing is explicitly prohibited without prior written approval. Testing other customers' resources is never allowed.

Full explanation →

554

MCQeasy

A company wants to automatically provision and renew SSL certificates for their HTTPS load balancer. They do not want to manually manage certificate files. Which approach should they use?

A.Upload a self-managed certificate in PEM format.

B.Configure SSL policies to enforce TLS version.

C.Create a Google-managed SSL certificate resource.

D.Use Certificate Manager with a DNS-authorized certificate.

AnswerC

Google-managed certificates handle provisioning and renewal automatically.

Why this answer

Google-managed SSL certificates are automatically provisioned, renewed, and managed by Google for load balancers. No manual file uploads are needed.

Full explanation →

555

MCQeasy

A security engineer wants to ensure that no IAM keys are created for service accounts in a Google Cloud organization. Which organization policy constraint should be applied?

A.constraints/compute.restrictCloudArmorPolicies

B.constraints/compute.requireShieldedVm

C.constraints/iam.allowedPolicyMemberDomains

D.constraints/iam.disableServiceAccountKeyCreation

AnswerD

Correct: Prevents creation of service account keys.

Why this answer

The `constraints/iam.disableServiceAccountKeyCreation` organization policy constraint specifically prevents the creation of IAM keys for service accounts, which is exactly what the security engineer needs to enforce. This constraint, when applied at the organization level, blocks all users from creating or uploading service account keys, ensuring that no long-lived credentials are generated for service accounts.

Exam trap

The PCSE exam often tests the distinction between constraints that control IAM policy membership (Option C) versus those that control service account key creation (Option D), leading candidates to confuse domain restrictions with key management policies.

How to eliminate wrong answers

Option A is wrong because `constraints/compute.restrictCloudArmorPolicies` is a Compute Engine policy that restricts the use of Cloud Armor security policies, not IAM key creation. Option B is wrong because `constraints/compute.requireShieldedVm` enforces that new VMs must use Shielded VM features (secure boot, vTPM, integrity monitoring), which is unrelated to IAM service account key management. Option C is wrong because `constraints/iam.allowedPolicyMemberDomains` restricts which external domains can be members of IAM policies (e.g., to prevent cross-org access), but does not control service account key creation.

Full explanation →

556

MCQmedium

During an incident, a security engineer needs to isolate a compromised Compute Engine instance for forensic analysis without losing evidence. What should they do first?

A.Disconnect the instance from the VPC network.

B.Shut down the instance immediately.

C.Delete the instance to prevent further damage.

D.Create a snapshot of the instance's persistent disks.

AnswerD

Snapshots capture disk data for later analysis without altering the instance.

Why this answer

Creating a snapshot of the persistent disks preserves the disk state for forensic analysis without altering the instance. This captures all data, including evidence, before any other actions. Option A (disconnecting from VPC) may cause loss of volatile data and is not the first step.

Option B (shutting down) could modify disk state or trigger cleanup processes, potentially destroying evidence. Option C (deleting) obviously destroys evidence and is counterproductive.

Full explanation →

557

MCQeasy

A company in the EU is moving to Google Cloud and must comply with GDPR data residency requirements. They have users across multiple EU countries and want to ensure that personal data remains within the European Economic Area (EEA). They plan to use Cloud Storage, BigQuery, and Compute Engine. The security administrator sets organization policies to restrict resource locations to europe-west1, europe-west3, and europe-west4. After deploying applications, the compliance team finds that some data is stored in a Cloud Storage bucket in us-central1. Investigation shows that the bucket was created by a developer who manually chose the region. The organization policy seems to have been bypassed. The administrator confirms the policy is active and applied to the project. What is the most likely cause?

A.The policy only applies to Compute Engine resources, not Cloud Storage.

B.The organization policy was set at the folder level, and the project where the bucket was created is not a child of that folder.

C.The developer has the orgpolicy.policyCreator role, which allows them to bypass the policy.

D.The policy was set to allowlist mode, and us-central1 is in the allowlist.

AnswerB

Organization policies are hierarchical; if the project is not under the folder where the policy is set, it is not enforced.

Why this answer

Organization policies in Google Cloud are hierarchical and apply only to resources within the scope of the node (organization, folder, or project) where they are set. If the policy is set at a folder level, it does not affect projects that are not children of that folder. In this scenario, the bucket was created in a project outside the folder hierarchy where the policy was applied, so the policy was not enforced on that project, allowing the developer to choose us-central1.

Exam trap

Google Cloud often tests the hierarchical nature of organization policies, and the trap here is that candidates assume a policy set at any level applies to all projects in the organization, ignoring that it only applies to projects within the specific folder or node where the policy is attached.

How to eliminate wrong answers

Option A is wrong because organization policies for resource location (constraints/gcp.resourceLocations) apply to Compute Engine, Cloud Storage, BigQuery, and many other services, not just Compute Engine. Option C is wrong because the orgpolicy.policyCreator role allows a user to create and manage organization policies, but it does not grant the ability to bypass an active policy; policies are enforced regardless of the creator's role. Option D is wrong because the policy was set to restrict locations to europe-west1, europe-west3, and europe-west4, which is a deny-list (restrict) mode, not an allowlist mode; if it were an allowlist, us-central1 would not be in the allowed set.

Full explanation →

558

MCQhard

A security engineer needs to protect sensitive data in BigQuery. The data includes columns with personally identifiable information (PII). They want to automatically mask PII data for users with the role 'analyst' but allow full access for 'admin' users. Which approach should they use?

A.Use VPC Service Controls to restrict access to the dataset.

B.Create authorized views that exclude PII columns for the analyst role.

C.Use column-level access control via IAM roles to deny access to PII columns for analysts.

D.Apply policy tags with data masking policies to PII columns and assign the tag to the analyst role.

AnswerD

Policy tags with masking policies can dynamically mask data based on user's role.

Why this answer

BigQuery's policy tags with data masking policies allow you to automatically mask sensitive columns (e.g., PII) at query time based on the user's role. You assign a masking policy to the policy tag, then attach that tag to the PII columns. By granting the 'analyst' role access to the tag with the masking rule applied, analysts see masked data, while 'admin' users (who have higher-level IAM permissions) see the full data without additional configuration.

Exam trap

Google Cloud often tests the distinction between column-level access control (which can only hide or deny columns) and data masking (which can partially obscure data while still allowing access), leading candidates to mistakenly choose option C.

How to eliminate wrong answers

Option A is wrong because VPC Service Controls restrict network-level access to the BigQuery API but do not provide column-level data masking or role-based masking of PII. Option B is wrong because authorized views require creating separate views for each dataset and manually maintaining them; they do not automatically mask data at query time for different roles within the same table, and they add administrative overhead. Option C is wrong because column-level access control via IAM roles can only deny access to entire columns (making them invisible or causing errors), not mask the data; it cannot show partially masked values to analysts while allowing full access to admins.

Full explanation →

559

MCQeasy

A security engineer needs to ensure that a Compute Engine VM can securely access Cloud Storage buckets without exposing a public IP address. The VM is in a VPC with Private Google Access enabled. What is the recommended approach?

A.No additional configuration is needed; Private Google Access allows access to Cloud Storage from VMs without external IPs.

B.Deploy a Squid proxy in the same VPC and configure the VM to use it for all outbound traffic.

C.Assign an external IP to the VM and configure a firewall rule to allow egress to 0.0.0.0/0.

D.Configure Cloud NAT and ensure the VM has a route to the internet.

AnswerA

Correct: Private Google Access enables access to Google APIs via internal IPs.

Why this answer

Private Google Access enables a VM without an external IP address to reach Google APIs and services, including Cloud Storage, using the VPC's internal IP and Google's private network. Since the VM is in a VPC with Private Google Access enabled, it can securely access Cloud Storage buckets without needing a public IP or additional proxy. No further configuration is required because the traffic stays within Google's network and never traverses the public internet.

Exam trap

Google Cloud often tests the misconception that Private Google Access requires an external IP or NAT, but the trap here is that Private Google Access is specifically designed for VMs without external IPs to access Google APIs and services directly, so no additional components like proxies or NAT are needed.

How to eliminate wrong answers

Option B is wrong because a Squid proxy is unnecessary and adds complexity; Private Google Access already provides direct private connectivity to Cloud Storage without a proxy. Option C is wrong because assigning an external IP and allowing egress to 0.0.0.0/0 exposes the VM to the public internet, violating the requirement to avoid a public IP. Option D is wrong because Cloud NAT is used for outbound internet access from private VMs, but Private Google Access already handles access to Google APIs and services like Cloud Storage without needing NAT or internet routing.

Full explanation →

560

MCQmedium

An organization wants to grant a DevOps team the ability to create and manage service accounts in a specific project, but prevent them from deleting existing service accounts or managing IAM policies. Which IAM role should be assigned to the team?

A.roles/iam.serviceAccountUser

B.roles/iam.serviceAccountAdmin

C.roles/iam.serviceAccountKeyAdmin

D.roles/editor

AnswerB

ServiceAccountAdmin includes permissions to create, update, and delete service accounts, but not manage IAM policies.

Why this answer

The roles/iam.serviceAccountAdmin role grants permissions to create, update, and delete service accounts, but not to manage IAM policies for them. The basic role (Editor) is too permissive, ServiceAccountUser only allows using existing service accounts, and ServiceAccountKeyAdmin focuses on key management.

Full explanation →

561

MCQmedium

A company wants to grant a group of external auditors read-only access to all resources in a GCP project. The auditors authenticate via a SAML 2.0 identity provider. What is the most secure way to grant access?

A.Create a Cloud Identity group, add the auditors, and assign the Viewer role to the group at the project level.

B.Create a service account for each auditor and assign the Viewer role.

C.Use IAP to restrict access to the GCP console.

D.Create a custom role with only list permissions and assign to each auditor individually.

AnswerA

Group-based access is secure and scalable.

Why this answer

Cloud Identity groups can be used to manage access. The auditors should be added to a Google Group, and that group is assigned the Viewer role at the project level. This avoids managing individual accounts.

IAP is for application access, not project-level. Service accounts are for workloads. Custom roles are not needed for read-only.

Full explanation →

562

MCQhard

A security engineer is troubleshooting access to a Cloud Storage bucket. The bucket has uniform bucket-level access enabled. The engineer's user account has the roles/storage.objectViewer role at the project level, but they get a 403 error when trying to download an object. What is the most likely cause?

A.The bucket has ACLs that override the IAM role.

B.The user does not have the storage.objects.get permission.

C.The user's project-level role does not apply to this specific bucket.

D.There is a deny rule in an Organization Policy or an IAM deny policy that blocks the user.

AnswerD

Deny rules take precedence over allow rules, causing the 403 error.

Why this answer

Uniform bucket-level access disables ACLs, so access is governed solely by IAM and organization policies. A deny rule in an Organization Policy or an IAM deny policy explicitly overrides any allow permissions, causing a 403 error even if the user has the roles/storage.objectViewer role at the project level. This is the most likely cause given that the user already has the necessary IAM role.

Exam trap

Google Cloud often tests the nuance that deny policies (IAM deny or Organization Policy) override allow policies, leading candidates to incorrectly assume that having the correct IAM role is sufficient for access.

How to eliminate wrong answers

Option A is wrong because uniform bucket-level access disables ACLs on the bucket, so ACLs cannot override IAM roles. Option B is wrong because the roles/storage.objectViewer role includes the storage.objects.get permission, which is sufficient to download objects. Option C is wrong because project-level IAM roles apply to all buckets in the project when uniform bucket-level access is enabled, so the role does apply to this specific bucket.

Full explanation →

563

MCQeasy

A company wants to monitor for suspicious login attempts across all their Google Cloud projects. They want to send a real-time Slack notification when a login fails from an IP address outside their corporate CIDR range. What is the most efficient way to achieve this?

A.Create a Cloud Monitoring alert policy that checks for failed logins in logs and sends a notification to Slack via webhook.

B.Use Cloud Scheduler to run a batch job every hour that queries logs and sends a summary to Slack.

C.Export Admin Activity audit logs to a Pub/Sub topic via a sink, and use a Cloud Function that subscribes to the topic to filter and post to Slack.

D.Enable Cloud Audit Logs and configure a log router to forward logs directly to Slack.

AnswerC

This provides real-time, scalable, and customizable notification.

Why this answer

Admin Activity audit logs capture login events (e.g., failed logins). By creating a log sink that exports these logs to a Pub/Sub topic, you can stream them in real-time. A Cloud Function subscribed to that topic can filter for failed logins from outside the corporate CIDR and post a notification to Slack via a webhook. This approach provides real-time alerting with minimal latency and cost.

Option A is incorrect because Cloud Monitoring alert policies can use log-based metrics, but they cannot directly check for failed logins in logs; you would need to create a log-based metric first, which adds complexity and may not support the IP range filter efficiently.

Option B is incorrect because Cloud Scheduler runs on a schedule (e.g., hourly), which would not provide real-time notifications.

Option D is incorrect because Cloud Audit Logs alone cannot directly forward logs to Slack; you need an intermediary such as Pub/Sub and a Cloud Function.

Full explanation →

564

MCQmedium

An organization uses Cloud Identity to manage users and groups. They want to enforce that only users from their corporate domain (example.com) can be granted IAM roles on GCP resources. Which organization policy constraint should they use?

A.constraints/iam.disableServiceAccountKeyCreation

B.constraints/compute.restrictCloudArmorPolicies

C.constraints/iam.allowedPolicyMemberDomains

D.constraints/iam.workloadIdentityPoolProviders

AnswerC

This constraint restricts IAM members to specified domains.

Why this answer

The constraint 'constraints/iam.allowedPolicyMemberDomains' restricts which domains can be used in IAM policy bindings. By setting it to allow only 'example.com', any binding that includes a user from another domain will be denied.

Full explanation →

565

MCQmedium

A security engineer needs to monitor network traffic for potential threats in a VPC. They want to inspect all traffic for malware signatures and alert on high-severity threats. The solution should be natively integrated with GCP. Which service should they use?

A.VPC Flow Logs

B.Security Command Center

C.Cloud Armor

D.Cloud IDS

AnswerD

Cloud IDS provides network threat detection using Palo Alto Networks and monitors all VPC traffic.

Why this answer

Cloud IDS (Intrusion Detection System) is a managed service that uses Palo Alto Networks threat detection to inspect traffic for malware and other threats. It integrates with packet mirroring in GCP.

Full explanation →

566

MCQmedium

A company needs to store audit logs for a minimum of 5 years to meet compliance requirements. Cloud Logging retains logs for 30 days by default. Which approach should they take?

A.Store logs in BigQuery and set table expiration to 5 years

B.Create a log sink to export logs to Cloud Storage, and use Object Lifecycle Management to delete objects after 5 years

C.Use Cloud Functions to periodically copy logs to a persistent disk

D.Enable the 'Log Retention' setting in Cloud Logging to 5 years

AnswerB

Log sink exports logs to Cloud Storage. Then, lifecycle rules can delete objects after 5 years, meeting the retention requirement.

Why this answer

To retain logs for longer than 30 days, you must create a log sink that exports logs to a destination like Cloud Storage, and then set a retention policy on the bucket. Cloud Storage's Object Lifecycle Management can delete objects after 5 years.

Full explanation →

567

MCQhard

Refer to the exhibit. A security engineer runs the command to view recent decrypt operations on a Cloud KMS key. The output shows a successful decryption. However, the engineer is concerned about the exposure of the plaintext. Based on the log entry, what is the most accurate statement regarding the visibility of the decrypted plaintext?

A.The plaintext field is not present in the log because the service does not log it.

B.The plaintext field contains the base64-encoded ciphertext, and the engineer needs to decode it.

C.The plaintext field is redacted by Cloud KMS, and the actual plaintext is not visible in the log entry.

D.The plaintext field contains the actual decrypted data in plaintext, and the engineer should restrict access to the logs.

AnswerC

Cloud Audit Logs automatically redact sensitive data like decrypted plaintext.

Why this answer

Cloud KMS automatically redacts the plaintext field in Cloud Audit Logs for decrypt operations. The log entry shows a successful decryption, but the actual decrypted data is never written to the logs; instead, the plaintext field is replaced with a redacted marker (e.g., `[REDACTED]`). This is a security feature to prevent sensitive data from being exposed in audit logs, even to users with access to view them.

Exam trap

Google Cloud often tests the misconception that the plaintext field in Cloud KMS logs contains the actual decrypted data or that it is simply absent, when in fact it is explicitly redacted to protect sensitive information.

How to eliminate wrong answers

Option A is wrong because the plaintext field is present in the log entry (as shown in the exhibit), but it is redacted, not absent; the service does log the field but explicitly omits the actual plaintext. Option B is wrong because the plaintext field does not contain base64-encoded ciphertext; it contains a redacted value, and the engineer does not need to decode anything—the ciphertext is a separate field in the log. Option D is wrong because the plaintext field does not contain the actual decrypted data; Cloud KMS ensures the plaintext is never exposed in logs, so restricting access to logs would not address the concern about plaintext visibility.

Full explanation →

568

Multi-Selectmedium

An organization wants to enforce that all IAM policy changes in their Google Cloud organization are logged and require approval. Which three Google Cloud capabilities can help achieve this? (Choose THREE.)

Select 3 answers

A.Cloud Run for Anthos

B.Organization policies with constraints

C.Cloud Asset Inventory with Cloud Pub/Sub notifications

D.VPC Service Controls

E.Cloud Audit Logs

AnswersB, C, E

Organization policies with constraints enable administrators to enforce approval workflows for IAM policy changes, for example by using the `iam.allowPolicyChangeApproval` constraint to require explicit approval before changes take effect.

Why this answer

Organization policies with constraints (B) allow you to define and enforce guardrails for IAM policy changes, such as restricting which principals can modify policies or requiring specific conditions to be met before changes take effect. This helps enforce approval workflows and compliance. Cloud Asset Inventory with Cloud Pub/Sub notifications (C) can monitor and stream real-time updates to IAM policies, triggering approval processes.

Cloud Audit Logs (E) record all IAM policy changes, providing an immutable audit trail that can be used to verify compliance and enforce approval requirements.

Exam trap

Google Cloud often tests the distinction between monitoring/logging services (Cloud Audit Logs, Cloud Asset Inventory) and security enforcement tools (Organization policies, VPC Service Controls), leading candidates to mistakenly select VPC Service Controls for IAM change approval instead of recognizing it as a data exfiltration prevention mechanism.

Full explanation →

569

MCQeasy

A developer needs to deploy a web application on Compute Engine that must access Cloud Storage buckets. The best practice for providing credentials to the VM is to:

A.Generate a JSON key for a service account and store it on the instance.

B.Use the Compute Engine default service account and grant it the required roles.

C.Create a service account with the required roles and attach it to the Compute Engine instance.

D.Store the user's personal credentials in the instance metadata.

AnswerC

This uses the instance's default service account or a custom one, with credentials obtained automatically via metadata server.

Why this answer

The best practice is to create a service account, assign the appropriate roles to it, and attach it to the Compute Engine instance. This avoids managing static keys and uses the instance's metadata server for automatic credential retrieval.

Full explanation →

570

MCQmedium

A company has two Google Cloud projects: Project A (production) and Project B (development). They want to allow a service account in Project B to list Compute Engine instances in Project A. What is the most secure way to grant this access?

A.Create a new service account in Project A, generate a key, and share it with the application in Project B.

B.Add the service account as a member in Project A's IAM policy with the roles/compute.viewer role.

C.Make the service account a project owner of Project A.

D.Export the service account key from Project B and use it in an application in Project A.

AnswerB

This grants only the necessary permissions to the service account without exposing credentials.

Why this answer

It uses IAM to grant the service account from Project B the roles/compute.viewer role on Project A, which allows it to list Compute Engine instances without sharing keys or granting excessive permissions. This follows the principle of least privilege and avoids the security risks of key management.

Exam trap

The trap here is that candidates often think service accounts can only access resources within their own project, or they mistakenly believe that sharing keys is the only way to grant cross-project access, ignoring IAM's ability to grant roles to principals from other projects.

How to eliminate wrong answers

Option A is wrong because creating a new service account in Project A and sharing its key with Project B introduces a long-lived credential that can be leaked or misused, violating security best practices. Option C is wrong because making the service account a project owner of Project A grants it full administrative access, far beyond the needed read-only permission to list instances, which is insecure. Option D is wrong because exporting the service account key from Project B and using it in Project A does not grant access to Project A's resources; the key authenticates the service account in Project B, which has no permissions in Project A unless explicitly granted via IAM.

Full explanation →

571

MCQmedium

An organization uses Shared VPC to centrally manage network resources. They want to allow a service project to use its own firewall rules for certain instances. How should they configure the firewall rules?

A.Firewall rules can only be created in the host project

B.Create firewall rules in the service project with target tags

C.Create firewall rules in the host project with target tags for service project instances

D.Use hierarchical firewall policies

AnswerA

In Shared VPC, the host project owns the VPC network and all firewall rules must be defined there.

Why this answer

In Shared VPC, all firewall rules are created in the host project. Service projects cannot create firewall rules for the shared VPC network. Therefore, the only way is to create rules in the host project.

Full explanation →

572

Multi-Selectmedium

A security engineer is designing a logging and monitoring strategy to meet compliance requirements. Which THREE services should be integrated to ensure log data is tamper-proof and available for analysis? (Choose THREE.)

Select 3 answers

A.Cloud Logging

B.BigQuery

C.Cloud Audit Logs

D.Security Command Center

E.Cloud Storage with Object Lock

AnswersA, B, E

Centralized log ingestion and management.

Why this answer

Options A, B, and E are correct. Cloud Logging (A) ingests logs, Cloud Storage with Object Lock (E) provides immutability to prevent tampering, and BigQuery (B) allows querying and analysis. Option C (Cloud Audit Logs) is a type of log, not a service.

Option D (Security Command Center) is for security findings and vulnerability management, not for log management or analysis.

Full explanation →

573

Multi-Selecthard

A company uses Cloud DLP to inspect BigQuery tables for sensitive data. They want to automatically de-identify the data before loading it into another BigQuery dataset for analysis. Which THREE components must be configured? (Choose three.)

Select 3 answers

A.A Cloud KMS key for encryption of the output

B.A DLP job trigger

C.A de-identification template

D.A BigQuery authorized view

E.An inspection template

AnswersB, C, E

To schedule the de-identification job.

Why this answer

To automatically de-identify data from BigQuery, a DLP job must be configured with a de-identification template. The inspection template identifies sensitive info types. The job can write results to a new BigQuery table.

A job trigger schedules the job.

Full explanation →

574

MCQhard

A company uses Access Context Manager to restrict access to Cloud Resources based on device policy. They want to allow access only from devices that are company-managed and have disk encryption enabled. What should they configure?

A.Create an IAM condition requiring a specific device tag.

B.Use Identity-Aware Proxy with device policy.

C.Create an access level with device policy conditions for corporate-owned and disk encryption.

D.Use VPC Service Controls with a device restriction.

AnswerC

Access Context Manager supports these conditions.

Why this answer

Access Context Manager allows you to create access levels that define device policy conditions, such as requiring devices to be corporate-owned and have disk encryption enabled. These access levels are then applied to the organization's access policies to restrict access to cloud resources based on the device's compliance status.

Exam trap

The trap here is that candidates often confuse the roles of IAM conditions, IAP, and VPC Service Controls, mistakenly thinking they can enforce device-level policies directly, when in fact Access Context Manager is the dedicated service for such fine-grained device policy enforcement.

How to eliminate wrong answers

Option A is wrong because IAM conditions cannot directly evaluate device policy attributes like disk encryption; they are used for attribute-based access control (ABAC) on resource and principal attributes, not device compliance. Option B is wrong because Identity-Aware Proxy (IAP) enforces access based on identity and context, but it does not natively check device-level policies like disk encryption; it relies on Access Context Manager for such conditions. Option D is wrong because VPC Service Controls are designed to prevent data exfiltration by controlling the perimeter around Google Cloud services, not to enforce device-level policies like corporate ownership or disk encryption.

Full explanation →

575

Multi-Selecthard

An organization wants to use VPC Service Controls to protect BigQuery data. They need to allow a group of data analysts to access BigQuery from outside the perimeter (e.g., from their laptops) while maintaining the perimeter for all other users. Which TWO configurations are necessary?

Select 2 answers

A.Define an access level that includes the analysts' identities or IPs

B.Create an egress rule in the service perimeter that allows the analysts to leave the perimeter

C.Assign the analysts the roles/bigquery.user role

D.Enable dry-run mode on the perimeter

E.Create an ingress rule in the service perimeter that allows the analysts' identities or IPs to access BigQuery

AnswersA, E

Access levels are used in ingress rules to specify who is allowed to cross the perimeter.

Why this answer

To allow specific users to access a service from outside the perimeter, you must create an access level that identifies those users (e.g., by IP range or device) and then create an ingress rule that permits traffic from that access level to BigQuery. The access level can be based on user identity (e.g., via BeyondCorp) or IP ranges.

Full explanation →

576

MCQhard

A financial services company runs a sensitive application on Google Kubernetes Engine (GKE) with Workload Identity enabled. Security policy requires that only pods with a specific service account can access a Cloud Storage bucket containing customer data. The bucket has uniform bucket-level access enabled. What is the correct combination of IAM bindings to achieve this?

A.Add the Google service account as a member of the bucket with roles/storage.objectViewer

B.Bind the Google service account (linked to the Kubernetes service account via Workload Identity) to the bucket IAM policy with roles/storage.objectViewer

C.Grant the Google service account roles/storage.objectViewer at the project level

D.Bind the Kubernetes service account to the bucket IAM policy with roles/storage.objectViewer

AnswerB

This is the correct approach: the GSA is granted the role, and pods using the mapped KSA inherit that access.

Why this answer

Workload Identity links a Kubernetes service account (KSA) to a Google service account (GSA). When a pod uses that KSA, it authenticates as the linked GSA. Since the bucket has uniform bucket-level access, IAM permissions must be granted directly on the bucket resource, not at the project level.

Binding the GSA to the bucket with roles/storage.objectViewer ensures only pods using that specific KSA can read the bucket.

Exam trap

Google Cloud often tests the distinction between Kubernetes service accounts and Google service accounts, trapping candidates who try to bind a KSA directly to a Google Cloud resource instead of using the linked GSA via Workload Identity.

How to eliminate wrong answers

Option A is wrong because it says 'Add the Google service account as a member of the bucket' but does not specify the correct IAM role binding on the bucket resource; it is vague and incomplete. Option C is wrong because granting roles/storage.objectViewer at the project level would allow any workload or user with that role to access the bucket, violating the security policy that restricts access to only pods with a specific service account. Option D is wrong because Kubernetes service accounts are not recognized by Cloud Storage IAM; only Google service accounts can be bound to bucket IAM policies, and Workload Identity provides the mapping.

Full explanation →

577

MCQeasy

Which Google Cloud service is specifically designed to help customers meet compliance requirements by creating a folder with pre-defined organization policies, resource location restrictions, and access controls?

A.VPC Service Controls

B.Assured Workloads

C.Cloud HSM

D.Security Command Center

AnswerB

Assured Workloads creates a folder with compliance controls, location restrictions, and access restrictions.

Why this answer

Assured Workloads automates the creation of a compliant environment with pre-configured controls.

Full explanation →

578

MCQmedium

A DevOps team wants to enforce that only container images signed by a specific authority can be deployed in a GKE cluster. They plan to use Binary Authorization. Which configuration is required?

A.Create an attestor and set the policy to 'Deny all' and then add exceptions for signed images

B.Create an attestor and set the policy to 'Allow all' so that signed images are allowed

C.Create an attestor, generate a key pair with Cloud KMS, and configure the policy to require at least one attestation from that attestor

D.Create a vulnerability scan policy in Artifact Registry to block unsigned images

AnswerC

This is the correct approach: attestor with KMS key, policy requires attestation before deployment.

Why this answer

Binary Authorization enforces deployment policies. To require signed images, you create an attestor (e.g., using Cloud KMS) and a policy that requires at least one attestation from that attestor. The policy type must be 'Require attestations' (not 'Allow all' or 'Deny all').

Full explanation →

579

MCQhard

An organization uses Binary Authorization with multiple attestors. They want to allow a deployment only if at least two attestors have signed the image. Which policy type should be used?

A.Allow all images

B.Require attestation with a single attestor

C.Require attestation with a list of attestors and a minimum number of 2

D.Deny all images

AnswerC

Binary Authorization policies can specify a list of attestors and a minimum number of required attestations.

Why this answer

Binary Authorization allows you to define a policy with multiple attestors and set a minimum number of attestations required.

Full explanation →

580

MCQhard

A financial services company wants to ensure that Google Cloud staff cannot access their encryption keys or the plaintext data. They must meet regulatory requirements for data sovereignty. Which combination of services should they use?

A.Use CMEK with Cloud HSM and disable Access Transparency.

B.Use Customer-Supplied Encryption Keys (CSEK) without Access Transparency.

C.Use Cloud External Key Manager and enable Access Transparency logs.

D.Use VPC Service Controls and Cloud DLP.

AnswerC

EKM keeps keys outside Google; Access Transparency monitors access.

Why this answer

Cloud External Key Manager (EKM) allows you to manage encryption keys using a supported external key management partner, ensuring that Google Cloud staff cannot access your keys or plaintext data. Enabling Access Transparency logs provides you with logs of Google Cloud staff access to your data, which helps meet regulatory requirements for data sovereignty by giving you visibility into administrative actions.

Exam trap

Google Cloud often tests the distinction between key management options (CMEK, CSEK, EKM) and the role of Access Transparency, leading candidates to confuse CMEK (which still gives Google control over key material) with EKM (which keeps keys external).

How to eliminate wrong answers

Option A is wrong because CMEK with Cloud HSM still allows Google Cloud to manage the key material (though in a hardware security module), and disabling Access Transparency removes visibility into Google staff access, failing the requirement that Google Cloud staff cannot access keys or plaintext. Option B is wrong because Customer-Supplied Encryption Keys (CSEK) are only supported for a limited set of Google Cloud services (Compute Engine and Cloud Storage) and do not prevent Google Cloud staff from accessing the keys during processing; also, disabling Access Transparency eliminates audit logs needed for sovereignty compliance. Option D is wrong because VPC Service Controls and Cloud DLP control network access and data loss prevention, respectively, but do not address encryption key management or prevent Google Cloud staff from accessing keys or plaintext data.

Full explanation →

581

MCQmedium

A security team wants to block all incoming traffic from a specific country to their web application behind a global HTTPS load balancer. They also need to allow traffic from all other countries. Which Cloud Armor feature should be used?

A.Rate limiting

B.Preconfigured WAF rules

C.Adaptive Protection

D.Custom rule with geo-based condition

AnswerD

Cloud Armor custom rules can use the origin.region_code field to match the source country.

Why this answer

Cloud Armor supports geo-based access control. By creating a custom rule that uses a GeoIP match condition to deny traffic from the specific country, all other traffic is allowed by default (or via another rule).

Full explanation →

582

Multi-Selecthard

Which THREE steps are most effective for troubleshooting a VPC firewall rule issue where desired traffic is being blocked?

Select 3 answers

A.Check IAM permissions for the VM's service account

B.Check firewall rule logs in Cloud Logging

C.Verify that the network tags on instances match the target tags in the firewall rule

D.Review VPC flow logs to see if traffic is reaching the VM

E.Inspect the route tables for the subnet

AnswersB, C, D

Firewall logs show allowed and denied connections, directly indicating blocking.

Why this answer

Options B, C, and D are correct. Checking firewall rule logs in Cloud Logging (B) reveals whether traffic was denied by a firewall rule. Verifying that network tags on instances match the target tags in the firewall rule (C) ensures the rule applies to the correct VMs.

Reviewing VPC flow logs (D) shows actual traffic flows to confirm whether traffic reaches the VM. Option A (check IAM permissions) is less relevant because firewall rules are network-level, not identity-based. Option E (inspect route tables) affects routing, not firewall blocking.

Full explanation →

583

MCQmedium

A company is designing a CI/CD pipeline using Cloud Build. Security requirements mandate that the pipeline deploy only to projects that have been explicitly authorized. The security team wants to use a service account that can be assumed by Cloud Build to perform deployments, and they want to restrict which projects can be deployed to using organization policies. Which approach should they take?

A.Use the organization policy constraint 'constraints/iam.serviceAccountKeyExpiryHours' to force key rotation.

B.Use the organization policy constraint 'constraints/iam.allowedPolicyMemberDomains' and set it to only allow the service account's domain.

C.Use the organization policy constraint 'constraints/compute.restrictCrossProjectNw' to limit network access.

D.Use the organization policy constraint 'constraints/iam.workloadIdentityPoolProviders' to restrict which workload identity pools can be used.

AnswerB

Correct. By restricting allowed member domains to the service account's domain, you ensure that only that service account can be used, and by granting it roles only in authorized projects, you limit deployment scope.

Why this answer

The organization policy constraint `constraints/iam.allowedPolicyMemberDomains` restricts which domains' principals can be granted roles in the organization. By setting this constraint to only allow the domain that contains the service account used by Cloud Build, you ensure that only service accounts from that domain can be granted roles. Then, you grant that service account the necessary deployment roles (e.g., Compute Instance Admin, Kubernetes Engine Admin) only in the explicitly authorized projects.

This combination of organization policy and IAM grants restricts deployment to only those projects, meeting the security requirement.

Full explanation →

584

Multi-Selectmedium

A company is designing a network architecture for a multi-region application. They want to minimize latency and maximize availability. Which two features should they consider? (Choose two.)

Select 2 answers

A.Cloud NAT

B.Cloud CDN

C.Cloud Interconnect

D.Global Cloud Load Balancer

E.VPC Network Peering

AnswersB, D

Caches content at edge locations for faster delivery.

Why this answer

Cloud CDN (Option B) caches content at Google's globally distributed edge points of presence (PoPs), reducing latency by serving users from the nearest cache instead of the origin. The Global Cloud Load Balancer (Option D) provides a single anycast IP address that routes traffic to the closest healthy backend across multiple regions, maximizing availability through automatic failover and global traffic distribution.

Exam trap

Google Cloud often tests the misconception that Cloud Interconnect or VPC Peering are needed for multi-region performance, when in fact the Global Cloud Load Balancer and Cloud CDN are the correct services for minimizing latency and maximizing availability across regions.

Full explanation →

585

MCQeasy

A company uses Cloud Armor to protect their HTTP Load Balancer. They want to block requests from a specific IP range during a DDoS attack. What is the most efficient way to implement this?

A.Create a new Cloud Armor security policy and attach it to the backend service.

B.Modify the load balancer's firewall rule to deny traffic from that IP range.

C.Use Cloud CDN to cache responses and block the IP at the edge.

D.Update the existing security policy by adding a deny rule for the IP range with priority 1000.

AnswerD

Adding a deny rule to the existing policy is immediate and efficient.

Why this answer

Updating the existing Cloud Armor security policy with a deny rule for the specific IP range is the most efficient method during an active DDoS attack. It allows for immediate blocking without the need to create a new policy or modify attachments. Option A is less efficient as it requires creating a new security policy and attaching it to the backend service, which takes more time and configuration.

Option B is incorrect because firewall rules operate at the network layer and cannot block HTTP-level requests handled by the load balancer. Option C is incorrect because Cloud CDN does not provide IP blocking capabilities; it is used for caching content at the edge.

Full explanation →

586

Multi-Selectmedium

A company is migrating to Google Cloud and needs to comply with the Health Insurance Portability and Accountability Act (HIPAA). They plan to use Cloud SQL for MySQL and Cloud Storage. Which TWO actions must they take to ensure HIPAA compliance?

Select 2 answers

A.Sign a Business Associate Agreement (BAA) with Google Cloud.

B.Disable automatic backups to prevent exposure of protected health information (PHI).

C.Enable encryption at rest for Cloud SQL and Cloud Storage.

D.Implement VPC Service Controls to create a perimeter around the projects.

E.Use customer-managed encryption keys (CMEK) for all services.

AnswersA, C

A BAA is required for any HIPAA-covered entity using Google Cloud services.

Why this answer

To achieve HIPAA compliance on Google Cloud, the organization must sign a Business Associate Agreement (BAA) with Google, which contractually establishes Google as a business associate. Additionally, encryption at rest must be enabled for Cloud SQL and Cloud Storage to protect protected health information (PHI). Option B is incorrect because disabling automatic backups is not a HIPAA requirement and could compromise data availability.

Option D is incorrect because VPC Service Controls help prevent data exfiltration but are not specifically mandated by HIPAA. Option E is incorrect because customer-managed encryption keys (CMEK) are optional; Google's default encryption at rest satisfies HIPAA requirements.

Full explanation →

587

MCQmedium

A company has deployed a web application on Compute Engine instances in a managed instance group behind an internal HTTP(S) load balancer. The application needs to be accessible only from the corporate office, which has a static public IP range of 203.0.113.0/24. The load balancer is in us-central1. What is the most secure way to restrict access?

A.Create a VPC firewall rule that allows traffic from 203.0.113.0/24 to the load balancer's forwarding rule IP.

B.Assign a public IP to the internal load balancer and restrict access using Google Cloud Armor.

C.Configure a Cloud VPN tunnel between on-premises and VPC, then create a firewall rule allowing the corporate IP range to the internal load balancer's backend instances.

D.Use Google Cloud Armor with IP allowlisting on the internal load balancer.

AnswerC

This provides secure connectivity and allows fine-grained access control.

Why this answer

An internal HTTP(S) load balancer has a private IP address that is only reachable from within the same VPC or via Cloud VPN / Cloud Interconnect. To allow access from a corporate office with a static public IP range, you must establish a Cloud VPN tunnel to extend the VPC network to the on-premises network, then create a firewall rule that permits traffic from the corporate IP range to the internal load balancer's backend instances. This ensures traffic traverses an encrypted tunnel and is subject to VPC firewall controls, providing the most secure and architecturally correct solution.

Exam trap

Google Cloud often tests the misconception that internal load balancers can be secured with Cloud Armor or that VPC firewall rules can filter traffic based on source public IPs when the destination is a private IP, but in reality, internal load balancers are only reachable from within the VPC or via hybrid connectivity like Cloud VPN.

How to eliminate wrong answers

Option A is wrong because an internal load balancer's forwarding rule IP is a private RFC 1918 address, not a public IP; VPC firewall rules cannot filter traffic destined to a private IP based on source public IPs because the traffic never reaches the load balancer from the internet. Option B is wrong because assigning a public IP to an internal load balancer is not supported; internal load balancers are designed to only have private IPs, and exposing them with a public IP would defeat the purpose of an internal load balancer. Option D is wrong because Google Cloud Armor cannot be directly attached to an internal HTTP(S) load balancer; Cloud Armor is only supported for external HTTP(S) load balancers, not internal ones.

Full explanation →

588

MCQeasy

Which of the following is a feature available only in Security Command Center Premium tier, not in Standard tier?

A.Security Health Analytics

B.Event Threat Detection

C.Anomaly Detection

D.Web Security Scanner

AnswerB

Event Threat Detection is Premium-only.

Why this answer

Event Threat Detection is a Premium-only feature. Security Health Analytics, Web Security Scanner, and Anomaly Detection are available in both tiers.

Full explanation →

589

Multi-Selectmedium

A company wants to use Cloud IDS to detect threats in their VPC. They have created a Cloud IDS endpoint and need to configure packet mirroring. Which TWO resources must be in place for packet mirroring to work? (Choose TWO.)

Select 2 answers

A.A Collector VPC network with the IDS endpoint

B.Public IP addresses on the source VMs

C.A mirrored VPC network with the VMs to be monitored

D.Cloud NAT on the mirrored VPC

E.A VPN tunnel between the collector and mirrored VPCs

AnswersA, C

The IDS endpoint is in the collector network.

Why this answer

Packet mirroring requires a Collector VPC (where the IDS endpoint resides) and a mirrored VPC (where source VMs are). The source VMs must be tagged.

Full explanation →

590

Multi-Selectmedium

Which two best practices for managing secrets in Secret Manager? (Choose two.)

Select 2 answers

A.Enable automatic replication to multiple regions for high availability.

B.Use the Secret Manager API to list all secrets for any user.

C.Set a short TTL for secret versions and delete them immediately.

D.Store secrets in multiple ConfigMaps for redundancy.

E.Use IAM conditions to restrict access based on resource tags.

AnswersA, E

Replication ensures availability if a region fails.

Why this answer

Secret Manager supports automatic replication across regions, ensuring that secret data remains available even during a regional outage. This is a key best practice for high availability and disaster recovery, as it allows applications to read secrets from the nearest or alternate region without manual intervention.

Exam trap

Google Cloud often tests the misconception that ConfigMaps are suitable for secrets or that short TTLs and immediate deletion are safe practices, when in fact they violate operational stability and security best practices.

Full explanation →

591

MCQmedium

A healthcare organization stores Protected Health Information (PHI) in Cloud Storage. They need to de-identify data before sharing it with researchers. Which service should they use?

A.Cloud Key Management Service (KMS)

B.VPC Service Controls

C.Cloud IAM

D.Cloud Data Loss Prevention (DLP)

AnswerD

DLP can de-identify structured and unstructured data, including PHI.

Why this answer

Cloud Data Loss Prevention (DLP) is the correct service because it is specifically designed to inspect, classify, and de-identify sensitive data such as Protected Health Information (PHI). It uses built-in infoTypes (e.g., US_INDIVIDUAL_HEALTHCARE_NPI) and de-identification techniques like masking, tokenization, and redaction to transform PHI into a de-identified dataset before sharing with researchers, ensuring compliance with HIPAA.

Exam trap

Google Cloud often tests the distinction between data protection services (encryption, access control, perimeter security) and data de-identification, so the trap here is that candidates confuse Cloud KMS or IAM with DLP because they all relate to 'protecting' data, but only DLP actively transforms sensitive content to remove identifiers.

How to eliminate wrong answers

Option A is wrong because Cloud Key Management Service (KMS) is used for managing encryption keys, not for de-identifying data; it protects data at rest but does not remove or transform PHI. Option B is wrong because VPC Service Controls provide a security perimeter to prevent data exfiltration from VPC services, but they do not inspect or de-identify the content of data. Option C is wrong because Cloud IAM manages access control policies (who can access resources), but it does not perform data de-identification or content inspection.

Full explanation →

592

MCQmedium

A company needs to archive their VPC Flow Logs for 10 years for compliance. They also need to run occasional queries on the logs. What is the most cost-effective approach?

A.Export VPC Flow Logs to both Cloud Storage and BigQuery simultaneously.

B.Create a log sink to export VPC Flow Logs to Cloud Storage with a retention policy of 10 years and use BigQuery external tables for occasional queries.

C.Create a log sink to export VPC Flow Logs to BigQuery and set a table partition expiration to 10 years.

D.Enable VPC Flow Logs and set the log bucket retention to 10 years.

AnswerB

Cloud Storage provides low-cost archival, and BigQuery external tables allow querying without loading.

Why this answer

Exporting logs to Cloud Storage with a retention policy is the most cost-effective for long-term archival. BigQuery is more expensive for storage but allows queries. Using a log sink with _Default log view includes VPC Flow Logs (if enabled).

Full explanation →

593

MCQmedium

A company wants to restrict access to Cloud Storage buckets so that only resources in a specific VPC network can reach them, and data cannot be exfiltrated to other networks. Which Google Cloud service should they use?

A.Identity-Aware Proxy (IAP)

B.Cloud Armor

C.VPC Firewall Rules

D.VPC Service Controls

AnswerD

Correct: VPC Service Controls create a service perimeter that isolates Google Cloud services and prevents data exfiltration.

Why this answer

VPC Service Controls allows creating service perimeters that protect Google Cloud services (including Cloud Storage) by restricting access from outside the perimeter. Resources inside the perimeter can access the protected services, but data cannot be exfiltrated to external networks.

Full explanation →

594

MCQmedium

A security engineer needs to audit changes to IAM policies across their Google Cloud organization. Which audit log type should they enable to capture IAM policy changes?

A.Admin Activity audit logs

B.System Event audit logs

C.Data Access audit logs

D.Access Transparency logs

AnswerA

Admin Activity audit logs record all modifications to IAM policies because they capture any API call that creates, modifies, or deletes a resource's metadata or configuration. This satisfies the stem’s requirement to audit *changes* specifically, as these logs are enabled by default and track administrative actions like binding roles to principals, unlike Data Access logs which record resource data reads.

Why this answer

Admin Activity audit logs capture all API calls that modify configuration, including IAM policy changes.

Full explanation →

595

MCQhard

A company uses Cloud SQL for PostgreSQL with CMEK. They need to ensure that the Cloud SQL instance can only be accessed by authorized compute resources that have the correct IAM permissions to decrypt the data. What additional configuration is required to enforce access control?

A.Enable mutual TLS for all connections to the Cloud SQL instance.

B.Set up a service account with Cloud KMS CryptoKey Encrypter/Decrypter and attach it to authorized VMs.

C.Use VPC Service Controls to restrict access to the Cloud SQL instance and the key.

D.Configure Cloud SQL to use Cloud Armor to whitelist IP addresses.

AnswerB

This ensures only specific VMs can decrypt, coupling compute access with key access.

Why this answer

Cloud SQL with CMEK requires that any compute resource accessing the instance must have the Cloud KMS CryptoKey Encrypter/Decrypter IAM role on the key. By attaching a service account with this role to authorized VMs, you ensure that only those VMs can decrypt the data at rest, enforcing access control at the IAM level. This directly ties the decryption permission to the compute resource's identity, not just network-level access.

Exam trap

Google Cloud often tests the distinction between network-level access controls (like VPC Service Controls or Cloud Armor) and IAM-based key authorization, leading candidates to choose perimeter security options instead of the correct identity-based decryption permission.

How to eliminate wrong answers

Option A is wrong because mutual TLS (mTLS) authenticates the client and server at the transport layer but does not control decryption permissions for CMEK; it addresses connection security, not key access. Option C is wrong because VPC Service Controls restrict data exfiltration and network access to Google Cloud services, but they do not grant or enforce IAM permissions to decrypt the CMEK key; they are a perimeter security control, not a key authorization mechanism. Option D is wrong because Cloud Armor is a web application firewall that filters traffic based on IP addresses or HTTP headers, but it cannot enforce IAM-based decryption permissions; it operates at the network edge, not at the key management layer.

Full explanation →

596

MCQmedium

A company stores sensitive customer data in Cloud Storage. They want to ensure that data is encrypted at rest using customer-managed encryption keys (CMEK) and that access to the key is audited. Which approach should they use?

A.Use Google-managed encryption keys and enable Cloud Audit Logs for the bucket.

B.Use CMEK with key material stored in a Cloud Storage bucket.

C.Use customer-supplied encryption keys (CSEK) and store the keys in Secret Manager.

D.Use CMEK with a Cloud KMS key and enable Cloud Audit Logs for the key.

AnswerD

CMEK uses Cloud KMS, and audit logs track access to the key.

Why this answer

It combines customer-managed encryption keys (CMEK) via Cloud KMS with Cloud Audit Logs enabled on the key itself. This ensures the data is encrypted at rest using a key that the customer controls and rotates, and all operations against that key (e.g., encrypt, decrypt, enable, disable) are logged for auditing. Cloud Audit Logs on the bucket alone would not capture key access events, which is required for full auditability.

Exam trap

Google Cloud often tests the distinction between CMEK and CSEK, and the trap here is that candidates confuse 'customer-managed' with 'customer-supplied' and overlook that CMEK requires Cloud KMS for key management and auditing, not just storing key material in Cloud Storage or Secret Manager.

How to eliminate wrong answers

Option A is wrong because Google-managed encryption keys do not allow customer control or rotation of the key material, and enabling Cloud Audit Logs only on the bucket does not audit access to the encryption key itself. Option B is wrong because storing CMEK key material in a Cloud Storage bucket violates the principle of keeping keys separate from the data they protect, and Cloud Storage does not provide the key management lifecycle or audit logging that Cloud KMS offers. Option C is wrong because customer-supplied encryption keys (CSEK) require the customer to supply the key on every API call, and storing the keys in Secret Manager does not provide the same level of key rotation, versioning, or centralized audit logging as Cloud KMS with CMEK.

Full explanation →

597

MCQeasy

Your organization has a VPC with several subnets and wants to enable Private Google Access for Compute Engine instances in a specific subnet to access Google APIs and services without external IP addresses. What must be configured?

A.Assign external IPs to the instances and create a firewall rule allowing egress to Google APIs.

B.Create a Cloud NAT gateway and enable Private Google Access on the subnet.

C.Enable Private Google Access on the subnet and ensure that instances have a default route (0.0.0.0/0) with next hop to the default internet gateway.

D.Enable Private Google Access on the subnet only.

AnswerC

Private Google Access works with the default route to the internet gateway; no NAT needed.

Why this answer

Private Google Access requires two components: enabling it on the subnet and having a default route (0.0.0.0/0) pointing to the internet gateway. This route allows instances without external IPs to use the VPC's default internet gateway to reach Google APIs via the 199.36.153.4/30 address range, which is advertised by Google's private IP space. Without the default route, traffic from the subnet cannot reach the internet gateway, even with Private Google Access enabled.

Exam trap

Google Cloud often tests the misconception that Cloud NAT is required for Private Google Access, but the correct configuration relies solely on the default internet gateway and a default route, not NAT.

How to eliminate wrong answers

Option A is wrong because assigning external IPs defeats the purpose of Private Google Access, which is designed for instances without public IPs, and a firewall rule alone does not enable the necessary routing. Option B is wrong because Cloud NAT is used for outbound internet access to non-Google services, not for Private Google Access, which uses the default internet gateway and Google's private IP range. Option D is wrong because enabling Private Google Access on the subnet alone is insufficient; a default route (0.0.0.0/0) with next hop to the default internet gateway is required to direct traffic to Google APIs.

Full explanation →

598

MCQeasy

What is the purpose of the Cloud DLP InfoType detector CREDIT_CARD_NUMBER?

A.It encrypts credit card numbers automatically.

B.It detects credit card numbers in data during inspection.

C.It redacts credit card numbers from images.

D.It de-identifies credit card numbers using masking.

AnswerB

InfoType detectors are used to find sensitive data.

Why this answer

Cloud DLP InfoType detectors are used to identify specific types of sensitive data. CREDIT_CARD_NUMBER is a built-in detector that finds credit card numbers in text or files.

Full explanation →

599

MCQeasy

A development team needs to grant a third-party auditor read-only access to a specific project's resources but must not allow the auditor to view any data stored in Cloud Storage buckets. Which IAM approach should be used?

A.Assign the predefined roles/viewer role and add a condition to deny access to Cloud Storage.

B.Use a deny policy to block access to storage.objects.get for the auditor.

C.Assign the basic roles/reader role to the auditor.

D.Create a custom role that includes only the required read permissions except those for Cloud Storage.

AnswerD

Custom roles allow exact permission selection, excluding storage read permissions.

Why this answer

Custom roles allow you to curate a specific set of permissions. You can create a role that includes read permissions for Compute Engine and Cloud SQL but excludes storage.objects.get on Cloud Storage. Predefined roles like Viewer include storage.objects.get, and basic roles are too broad.

Condition-based access can be complex and error-prone.

Full explanation →

600

MCQmedium

A security team needs to apply a set of firewall rules that enforce baseline security for all VPC networks across multiple projects in an organization. These rules must be inherited and cannot be overridden by project-level rules. What should they use?

A.VPC firewall rules

B.Network firewall policies

C.Cloud Armor security policies

D.Hierarchical firewall policies

AnswerD

Hierarchical firewall policies are applied at the organization or folder level, inherited, and cannot be overridden.

Why this answer

Hierarchical firewall policies can be applied at the organization or folder level and are inherited by all VPC networks in the hierarchy. They cannot be overridden by lower-level firewall rules, making them ideal for baseline security policies. Network firewall policies are applied to a specific VPC network.

VPC firewall rules are per project and can be overridden.

Full explanation →

Page 8 of 13

All pages

1 2 3 4 5 6 7 8 9 10 11 12 13

Practice PCSE by domain

Target a specific domain to shore up weak areas.

Configuring Access Within a Cloud Solution Environment Ensuring Data Protection Managing Operations in a Cloud Solution Environment Configuring Network Security Supporting Compliance Requirements

See all domains with question counts →