Courseiva
← Back to Google Professional Cloud Security Engineer questions

Scenario-based practice

Select Two (Multi-Select) Questions

Practise Google Professional Cloud Security Engineer practice questions — original exam-style scenarios covering every exam domain, with detailed explanations, wrong-answer analysis, and common exam traps.

Start full practice testRead exam guide
20
scenario questions
PCSE
exam code
Google Cloud
vendor

Scenario guide

How to approach select two (multi-select) questions

Multi-select questions tell you to 'Choose TWO' or 'Choose THREE'. Getting partial credit is not a thing — you must select all correct answers with no incorrect ones. The stem always states how many to choose, so trust it. These questions require precision, not best-guess elimination.

Quick answer

Select Two (Multi-Select) Questions questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Related practice questions

Related PCSE topic practice pages

Scenario questions usually connect to one or more exam topics. Use these links to review the underlying concepts behind the scenario.

Configuring Access Within a Cloud Solution Environment practice questions

Sharpen your PCSE knowledge of Configuring Access Within a Cloud Solution Environment.

Ensuring Data Protection practice questions

Sharpen your PCSE knowledge of Ensuring Data Protection.

Managing Operations in a Cloud Solution Environment practice questions

Practise PCSE questions linked to Managing Operations in a Cloud Solution Environment.

Configuring Network Security practice questions

Targeted PCSE practice covering Configuring Network Security.

Supporting Compliance Requirements practice questions

Sharpen your PCSE knowledge of Supporting Compliance Requirements.

PCSE fundamentals practice questions

Work through PCSE questions on PCSE fundamentals.

PCSE scenario practice questions

Practise PCSE questions linked to PCSE scenario.

PCSE troubleshooting practice questions

Practise PCSE questions linked to PCSE troubleshooting.

Practice set

Practice scenarios

Question 1mediummulti select
Full question →

A company must store API keys and database credentials securely in Google Cloud. They need automatic rotation of these secrets every 30 days, with notifications sent to a security team after each rotation. Which services should they use? (Choose TWO).

Question 2mediummulti select
Full question →

A multinational company is migrating sensitive workloads to Google Cloud and must comply with GDPR data residency requirements. Which TWO actions ensure data remains stored only within the European Union? (Choose TWO.)

Question 3easymulti select
Full question →

A company wants to use Private Service Connect to publish a managed service (e.g., a custom application) so that consumers can access it privately within Google Cloud. Which THREE resources are involved in this setup?

Question 4mediummulti select
Full question →

A security engineer wants to ensure that sensitive data in BigQuery is masked for analysts but visible in full to data stewards. Which two components must be used together? (Choose TWO.)

Question 5easymulti select
Full question →

Which two authentication methods are available for applications to authenticate to Google Cloud APIs without using a service account key? (Choose TWO.)

Question 6mediummulti select
Full question →

Which TWO practices help implement the principle of least privilege when configuring access to Google Cloud resources? (Choose two.)

Question 7hardmulti select
Full question →

Which THREE components are required to configure VPC Flow Logs for a Compute Engine instance?

Question 8mediummulti select
Full question →

A company wants to ensure compliance with PCI DSS by monitoring access to BigQuery datasets containing sensitive data. They need to log all read operations and enable real-time alerting for anomalous access. Which TWO actions should they take? (Choose TWO.)

Question 9hardmulti select
Full question →

Which THREE are best practices for managing encryption keys in Google Cloud?

Question 10mediummulti select
Full question →

Which THREE of the following are best practices for using Cloud DLP to protect sensitive data in BigQuery?

Question 11hardmulti select
Full question →

A security team wants to ensure that a Cloud KMS key is rotated automatically every 30 days and that previous key versions are available for decryption for at least 6 months. Which THREE steps should they take? (Choose three.)

Question 12hardmulti select
Full question →

An incident responder needs to collect forensic evidence from a compromised Compute Engine instance for later analysis. They want to preserve disk state and network logs. Which THREE actions should they take?

Question 13mediummulti select
Full question →

A company is using Security Command Center (SCC) Premium tier and wants to automatically remediate certain high-severity findings. Which two services can be used together to achieve this? (Choose two.)

Question 14hardmulti select
Full question →

A multinational organization uses Chronicle SIEM to aggregate and analyze security logs from multiple GCP projects and on-premises systems. The security team wants to detect a known threat pattern: a user authenticating from an anomalous geographic location followed by a large data egress from a Compute Engine instance within 10 minutes. Which three steps are necessary to create this detection? (Choose three.)

Question 15hardmulti select
Full question →

A gaming company deploys a multiplayer game backend on Google Kubernetes Engine (GKE) with multiple microservices. The operations team needs to collect structured logs from containers, analyze them in real-time for anomalies, and store them for 30 days for compliance. They also need to monitor custom application metrics (e.g., player count per game server). Which three Google Cloud services should they use? (Choose three.)

Question 16mediummulti select
Full question →

Your company needs to implement real-time monitoring of security events from Google Cloud resources. They want to ingest logs into a third-party SIEM system. Which two services should they use together? (Choose two.)

Question 17hardmulti select
Full question →

A financial services company is migrating to Google Cloud and needs to enforce strict security controls. They want to ensure that: 1) No service account keys are created. 2) All Compute Engine instances must be created with Shielded VM enabled. 3) Only users from the corporate domain (example.com) can be granted IAM roles. Which THREE Organization Policy constraints must be used? (Choose three.)

Question 18mediummulti select
Full question →

A company needs to grant developers the ability to deploy applications to App Engine, but they should not be able to modify IAM policies. Which two roles should be assigned to the developers? (Choose two.)

Question 19mediummulti select
Full question →

A company is implementing data loss prevention (DLP) for BigQuery. Which THREE capabilities are provided by Cloud DLP? (Choose THREE.)

Question 20mediummulti select
Full question →

Which TWO options are required to use Cloud DLP to successfully inspect data in a Cloud Storage bucket?

These PCSE practice questions are part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style PCSE questions with detailed explanations, topic-based practice, mock exams, readiness tracking, and study analytics.