View Full Google Professional Cloud Security Engineer Exam Dumps and Practice Test Dumps.

 

Question 81

A company wants to ensure that a workload can access only the Google Cloud resources required for its specific function. Which IAM design principle should be applied?

1. Grant Project Owner to the workload
2. Grant broad organization-level access
3. Apply the principle of least privilege
4. Use anonymous authentication

Correct Answer: 3

Explanation

The principle of least privilege requires an identity to receive only the permissions necessary to perform its intended function. Applying this principle to workloads limits the potential impact of compromised credentials or vulnerable applications. Instead of granting broad project or organization-level roles, security engineers should select appropriate predefined or custom roles and scope them to the required resources whenever practical. This approach also improves accountability and simplifies permission reviews. Project Owner access is generally much broader than a workload needs, while anonymous authentication removes important security controls. Least privilege should be combined with workload-specific identities, logging, monitoring, and regular IAM reviews.

Question 82

A security engineer needs to determine whether an administrator recently created a new service account in a production project. Which Google Cloud capability should be reviewed?

1. Cloud Audit Logs
2. Cloud CDN
3. Cloud NAT
4. Cloud DNS

Correct Answer: 1

Explanation

Cloud Audit Logs provide records of administrative activities performed on Google Cloud resources. Creating service accounts is an administrative operation that can be investigated through the relevant audit records. Security teams can use audit information to determine when an identity-related change occurred and which principal performed the operation. This is particularly useful for detecting unauthorized identity creation or investigating changes that may affect the security posture of a production project. Cloud CDN handles content delivery, Cloud NAT provides outbound network translation, and Cloud DNS manages name resolution. Audit logs should be retained and protected appropriately so that investigators can rely on them during security reviews and incident response.

Question 83

A company needs to provide an application with access to a database password without exposing the password in its source code. Which service should be used?

1. Cloud Scheduler
2. Secret Manager
3. Cloud Router
4. Cloud CDN

Correct Answer: 2

Explanation

Secret Manager is designed to securely store sensitive information such as database passwords, API credentials, certificates, and other application secrets. An application can retrieve the required secret at runtime when its identity has appropriate IAM permissions. This avoids embedding credentials directly in source code, configuration files, or container images where they could be accidentally exposed. Security teams should grant access only to the workloads that need the secret and establish appropriate rotation and lifecycle practices. Cloud Scheduler is used for scheduled jobs, Cloud Router manages dynamic routing, and Cloud CDN handles content delivery. Secret Manager is therefore the appropriate service for protecting application credentials.

Question 84

A security team wants to restrict access to sensitive resources based on the user’s network location. Which Google Cloud capability should be considered?

1. Cloud Storage
2. Access Context Manager
3. Cloud SQL
4. Cloud Scheduler

Correct Answer: 2

Explanation

Access Context Manager allows organizations to define access levels based on contextual attributes, including network location and other supported conditions. These access levels can be used with supported Google Cloud access controls to require users to meet specific conditions before accessing protected resources. This can provide additional protection against stolen credentials because successful authentication alone may not be sufficient for access. Cloud Storage provides object storage, Cloud SQL provides managed database services, and Cloud Scheduler manages scheduled jobs. Access Context Manager is therefore appropriate when security policies need to consider the context from which a user is accessing sensitive cloud resources.

Question 85

An organization wants to prevent unauthorized public exposure of Cloud Storage buckets across its environment. Which configuration should be considered?

1. Public Access Prevention
2. Cloud Trace
3. Cloud Router
4. Cloud Scheduler

Correct Answer: 1

Explanation

Public Access Prevention helps organizations prevent Cloud Storage resources from being exposed through public access configurations. It is useful when organizational policy requires stored information to remain private and accessible only through authorized identities. Applying this control reduces the likelihood that an administrator or application will accidentally grant public access to sensitive data. Cloud Trace is used for application tracing, Cloud Router manages dynamic routing, and Cloud Scheduler executes scheduled tasks. Public Access Prevention should be combined with IAM, regular permission reviews, and monitoring because preventing public access does not eliminate the need to control which authenticated users and workloads can access storage resources.

Question 86

A company wants to establish centralized restrictions that apply to projects and folders throughout its Google Cloud organization. Which capability should be used?

1. Cloud CDN
2. Organization Policy Service
3. Cloud NAT
4. Cloud Trace

Correct Answer: 2

Explanation

Organization Policy Service provides centralized governance controls that can be applied at organizational, folder, or project levels. Security teams can use supported constraints to establish rules for resource configurations and prevent certain insecure or noncompliant settings. This approach helps maintain consistent security standards across large cloud environments and reduces configuration drift. Cloud CDN provides content delivery capabilities, Cloud NAT handles outbound network address translation, and Cloud Trace supports application tracing. Organization policies are particularly valuable because they provide preventive guardrails that can affect multiple projects instead of requiring administrators to configure the same restrictions independently in every project.

Question 87

A security engineer needs to prevent a compromised workload from reaching unnecessary network destinations. Which control should be used?

1. VPC firewall rules
2. Cloud KMS key rotation
3. Secret Manager versions
4. Cloud Scheduler jobs

Correct Answer: 1

Explanation

VPC firewall rules provide network-level controls that can restrict traffic entering or leaving applicable resources. Security engineers can define rules using source and destination ranges, protocols, ports, and other supported attributes. By allowing only required communication paths, organizations can reduce unnecessary connectivity and limit potential lateral movement after a workload compromise. Cloud KMS manages cryptographic keys, Secret Manager manages sensitive values, and Cloud Scheduler runs scheduled tasks. Firewall rules should be designed according to application dependencies and regularly reviewed to remove unnecessary access. Combining network restrictions with least-privilege IAM, workload identity, logging, and monitoring provides multiple defensive layers.

Question 88

A company wants to identify known vulnerabilities in container images before they are deployed to production. Which capability is most appropriate?

1. Cloud DNS
2. Artifact Analysis
3. Cloud VPN
4. Cloud Scheduler

Correct Answer: 2

Explanation

Artifact Analysis can provide vulnerability information for supported container images and software artifacts. Identifying known vulnerabilities before deployment allows development and security teams to address risky components earlier in the software supply chain. The capability can be integrated into development and deployment workflows so that vulnerability information becomes part of the security review process. Cloud DNS manages domain names, Cloud VPN provides encrypted network connectivity, and Cloud Scheduler runs scheduled tasks. Vulnerability scanning should be complemented by secure build processes, dependency management, image provenance controls, and appropriate deployment policies to reduce the likelihood that vulnerable artifacts reach production environments.

Question 89

A security team needs a centralized view of threats, vulnerabilities, and security misconfigurations across multiple Google Cloud projects. Which service should be used?

1. Security Command Center
2. Cloud SQL
3. Cloud Storage
4. Cloud Router

Correct Answer: 1

Explanation

Security Command Center provides centralized visibility into security findings across supported Google Cloud environments. It can help security teams identify vulnerabilities, threats, misconfigurations, and other security issues affecting resources across projects. Centralized findings make it easier to prioritize investigations and coordinate remediation instead of manually reviewing each project. Cloud SQL provides managed relational database services, Cloud Storage provides object storage, and Cloud Router handles dynamic route exchange. Security Command Center can work alongside IAM, organization policies, logging, and monitoring to provide a broader security operations capability and improve awareness of the organization’s overall cloud security posture.

Question 90

A company wants to use customer-controlled encryption keys managed through Cloud KMS for supported cloud resources. Which encryption model should be selected?

1. Google-managed encryption keys
2. Customer-managed encryption keys
3. Unencrypted storage
4. Public encryption keys

Correct Answer: 2

Explanation

Customer-managed encryption keys allow an organization to manage cryptographic keys through Cloud KMS while using them for supported Google Cloud services. This provides greater control over key access, lifecycle management, versions, and rotation than relying exclusively on Google-managed keys. Organizations can use IAM to control which identities can administer or use the keys. Google-managed encryption keys are operated by Google, while unencrypted storage does not provide encryption at rest. Public encryption keys are not an appropriate description of the required Cloud KMS management model. Customer-managed encryption keys are therefore appropriate when an organization requires direct control over cryptographic key administration.

Question 91

A security engineer wants to prevent an external workload from using long-lived service account keys to access Google Cloud resources. Which solution is appropriate?

1. Workload Identity Federation
2. Public IP addresses
3. Cloud CDN
4. Cloud Storage ACLs

Correct Answer: 1

Explanation

Workload Identity Federation allows external workloads to obtain short-lived Google Cloud credentials without requiring long-lived service account key files. This reduces the risk of credentials being leaked through configuration files, source repositories, build systems, or compromised machines. The external identity can be mapped to an appropriate Google Cloud identity and granted only the permissions required for the workload. Public IP addresses do not provide authentication, Cloud CDN is a content delivery service, and Cloud Storage ACLs control access to storage objects. Workload Identity Federation is therefore a suitable approach for securely authenticating workloads that operate outside Google Cloud.

Question 92

An organization needs to identify which user performed an administrative change to a production resource. Which capability provides this audit information?

1. Cloud Audit Logs
2. Cloud CDN
3. Cloud NAT
4. Cloud DNS

Correct Answer: 1

Explanation

Cloud Audit Logs record administrative activities and other supported operations across Google Cloud services. Audit records can provide information about the principal responsible for an operation, the affected resource, and the action that occurred. This information is valuable for security investigations, compliance reporting, and accountability. Security teams can use audit records to investigate unexpected changes and determine whether actions were authorized. Cloud CDN manages content delivery, Cloud NAT provides network address translation, and Cloud DNS manages domain resolution. Audit logs should be protected against unauthorized modification and retained according to organizational requirements so that they remain useful during investigations.

Question 93

A company wants to reduce data exfiltration risks from sensitive Google Cloud services by creating a logical security boundary. Which service should be considered?

1. VPC Service Controls
2. Cloud Scheduler
3. Cloud CDN
4. Cloud Trace

Correct Answer: 1

Explanation

VPC Service Controls provide service perimeters around supported Google Cloud services and can help reduce the risk of unauthorized data exfiltration. Security teams can define boundaries and access conditions intended to limit how protected resources can be accessed and how data can move between protected and unprotected environments. This control complements IAM because IAM determines whether an identity is authorized while service controls add another layer based on security boundaries and request context. Cloud Scheduler, Cloud CDN, and Cloud Trace have different operational purposes. VPC Service Controls are therefore relevant when the primary concern is protecting sensitive services against unauthorized data movement.

Question 94

A security team wants to ensure that users receive only the permissions required for their job responsibilities. Which IAM concept should guide the access design?

1. Least privilege
2. Full administrative access
3. Anonymous access
4. Shared credentials

Correct Answer: 1

Explanation

Least privilege is an important IAM principle that requires users and workloads to receive only the permissions necessary to perform their responsibilities. This reduces the potential impact of compromised accounts, accidental actions, and excessive privileges. Security teams should select appropriate predefined or custom roles and scope them as narrowly as practical. Full administrative access provides unnecessary permissions for most users, while anonymous access eliminates meaningful authorization controls. Shared credentials also make accountability and access reviews more difficult. Applying least privilege should be supported by regular IAM reviews, strong authentication, audit logging, and appropriate processes for granting and removing access.

Question 95

A company wants to protect application secrets from being exposed through container images. What should the development team do?

1. Embed passwords directly into the image
2. Store secrets in Secret Manager and retrieve them securely
3. Upload passwords to a public repository
4. Put credentials in application comments

Correct Answer: 2

Explanation

Secrets should not be embedded directly into container images because images can be copied, stored in registries, scanned, or distributed across environments. Secret Manager provides a dedicated service for securely storing sensitive values and controlling which identities can retrieve them. Applications can access secrets at runtime using appropriate authentication and IAM permissions. This approach separates sensitive credentials from application artifacts and makes secret rotation easier. Embedding passwords in images, repositories, or comments can result in accidental disclosure and can be difficult to remediate once an image or source repository has been distributed. Runtime secret retrieval is therefore a safer approach for containerized applications.

Question 96

A security engineer wants to limit access to a sensitive application to users connecting from approved corporate IP ranges. Which capability should be evaluated?

1. Access Context Manager
2. Cloud KMS
3. Cloud Storage
4. Cloud Scheduler

Correct Answer: 1

Explanation

Access Context Manager can define access levels using contextual information such as approved IP subnetworks. These access levels can then be used with supported Google Cloud access controls to require users to meet the organization’s network-location requirements before accessing protected resources. This provides an additional security condition beyond the user’s identity and assigned IAM permissions. Cloud KMS manages cryptographic keys, Cloud Storage provides object storage, and Cloud Scheduler handles scheduled execution. Context-aware access can reduce the risk associated with stolen credentials because an attacker may still be denied if they do not satisfy the required network or contextual conditions.

Question 97

A company needs to monitor and alert on unusual resource behavior using metrics collected from Google Cloud services. Which service is designed for this purpose?

1. Cloud Monitoring
2. Cloud VPN
3. Cloud KMS
4. Secret Manager

Correct Answer: 1

Explanation

Cloud Monitoring collects metrics from Google Cloud resources and supported applications and provides dashboards, alerting policies, and other observability capabilities. Security and operations teams can configure alerts when monitored metrics cross defined thresholds or exhibit unexpected behavior. Monitoring can help identify resource anomalies, availability problems, and patterns that may warrant security investigation. Cloud VPN provides encrypted network connectivity, Cloud KMS manages cryptographic keys, and Secret Manager stores sensitive credentials. Cloud Monitoring should be used together with Cloud Logging and dedicated security detection capabilities because metrics alone may not provide sufficient information for a complete security investigation.

Question 98

An organization wants to ensure that a production project cannot use certain insecure resource configurations even if project administrators attempt to enable them. Which mechanism provides this preventive control?

1. Organization Policy Service
2. Cloud Trace
3. Cloud CDN
4. Cloud SQL

Correct Answer: 1

Explanation

Organization Policy Service provides centralized constraints that can prevent supported configurations from being used across projects and folders. This creates a preventive security control that can stop insecure resource configurations rather than relying solely on detection after deployment. Policies can be applied at higher organizational levels to establish consistent guardrails across many projects. Cloud Trace provides application tracing, Cloud CDN improves content delivery, and Cloud SQL provides managed database services. Organization policies should be carefully tested before broad deployment because restrictive constraints can affect legitimate workloads. Proper policy design, documentation, monitoring, and exception processes help organizations maintain both security and operational requirements.

Question 99

A security engineer discovers that a service account has permissions to access several resources that the workload does not require. What should the engineer do?

1. Add more permissions
2. Remove unnecessary permissions
3. Share the account with more applications
4. Grant the service account Owner access

Correct Answer: 2

Explanation

Unnecessary service account permissions should be removed to follow the principle of least privilege. Excessive permissions increase the potential impact if the service account or the workload using it is compromised. Security teams should review the application’s actual requirements and retain only the roles and permissions needed for legitimate operations. Granting additional privileges or Owner access would increase risk rather than reduce it. Sharing a service account across additional applications also makes accountability more difficult and can expand the blast radius of a compromise. Periodic IAM reviews, permission analysis, audit logs, and workload-specific identities can help organizations continuously reduce unnecessary access.

Question 100

A company wants to protect sensitive information stored in cloud services by discovering where personally identifiable information exists before applying additional controls. Which service should be used?

1. Cloud Router
2. Sensitive Data Protection
3. Cloud NAT
4. Cloud Scheduler

Correct Answer: 2

Explanation

Sensitive Data Protection is designed to inspect supported data sources and identify sensitive information, including patterns associated with personally identifiable information. Discovering and classifying sensitive data helps organizations understand their exposure and determine where stronger access controls, retention policies, encryption, or de-identification may be appropriate. Cloud Router manages dynamic routing, Cloud NAT provides outbound network address translation, and Cloud Scheduler executes scheduled jobs. Sensitive Data Protection can therefore serve as an important part of a broader data security and governance program. Organizations should combine data discovery with appropriate IAM, encryption, monitoring, retention, and data-handling policies to protect sensitive information throughout its lifecycle.