View Full Google Professional Cloud Security Engineer Exam Dumps and Practice Test Dumps.

 

Question 121

A company wants to allow an application to access only one specific Secret Manager secret. Which approach best follows the principle of least privilege?

1. Grant the application Organization Administrator
2. Grant the application access only to the required secret
3. Grant the application Project Owner
4. Grant all users Secret Manager Admin

Correct Answer: 2

Explanation

Granting an application access only to the secret it requires follows the principle of least privilege. The workload should receive the smallest set of permissions necessary to perform its function, preferably at the narrowest practical resource scope. Broad roles such as Organization Administrator or Project Owner provide many unrelated permissions and can significantly increase the impact of a compromised workload. Granting administrative access to every user is also unnecessary and creates additional security risks. Secret Manager supports IAM-based authorization, allowing organizations to control which identities can access individual secrets. Regular permission reviews should also be performed to identify and remove access that is no longer required.

Question 122

A security engineer needs to identify security vulnerabilities and misconfigurations across a Google Cloud environment from a centralized location. Which service should be used?

1. Cloud Scheduler
2. Cloud DNS
3. Security Command Center
4. Cloud NAT

Correct Answer: 3

Explanation

Security Command Center provides centralized visibility into security findings, vulnerabilities, threats, and certain configuration issues across supported Google Cloud environments. This allows security teams to review findings from multiple projects and prioritize remediation without manually checking every individual service. Cloud Scheduler is used to execute scheduled jobs, Cloud DNS manages domain name resolution, and Cloud NAT provides outbound network address translation. Security Command Center can be integrated into a broader security operations process that includes IAM reviews, organization policies, logging, monitoring, and incident response. Centralized visibility is especially useful for large environments where security teams need to identify and prioritize risks across many cloud resources.

Question 123

An organization wants to prevent users from creating resources with external IP addresses unless explicitly permitted. Which control is most suitable?

1. Cloud Trace
2. Organization Policy Service
3. Cloud CDN
4. Cloud SQL

Correct Answer: 2

Explanation

Organization Policy Service provides centralized constraints that can enforce security requirements across projects and folders. Where supported, an appropriate constraint can restrict the use of external IP addresses on cloud resources. This creates a preventive guardrail that can stop insecure configurations from being introduced rather than relying solely on security teams to discover them afterward. Cloud Trace is used for application tracing, Cloud CDN supports content delivery, and Cloud SQL provides managed database services. Organizations should carefully assess workloads before applying restrictive policies because some legitimate services may require external connectivity. Policies should be documented, tested, monitored, and reviewed as infrastructure requirements evolve.

Question 124

A security team wants to detect when an administrator changes the configuration of a production resource. Which capability provides an audit trail for administrative activity?

1. Cloud Audit Logs
2. Cloud CDN
3. Cloud NAT
4. Cloud Storage lifecycle management

Correct Answer: 1

Explanation

Cloud Audit Logs provides records of administrative operations performed against supported Google Cloud resources. These records can help security teams determine which principal performed an operation, when it occurred, and which resource was affected. Audit information is valuable for security investigations, compliance activities, and accountability. Cloud CDN focuses on content delivery, Cloud NAT provides outbound network translation, and Storage lifecycle management controls object retention and deletion. Organizations should configure appropriate log retention and access controls because audit records may contain sensitive information and are important evidence during incident investigations. Centralized analysis can further help correlate administrative actions across multiple services.

Question 125

A company needs an identity mechanism for a GKE workload that avoids relying on the shared identity of the underlying node. Which feature should be configured?

1. Cloud VPN
2. Workload Identity
3. Cloud Scheduler
4. Cloud Router

Correct Answer: 2

Explanation

Workload Identity allows Kubernetes workloads running in GKE to authenticate to Google Cloud services using dedicated identities. This avoids relying on a shared node service account and enables administrators to assign permissions based on the specific workload. Applying separate identities improves least-privilege authorization and can make security auditing more precise. Cloud VPN provides encrypted network connectivity, Cloud Scheduler executes scheduled jobs, and Cloud Router manages dynamic route exchange. Security teams should carefully map Kubernetes service accounts to appropriate Google Cloud identities and grant only the permissions required by each workload. Regular reviews help ensure that workload permissions do not become unnecessarily broad.

Question 126

A company wants to inspect stored data for sensitive information such as financial identifiers and personally identifiable information. Which service should be selected?

1. Cloud NAT
2. Cloud Router
3. Sensitive Data Protection
4. Cloud Scheduler

Correct Answer: 3

Explanation

Sensitive Data Protection provides capabilities for inspecting supported data sources and identifying sensitive information. It can help organizations discover data such as personally identifiable information and other sensitive patterns. This visibility allows security teams to determine where sensitive information exists and apply appropriate access, retention, encryption, or de-identification controls. Cloud NAT handles outbound network address translation, Cloud Router manages dynamic routing, and Cloud Scheduler runs scheduled tasks. Sensitive Data Protection is therefore the appropriate service when the primary requirement is data discovery and classification. Organizations should combine discovery with appropriate governance and access controls to reduce unnecessary exposure of sensitive information.

Question 127

A security engineer wants to reduce the possibility that stolen credentials can be used to access sensitive resources from an untrusted network. Which capability can add network-context requirements to access decisions?

1. Access Context Manager
2. Cloud Storage
3. Cloud SQL
4. Cloud CDN

Correct Answer: 1

Explanation

Access Context Manager allows organizations to define access levels based on contextual attributes such as network location and other supported conditions. These access levels can be used with supported access-control mechanisms to require users to satisfy specific contextual requirements before reaching protected resources. This can provide an additional layer of protection when credentials may have been compromised. Cloud Storage provides object storage, Cloud SQL provides managed database services, and Cloud CDN supports content delivery. Context-aware access should not replace strong authentication or least-privilege IAM. Instead, it can complement those controls by requiring an approved environment or network context in addition to valid identity credentials.

Question 128

An organization needs to encrypt supported resources using cryptographic keys that it manages through Cloud KMS. Which option should be selected?

1. Customer-managed encryption keys
2. Google-managed encryption keys
3. Unencrypted resources
4. Anonymous encryption

Correct Answer: 1

Explanation

Customer-managed encryption keys allow an organization to manage encryption keys through Cloud KMS and use them with supported Google Cloud services. This provides greater control over key lifecycle operations, permissions, rotation, and key versions. IAM can be used to separate key administration from key usage where appropriate. Google-managed keys are managed by Google and require less customer administration, while unencrypted resources do not provide encryption at rest. Anonymous encryption is not an appropriate Google Cloud key-management model. Customer-managed keys are therefore suitable when organizational requirements call for direct control over encryption keys and their lifecycle.

Question 129

A web application needs protection against SQL injection and other malicious HTTP request patterns. Which Google Cloud service should be configured?

1. Cloud Scheduler
2. Cloud KMS
3. Cloud Armor
4. Cloud Router

Correct Answer: 3

Explanation

Cloud Armor provides web application firewall capabilities and security policies for supported Google Cloud application architectures. It can help protect applications from malicious HTTP traffic, including patterns associated with common attacks such as SQL injection. Security teams can define rules to allow, deny, or otherwise control requests based on security requirements. Cloud Scheduler manages scheduled tasks, Cloud KMS manages cryptographic keys, and Cloud Router manages dynamic network routes. Cloud Armor should be deployed as part of a broader application security strategy that also includes secure coding, strong authentication, appropriate IAM, logging, and monitoring. Rules should be tested carefully to reduce false positives and avoid disrupting legitimate users.

Question 130

A security engineer discovers that a service account has excessive permissions that are not required by its workload. What action should be taken?

1. Grant additional roles
2. Share the service account with other workloads
3. Remove unnecessary permissions
4. Assign Organization Owner

Correct Answer: 3

Explanation

Excessive service account permissions should be removed so that the identity has only the access required by its workload. This follows the principle of least privilege and limits the potential impact if the service account or application is compromised. Granting additional roles or assigning broad administrative permissions would increase the attack surface. Sharing the service account across multiple workloads can also make accountability difficult and increase the blast radius of a compromise. Security teams should periodically review service account permissions and compare them with actual workload requirements. Appropriate IAM roles, workload-specific identities, audit logging, and access reviews should be used to maintain a controlled identity environment.

Question 131

A company wants to protect application credentials from accidental exposure in source repositories. Which practice should be implemented?

1. Store credentials in Secret Manager
2. Hard-code credentials in source files
3. Upload credentials to a public repository
4. Put credentials in comments

Correct Answer: 1

Explanation

Secret Manager provides a dedicated service for securely storing application credentials and other sensitive information. Applications can retrieve secrets at runtime using an authorized identity instead of storing passwords or API keys directly in source code. Hard-coded credentials can be accidentally committed to repositories and may remain accessible through version history even after removal. Public repositories create an especially serious exposure risk, while comments are not secure storage mechanisms. Secret Manager can also support secret versions and controlled lifecycle management. Access should be limited to the workloads that require each secret, and organizations should establish appropriate rotation and monitoring processes.

Question 132

A security team wants to prevent sensitive data from leaving a protected Google Cloud service perimeter. Which technology is designed for this purpose?

1. Cloud CDN
2. VPC Service Controls
3. Cloud Scheduler
4. Cloud Trace

Correct Answer: 2

Explanation

VPC Service Controls provide service perimeters around supported Google Cloud services and are designed to help reduce data exfiltration risks. Security teams can establish boundaries around sensitive resources and define conditions under which access between protected and external environments is permitted. This provides an additional security layer beyond IAM. Cloud CDN is focused on content delivery, Cloud Scheduler handles scheduled execution, and Cloud Trace provides application tracing. VPC Service Controls should be carefully designed because legitimate integrations may require appropriate perimeter configurations or access levels. They work best when combined with IAM, logging, monitoring, and other security controls rather than being used as a standalone defense.

Question 133

An organization wants to restrict network access to a Compute Engine workload so that only specific ports and trusted sources are allowed. Which control should be configured?

1. Cloud KMS
2. Secret Manager
3. VPC firewall rules
4. Cloud Scheduler

Correct Answer: 3

Explanation

VPC firewall rules provide network traffic filtering for applicable Google Cloud resources. Security engineers can specify source or destination ranges, protocols, ports, and targets to control which traffic is permitted. This allows organizations to limit workloads to required communication paths and reduce unnecessary exposure. Cloud KMS manages encryption keys, Secret Manager stores sensitive credentials, and Cloud Scheduler runs scheduled operations. Firewall rules should follow application requirements and use the narrowest practical source ranges and ports. Organizations should also monitor firewall-related logs and periodically review rules to remove obsolete access. Network restrictions are most effective when combined with identity-based controls and workload segmentation.

Question 134

A company wants to analyze logs from multiple cloud services during a security investigation. Which Google Cloud service should be used?

1. Cloud Logging
2. Cloud NAT
3. Cloud Router
4. Cloud CDN

Correct Answer: 1

Explanation

Cloud Logging provides centralized collection, storage, search, analysis, and routing of logs from Google Cloud resources and supported applications. During a security investigation, analysts can use logs to examine authentication events, administrative changes, application behavior, and other relevant activity. Centralized logging makes it easier to correlate events across services and establish a timeline of suspicious activity. Cloud NAT provides network address translation, Cloud Router manages dynamic routing, and Cloud CDN handles content delivery. Security teams should configure suitable retention and access controls for logs because security records can contain sensitive information. Centralized logging is an important component of incident response and security monitoring.

Question 135

A company wants to reduce the security risks associated with long-lived service account keys for an external workload. Which solution is most appropriate?

1. Cloud CDN
2. Workload Identity Federation
3. Cloud DNS
4. Cloud Storage ACLs

Correct Answer: 2

Explanation

Workload Identity Federation allows external workloads to authenticate to Google Cloud without maintaining long-lived service account key files. Instead, the external identity can exchange its trusted credentials for short-lived Google Cloud credentials and receive permissions through an associated identity. This reduces the risk associated with leaked, forgotten, or improperly stored service account keys. Cloud CDN provides content delivery, Cloud DNS manages domain resolution, and Cloud Storage ACLs control storage access. Federation is particularly useful when applications operate outside Google Cloud but still need controlled access to Google Cloud services. Appropriate identity mappings and least-privilege IAM permissions should be configured.

Question 136

A security engineer needs to determine which administrator changed an organization’s security configuration. Which source provides the relevant evidence?

1. Cloud CDN logs
2. Cloud Audit Logs
3. Cloud DNS records
4. Cloud Storage lifecycle reports

Correct Answer: 2

Explanation

Cloud Audit Logs provide records of administrative activities performed against supported Google Cloud resources and configurations. These records can help security teams identify the principal associated with a change, determine when it occurred, and understand which resource or configuration was affected. This makes audit logs valuable for investigating unexpected security changes and maintaining accountability. CDN logs focus on content delivery, DNS records concern name resolution, and Storage lifecycle reports describe object management. Audit logs should be protected through appropriate access controls and retained according to security and compliance requirements. Centralized analysis can also help correlate administrative activity across projects and services.

Question 137

A company needs to allow a VM without an external IP address to access supported Google APIs. Which feature should be enabled?

1. Private Google Access
2. Cloud Armor
3. Cloud Scheduler
4. Cloud CDN

Correct Answer: 1

Explanation

Private Google Access allows eligible resources without external IP addresses to access supported Google APIs and services from a VPC network. This can help organizations keep workloads private while still providing access to required Google services. Removing unnecessary external IP addresses can reduce public exposure and support a more controlled network architecture. Cloud Armor provides application protection, Cloud Scheduler handles scheduled tasks, and Cloud CDN improves content delivery. Private Google Access should be configured on the relevant subnet and used alongside IAM, firewall rules, and appropriate routing controls. These additional controls ensure that workloads can reach only the services and destinations required for their functions.

Question 138

A security team wants to identify vulnerabilities in software artifacts before deployment. Which Google Cloud capability should be included in the software supply-chain process?

1. Cloud NAT
2. Cloud Router
3. Artifact Analysis
4. Cloud Scheduler

Correct Answer: 3

Explanation

Artifact Analysis can provide vulnerability information for supported software artifacts, including container images. Including artifact analysis in development and deployment workflows helps security teams identify known vulnerabilities before affected components reach production. Developers can use these findings to update vulnerable dependencies or replace affected components. Cloud NAT provides network address translation, Cloud Router manages dynamic routing, and Cloud Scheduler executes scheduled tasks. Vulnerability analysis should be combined with secure build processes, dependency management, artifact provenance, and deployment controls. A layered software supply-chain security strategy helps organizations identify and address risks earlier instead of discovering them after vulnerable software has been deployed.

Question 139

A company wants to ensure that users accessing sensitive cloud resources meet specific contextual requirements such as approved network location. Which capability should be evaluated?

1. Cloud SQL
2. Access Context Manager
3. Cloud Storage
4. Cloud Router

Correct Answer: 2

Explanation

Access Context Manager provides context-aware access levels that can incorporate conditions such as approved network locations and other supported attributes. These access levels can be applied with supported Google Cloud access controls to require users to meet additional conditions before accessing protected resources. This can help reduce risks associated with stolen credentials because an attacker may be denied if the required context is not satisfied. Cloud SQL provides managed databases, Cloud Storage provides object storage, and Cloud Router manages dynamic routes. Context-aware access should complement strong authentication and least-privilege IAM rather than replace them as the primary identity security mechanisms.

Question 140

A security engineer wants to enforce a policy that prevents users across several projects from creating resources with a prohibited configuration. Which mechanism should be used?

1. Cloud Trace
2. Cloud CDN
3. Organization Policy Service
4. Cloud VPN

Correct Answer: 3

Explanation

Organization Policy Service provides centralized governance and preventive controls across Google Cloud projects and folders. Administrators can use supported constraints to prohibit configurations that conflict with organizational security or compliance requirements. Applying policies at higher organizational levels helps ensure that project administrators cannot independently introduce configurations that violate centrally defined standards. Cloud Trace supports application tracing, Cloud CDN provides content delivery, and Cloud VPN provides encrypted network connectivity. Organization policies should be carefully evaluated and tested before enforcement because they can affect legitimate deployments. A documented exception process and periodic policy review can help maintain an appropriate balance between security requirements and operational needs.