View Full Google Professional Cloud Security Engineer Exam Dumps and Practice Test Dumps.

 

Question 101

A security engineer needs to allow a Compute Engine workload to access Google Cloud resources without storing a service account key on the VM. Which approach should be used?

1. Store a key in the VM startup script
2. Use an attached service account with appropriate IAM permissions
3. Use a shared administrator password
4. Store credentials in Cloud Storage

Correct Answer: 2

Explanation

A Compute Engine instance can use an attached service account to obtain credentials without requiring a long-lived service account key to be stored on the VM. The service account should have only the IAM permissions necessary for the workload. This approach reduces credential-management risks and supports automated authentication. Storing keys in startup scripts or Cloud Storage introduces additional exposure risks because credentials can potentially be accessed by unauthorized users or systems. Shared administrator passwords are also inappropriate for workload authentication because they weaken accountability and access control. Using an appropriately scoped service account provides a more secure identity model for applications running directly on Google Cloud infrastructure.

Question 102

An organization wants to prevent sensitive data stored in a Google Cloud service from being accessed from unauthorized external environments. Which security control can help establish this boundary?

1. Cloud CDN
2. Cloud Scheduler
3. VPC Service Controls
4. Cloud Trace

Correct Answer: 3

Explanation

VPC Service Controls can establish service perimeters around supported Google Cloud services and help reduce the risk of unauthorized data movement. Security teams can define boundaries and access conditions around sensitive resources, providing an additional security layer beyond IAM. This is useful when an organization wants to reduce the possibility that legitimate credentials could be misused to access or move sensitive data from an unauthorized context. Cloud CDN focuses on content delivery, Cloud Scheduler manages scheduled tasks, and Cloud Trace supports application tracing. VPC Service Controls should be implemented alongside IAM and other controls rather than treated as a replacement for identity-based authorization.

Question 103

A company wants to ensure that employees cannot create resources outside approved Google Cloud regions. Which control should be configured?

1. Organization Policy Service
2. Cloud NAT
3. Cloud Logging
4. Cloud Armor

Correct Answer: 1

Explanation

Organization Policy Service provides centralized constraints that can be applied across projects and folders. Location-based organization policies can restrict supported resources to approved regions or locations. This can help organizations meet regulatory, data residency, security, and operational requirements. Cloud NAT provides outbound network translation, Cloud Logging collects and manages logs, and Cloud Armor protects supported applications from malicious traffic. Organization policies are particularly useful because they provide preventive governance, meaning users can be prevented from creating certain configurations instead of security teams discovering the problem afterward. Policies should be tested and reviewed regularly to ensure that legitimate workloads remain compatible with organizational requirements.

Question 104

A security analyst needs to determine who modified a firewall rule in a production project. Which source should be investigated?

1. Cloud CDN cache logs
2. Cloud Storage lifecycle events
3. Cloud Audit Logs
4. Cloud DNS records

Correct Answer: 3

Explanation

Cloud Audit Logs provide records of administrative activities performed against Google Cloud resources. Changes to firewall configurations can be investigated using relevant audit records, which may identify the principal that performed the operation, the affected resource, and the time of the change. This information is valuable for incident response, compliance investigations, and accountability. CDN cache logs describe content delivery activity, Storage lifecycle events concern object management, and DNS records describe name-resolution configuration. Security teams should maintain appropriate audit-log retention and access controls so that these records remain available and trustworthy when investigating unexpected administrative changes.

Question 105

A developer needs to retrieve an API credential from Google Cloud without embedding it directly in application code. Which service should be used?

1. Cloud Router
2. Cloud Storage
3. Secret Manager
4. Cloud CDN

Correct Answer: 3

Explanation

Secret Manager is designed to securely store sensitive information such as API credentials, passwords, certificates, and other secrets. Applications can retrieve secret values at runtime when their identities have the required IAM permissions. This avoids placing credentials directly in source code, configuration files, or container images where they could be accidentally exposed. Cloud Router manages dynamic network routes, Cloud Storage provides object storage, and Cloud CDN accelerates content delivery. Secret Manager also supports secret versions, allowing organizations to implement controlled updates and rotation procedures. Access should be limited to the workloads that genuinely require each secret, following the principle of least privilege.

Question 106

A company wants to protect an internet-facing application against malicious HTTP requests and common web attacks. Which Google Cloud service is appropriate?

1. Cloud KMS
2. Cloud Armor
3. Cloud SQL
4. Cloud Scheduler

Correct Answer: 2

Explanation

Cloud Armor provides security policies and web application firewall capabilities for supported Google Cloud application architectures. It can help identify and manage malicious HTTP traffic and protect applications against common web attacks. Security teams can create rules that allow, deny, or otherwise control requests based on defined security requirements. Cloud KMS manages cryptographic keys, Cloud SQL provides managed relational databases, and Cloud Scheduler runs scheduled jobs. Cloud Armor should be configured carefully so that legitimate application traffic is not unnecessarily blocked. Combining application-layer protection with secure coding, authentication, IAM, logging, and monitoring provides stronger defense for internet-facing applications.

Question 107

A security team needs to identify sensitive information such as personally identifiable information across supported cloud data sources. Which service should they use?

1. Cloud NAT
2. Cloud Router
3. Sensitive Data Protection
4. Cloud Scheduler

Correct Answer: 3

Explanation

Sensitive Data Protection provides capabilities for inspecting supported data sources and identifying sensitive information. It can detect patterns associated with various types of sensitive data, including personally identifiable information. This helps organizations understand where sensitive information exists so they can apply appropriate access controls, retention policies, encryption, or de-identification techniques. Cloud NAT manages outbound network address translation, Cloud Router handles dynamic routing, and Cloud Scheduler executes scheduled jobs. Data discovery is an important part of a security program because organizations need visibility into sensitive information before they can effectively manage its exposure and apply appropriate protection measures.

Question 108

An organization wants to grant a user permission to view resources without allowing the user to modify them. Which IAM approach is most appropriate?

1. Grant a suitable read-only role
2. Grant Project Owner
3. Grant Organization Administrator
4. Grant unrestricted Editor access

Correct Answer: 1

Explanation

A suitable read-only IAM role provides the user with the permissions needed to inspect resources while avoiding unnecessary modification privileges. This follows the principle of least privilege and reduces the potential impact of mistakes or compromised credentials. Broad roles such as Owner, Organization Administrator, or unrestricted Editor provide substantially more access than required for a viewing-only task. Security teams should select predefined roles where they adequately meet the requirement and scope the role to the appropriate resource whenever practical. Regular access reviews should also be performed to identify permissions that are no longer necessary and remove them promptly.

Question 109

A company wants to centrally identify security findings from multiple Google Cloud projects. Which service provides this capability?

1. Cloud DNS
2. Security Command Center
3. Cloud SQL
4. Cloud Storage

Correct Answer: 2

Explanation

Security Command Center provides centralized visibility into security findings across supported Google Cloud environments. It can help security teams identify vulnerabilities, threats, misconfigurations, and other security issues affecting resources across projects. Centralized security findings make it easier to investigate and prioritize issues rather than reviewing every project independently. Cloud DNS manages domain name services, Cloud SQL provides managed relational databases, and Cloud Storage provides object storage. Security Command Center can be used alongside IAM, organization policies, logging, and monitoring to create a broader cloud security management process and improve visibility into the organization’s security posture.

Question 110

A security engineer wants a workload running outside Google Cloud to authenticate without maintaining a long-lived service account key. Which solution is recommended?

1. Cloud CDN
2. Cloud Storage ACLs
3. Workload Identity Federation
4. Public IP authentication

Correct Answer: 3

Explanation

Workload Identity Federation allows external workloads to obtain short-lived Google Cloud credentials without requiring long-lived service account key files. This reduces the risk associated with leaked or improperly managed credentials and supports more secure authentication for workloads running outside Google Cloud. The external identity can be mapped to an appropriate Google Cloud identity with narrowly scoped permissions. Cloud CDN is a content delivery service, Storage ACLs control object access, and public IP addresses do not provide secure workload authentication. Federation is therefore an appropriate solution when external applications need controlled access to Google Cloud resources without distributing persistent service account keys.

Question 111

An organization wants to restrict which users or workloads can use a cryptographic key for encryption and decryption operations. Which control should be configured?

1. Cloud CDN policies
2. IAM permissions on the KMS key
3. DNS routing rules
4. Cloud Scheduler jobs

Correct Answer: 2

Explanation

Cloud KMS uses IAM permissions to control which identities can administer keys and which identities can perform supported cryptographic operations. Security teams should grant only the permissions required by each identity and consider separating key administration from key usage where appropriate. This helps prevent unauthorized users or workloads from using sensitive cryptographic keys. Cloud CDN policies manage content delivery, DNS routing controls name resolution and network behavior, and Cloud Scheduler manages scheduled execution. IAM permissions on KMS resources therefore provide the primary authorization mechanism for controlling access to cryptographic key operations.

Question 112

A security team wants to prevent users from assigning public access to sensitive Cloud Storage resources. Which feature should be considered?

1. Cloud Trace
2. Public Access Prevention
3. Cloud Router
4. Cloud Scheduler

Correct Answer: 2

Explanation

Public Access Prevention helps prevent Cloud Storage resources from being exposed through public access configurations. This is useful for organizations that require sensitive or confidential storage data to remain private. By preventing public principals from being granted access, the feature provides a preventive safeguard against certain accidental exposure scenarios. Cloud Trace is used for application tracing, Cloud Router manages dynamic routing, and Cloud Scheduler runs scheduled jobs. Public Access Prevention should still be combined with IAM controls because preventing public access does not determine which authenticated users or workloads are allowed to access the data. Regular permission reviews remain important for maintaining secure storage configurations.

Question 113

A company wants to restrict network traffic reaching a Compute Engine instance based on source IP ranges and ports. Which control should be used?

1. Secret Manager
2. Cloud KMS
3. VPC firewall rules
4. Cloud Scheduler

Correct Answer: 3

Explanation

VPC firewall rules allow organizations to control network traffic to and from applicable Google Cloud resources. Rules can use attributes such as source or destination ranges, protocols, and ports to determine which traffic should be allowed or denied. This makes firewall rules an important component of network segmentation and workload protection. Secret Manager protects application secrets, Cloud KMS manages cryptographic keys, and Cloud Scheduler executes scheduled operations. Firewall policies should follow application requirements and avoid unnecessary open ports or broad source ranges. Logging and monitoring should also be used to identify unusual traffic and verify that firewall configurations continue to meet security requirements.

Question 114

A security engineer wants to require access to a sensitive resource only when users connect from an approved corporate network. Which capability can support this requirement?

1. Access Context Manager
2. Cloud SQL
3. Cloud Storage Transfer Service
4. Cloud CDN

Correct Answer: 1

Explanation

Access Context Manager supports context-aware access levels that can include network-based conditions such as approved IP subnetworks. These access levels can be applied with supported Google Cloud access mechanisms to require users to meet defined contextual conditions. This provides an additional layer of protection when identity authentication alone is not considered sufficient. Cloud SQL provides managed databases, Storage Transfer Service moves data between supported locations, and Cloud CDN provides content delivery capabilities. Requiring access from an approved network can reduce exposure from stolen credentials, although organizations should combine contextual access with strong authentication and least-privilege IAM rather than relying on network location as the only security control.

Question 115

An organization wants to prevent resource configurations that violate centrally defined security requirements across multiple projects. Which service should be used?

1. Cloud Monitoring
2. Organization Policy Service
3. Cloud NAT
4. Cloud Trace

Correct Answer: 2

Explanation

Organization Policy Service provides centralized constraints that can be applied across projects and folders. These constraints can enforce supported organizational requirements and prevent certain resource configurations from being used. This creates preventive security guardrails and helps reduce configuration inconsistencies between projects. Cloud Monitoring provides metrics and alerting, Cloud NAT manages outbound address translation, and Cloud Trace provides application tracing. Organization policies should be carefully designed and tested because restrictive policies can affect legitimate workloads. Security teams should also document policy requirements and establish appropriate processes for reviewing policy changes and handling legitimate exceptions.

Question 116

A company wants to reduce the risk of a compromised workload moving laterally to unrelated systems within the cloud environment. Which architecture principle is most relevant?

1. Network segmentation
2. Public IP assignment
3. Shared service accounts
4. Unrestricted firewall rules

Correct Answer: 1

Explanation

Network segmentation divides environments and workloads into controlled network zones and restricts unnecessary communication between them. This can limit lateral movement if an attacker compromises one workload because the compromised system may not have network connectivity to unrelated or sensitive resources. Segmentation can be implemented using VPC networks, subnets, firewall rules, and other network security controls. Public IP assignment and unrestricted firewall rules can increase exposure, while shared service accounts create broader identity risks. Effective segmentation should be based on actual application communication requirements and supported by identity-based access controls, monitoring, and regular firewall-policy reviews.

Question 117

A security team discovers that an administrator unexpectedly changed IAM permissions on a production resource. What should the team examine to identify the responsible identity?

1. Cloud Audit Logs
2. Cloud CDN cache status
3. Cloud DNS records
4. Cloud Storage lifecycle configuration

Correct Answer: 1

Explanation

Cloud Audit Logs can provide records of administrative operations performed on Google Cloud resources. Relevant audit entries can help investigators determine which principal performed an IAM-related change, what resource was affected, and when the operation occurred. This information supports incident investigation and accountability. CDN cache information, DNS records, and Storage lifecycle configurations do not normally provide the necessary evidence for determining which identity modified an IAM policy. Security teams should ensure that audit logs are appropriately retained and protected because attackers who gain administrative access may attempt to conceal activity. Centralized log analysis can further improve investigation capabilities.

Question 118

A company wants to identify vulnerable software components in container images before deployment. Which capability should be integrated into its security process?

1. Cloud Router
2. Artifact Analysis
3. Cloud NAT
4. Cloud Scheduler

Correct Answer: 2

Explanation

Artifact Analysis can provide vulnerability information for supported container images and other software artifacts. Integrating artifact vulnerability analysis into development and CI/CD workflows helps teams identify known vulnerabilities before affected software reaches production. Security teams can use these findings to determine whether components should be updated, replaced, or otherwise addressed. Cloud Router manages dynamic routing, Cloud NAT provides network address translation, and Cloud Scheduler runs scheduled tasks. Vulnerability scanning is most effective when combined with dependency management, secure build practices, image provenance, and deployment controls that prevent unacceptable artifacts from reaching production environments.

Question 119

A security engineer wants to reduce the use of permanent credentials by applications running in Google Cloud. Which approach should be preferred?

1. Store permanent keys in source code
2. Share one service account key across applications
3. Use workload identities and short-lived credentials
4. Give every application Owner permissions

Correct Answer: 3

Explanation

Workload identities and short-lived credentials reduce the need for applications to maintain permanent authentication secrets. This approach limits the period during which credentials remain valid and can provide more granular identity and authorization controls. Sharing one service account key across multiple applications increases the potential blast radius of a compromise and makes auditing more difficult. Storing permanent keys in source code creates significant credential exposure risks, while Owner permissions provide unnecessary access. Organizations should use workload-specific identities wherever possible and combine them with least-privilege IAM, logging, monitoring, and regular permission reviews to maintain strong application security.

Question 120

A company wants to monitor metrics from cloud resources and automatically notify administrators when defined conditions occur. Which service should be configured?

1. Cloud KMS
2. Secret Manager
3. Cloud VPN
4. Cloud Monitoring

Correct Answer: 4

Explanation

Cloud Monitoring collects metrics from Google Cloud resources and supported applications and provides dashboards and alerting capabilities. Security and operations teams can define alerting policies that trigger when monitored metrics meet specified conditions. This can help identify unusual resource behavior, availability problems, capacity issues, and signals that may require further security investigation. Cloud KMS manages cryptographic keys, Secret Manager protects sensitive credentials, and Cloud VPN provides encrypted network connectivity. Cloud Monitoring should be combined with Cloud Logging and dedicated security detection capabilities when investigating security events because metrics alone may not provide sufficient detail about the underlying activity.