View Full Google Professional Cloud Security Engineer Exam Dumps and Practice Test Dumps.

 

Question 141

A security engineer wants to ensure that a compromised application cannot access secrets belonging to unrelated applications. What is the best approach?

1. Give all applications the same service account
2. Use separate workload identities with narrowly scoped permissions
3. Grant every application Project Owner
4. Store all secrets in application source code

Correct Answer: 2

Explanation

Using separate workload identities with narrowly scoped permissions helps isolate applications and limits access to only the secrets each workload requires. If one application is compromised, the attacker is less likely to gain access to credentials belonging to unrelated workloads. Sharing a service account across applications increases the blast radius of a compromise and makes auditing more difficult. Broad administrative roles also violate least-privilege principles. Secrets should be stored in a dedicated secret-management service rather than application source code. Combining workload-specific identities with resource-level IAM permissions, logging, and regular access reviews provides stronger isolation and improves accountability across cloud workloads.

Question 142

An organization needs to identify suspicious administrative activity across its Google Cloud projects. Which capability should security analysts review?

1. Cloud Audit Logs
2. Cloud CDN
3. Cloud DNS
4. Cloud Scheduler

Correct Answer: 1

Explanation

Cloud Audit Logs provide records of administrative activity and other supported operations performed against Google Cloud resources. Security analysts can review these records to identify unexpected configuration changes, permission modifications, resource creation, and other administrative actions. Audit information can help establish who performed an operation and when it occurred, making it valuable for investigations and accountability. Cloud CDN manages content delivery, Cloud DNS handles name resolution, and Cloud Scheduler executes scheduled tasks. Audit logs should be retained according to organizational requirements and protected from unauthorized access. Combining audit records with monitoring and security findings can provide better visibility into suspicious activity across cloud projects.

Question 143

A company wants to make sure sensitive Cloud Storage buckets cannot accidentally become publicly accessible. Which setting should be considered?

1. Cloud Router
2. Public Access Prevention
3. Cloud Trace
4. Cloud Scheduler

Correct Answer: 2

Explanation

Public Access Prevention helps organizations prevent supported Cloud Storage resources from being exposed through public access. This provides a preventive safeguard against accidental configuration changes that could otherwise make sensitive objects available to unauthenticated users. IAM should still be used to determine which authenticated users and workloads are allowed to access the bucket. Cloud Router manages dynamic routing, Cloud Trace provides application tracing, and Cloud Scheduler handles scheduled tasks. Public Access Prevention is particularly useful for environments where organizational policy requires storage data to remain private. Security teams should also conduct regular IAM reviews and monitor storage activity for unexpected access patterns.

Question 144

A security team needs to allow an application running in GKE to access Google Cloud APIs using a dedicated identity. Which capability is appropriate?

1. Cloud NAT
2. Workload Identity
3. Cloud CDN
4. Cloud Router

Correct Answer: 2

Explanation

Workload Identity allows GKE workloads to authenticate to Google Cloud services using dedicated identities instead of relying on a shared node identity. This enables security teams to assign permissions according to the specific requirements of each workload. A workload can therefore receive only the IAM roles necessary for its function. Cloud NAT handles network address translation, Cloud CDN provides content delivery, and Cloud Router manages dynamic routing. Using workload-specific identities improves isolation and reduces the impact of compromised applications. Security teams should regularly review the permissions associated with workload identities and remove roles that are no longer required.

Question 145

A company wants to inspect data repositories to discover sensitive information before deciding which protection controls are required. Which service is designed for this purpose?

1. Cloud VPN
2. Sensitive Data Protection
3. Cloud Router
4. Cloud CDN

Correct Answer: 2

Explanation

Sensitive Data Protection helps organizations discover and classify sensitive information in supported data sources. Identifying sensitive data before implementing additional controls allows security teams to understand where important information resides and determine whether stronger access restrictions, retention rules, encryption, or de-identification are necessary. Cloud VPN provides encrypted network connectivity, Cloud Router manages dynamic routes, and Cloud CDN supports content delivery. Data discovery is an important component of information security because organizations need visibility into sensitive information before they can effectively manage its exposure. Security teams should combine discovery results with appropriate IAM, data governance, monitoring, and lifecycle-management controls.

Question 146

A security engineer wants to protect an internet-facing application by filtering malicious HTTP traffic before it reaches the backend. Which service should be configured?

1. Cloud Armor
2. Cloud KMS
3. Cloud Storage
4. Cloud Scheduler

Correct Answer: 1

Explanation

Cloud Armor provides security policies and web application firewall capabilities for supported Google Cloud application architectures. It can filter HTTP traffic according to configured rules and help protect applications from common malicious request patterns. Security teams can use policies to manage traffic based on characteristics associated with known threats or organizational requirements. Cloud KMS manages cryptographic keys, Cloud Storage provides object storage, and Cloud Scheduler executes scheduled tasks. Cloud Armor should be combined with secure application development, authentication, authorization, logging, and monitoring. Security rules should also be tested to reduce false positives and ensure that legitimate application traffic continues to operate normally.

Question 147

A company needs centralized control over encryption keys used by supported cloud services. Which service should be used?

1. Cloud Monitoring
2. Cloud Key Management Service
3. Cloud DNS
4. Cloud Scheduler

Correct Answer: 2

Explanation

Cloud Key Management Service provides centralized management of cryptographic keys used by supported Google Cloud services and applications. Security teams can manage key versions, permissions, lifecycle operations, and other key-management activities. IAM can be used to control who can administer keys and who can perform cryptographic operations. Cloud Monitoring provides metrics and alerting, Cloud DNS manages name resolution, and Cloud Scheduler runs scheduled tasks. Centralized key management is useful when organizations require greater control over encryption operations or need to meet specific security and compliance requirements. Key access should be restricted carefully and reviewed periodically.

Question 148

An organization wants to restrict access to sensitive cloud services so that requests must originate from an approved security perimeter. Which technology is appropriate?

1. Cloud Trace
2. VPC Service Controls
3. Cloud Scheduler
4. Cloud CDN

Correct Answer: 2

Explanation

VPC Service Controls can create service perimeters around supported Google Cloud services and help reduce unauthorized data access and exfiltration. A perimeter establishes a boundary around protected resources, while additional access conditions can determine whether requests are allowed to cross that boundary. This provides a layer of protection that complements IAM authorization. Cloud Trace is used for application tracing, Cloud Scheduler handles scheduled jobs, and Cloud CDN supports content delivery. VPC Service Controls should be carefully designed around legitimate application dependencies because overly restrictive boundaries can interfere with required integrations. Logging and monitoring should be used to investigate denied or unexpected access attempts.

Question 149

A security team wants to prevent a developer from creating resources in an unauthorized geographic location. Which capability should be used?

1. Organization Policy Service
2. Cloud NAT
3. Cloud SQL
4. Cloud Trace

Correct Answer: 1

Explanation

Organization Policy Service can provide centralized constraints that restrict supported resource configurations, including location-related requirements. Organizations can use such policies to limit where resources are created and help enforce data residency, compliance, and security requirements. This approach provides preventive governance rather than relying solely on detection after an unauthorized resource has been deployed. Cloud NAT manages outbound network translation, Cloud SQL provides managed database services, and Cloud Trace supports application tracing. Location restrictions should be designed according to business and regulatory requirements, and security teams should review policies regularly to ensure that legitimate workloads can still operate in approved regions.

Question 150

A company wants applications to obtain sensitive credentials at runtime instead of storing them inside container images. Which service should be used?

1. Cloud Router
2. Cloud CDN
3. Secret Manager
4. Cloud VPN

Correct Answer: 3

Explanation

Secret Manager allows applications to retrieve sensitive credentials securely at runtime instead of embedding them in container images or source code. This reduces the chance that passwords, API keys, or other secrets will be exposed through image registries, source repositories, or application artifacts. IAM permissions can restrict which workloads are allowed to retrieve each secret. Cloud Router manages dynamic routing, Cloud CDN supports content delivery, and Cloud VPN provides encrypted connectivity. Using Secret Manager also makes it easier to manage secret versions and rotate credentials without rebuilding application images. Security teams should combine secret management with workload-specific identities and least-privilege access.

Question 151

A security engineer needs to determine whether an unauthorized identity modified an IAM policy. Which information source should be examined first?

1. Cloud Audit Logs
2. Cloud CDN cache statistics
3. Cloud DNS records
4. Cloud Scheduler history

Correct Answer: 1

Explanation

Cloud Audit Logs provide records of administrative activities performed on Google Cloud resources. IAM policy changes are administrative operations that can be investigated using relevant audit records. These logs can help identify the principal associated with a change and provide information about when and where the operation occurred. CDN cache statistics, DNS records, and scheduler history do not normally provide the required identity information for investigating IAM modifications. Audit logs are especially important during security incidents because they can help establish an activity timeline. Organizations should ensure that appropriate logging, retention, and access-control policies are applied to preserve the usefulness of these records.

Question 152

A company wants to allow a VM without an external IP address to communicate with supported Google APIs. Which feature should be enabled on the relevant network configuration?

1. Cloud Armor
2. Private Google Access
3. Cloud Scheduler
4. Cloud CDN

Correct Answer: 2

Explanation

Private Google Access enables resources without external IP addresses to reach supported Google APIs and services through their VPC network. This can help organizations keep workloads private while still allowing them to use required Google Cloud capabilities. Removing unnecessary external IP addresses can reduce public exposure and support a more controlled network architecture. Cloud Armor provides application-layer protection, Cloud Scheduler runs scheduled tasks, and Cloud CDN provides content delivery. Private Google Access should be configured appropriately for the relevant subnet and combined with firewall rules, IAM, and routing controls. These additional controls help ensure that workloads have only the connectivity and permissions they require.

Question 153

A company wants to identify known vulnerabilities in container images stored in its artifact repository. Which capability should be used?

1. Cloud Router
2. Cloud Scheduler
3. Artifact Analysis
4. Cloud NAT

Correct Answer: 3

Explanation

Artifact Analysis can provide vulnerability information for supported container images and software artifacts. Security teams can use these findings to identify known vulnerabilities before affected images are deployed to production. Integrating vulnerability analysis into CI/CD workflows can allow developers to address insecure dependencies earlier in the software lifecycle. Cloud Router manages dynamic routing, Cloud Scheduler executes scheduled tasks, and Cloud NAT provides network address translation. Artifact vulnerability findings should be considered alongside software composition analysis, secure build processes, image provenance, and deployment controls. Regular scanning is important because newly discovered vulnerabilities can affect previously analyzed images.

Question 154

A security team wants to monitor resource metrics and generate notifications when specific conditions occur. Which service provides this capability?

1. Cloud Monitoring
2. Cloud KMS
3. Secret Manager
4. Cloud VPN

Correct Answer: 1

Explanation

Cloud Monitoring collects metrics from Google Cloud resources and supported applications and provides dashboards and alerting capabilities. Security and operations teams can create alerting policies that notify appropriate personnel when defined metric conditions occur. Monitoring can help identify unusual resource behavior, performance issues, availability problems, or signals that require further security investigation. Cloud KMS manages cryptographic keys, Secret Manager protects sensitive credentials, and Cloud VPN provides encrypted network connectivity. Cloud Monitoring should be used alongside Cloud Logging and security-specific detection tools because metrics may indicate that something unusual occurred without providing all the contextual information needed to investigate the event.

Question 155

A company wants to ensure that a service account cannot modify resources outside the application’s required scope. What should the security engineer implement?

1. Broad Owner permissions
2. Resource-scoped IAM permissions
3. Shared administrator credentials
4. Organization-wide unrestricted access

Correct Answer: 2

Explanation

Resource-scoped IAM permissions help limit a service account to the resources it actually needs. This follows the principle of least privilege and reduces the potential impact of a compromised workload. Granting Owner or unrestricted organization-level access gives the identity many permissions that may not be required for normal application operation. Shared administrator credentials also make accountability and credential management more difficult. Security engineers should identify the workload’s exact resource dependencies and assign suitable IAM roles at the narrowest practical scope. Permissions should be reviewed periodically because application requirements can change, leaving previously granted access unnecessary.

Question 156

A company wants to enforce centralized restrictions on cloud resources regardless of individual project administrator preferences. Which service should be used?

1. Cloud Trace
2. Organization Policy Service
3. Cloud CDN
4. Cloud NAT

Correct Answer: 2

Explanation

Organization Policy Service provides centralized governance controls that can apply constraints across projects and folders. This allows organizations to establish security and compliance guardrails that are not dependent on each individual project administrator manually configuring the same settings. Policies can help prevent supported insecure configurations and promote consistent standards across the cloud environment. Cloud Trace provides application tracing, Cloud CDN provides content delivery, and Cloud NAT handles network address translation. Organization policies should be carefully tested and documented before broad enforcement. Security teams should also maintain appropriate review and exception processes for workloads that have legitimate requirements differing from standard configurations.

Question 157

An external application needs temporary access to Google Cloud resources without storing a permanent service account key. Which authentication mechanism should be considered?

1. Workload Identity Federation
2. Publicly accessible credentials
3. Shared service account keys
4. Hard-coded passwords

Correct Answer: 1

Explanation

Workload Identity Federation allows external workloads to obtain temporary Google Cloud credentials without maintaining permanent service account key files. This reduces the risk of credential leakage and makes authentication more manageable for workloads running outside Google Cloud. External identities can be mapped to appropriate Google Cloud identities and assigned narrowly scoped IAM permissions. Public credentials, shared service account keys, and hard-coded passwords introduce unnecessary security risks and make credential rotation and accountability more difficult. Federation should be configured with trusted identity providers and carefully scoped permissions. Security teams should also monitor authentication activity and periodically review the relationships between external identities and Google Cloud resources.

Question 158

A security engineer needs to discover where sensitive information is stored so that data protection policies can be applied appropriately. Which service should be selected?

1. Cloud Router
2. Sensitive Data Protection
3. Cloud Scheduler
4. Cloud NAT

Correct Answer: 2

Explanation

Sensitive Data Protection provides tools for discovering and classifying sensitive information in supported data sources. By identifying where sensitive information exists, organizations can make informed decisions about access restrictions, retention, encryption, de-identification, and other protection mechanisms. Cloud Router handles dynamic routing, Cloud Scheduler executes scheduled tasks, and Cloud NAT manages outbound network address translation. Data discovery is useful because security teams need an accurate understanding of the data environment before they can effectively prioritize protection measures. Sensitive Data Protection should be integrated with broader data governance practices, including IAM, monitoring, lifecycle management, and appropriate handling requirements for sensitive information.

Question 159

A security team wants to reduce the risk that a stolen user credential can be used from an unauthorized location to access sensitive resources. Which capability provides contextual access controls?

1. Cloud SQL
2. Access Context Manager
3. Cloud Storage
4. Cloud Router

Correct Answer: 2

Explanation

Access Context Manager enables organizations to define access levels based on contextual attributes such as network location and other supported conditions. These controls can be used with supported Google Cloud access mechanisms to require users to satisfy additional conditions before reaching protected resources. This can reduce the usefulness of stolen credentials when an attacker cannot satisfy the required context. Cloud SQL provides managed databases, Cloud Storage provides object storage, and Cloud Router manages dynamic routing. Context-aware access is an additional security layer and should be combined with strong authentication, least-privilege IAM, monitoring, and other identity security controls.

Question 160

A company wants to protect an application from common web attacks by applying security rules to incoming HTTP requests. Which service should be deployed?

1. Cloud Scheduler
2. Cloud Armor
3. Cloud KMS
4. Cloud Router

Correct Answer: 2

Explanation

Cloud Armor provides security policies and web application firewall capabilities for supported application architectures. Security teams can create rules that inspect incoming HTTP traffic and manage requests according to defined security requirements. This can help protect applications against common malicious request patterns and other web-based threats. Cloud Scheduler executes scheduled tasks, Cloud KMS manages cryptographic keys, and Cloud Router handles dynamic routing. Cloud Armor should be combined with secure application development, authentication, authorization, and monitoring. Security rules should be regularly reviewed and updated because attack patterns change over time, while overly broad rules can potentially interfere with legitimate application traffic.