{"id":19623,"date":"2026-09-23T06:43:51","date_gmt":"2026-09-23T06:43:51","guid":{"rendered":"https:\/\/www.examlabs.com\/certification\/?p=19623"},"modified":"2026-09-23T06:43:51","modified_gmt":"2026-09-23T06:43:51","slug":"google-professional-cloud-security-engineer-practice-test-questions-and-exam-dumps-part19-q361-380","status":"publish","type":"post","link":"https:\/\/www.examlabs.com\/certification\/google-professional-cloud-security-engineer-practice-test-questions-and-exam-dumps-part19-q361-380\/","title":{"rendered":"Google Professional Cloud Security Engineer Practice Test Questions and Exam Dumps Part19 Q361-380"},"content":{"rendered":"

View Full <\/b>Google Professional Cloud Security Engineer Exam Dumps<\/b><\/a> and Practice Test Dumps.<\/b><\/h2>\n

 <\/p>\n

Question 361<\/b><\/h3>\n

A security administrator wants to prevent a user from accessing resources outside a defined set of projects, even when the user has broad IAM permissions. Which capability should be considered?<\/b><\/p>\n

    \n
  1. Cloud Armor<\/span><\/li>\n
  2. Principal Access Boundary<\/span><\/li>\n
  3. Cloud NAT<\/span><\/li>\n
  4. Cloud DNS<\/span><\/li>\n<\/ol>\n

    Correct Answer: 2<\/b><\/p>\n

    Explanation<\/b><\/p>\n

    Principal Access Boundary policies can define the maximum resource scope within which a principal can exercise its permissions. This provides an additional restriction when an identity has broad IAM access but should not be able to operate on resources outside an approved boundary. The boundary does not grant permissions; the principal must still receive appropriate permissions through IAM. This separation helps organizations combine access grants with resource-level restrictions. Security teams should carefully define boundaries, test legitimate workflows, and review them regularly. Principal Access Boundaries can be particularly useful for limiting the potential impact of compromised or overprivileged identities.<\/span><\/p>\n

    Question 362<\/b><\/h3>\n

    A company wants to provide temporary administrative access to a production environment without permanently assigning the administrator a highly privileged role. Which approach is most appropriate?<\/b><\/p>\n

      \n
    1. Grant Owner permanently<\/span><\/li>\n
    2. Use temporary or conditional IAM access<\/span><\/li>\n
    3. Make the project public<\/span><\/li>\n
    4. Share a service account key<\/span><\/li>\n<\/ol>\n

      Correct Answer: 2<\/b><\/p>\n

      Explanation<\/b><\/p>\n

      Temporary or conditional IAM access can reduce the amount of time a highly privileged identity retains access to sensitive resources. Organizations can use appropriate IAM mechanisms to grant permissions only when required and restrict their use through conditions where supported. This supports least privilege and reduces the potential impact of compromised administrative credentials. Permanent Owner-level access should generally be avoided when a narrower role is sufficient. Security teams should document emergency-access procedures, monitor privileged activity, and regularly review administrative permissions. Temporary privilege elevation is particularly useful for production environments where administrative access should be tightly controlled.<\/span><\/p>\n

      Question 363<\/b><\/h3>\n

      A security team wants to separate the responsibilities of managing encryption keys from using those keys for cryptographic operations. Which principle should be implemented?<\/b><\/p>\n

        \n
      1. Separation of duties<\/span><\/li>\n
      2. Public access<\/span><\/li>\n
      3. Shared administration<\/span><\/li>\n
      4. Unrestricted IAM<\/span><\/li>\n<\/ol>\n

        Correct Answer: 1<\/b><\/p>\n

        Explanation<\/b><\/p>\n

        Separation of duties reduces the risk associated with giving one identity complete control over a sensitive process. In Cloud KMS, organizations can separate key administration from cryptographic usage by assigning different IAM roles to different identities. For example, an administrator may manage key configuration while an application receives only the permissions required to encrypt or decrypt data. This reduces the risk of unauthorized key modification or destruction by application identities. Security teams should document responsibilities and periodically review permissions. Separation of duties is particularly important for highly sensitive encryption keys and regulated workloads.<\/span><\/p>\n

        Question 364<\/b><\/h3>\n

        A company wants to protect a service account from unauthorized use by requiring workloads to authenticate through an approved identity mechanism rather than using a downloaded private key. Which approach is preferable?<\/b><\/p>\n

          \n
        1. Workload identity<\/span><\/li>\n
        2. Public bucket access<\/span><\/li>\n
        3. Shared password<\/span><\/li>\n
        4. Permanent JSON key<\/span><\/li>\n<\/ol>\n

          Correct Answer: 1<\/b><\/p>\n

          Explanation<\/b><\/p>\n

          Workload identity mechanisms allow applications to authenticate using managed or federated identities instead of long-lived private keys. This reduces the risk associated with storing service account keys in source code, container images, virtual machines, or configuration files. Workloads can receive short-lived credentials according to their identity and configured permissions. Security teams should ensure that the workload-to-identity mapping is tightly controlled and that the associated service account has only the permissions required by the application. Monitoring authentication activity and periodically reviewing workload identity configuration are also important. Identity-based authentication is generally easier to manage securely than unmanaged long-lived credentials.<\/span><\/p>\n

          Question 365<\/b><\/h3>\n

          A security engineer needs to authenticate an external workload running outside Google Cloud using an existing identity provider. Which capability avoids storing a Google Cloud service account key?<\/b><\/p>\n

            \n
          1. Workload Identity Federation<\/span><\/li>\n
          2. Cloud NAT<\/span><\/li>\n
          3. Cloud DNS<\/span><\/li>\n
          4. VPC Flow Logs<\/span><\/li>\n<\/ol>\n

            Correct Answer: 1<\/b><\/p>\n

            Explanation<\/b><\/p>\n

            Workload Identity Federation allows external workloads to use trusted identities from supported identity providers to obtain short-lived Google Cloud credentials. This eliminates the need to distribute long-lived service account keys to workloads running outside Google Cloud. Administrators configure a trust relationship and determine which external identities can access specific Google Cloud resources. Attribute mappings and IAM permissions should be narrowly defined to prevent unauthorized identities from gaining access. Federation configuration should also be monitored and periodically reviewed. This approach is useful for workloads running in other cloud platforms, on-premises environments, or external identity systems.<\/span><\/p>\n

            Question 366<\/b><\/h3>\n

            A company wants to detect sensitive data stored in cloud resources and understand where personally identifiable information may exist. Which service can help discover and classify sensitive information?<\/b><\/p>\n

              \n
            1. Sensitive Data Protection<\/span><\/li>\n
            2. Cloud NAT<\/span><\/li>\n
            3. Cloud Scheduler<\/span><\/li>\n
            4. Cloud Router<\/span><\/li>\n<\/ol>\n

              Correct Answer: 1<\/b><\/p>\n

              Explanation<\/b><\/p>\n

              Sensitive Data Protection can help organizations discover, classify, and protect sensitive information across supported data sources. It can identify information types such as personally identifiable information and other sensitive data patterns using configured inspection methods. Discovery and classification can help security teams understand where sensitive information exists and determine whether additional controls are necessary. The service can also support data transformation and de-identification use cases. Security teams should combine sensitive-data discovery with IAM, encryption, retention, monitoring, and data-governance policies. Automated discovery is valuable because sensitive information can be distributed across many datasets and storage locations.<\/span><\/p>\n

              Question 367<\/b><\/h3>\n

              A security team wants to prevent sensitive data from leaving a controlled Google Cloud environment through supported managed services. Which control is designed specifically to address data exfiltration risks?<\/b><\/p>\n

                \n
              1. VPC Service Controls<\/span><\/li>\n
              2. Cloud Scheduler<\/span><\/li>\n
              3. Cloud DNS<\/span><\/li>\n
              4. Cloud NAT<\/span><\/li>\n<\/ol>\n

                Correct Answer: 1<\/b><\/p>\n

                Explanation<\/b><\/p>\n

                VPC Service Controls can establish security perimeters around supported Google Cloud services and help reduce certain data exfiltration risks. The perimeter provides a separate security boundary from IAM, meaning that possessing valid IAM permissions does not automatically allow access across a restricted perimeter. Organizations can define protected projects and services and configure approved access paths. Security teams should carefully test service dependencies before enforcing a perimeter because legitimate applications may require communication across boundaries. VPC Service Controls should be combined with IAM, network security, logging, and data classification to provide layered protection for sensitive information.<\/span><\/p>\n

                Question 368<\/b><\/h3>\n

                A company wants to monitor security findings, vulnerabilities, and potential threats from a centralized Google Cloud security platform. Which service should be used?<\/b><\/p>\n

                  \n
                1. Security Command Center<\/span><\/li>\n
                2. Cloud NAT<\/span><\/li>\n
                3. Cloud DNS<\/span><\/li>\n
                4. Cloud Scheduler<\/span><\/li>\n<\/ol>\n

                  Correct Answer: 1<\/b><\/p>\n

                  Explanation<\/b><\/p>\n

                  Security Command Center provides centralized security visibility and can aggregate findings related to vulnerabilities, misconfigurations, threats, and other security issues depending on the enabled capabilities and services. Security teams can use the findings to investigate risks and prioritize remediation. Security Command Center can integrate information from capabilities such as Security Health Analytics and Event Threat Detection. It should not be considered a replacement for all security monitoring because application, identity, and network-specific controls may still be required. Organizations should establish processes for triaging findings, assigning ownership, tracking remediation, and validating that important issues have been resolved.<\/span><\/p>\n

                  Question 369<\/b><\/h3>\n

                  A security administrator wants to restrict inbound traffic to a VM so that only approved sources and ports can connect. Which Google Cloud control should be configured?<\/b><\/p>\n

                    \n
                  1. VPC firewall rules<\/span><\/li>\n
                  2. Cloud Scheduler<\/span><\/li>\n
                  3. Cloud DNSSEC<\/span><\/li>\n
                  4. Cloud Storage lifecycle rules<\/span><\/li>\n<\/ol>\n

                    Correct Answer: 1<\/b><\/p>\n

                    Explanation<\/b><\/p>\n

                    VPC firewall rules control network traffic to and from resources in a VPC according to configured criteria such as direction, protocol, port, source, destination, and target. Restricting inbound traffic to only the required sources and ports supports network least privilege. Administrators should avoid broad rules such as allowing unrestricted traffic from the internet unless there is a specific business requirement. Firewall rules should be reviewed periodically and combined with identity-based access controls. Logging can also help identify unexpected connection attempts. Properly configured firewall policies can reduce the attack surface of workloads by limiting unnecessary network exposure.<\/span><\/p>\n

                    Question 370<\/b><\/h3>\n

                    A company wants to apply centralized firewall controls across several folders and projects. Which capability should the security team use?<\/b><\/p>\n

                      \n
                    1. Hierarchical firewall policies<\/span><\/li>\n
                    2. Cloud NAT<\/span><\/li>\n
                    3. Cloud DNS<\/span><\/li>\n
                    4. Cloud Scheduler<\/span><\/li>\n<\/ol>\n

                      Correct Answer: 1<\/b><\/p>\n

                      Explanation<\/b><\/p>\n

                      Hierarchical firewall policies allow organizations to establish firewall controls at higher levels of the Google Cloud resource hierarchy. Policies can be associated with an organization or folder and can provide consistent security requirements across multiple projects. This centralized approach can reduce configuration drift and make it easier to enforce common network security standards. Administrators should carefully understand policy inheritance and rule evaluation before deployment. Exceptions should be narrowly defined and documented. Hierarchical firewall policies complement other firewall configurations and should be combined with network segmentation, workload identity, IAM, monitoring, and application-level authorization.<\/span><\/p>\n

                      Question 371<\/b><\/h3>\n

                      A security team wants to reduce the risk of internet-based attacks against a public web application deployed behind a Google Cloud load balancer. Which service provides web application protection capabilities?<\/b><\/p>\n

                        \n
                      1. Cloud Armor<\/span><\/li>\n
                      2. Cloud Scheduler<\/span><\/li>\n
                      3. Cloud NAT<\/span><\/li>\n
                      4. Cloud DNS<\/span><\/li>\n<\/ol>\n

                        Correct Answer: 1<\/b><\/p>\n

                        Explanation<\/b><\/p>\n

                        Cloud Armor provides security capabilities for applications deployed behind supported Google Cloud load balancing architectures. Security policies can control traffic based on supported request characteristics and can provide protections against various application and network threats. Cloud Armor can also support rate-limiting and other traffic-management security controls. It should be combined with secure application development, strong authentication, TLS, IAM, and monitoring. A web application firewall does not eliminate vulnerabilities in application code. Security teams should regularly review Cloud Armor policies and monitor security events to identify changes in attack patterns and legitimate traffic behavior.<\/span><\/p>\n

                        Question 372<\/b><\/h3>\n

                        A company wants to control excessive requests to an internet-facing application to reduce abuse and resource exhaustion. Which Cloud Armor capability is appropriate?<\/b><\/p>\n

                          \n
                        1. Rate limiting<\/span><\/li>\n
                        2. Cloud DNS forwarding<\/span><\/li>\n
                        3. Cloud NAT<\/span><\/li>\n
                        4. Cloud Scheduler<\/span><\/li>\n<\/ol>\n

                          Correct Answer: 1<\/b><\/p>\n

                          Explanation<\/b><\/p>\n

                          Cloud Armor rate limiting can help control excessive requests to protected applications based on configured policies and supported request attributes. Rate limiting can reduce abuse and help protect application resources from unusually high request volumes. Security teams should establish thresholds based on normal application behavior because overly aggressive limits can block legitimate users. Rate limiting should complement other Cloud Armor rules, application authentication, autoscaling, and monitoring. It is not a substitute for secure application design or comprehensive denial-of-service protection. Administrators should review traffic patterns regularly and adjust policies when application usage changes.<\/span><\/p>\n

                          Question 373<\/b><\/h3>\n

                          A security engineer wants to detect unexpected changes to a VM or cloud resource configuration over time. Which service can provide resource inventory information that supports this investigation?<\/b><\/p>\n

                            \n
                          1. Cloud Asset Inventory<\/span><\/li>\n
                          2. Cloud NAT<\/span><\/li>\n
                          3. Cloud DNS<\/span><\/li>\n
                          4. Cloud Scheduler<\/span><\/li>\n<\/ol>\n

                            Correct Answer: 1<\/b><\/p>\n

                            Explanation<\/b><\/p>\n

                            Cloud Asset Inventory provides information about supported Google Cloud resources and their metadata. Security teams can use asset information to investigate resource configurations and understand what assets exist within an organization. When combined with audit logs and other monitoring data, asset inventory can help identify when resources were changed and investigate the identity responsible for the operation. This is useful for detecting configuration drift and supporting incident response. Organizations should maintain appropriate access controls around asset information and integrate inventory data into their governance processes. Asset visibility is an important foundation for identifying security-relevant changes in large cloud environments.<\/span><\/p>\n

                            Question 374<\/b><\/h3>\n

                            A security team wants to maintain evidence of administrative changes to IAM policies for later investigation. Which audit log category is most relevant?<\/b><\/p>\n

                              \n
                            1. Admin Activity audit logs<\/span><\/li>\n
                            2. Cloud NAT logs<\/span><\/li>\n
                            3. Cloud DNS logs<\/span><\/li>\n
                            4. Cloud Scheduler logs<\/span><\/li>\n<\/ol>\n

                              Correct Answer: 1<\/b><\/p>\n

                              Explanation<\/b><\/p>\n

                              Admin Activity audit logs record administrative operations performed on Google Cloud resources. Changes to IAM policies and other administrative configurations can be captured through these logs for supported services and operations. Security teams can use them to determine who performed a change and when it occurred. Audit logs should be protected from unauthorized modification and retained according to organizational and regulatory requirements. Administrators can correlate audit events with Cloud Asset Inventory, Security Command Center findings, and other telemetry during investigations. Monitoring privileged administrative activity is especially important because unauthorized IAM changes can grant attackers additional access.<\/span><\/p>\n

                              Question 375<\/b><\/h3>\n

                              A company needs to route security logs from multiple projects into a central BigQuery dataset for analysis. Which configuration is most suitable?<\/b><\/p>\n

                                \n
                              1. Aggregated log sink<\/span><\/li>\n
                              2. Cloud NAT<\/span><\/li>\n
                              3. Cloud DNSSEC<\/span><\/li>\n
                              4. Cloud Scheduler<\/span><\/li>\n<\/ol>\n

                                Correct Answer: 1<\/b><\/p>\n

                                Explanation<\/b><\/p>\n

                                An aggregated log sink can collect selected logs across multiple projects under an organization or folder and route them to a centralized destination such as BigQuery. This simplifies security analytics by allowing teams to query relevant events from a common location. Security administrators should define appropriate log filters to avoid collecting unnecessary data and should protect the destination dataset using restrictive IAM permissions. Retention and cost considerations should also be evaluated. Centralized log analysis can help identify patterns across projects that might be difficult to detect when logs remain isolated within individual project environments.<\/span><\/p>\n

                                Question 376<\/b><\/h3>\n

                                A security administrator wants to send selected audit events to a system that can process them automatically as they arrive. Which Cloud Logging destination is appropriate?<\/b><\/p>\n

                                  \n
                                1. Pub\/Sub<\/span><\/li>\n
                                2. Cloud DNS<\/span><\/li>\n
                                3. Cloud NAT<\/span><\/li>\n
                                4. Cloud Scheduler<\/span><\/li>\n<\/ol>\n

                                  Correct Answer: 1<\/b><\/p>\n

                                  Explanation<\/b><\/p>\n

                                  Pub\/Sub can be used as a destination for Cloud Logging sinks when organizations need event-driven processing of selected log entries. Security events can be forwarded to a Pub\/Sub topic and consumed by downstream applications or security automation systems. This architecture can support automated alerting, enrichment, and response workflows. Administrators should carefully control access to the topic and subscriber resources using IAM. Filters should also be tested to ensure that only relevant events are processed. Automated security responses should be designed cautiously because incorrect filters or false positives can result in unnecessary or disruptive actions.<\/span><\/p>\n

                                  Question 377<\/b><\/h3>\n

                                  A company wants to prevent public access to objects in a Cloud Storage bucket regardless of individual object ACLs. Which control should be used?<\/b><\/p>\n

                                    \n
                                  1. Public access prevention<\/span><\/li>\n
                                  2. Cloud NAT<\/span><\/li>\n
                                  3. Cloud Scheduler<\/span><\/li>\n
                                  4. Cloud DNS<\/span><\/li>\n<\/ol>\n

                                    Correct Answer: 1<\/b><\/p>\n

                                    Explanation<\/b><\/p>\n

                                    Cloud Storage public access prevention can prevent a bucket and its objects from being exposed through public IAM or ACL-based access. This provides an organizational safeguard for buckets that should never be publicly accessible. It is particularly useful for sensitive or internal datasets where accidental public exposure would create significant risk. Administrators should still configure appropriate IAM permissions for legitimate users and applications. Public access prevention does not replace encryption, logging, retention controls, or data classification. Security teams should also review existing bucket permissions and monitor access activity to ensure that data remains available only to authorized identities.<\/span><\/p>\n

                                    Question 378<\/b><\/h3>\n

                                    A security team wants to ensure that a Cloud Storage bucket retains objects for a minimum period and that users cannot delete them before that period expires. Which feature should be configured?<\/b><\/p>\n

                                      \n
                                    1. Retention policy<\/span><\/li>\n
                                    2. Cloud Armor<\/span><\/li>\n
                                    3. Cloud NAT<\/span><\/li>\n
                                    4. Cloud DNS<\/span><\/li>\n<\/ol>\n

                                      Correct Answer: 1<\/b><\/p>\n

                                      Explanation<\/b><\/p>\n

                                      A Cloud Storage retention policy specifies a minimum retention period during which objects cannot be deleted or replaced. This can support regulatory requirements, records management, and protection against accidental or malicious deletion. Organizations should determine the appropriate retention duration before applying the policy because it can affect normal data-management operations. A locked retention policy provides stronger protection but should only be used after validating that the configured period is correct. Retention controls should be combined with IAM, logging, encryption, and lifecycle-management processes. Security teams should carefully document retention requirements and review them with data owners.<\/span><\/p>\n

                                      Question 379<\/b><\/h3>\n

                                      A company wants to protect data in a sensitive database using a customer-managed encryption key. Which approach provides this capability for supported Google Cloud services?<\/b><\/p>\n

                                        \n
                                      1. CMEK with Cloud KMS<\/span><\/li>\n
                                      2. Cloud NAT<\/span><\/li>\n
                                      3. VPC Flow Logs<\/span><\/li>\n
                                      4. Cloud Scheduler<\/span><\/li>\n<\/ol>\n

                                        Correct Answer: 1<\/b><\/p>\n

                                        Explanation<\/b><\/p>\n

                                        Customer-managed encryption keys allow organizations to use cryptographic keys that they manage through Cloud KMS for supported Google Cloud services. This provides greater control over key lifecycle operations, including access, rotation, disabling, and destruction. CMEK can be useful when regulatory or internal policies require customers to maintain additional control over encryption keys. Administrators must carefully configure IAM permissions because applications need appropriate key access to perform encryption or decryption operations. Key lifecycle procedures should also account for the consequences of disabling or destroying keys. CMEK is one component of a broader data-protection strategy.<\/span><\/p>\n

                                        Question 380<\/b><\/h3>\n

                                        A security engineer wants to protect a VM workload against certain boot-level attacks by verifying the integrity of the boot process. Which capability should be enabled?<\/b><\/p>\n

                                          \n
                                        1. Shielded VM<\/span><\/li>\n
                                        2. Cloud NAT<\/span><\/li>\n
                                        3. Cloud Scheduler<\/span><\/li>\n
                                        4. Cloud DNS<\/span><\/li>\n<\/ol>\n

                                          Correct Answer: 1<\/b><\/p>\n

                                          Explanation<\/b><\/p>\n

                                          Shielded VM provides security features that help protect virtual machines against certain rootkits, boot-level attacks, and unauthorized changes to the boot process. Features such as Secure Boot, virtual trusted platform module capabilities, and integrity monitoring can provide additional protection depending on the VM configuration. Secure Boot helps ensure that trusted boot components are used, while integrity monitoring can help identify unexpected changes. Shielded VM should be combined with operating system hardening, IAM, patch management, network security, and monitoring. It provides an additional protection layer rather than replacing other security controls required for secure VM operations.<\/span><\/p>\n","protected":false},"excerpt":{"rendered":"

                                          View Full Google Professional Cloud Security Engineer Exam Dumps and Practice Test Dumps.   Question 361 A security administrator wants to prevent a user from accessing resources outside a defined set of projects, even when the user has broad IAM permissions. Which capability should be considered? Cloud Armor Principal Access Boundary Cloud NAT Cloud DNS […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[1648,1647],"tags":[],"_links":{"self":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts\/19623"}],"collection":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/comments?post=19623"}],"version-history":[{"count":1,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts\/19623\/revisions"}],"predecessor-version":[{"id":19624,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts\/19623\/revisions\/19624"}],"wp:attachment":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/media?parent=19623"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/categories?post=19623"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/tags?post=19623"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}