Question bank
Professional Cloud Security Engineer
42 Professional Cloud Security Engineer questions with the correct answer and a written explanation, organised across 5 exam domains.
- 42 questions
- 5 domains
- Foundation level
certilumQuestion index
Jump straight to any question. Answers and explanations are inline.
Configure access
10 questions in this domain
- Question 1Single Choice
Which component of an IAM policy directly associates a principal with a role?
- APolicy bindingCorrect answer
- BResource hierarchy
- CAudit log
- DOrganization policy
Why this is the answer
An IAM policy is made of bindings; each binding associates members with a role.
- Question 2Multiple Select
Which two statements about IAM role types are correct?
- APrimitive roles grant broad access across an entire project.Correct answer
- BPredefined roles are Google-managed and service-specific.Correct answer
- CCustom roles are automatically created by Google Cloud.
- DPrimitive roles are recommended for least privilege.
Why this is the answer
Primitive roles are broad and legacy; predefined roles are granular and Google-managed. Custom roles are user-defined.
- Question 3Interactive
In the policy binding represented in the code block, what kind of principal is assigned to the role?
- AA user identityCorrect answer
- BA service account
- CA group lifecycle
- DAn API key
Why this is the answer
The 'user:' prefix indicates a Google user identity. Service accounts use 'serviceAccount:' and groups use 'group:'.
- Question 4Single Choice
What is the default setting for Data Access audit logs for most Google Cloud services?
- AThey are disabled by defaultCorrect answer
- BThey are enabled by default
- CThey require no configuration
- DThey cannot be enabled
Why this is the answer
Data Access logs are disabled by default for most services because of volume and cost, and must be explicitly enabled.
- Question 5Multiple Select
Which two audit log categories are associated with reading user data and explicit denial of access?
- AData AccessCorrect answer
- BPolicy DenyCorrect answer
- CAdmin Activity
- DSystem Event
Why this is the answer
Data Access logs record read/write to user data; Policy Deny logs record explicit deny-policy blocks.
- Question 6Interactive
According to the constraint shown in the code block, which two outcomes will occur?
- ACompute Engine instances cannot be assigned external IP addresses.Correct answer
- BVMs will be denied public internet IPs.Correct answer
- CService account key creation is blocked.
- DAll IAM policy bindings are denied.
Why this is the answer
This list constraint denies external IPs on VMs; it does not affect service account keys or IAM bindings.
- Question 7Single Choice
Which IAM role type is considered a legacy broad role and violates least privilege?
- APrimitive rolesCorrect answer
- BPredefined roles
- CCustom roles
- DConditional roles
Why this is the answer
Primitive roles Owner, Editor, and Viewer grant broad legacy access across projects, conflicting with least privilege.
- Question 8Multiple Select
Which two alternatives help eliminate long-lived service account keys?
- AUsing service account impersonationCorrect answer
- BUsing Workload Identity FederationCorrect answer
- CStoring JSON keys in Secret Manager
- DDownloading JSON keys to developer laptops
Why this is the answer
Impersonation and Workload Identity Federation allow short-lived access without static keys. Secret Manager only centralizes keys, not eliminate them.
- Question 9Interactive
What access restriction does the condition in the code block enforce?
- AAccess is granted only before January 1, 2026.Correct answer
- BAccess is granted only after January 1, 2026.
- CAccess is restricted to a specific IP address.
- DAccess is restricted to corporate-managed devices.
Why this is the answer
The expression compares request.time against a fixed timestamp, allowing access before that time and denying after it.
- Question 10Single Choice
What is the name of the non-human identity used by applications and VMs to authenticate to Google Cloud APIs?
- AService accountCorrect answer
- BUser account
- COrganization node
- DFolder resource
Why this is the answer
Service accounts are special Google accounts that represent applications and workloads for programmatic access.
Ensure data protection
10 questions in this domain
- Question 11Single Choice
What is the main purpose of Cloud Key Management Service on Google Cloud for protecting sensitive data?
- AMonitor network traffic for threats
- BManage cryptographic keys for encryptionCorrect answer
- CStore application logs for compliance
- DEnforce physical data center security
Why this is the answer
Cloud KMS is a cloud-hosted cryptographic key management service used to generate, use, rotate, and destroy keys for encrypting sensitive data.
- Question 12Multiple Select
Which key management service tiers does Google Cloud offer through Cloud KMS for encryption of sensitive data?
- ACloud External Key ManagerCorrect answer
- BCloud Data Loss Prevention
- CCloud KMSCorrect answer
- DCloud HSMCorrect answer
Why this is the answer
Cloud KMS includes software-backed Cloud KMS, FIPS 140-2 Level 3 Cloud HSM, and Cloud EKM for externally managed keys.
- Question 13Interactive
An engineer runs the command shown. What is the effect of this IAM binding on the service account?
- ACreate new key versions in the key ring
- BEncrypt and decrypt data with the specified keyCorrect answer
- CDelete the key ring and all its versions
- DView metadata for all keys in the project
Why this is the answer
The roles/cloudkms.cryptoKeyEncrypterDecrypter role allows the service account to encrypt and decrypt data using the referenced crypto key.
- Question 14Single Choice
What is a key ring in Cloud Key Management Service on Google Cloud for organizing keys?
- AA hardware security module device
- BA logical grouping of cryptographic keysCorrect answer
- CA single encryption algorithm
- DA type of access transparency log
Why this is the answer
A key ring is a logical grouping of cryptographic keys that helps organize keys and assign access control policies.
- Question 15Multiple Select
Which statements accurately describe Customer-Supplied Encryption Keys (CSEK) for data protection on Google Cloud workloads?
- AGoogle automatically rotates CSEK keys
- BThe customer generates and supplies the AES-256 keyCorrect answer
- CGoogle never stores the raw key materialCorrect answer
- DThe key is transmitted with each API callCorrect answer
Why this is the answer
CSEK requires the customer to supply and manage AES-256 keys. Google uses them transiently and never persists key material, and no automated rotation exists.
- Question 16Interactive
An engineer runs the command shown. What access does this IAM binding grant to the service account?
- ACreate new secret versions
- BAccess secret payload valuesCorrect answer
- CDelete the secret resource
- DSet IAM policies on secrets
Why this is the answer
The secretAccessor role is scoped to reading the secret payload, not managing secret resources or versions.
- Question 17Single Choice
What is the maximum payload size allowed for a Secret Manager secret version on Google Cloud?
- A10 MiB
- B64 KiBCorrect answer
- C128 KiB
- D1 MiB
Why this is the answer
Secret Manager accommodates payloads up to 64 KiB per secret version.
- Question 18Multiple Select
Which capabilities are provided by the Cloud Data Loss Prevention (DLP) API to protect sensitive data?
- AManage cryptographic key rotation
- BInspect data for sensitive informationCorrect answer
- CPerform re-identification risk analysisCorrect answer
- DApply de-identification transformationsCorrect answer
Why this is the answer
Cloud DLP discovers, classifies, protects, and de-identifies data, including inspection, transformation, and risk analysis.
- Question 19Interactive
A security team deploys the DLP inspect template shown. What does this configuration accomplish for sensitive data?
- ADelete all PII from the target dataset
- BEnforce encryption on all detected fields
- CDetect credit cards and social security numbersCorrect answer
- DMask data using a surrogate key
Why this is the answer
The template defines an inspection configuration that scans for specific infoTypes and requires a minimum likelihood of LIKELY for matches.
- Question 20Single Choice
Which Google Cloud feature records when Google personnel access customer content for support operations and administrative tasks?
- AAccess TransparencyCorrect answer
- BResource Location Constraints
- CCloud Audit Logs
- DVPC Service Controls
Why this is the answer
Access Transparency logs when Google personnel access customer content; Cloud Audit Logs track customer actions instead.
Manage operations
8 questions in this domain
- Question 21Single Choice
Which Cloud Audit Log category is enabled by default in Google Cloud?
- AAdmin ActivityCorrect answer
- BData Access
- CSystem Event
- DPolicy Denied
Why this is the answer
Admin Activity logs are always enabled and record API calls that modify resource configuration or metadata.
- Question 22Multiple Select
Which statements accurately describe Data Access audit logs? Select all that apply.
- AThey are enabled by default for every Google Cloud service.
- BThey record API calls that create, modify, or read user-provided resource data.Correct answer
- CThey are disabled by default for most services to control ingestion volume and cost.Correct answer
- DThey primarily track administrative actions that modify resource configuration.
Why this is the answer
Data Access logs are off by default for most services and record reads and writes of actual resource data, not administrative configuration changes.
- Question 23Interactive
What does the gcloud command shown in the code block accomplish?
- ACreates an organization-level aggregated sink that exports Admin Activity logs to BigQueryCorrect answer
- BCreates a project-level sink that exports Data Access logs to Cloud Storage
- CEnables Data Access logs for all child projects in the organization
- DExports Policy Denied logs to a Pub/Sub topic for real-time alerting
Why this is the answer
The command uses --organization and --include-children, so it creates an aggregated sink that routes Admin Activity logs to BigQuery.
- Question 24Single Choice
Which destination is NOT supported for a Cloud Logging log sink?
- ACloud Storage bucket
- BBigQuery dataset
- CPub/Sub topic
- DCloud Functions functionCorrect answer
Why this is the answer
Log sinks can route to Cloud Storage, BigQuery, Pub/Sub, or external logging systems, but Cloud Functions is not a direct sink destination.
- Question 25Multiple Select
Which of the following are common traps when working with Cloud Audit Logs and log sinks? Select all that apply.
- AAssuming Data Access logs are enabled by default across all servicesCorrect answer
- BConfiguring a project-level sink when centralized organization-wide aggregation is requiredCorrect answer
- CEnabling Data Access logs for all services without considering storage costs and data volumeCorrect answer
- DUsing an aggregated sink at the organization level to export security logs to a centralized project
Why this is the answer
These are explicitly called out as common traps; organization-level aggregation with native sinks is the recommended practice.
- Question 26Interactive
What is created by the configuration in the code block?
- AA custom log-based metric that counts failed SSH attemptsCorrect answer
- BA Cloud Monitoring alerting policy for memory usage
- CA log sink exporting audit logs to BigQuery
- DAn Eventarc trigger for automating incident response
Why this is the answer
The code defines a google_logging_metric with metric_kind DELTA and value_type INT64, counting matching failed SSH log entries.
- Question 27Single Choice
Which Security Command Center detector performs agentless memory scanning on Compute Engine instances?
- AEvent Threat Detection
- BContainer Threat Detection
- CVirtual Machine Threat DetectionCorrect answer
- DSecurity Health Analytics
Why this is the answer
Virtual Machine Threat Detection performs agentless memory scanning at the hypervisor level to detect malware and rootkits.
- Question 28Multiple Select
Which statements about Security Command Center threat detection are true? Select all that apply.
- AEvent Threat Detection and Container Threat Detection are Premium tier features.Correct answer
- BVirtual Machine Threat Detection requires installing a guest OS agent.
- CEvent Threat Detection analyzes Cloud DNS query logs and VPC Flow Logs.Correct answer
- DSecurity Health Analytics only monitors external applications for XSS vulnerabilities.
Why this is the answer
Event Threat Detection and Container Threat Detection require Premium tier; VM Threat Detection is agentless; ETD analyzes audit, DNS, and VPC Flow Logs.
Secure communications and establish boundary protection
9 questions in this domain
- Question 29Single Choice
What is the primary benefit of using Shared VPC in Google Cloud?
- ACentralized network administration and shared subnetsCorrect answer
- BIndependent VPC management with peering
- CPublic internet connectivity for private instances
- DNon-transitive private connectivity between VPCs
Why this is the answer
Shared VPC centralizes network management in a host project and lets service projects use its subnets. This is the key enterprise benefit.
- Question 30Multiple Select
Which two statements correctly describe VPC Network Peering?
- AUses private internal IP addresses for communicationCorrect answer
- BIs non-transitive between peered networksCorrect answer
- CRequires traffic to traverse the public internet
- DProvides centralized billing across projects
Why this is the answer
Peering uses internal IPs and is non-transitive, so peered networks cannot relay traffic. It does not use the internet or centralize billing.
- Question 31Interactive
The displayed command creates a VPC firewall rule. What is true about its evaluation order?
- AHigher precedence than a priority 1000 ruleCorrect answer
- BLower precedence than a priority 1000 rule
- CRules are evaluated alphabetically by name
- DDeny rules always override allow rules
Why this is the answer
Within Cloud VPC firewalls, lower priority values are evaluated first. A priority 100 rule takes precedence over a priority 1000 rule.
- Question 32Single Choice
Which service allows private instances without external IP addresses to initiate outbound internet connections?
- ACloud NATCorrect answer
- BCloud VPN
- CVPC Network Peering
- DShared VPC
Why this is the answer
Cloud NAT translates private source IPs and ports to external IP addresses for outbound-only traffic. It does not allow inbound connections.
- Question 33Multiple Select
Which two statements correctly describe Dedicated Interconnect?
- ADirect physical connection bypassing the public internetCorrect answer
- BIs encrypted by default without extra setup
- CRequires a third-party service provider
- DCan use MACsec to encrypt the physical linkCorrect answer
Why this is the answer
Dedicated Interconnect bypasses the internet, but encryption is not automatic. Organizations can enable MACsec at Layer 2 or IPsec at Layer 3.
- Question 34Interactive
Review the Cloud Armor command shown. What is the immediate effect of this rule?
- ABlocks matching traffic with HTTP 403Correct answer
- BAllows all traffic to the backend
- CApplies encryption to matching requests
- DRedirects matching traffic to another backend
Why this is the answer
The rule denies HTTP 403 for requests originating from 203.0.113.0/24. It is a Layer 7 Cloud Armor security policy rule.
- Question 35Single Choice
Which Cloud DNS feature prevents cache poisoning by authenticating DNS responses?
- ADNSSECCorrect answer
- BCloud VPN
- CResponse Policy Zones
- DVPC Service Controls
Why this is the answer
DNSSEC adds cryptographic signatures to DNS records, enabling resolvers to validate authenticity and integrity and preventing poisoning.
- Question 36Multiple Select
Which two statements accurately describe Packet Mirroring?
- ACopies actual packet payloads for inspectionCorrect answer
- BForwards mirrored traffic to collector endpointsCorrect answer
- CGenerates metadata logs only
- DReplaces VPC firewall rules
Why this is the answer
Packet Mirroring copies packet data out-of-band to collectors for analysis. It is not metadata-only and does not replace firewall rules.
- Question 37Interactive
The displayed command configures Cloud NAT. What is the expected result?
- AProvides outbound internet access for private instancesCorrect answer
- BAllows inbound internet traffic to private instances
- CCreates a VPN tunnel to on-premises
- DEnables DNSSEC on the VPC network
Why this is the answer
Cloud NAT enables instances without external IPs to reach the internet using SNAT. It is egress-only and cannot initiate inbound connections.
Support compliance requirements
5 questions in this domain
- Question 38Single Choice
According to Google Cloud's shared responsibility model, which layer of the cloud stack is managed exclusively by Google?
- ACustomer IAM policy configuration
- BPhysical data center securityCorrect answer
- CApplication vulnerability management
- DVirtual machine operating system patching
Why this is the answer
Google secures the cloud, including physical data centers, hardware, software, networking, and facilities. Customers oversee data and access controls.
- Question 39Multiple Select
According to Google Cloud's shared responsibility model, which two security controls are specifically customer-managed?
- APhysical security of data centers
- BData classification and identity managementCorrect answer
- CApplication-level security controlsCorrect answer
- DHypervisor maintenance
Why this is the answer
Customers handle security in the cloud, including data classification, identity management, VM patching, network configuration, and application-level controls.
- Question 40Interactive
A security engineer creates the following IAM resource to let a group authorize Google support access requests. Which pre-defined role is being assigned?
- Aroles/logging.viewer
- Broles/accessapproval.viewer
- Croles/accessapproval.approverCorrect answer
- Droles/iam.securityReviewer
Why this is the answer
roles/accessapproval.approver authorizes users to review, approve, or deny explicit Google access requests. It is assigned to designated security operations personnel for Access Approval workflows.
- Question 41Single Choice
Which Google Cloud console interface provides customers with direct access to SOC reports and ISO certifications?
- ACloud Shell
- BSecurity Command Center
- CCloud Logging
- DCompliance Reports ManagerCorrect answer
Why this is the answer
Compliance Reports Manager is the dedicated console interface for accessing independent audit reports, certifications, and regulatory evaluations.
- Question 42Multiple Select
Which two platform-level enforcements are included in an Assured Workloads compliance profile?
- ARemoval of all resource isolation boundaries
- BData residency enforcementCorrect answer
- CManual creation of custom organization policies
- DCustomer-managed encryption key enforcementCorrect answer
Why this is the answer
Assured Workloads profiles enforce data residency and customer-managed encryption keys while providing preconfigured controls and support restrictions.
Frequently asked questions
Everything about the Professional Cloud Security Engineer question bank and how to use it.