Google Cloud Professional Cloud Security Engineer Practice Exam

What the Google Cloud Professional Cloud Security Engineer exam covers

• Configuring Access226 questions
• Securing Communications and Boundary Protection221 questions
• Ensuring Data Protection189 questions
• Managing Operations245 questions
• Supporting Compliance Requirements117 questions

Free Google Cloud Professional Cloud Security Engineer sample questions

A sample of 10 questions with answers and explanations. Sign up free to practice all 998.

1. Question 1Configuring Access

   Which IAM role type should be preferred over the broad primitive roles (Owner/Editor/Viewer) for least privilege?

   • ABasic roles (Owner/Editor/Viewer) applied at the project level
   • BPredefined or custom roles scoped to specific services/actionsCorrect
   • CThe Editor primitive role granted at the organization node
   • DIAM allow-all conditions on the default service account
   ✓ Correct answer: B

   Least privilege means granting only the permissions required for a task. Predefined roles are curated per service (e.g., roles/storage.objectViewer) and custom roles let you craft the exact permission set needed, both far narrower than the primitive Owner/Editor/Viewer roles which span nearly every Google Cloud service.

   Why the other options are wrong

   • ABasic (primitive) roles span nearly every service and are exactly the broad grants least privilege tells you to avoid, not the preferred scoped alternative.
   • CEditor is a primitive role, and granting it at the org node makes it even broader across all projects, the opposite of narrowing to specific services.
   • DAn allow-all IAM condition widens rather than restricts access and does not define a curated, service-scoped permission set the way predefined or custom roles do.
2. Question 2Securing Communications and Boundary Protection

   Which command attaches a Cloud Armor security policy named armor-prod to a backend service named web-backend?

   • Agcloud compute backend-services update web-backend --security-policy=armor-prod --globalCorrect
   • Bgcloud compute security-policies attach armor-prod --backend-service=web-backend
   • Cgcloud compute backend-services add-security-policy web-backend --policy=armor-prod
   • Dgcloud compute armor-policies bind armor-prod --to=web-backend
   ✓ Correct answer: A

   Cloud Armor security policies are attached to backend services using gcloud compute backend-services update <backend-service-name> --security-policy=<policy-name>. Adding --global targets a global backend service used by an external Application Load Balancer. Once attached, all requests routed to that backend service are evaluated against the Cloud Armor policy rules before reaching the backends.

   Why the other options are wrong

   • Bgcloud compute security-policies attach is not a valid subcommand; Cloud Armor policies are attached by updating the backend service, not by an attach subcommand on the security-policies resource group.
   • Cgcloud compute backend-services add-security-policy is not a valid gcloud command; the correct operation is backend-services update with the --security-policy flag.
   • Dgcloud compute armor-policies bind is not a valid gcloud command; there is no armor-policies subgroup in the gcloud CLI.
3. Question 3Managing Operations

   For a logs-based metric counting failed login events, which Cloud Monitoring object should reference it to notify an on-call channel?

   • AA logging exclusion filter that removes the failed-login entries after counting
   • BAn alerting policy condition on the log-based metricCorrect
   • CA Monitoring dashboard chart displaying the failed-login metric over time
   • DA notification channel configured on its own without any policy
   ✓ Correct answer: B

   Once a log-based metric counting failed login events is defined in Cloud Logging, a Cloud Monitoring alerting policy can reference it as a metric condition with a threshold (for example, more than 5 failures per minute). When the condition is breached, the policy fires an incident and delivers notifications to configured channels such as PagerDuty, Slack, or email, closing the loop between log-derived signals and on-call response.

   Why the other options are wrong

   • AAn exclusion filter drops matching entries and would prevent the metric from counting them; it does not evaluate the metric or notify anyone.
   • CA dashboard chart only visualizes the metric; it cannot evaluate a condition or send a notification to the on-call channel.
   • DA notification channel is only a delivery target; it does nothing until an alerting policy with a condition references both the metric and the channel.
4. Question 4Managing Operations

   You want every new project to automatically have Security Command Center detectors active and findings centralized, rather than configuring each project individually. How should SCC be enabled?

   • AActivate SCC on the top-level folder and manually add each new project below it
   • BEnable SCC on a designated management project and grant it access to the others
   • CActivate Security Command Center at the organization level so all current and future projects are coveredCorrect
   • DEnable a separate SCC configuration per project through a shared onboarding script
   ✓ Correct answer: C

   Security Command Center requires proper scope and service enablement. {answer_text} ensures SCC is configured for the relevant projects.

   Why the other options are wrong

   • AActivating on a folder covers only that folder's descendants and still requires manually placing every new project under it; organization-level activation automatically covers all current and future projects without that step.
   • BSCC is not enabled by pointing one project at others; it is a hierarchy-scoped service, and covering everything automatically requires activation at the organization level, not a management project pattern.
   • DConfiguring SCC per project via a script still requires action for each new project and can be missed; organization-level activation removes the per-project step entirely.
5. Question 5Securing Communications and Boundary Protection

   Your enterprise wants to centrally govern and inspect outbound (egress) internet access for workloads in a VPC, enforcing TLS inspection and URL allow-lists per identity, instead of relying on Cloud NAT plus ad hoc egress firewall rules. Which Google Cloud service is purpose-built for this?

   • ACloud NAT with a static external IP and logging enabled
   • BSecure Web Proxy, which provides identity-aware egress web filtering with TLS inspectionCorrect
   • CCloud Armor edge security policy attached to a backend bucket
   • DA hierarchical firewall egress deny rule on TCP 443
   ✓ Correct answer: B

   Firewall rules control network traffic but do not transit across peering connections automatically. Secure Web Proxy, which provides identity-aware egress web filtering with TLS inspection ensures both connectivity and proper access control.

   Why the other options are wrong

   • ACloud NAT with a static external IP and logging enabled is incorrect because it does not provide the required implementation.
   • CCloud Armor edge security policy attached to a backend bucket is incorrect because it does not provide the required implementation.
   • DA hierarchical firewall egress deny rule on TCP 443 is incorrect because it does not provide the required implementation.
6. Question 6Ensuring Data Protection

   A team performed Sensitive Data Protection de-identification on customer records using deterministic encryption with a Cloud KMS-wrapped key. An authorized fraud-investigation service now needs to re-identify selected tokens back to original values. What does the re-identification operation require?

   • AThe same Cloud KMS-wrapped key and matching transformation config used at de-identification, plus decrypt permission on itCorrect
   • BA read of the original inspection template that recorded which infoTypes were detected during de-identification
   • CThe Cloud KMS public key that corresponds to the wrapped key, used to verify each token before its reversal
   • DThe Secret Manager secret version that stored the de-identification job's configuration parameters and settings
   ✓ Correct answer: A

   Sensitive Data Protection deterministic encryption uses a Cloud KMS-wrapped key to produce tokens that are consistent and reversible only by authorized parties. To reverse the process, the re-identification API call must reference the exact same CryptoKey and transformation configuration used during de-identification, and the caller's identity must have the Cloud KMS CryptoKey Decrypter IAM permission on that key. This ensures only authorized fraud-investigation services can recover original values.

   Why the other options are wrong

   • BAn inspection template lists which infoTypes to find; it does not carry the crypto key or the exact transformation config needed to reverse deterministic encryption, so it cannot re-identify tokens.
   • CDeterministic encryption uses a symmetric KMS-wrapped key, not an asymmetric public/private pair, so there is no public key to verify tokens; re-identification needs the same symmetric key and config.
   • DStoring job parameters in Secret Manager is not what reversal requires; re-identification needs the identical KMS-wrapped key and matching transformation settings plus decrypt permission on the key.
7. Question 7Managing Operations

   A request to a resource inside a VPC Service Controls perimeter is blocked. The security team wants to confirm the block and see the violating principal. Which Cloud Audit Logs category records this denial?

   • APolicy Denied audit logsCorrect
   • BData Access audit logs
   • CAdmin Activity audit logs
   • DSystem Event audit logs
   ✓ Correct answer: A

   When a request is blocked by a VPC Service Controls perimeter, Google Cloud writes a Policy Denied audit log entry that contains the violating principal, the resource attempted, and the policy that triggered the denial. This log category is specifically designed for access denials enforced by org-level policies such as VPC Service Controls, making it the correct source for confirming blocks and identifying offending principals.

   Why the other options are wrong

   • BData Access audit logs record successful reads and writes of user data, not policy-enforced denials from VPC Service Controls perimeters.
   • CAdmin Activity audit logs capture administrative changes to resource configurations, not runtime access denials caused by perimeter policies.
   • DSystem Event audit logs record Google-initiated infrastructure events such as live migrations, not access denials triggered by VPC Service Controls.
8. Question 8Securing Communications and Boundary Protection

   A regulated payments platform terminates HTTPS at a global external Application Load Balancer. An auditor mandates that the load balancer must reject any client that negotiates anything weaker than TLS 1.2 and must disable known-weak cipher suites, while still serving legacy partners who cannot reach TLS 1.3. What is the BEST way to enforce this on the load balancer's HTTPS frontend?

   • AAttach a Cloud Armor security policy rule that inspects the JA3 fingerprint and denies old TLS clients
   • BCreate an SSL policy with profile MODERN (or a custom profile) and minimum TLS version TLS_1_2 and apply it to the target HTTPS proxyCorrect
   • CReplace the Google-managed certificate with a self-managed certificate that only includes TLS 1.2 ciphers
   • DSet a backend service timeout and enable HTTP/2 so older clients are forced to upgrade
   ✓ Correct answer: B

   SSL policies are the dedicated control for governing the TLS handshake on Google Cloud HTTPS/SSL load balancers. You set a minimum TLS version (for example TLS_1_2) and a profile - COMPATIBLE, MODERN, RESTRICTED, or CUSTOM - where the profile determines which cipher suites are allowed. MODERN drops the weakest ciphers while still supporting TLS 1.2, satisfying the requirement to keep legacy-but-not-ancient partners working while rejecting weaker negotiations. The SSL policy is attached to the target HTTPS proxy, so it governs the client-facing handshake directly.

   Why the other options are wrong

   • ACloud Armor operates on L7 request attributes after TLS termination; it does not set the minimum TLS version or restrict cipher suites negotiated during the handshake, and JA3 fingerprinting is not a built-in supported control for enforcing TLS versions.
   • CThe certificate carries the public key and identity; it does not control which TLS versions or cipher suites the proxy will negotiate. That negotiation is governed by the SSL policy, not the cert contents.
   • DBackend timeouts and HTTP/2 affect connection handling and multiplexing, not the TLS version floor or cipher selection, so they cannot enforce the auditor's requirement.
9. Question 9Configuring Access

   A company federates Google Cloud sign-in to Azure AD (Microsoft Entra ID) via SAML and uses automatic provisioning. A new employee exists in Entra ID and can authenticate, but receives an error that no Google account exists. What is the most likely gap?

   • AThe provisioning connector has not yet created the corresponding Cloud Identity user, so authentication has no matching account to map toCorrect
   • BThe employee's Entra ID object lacks the immutableId attribute, so the SAML NameID cannot be generated at all
   • CThe Cloud Identity domain has not verified the Entra ID tenant as a trusted federation partner yet
   • DThe user's session has not yet propagated through GCDS, which must run before the account becomes usable
   ✓ Correct answer: A

   SAML SSO maps an authenticated IdP user to an existing Cloud Identity account by the matching identifier such as primary email. If provisioning (SCIM or a connector) has not created that account yet, the SAML assertion has nothing to map to and sign-in fails. Provisioning and SSO must both be in place.

   Why the other options are wrong

   • BIf the SAML NameID could not be produced, the user would fail authentication, but the scenario says they authenticate successfully and only lack a Google account; the gap is provisioning, not the NameID attribute.
   • CCloud Identity does not require verifying the Entra ID tenant as a federation partner for SAML SSO to work, and authentication is already succeeding; the missing piece is the provisioned Cloud Identity user.
   • DGCDS syncs from LDAP, not from Entra ID, and this org uses Entra automatic provisioning; the error is that the provisioning connector has not created the user yet, unrelated to GCDS.
10. Question 10Ensuring Data Protection

    A developer asks why their attempt to immediately and permanently delete a Cloud KMS key version succeeded only in scheduling it for destruction with a waiting period before it is gone. What is the purpose of this behavior?

    • AIt lets Cloud KMS complete any in-flight crypto operations that still reference the key version before removal
    • BThe scheduled-for-destruction state provides a recovery window to restore the version if destruction was a mistakeCorrect
    • CIt gives dependent services time to re-encrypt their data under a newer key version before the old one is gone
    • DIt enforces a mandatory audit-log flush so the destruction event is fully recorded before deletion
    ✓ Correct answer: B

    Destroying a Cloud KMS key version places it in a scheduled-for-destruction state for a waiting period during which it can be restored, preventing irreversible data loss from a mistaken or malicious destroy. Once the period elapses the material is destroyed and cannot be recovered. This safety window is a deliberate protective control.

    Why the other options are wrong

    • AThe waiting period is not about draining in-flight operations; scheduled-for-destruction keys are already unusable for crypto, and the delay exists specifically to allow restoration of a mistaken destruction.
    • CCloud KMS does not automatically re-encrypt dependent data during the window; the delay is a safety/recovery window for the version itself, not a migration grace period for consumers.
    • DAudit logging of the destroy request is immediate and does not require a multi-day delay; the waiting period exists to permit recovery, not to flush logs.

Related Google resources

• Google Cloud Professional Cloud Security Engineer study guideKey concepts
• Google practice examsAll Google
• Certification pathWhere this fits
• Certification exam guides & tipsBlog
• Plans & pricingFree & paid
• Google Cloud Professional Cloud Network Engineer practice examRelated
• Associate Google Workspace Administrator practice examRelated
• Google Cloud Professional Data Engineer practice examRelated

Google Cloud Professional Cloud Security Engineer practice exam FAQ