Google Cloud Professional Cloud Security Engineer Practice Exam

What the Google Cloud Professional Cloud Security Engineer exam covers

• Configuring Access232 questions
• Securing Communications and Boundary Protection226 questions
• Ensuring Data Protection194 questions
• Managing Operations251 questions
• Supporting Compliance Requirements120 questions

Free Google Cloud Professional Cloud Security Engineer practice test questions

A sample of 10 questions with answers and explanations. Sign up free to practice all 1,023.

1. Question 1Configuring Access

   Which IAM role type should be preferred over the broad basic roles (Owner/Editor/Viewer) for least privilege?

   • ABasic roles (Owner/Editor/Viewer) applied at the project level
   • BPredefined or custom roles scoped to specific services/actionsCorrect
   • CThe Editor basic role granted at the organization node
   • DIAM allow-all conditions on the default service account
   ✓ Correct answer: B

   Predefined roles are curated per service (for example roles/storage.objectViewer) and custom roles let you assemble the exact permissions a task needs. Both grant far narrower access than the basic Owner, Editor, and Viewer roles, which span nearly every Google Cloud service, so they implement least privilege.

   Why the other options are wrong

   • ABasic roles applied at the project level grant broad access across nearly every service, which is exactly the over-broad grant that least privilege tells you to avoid.
   • CThe Editor basic role granted at the organization node is even broader, applying wide write access across every project rather than narrowing to specific services.
   • DAn allow-all IAM condition on the default service account widens access instead of restricting it and does not define a curated, service-scoped permission set.
2. Question 2Securing Communications and Boundary ProtectionSelect all that apply

   Which TWO commands help build a VPC Service Controls perimeter around storage.googleapis.com? (Choose TWO)

   • Agcloud storage buckets update gs://prod-media-assets --public-access-prevention=enforced --uniform-bucket-level-access
   • Bgcloud access-context-manager perimeters update prod-perimeter --policy=POLICY_ID --add-resources=projects/456,projects/789Correct
   • Cgcloud access-context-manager perimeters create prod-perimeter --policy=POLICY_ID --resources=projects/123 --restricted-services=storage.googleapis.comCorrect
   • Dgcloud compute networks peerings create prod-vpc-peer --network=default --peer-project=other-proj --peer-network=default --import-custom-routes
   ✓ Correct answer: B, C

   VPC Service Controls perimeters are built using the `gcloud access-context-manager perimeters create` command to establish the initial perimeter with `--restricted-services` and `--resources`, and then `gcloud access-context-manager perimeters update` with `--add-resources` to include additional projects - together these two commands cover the full lifecycle of building a perimeter around storage.googleapis.com.

   Why the other options are wrong

   • AThe gcloud storage buckets update command with public-access-prevention and uniform bucket-level access hardens a single bucket; it does not create or configure a VPC Service Controls perimeter.
   • Dgcloud compute networks peerings create sets up VPC Network Peering between VPC networks and has no connection to VPC Service Controls perimeter management.
3. Question 3Managing Operations

   Which Security Command Center capability continuously detects misconfigurations such as public buckets and over-permissive firewall rules?

   • ACloud NAT
   • BSecurity Health AnalyticsCorrect
   • CCloud Trace
   • DCloud Profiler
   ✓ Correct answer: B

   Security Health Analytics is a built-in Security Command Center service that continuously scans Google Cloud resources and IAM policies for misconfigurations - such as publicly accessible Cloud Storage buckets, overly permissive firewall rules that allow 0.0.0.0/0, and missing OS-level security controls - surfacing findings as SCC findings so security teams can remediate them.

   Why the other options are wrong

   • ACloud NAT provides outbound internet connectivity for VM instances in private subnets and has no security scanning or misconfiguration detection capabilities.
   • CCloud Trace collects distributed latency traces for application performance analysis and does not scan for infrastructure misconfigurations or security policy violations.
   • DCloud Profiler captures CPU and memory profiling data for running applications and is unrelated to detecting security misconfigurations in cloud resources.
4. Question 4Configuring AccessSelect all that apply

   An auditor flags that your single Cloud Identity super administrator account is used for daily administrative tasks and lacks strong protections. Which TWO actions best harden super administrator accounts following Google best practices? (Choose TWO)

   • AEnforce hardware security keys (FIDO/Titan) as the second factor for all super administrator accountsCorrect
   • BUse dedicated super administrator accounts only for emergencies and perform daily work with lower-privileged admin rolesCorrect
   • CGrant the super administrator role to a synced group so membership can be managed in Active Directory
   • DDisable 2-step verification on super administrators so emergency access is never blocked
   ✓ Correct answer: A, B

   Both actions are Google-recommended hardening for super administrator accounts. A enforces phishing-resistant FIDO/Titan security keys as the second factor. B applies least privilege by reserving dedicated super-admin accounts for emergencies and performing daily work with lower-privileged roles. C (syncing the super-admin role from AD) and D (disabling 2-step verification) both weaken security and are incorrect.

   Why the other options are wrong

   • CGrant the super administrator role to a synced group so membership can be managed in Active Directory is incorrect because it does not provide the required implementation.
   • DDisable 2-step verification on super administrators so emergency access is never blocked is incorrect because it disables critical security or functionality needed for the requirement.
5. Question 5Securing Communications and Boundary Protection

   You operate a public API and want Cloud Armor to immediately block any request originating from a specific set of high-risk countries while still rate-limiting everyone else. Which Cloud Armor rule expression should the geo-blocking rule use?

   • Arequest.path.matches() against a list of country names
   • Borigin.region_code matched against the ISO country codes to denyCorrect
   • CinIpRange(origin.ip, '0.0.0.0/0') with action throttle
   • Dhas(request.headers['x-country']) to read a client-supplied header
   ✓ Correct answer: B

   Cloud Armor custom rules can reference origin.region_code, the ISO 3166-1 alpha-2 country code Google resolves from the client IP. A deny rule matching the high-risk codes blocks those requests, while a separate lower-priority rate-limit rule still governs everyone else.

   Why the other options are wrong

   • Arequest.path.matches() inspects the URL path, not geography, and country names are not part of the request path, so it cannot geo-block traffic.
   • CinIpRange against 0.0.0.0/0 matches every client and applies throttle to all of them; it neither identifies countries nor blocks the high-risk ones.
   • DA client-supplied x-country header is attacker-controlled and easily spoofed, so trusting it for geo-blocking is unreliable and insecure.
6. Question 6Ensuring Data Protection

   Compliance requires the ability to permanently and instantly render all data encrypted with a particular CMEK key unrecoverable, including by Google, on a defined date. Which Cloud KMS action achieves crypto-shredding while honoring a safety window?

   • BSchedule the key version for destruction, which moves it to a scheduled-for-destruction state before permanent deletion after the configured waiting periodCorrect
   • ADisable the key version, which immediately blocks its use but leaves the key material fully intact and re-enablable, so the data stays recoverable indefinitely
   • CAttach an IAM Deny policy blocking cloudkms.cryptoKeyVersions.useToDecrypt for all principals, which stops decryption while the key material remains fully intact
   • DLower the key's rotation period to one day so a new primary version is generated daily, though the earlier versions are retained and remain usable
   ✓ Correct answer: B

   Cloud KMS destruction moves a key version into a scheduled-for-destruction state for a configurable waiting period (24 hours to 120 days). It can be canceled during that safety window, but once it elapses the key material is irreversibly deleted, making all data it encrypted unrecoverable, even by Google.

   Why the other options are wrong

   • ADisabling a key version is fully reversible: re-enabling it restores the key material and access, so it never renders the data permanently unrecoverable.
   • CAn IAM Deny only blocks principals from calling the key; the underlying key material still exists and access can be restored, so the data is not crypto-shredded.
   • DFaster rotation adds a new primary version but never deletes older versions, so the prior key material persists and the old ciphertext stays decryptable.
7. Question 7Managing OperationsSelect all that apply

   A platform team wants every new project in the organization to automatically gain Security Command Center coverage and centralized findings without per-project setup. Which TWO actions support this? (Choose TWO)

   • AActivate Security Command Center at the organization level so it includes all current and future projectsCorrect
   • BEnable the desired built-in detector services (such as Security Health Analytics and Event Threat Detection) at the organization scopeCorrect
   • CManually enable Security Command Center in each project after it is created
   • DGrant each project owner the Security Center Findings Editor role
   ✓ Correct answer: A, B

   Activating Security Command Center at the organization level automatically includes all current and future projects without per-project setup. Enabling built-in detector services such as Security Health Analytics and Event Threat Detection at the organization scope ensures those detectors apply to every project in the hierarchy. Together, these two actions provide the desired automatic, centralized coverage for any newly created project.

   Why the other options are wrong

   • CManually enabling Security Command Center in each project after creation defeats the goal of automatic coverage and does not scale across an organization.
   • DGranting each project owner the Security Center Findings Editor role provides the ability to edit findings but does not enable detection coverage or ensure new projects are automatically included in SCC scanning.
8. Question 8Ensuring Data Protection

   Auditors must see a tamper-evident, queryable record of every Cloud KMS encrypt and decrypt operation against a specific CMEK key for a 90-day investigation window. Cloud Audit Logs are enabled. What must be true, given that these are Data Access logs?

   • ACloud KMS Data Access (DATA_READ/DATA_WRITE) audit logs must be explicitly enabled, since they are not captured by default, and then exported/queried for the periodCorrect
   • BCloud KMS Data Access logs are already on by default for cryptographic operations, so they only need to be exported and queried for the 90-day investigation window
   • CThe key ring's Cloud Monitoring encrypt/decrypt request-count metric must be enabled and retained for 90 days to serve as the tamper-evident record of operations
   • DSystem Event audit logs for Cloud KMS already capture each individual encrypt and decrypt call, so they only need to be queried for the investigation window
   ✓ Correct answer: A

   Encrypt/decrypt calls on a KMS key are recorded as Data Access audit logs (DATA_READ/DATA_WRITE), and Data Access logs (except for some BigQuery cases) are disabled by default and must be turned on for the service. Once enabled, they capture caller identity, timestamp, and the key version used, and can be exported to BigQuery or a log bucket for the 90-day query window. Admin Activity logs, which are always on, record key administration (create/disable/destroy) but not individual cryptographic operations.

   Why the other options are wrong

   • BCloud KMS encrypt/decrypt operations are Data Access logs, which are disabled by default and must be explicitly enabled; they are not captured automatically, so they cannot simply be exported after the fact.
   • CA Monitoring request-count metric shows aggregate volume, not a tamper-evident, queryable record of each individual encrypt and decrypt operation, so it does not meet the per-operation audit requirement.
   • DSystem Event audit logs record Google-initiated system actions, not per-request encrypt and decrypt calls; those calls are Data Access events that must be explicitly enabled.
9. Question 9Securing Communications and Boundary Protection

   A security engineer wants firewall rules whose scope follows workload identity rather than network labels that any instance editor can change. They choose target service accounts over target tags. What is the most accurate security rationale?

   • ATarget service accounts are evaluated before target tags in the firewall rule order, so they take precedence over any tag-based rule
   • BChanging a VM's service account requires IAM permissions and stops/replaces semantics, making scope harder to alter casually than network tagsCorrect
   • CTarget service accounts encrypt the rule match so an instance editor cannot read which VMs a rule applies to
   • DTarget service accounts automatically inherit the least-privilege permissions of the attached VM, unlike static tags
   ✓ Correct answer: B

   A network tag can be added or removed by anyone with instance-update permission, silently widening or narrowing a rule's scope. Reassigning a VM's service account requires the iam.serviceAccounts.actAs permission and the instance to be stopped, so target-service-account rules tie firewall scope to a controlled identity. Note tags and service accounts cannot be mixed in a single rule.

   Why the other options are wrong

   • AFirewall rules are evaluated by priority, not by whether they target service accounts versus tags; there is no built-in precedence of service-account targeting over tag targeting, so this is not the security rationale.
   • CFirewall targeting does not encrypt or hide which VMs a rule matches; the security benefit is that changing a VM's service account is IAM-gated and disruptive, not that the match is concealed.
   • DA firewall target service account simply identifies which VMs a rule applies to; it does not confer or inherit least-privilege permissions onto the VM, so this mischaracterizes how service-account targeting works.
10. Question 10Managing Operations

    Security Command Center raises an Event Threat Detection finding titled 'Malware: Bad IP' for a production VM. An engineer asks what data source ETD primarily analyzes to generate such findings. What is the correct answer?

    • ACloud Logging streams such as VPC Flow Logs, Cloud DNS, and Cloud Audit LogsCorrect
    • BLive packet capture mirrored from the VM's network interface for signature matching
    • CSnapshots of the VM's persistent disk scanned for malicious file hashes
    • DContainer image layers pulled from Artifact Registry and scanned for known bad indicators
    ✓ Correct answer: A

    ETD ingests logs such as Cloud Audit Logs, VPC Flow Logs, and Cloud DNS logs, then correlates them against Google threat intelligence and detection logic to flag activity like connections to known-bad IPs. It is log-based, which is why log streams must be available for detections to fire.

    Why the other options are wrong

    • BEvent Threat Detection analyzes exported logs, not live mirrored packet captures; the Bad IP finding comes from log streams like VPC Flow Logs and Cloud DNS matched against threat intelligence.
    • CETD does not scan persistent-disk snapshots for file hashes; disk/file scanning is a different capability, whereas ETD is a log-analysis detector.
    • DScanning container image layers is Artifact Analysis, not Event Threat Detection; ETD reasons over runtime log telemetry rather than image contents.

Who this Google Cloud Professional Cloud Security Engineer practice exam is for

This practice set is for anyone preparing for the Google Cloud Professional Cloud Security Engineer exam at the advanced level - from first-time candidates building a foundation to experienced Google practitioners doing a final review before test day. If you learn best by working through realistic questions and reading why each answer is right or wrong, it is built for you.

How to use this Google Cloud Professional Cloud Security Engineer practice exam

1. Start with the free sample questions above to gauge your current baseline.
2. Read the full explanation on every question, including why each wrong option is wrong.
3. Track your weak domains and focus your study where you are losing the most marks.
4. Once you are scoring consistently well, take a timed, full-length mock exam.
5. Use your readiness score to decide when you are ready to book the real Google Cloud Professional Cloud Security Engineer exam.

Related Google resources

• Google Cloud Professional Cloud Security Engineer study guideKey concepts
• Google practice examsAll Google
• Certification pathWhere this fits
• Certification exam guides & tipsBlog
• Plans & pricingFree & paid
• How these questions are written and reviewedMethodology
• Report a problem with a questionCorrections
• Google Cloud Professional Data Engineer practice examRelated
• Google Cloud Professional Machine Learning Engineer practice examRelated
• Google Cloud Professional Security Operations Engineer practice examRelated

Google Cloud Professional Cloud Security Engineer practice exam FAQ