Professional-Cloud-Security-Engineer Dumps Updated Jul 08, 2025 Practice Test and 343 unique questions
2025 Latest 100% Exam Passing Ratio - Professional-Cloud-Security-Engineer Dumps PDF
To prepare for the Google Professional-Cloud-Security-Engineer Certification Exam, candidates should review the exam objectives and study the relevant Google Cloud Platform documentation. Google also offers training courses and resources to help candidates prepare for the exam. Additionally, candidates can take practice exams to gauge their readiness for the actual exam. It is recommended that candidates have hands-on experience with Google Cloud Platform and its security features before taking the exam.
The Google Professional-Cloud-Security-Engineer exam is designed to be challenging, and individuals are required to demonstrate their ability to apply their knowledge to real-world scenarios. Professional-Cloud-Security-Engineer exam is also designed to be fair and unbiased, and Google Cloud takes steps to ensure that the exam is free from any kind of bias or discrimination.
NEW QUESTION # 151
You are the Security Admin in your company. You want to synchronize all security groups that have an email address from your LDAP directory in Cloud IAM.
What should you do?
- A. Use a management tool to sync the subset based on the email address attribute. Create a group in the Google domain. A group created in a Google domain will automatically have an explicit Google Cloud Identity and Access Management (IAM) role.
- B. Configure Google Cloud Directory Sync to sync security groups using LDAP search rules that have
"user email address" as the attribute to facilitate bidirectional sync. - C. Use a management tool to sync the subset based on group object class attribute. Create a group in the Google domain. A group created in a Google domain will automatically have an explicit Google Cloud Identity and Access Management (IAM) role.
- D. Configure Google Cloud Directory Sync to sync security groups using LDAP search rules that have
"user email address" as the attribute to facilitate one-way sync.
Answer: D
Explanation:
Explanation
search rules that have "user email address" as the attribute to facilitate one-way sync. Reference Links:https://support.google.com/a/answer/6126589?hl=en
NEW QUESTION # 152
An organization is moving applications to Google Cloud while maintaining a few mission-critical applications on-premises. The organization must transfer the data at a bandwidth of at least 50 Gbps. What should they use to ensure secure continued connectivity between sites?
- A. Partner Interconnect
- B. Cloud VPN
- C. Cloud Router
- D. Dedicated Interconnect
Answer: D
Explanation:
https://cloud.google.com/network-connectivity/docs/interconnect/concepts/overview
NEW QUESTION # 153
You need to centralize your team's logs for production projects. You want your team to be able to search and analyze the logs using Logs Explorer. What should you do?
- A. Create an aggregate org sink at the parent folder of the production projects, and set the destination to a logs bucket.
- B. Enable Cloud Monitoring workspace, and add the production projects to be monitored.
- C. Use Logs Explorer at the organization level and filter for production project logs.
- D. Create an aggregate org sink at the parent folder of the production projects, and set the destination to a Cloud Storage bucket.
Answer: A
NEW QUESTION # 154
Your Security team believes that a former employee of your company gained unauthorized access to Google Cloud resources some time in the past 2 months by using a service account key. You need to confirm the unauthorized access and determine the user activity. What should you do?
- A. Use the Cloud Data Loss Prevention API to query logs in Cloud Storage.
- B. Use the Logs Explorer to search for user activity.
- C. Use Security Health Analytics to determine user activity.
- D. Use the Cloud Monitoring console to filter audit logs by user.
Answer: B
Explanation:
* Objective: Ensure that a Cloud Storage bucket in Project A can only be readable from Project B and prevent data access or copying to Cloud Storage buckets outside the network, even with correct credentials.
* Solution: Use VPC Service Controls to create a security perimeter.
* Steps:
* Step 1: Open the Google Cloud Console.
* Step 2: Navigate to the VPC Service Controls page.
* Step 3: Create a new service perimeter.
* Step 4: Add Project A and Project B to the service perimeter.
* Step 5: Include Cloud Storage service in the perimeter configuration.
* Step 6: Define access levels to ensure that only resources within the perimeter can access the Cloud Storage bucket.
By setting up a VPC Service Controls perimeter, you can enforce security boundaries that restrict data access and movement to within defined projects, providing an extra layer of protection beyond IAM permissions.
References:
* VPC Service Controls Overview
* Configuring VPC Service Controls
NEW QUESTION # 155
You are responsible for a set of Cloud Functions running on your organization's Google Cloud environment. During the last annual security review, secrets were identified in environment variables of some of these Cloud Functions. You must ensure that secrets are identified in a timely manner. What should you do?
- A. Integrate dynamic application security testing into the CI/CD pipeline that scans the application code for the Cloud Functions. Fail the build process if secrets are discovered.
- B. Use Sensitive Data Protection to scan the environment variables multiple times per day, and create a finding in Security Command Center if secrets are discovered.
- C. Implement a Cloud Function that scans the environment variables multiple times a day, and creates a finding in Security Command Center if secrets are discovered.
- D. Implement regular peer reviews to assess the environment variables and identify secrets in your Cloud Functions. Raise a security incident if secrets are discovered.
Answer: B
Explanation:
https://cloud.google.com/sensitive-data-protection/docs/secrets-discovery#why
NEW QUESTION # 156
In order to meet PCI DSS requirements, a customer wants to ensure that all outbound traffic is authorized.
Which two cloud offerings meet this requirement without additional compensating controls? (Choose two.)
- A. Cloud Storage
- B. Compute Engine
- C. Google Kubernetes Engine
- D. Cloud Functions
- E. App Engine
Answer: B,E
NEW QUESTION # 157
A manager wants to start retaining security event logs for 2 years while minimizing costs. You write a filter to select the appropriate log entries.
Where should you export the logs?
- A. Cloud Pub/Sub topics
- B. BigQuery datasets
- C. Cloud Storage buckets
- D. StackDriver logging
Answer: C
Explanation:
To retain security event logs for 2 years while minimizing costs, exporting the logs to Cloud Storage buckets is the most cost-effective solution. Cloud Storage provides scalable and durable storage at a lower cost compared to BigQuery, which is more suited for analytics and querying, or Cloud Pub/Sub, which is designed for messaging and stream processing.
Steps:
* Create a Cloud Storage Bucket: Set up a new Cloud Storage bucket configured with appropriate retention policies.
* Set Up Log Export: Use the Google Cloud Console or gcloud command-line tool to create a sink that exports the selected log entries to the Cloud Storage bucket.
* Configure Retention Policy: Set the retention policy on the Cloud Storage bucket to ensure that logs are retained for the required period of 2 years.
References:
* Google Cloud: Exporting logs
* Google Cloud Storage pricing
NEW QUESTION # 158
Your organization uses a microservices architecture based on Google Kubernetes Engine (GKE). Security reviews recommend tighter controls around deployed container images to reduce potential vulnerabilities and maintain compliance. You need to implement an automated system by using managed services to ensure that only approved container images are deployed to the GKE clusters. What should you do?
- A. Enforce Binary Authorization in your GKE clusters. Integrate container image vulnerability scanning into the CI/CD pipeline and require vulnerability scan results to be used for Binary Authorization policy decisions.
- B. Build a system using third-party vulnerability databases and custom scripts to identify potential Common Vulnerabilities and Exposures (CVEs) in your container images. Prevent image deployment if the CVE impact score is beyond a specified threshold.
- C. Develop custom organization policies that restrict GKE cluster deployments to container images hosted within a specific Artifact Registry project where your approved images reside.
- D. Automatically deploy new container images upon successful CI/CD builds by using Cloud Build triggers. Set up firewall rules to limit and control access to instances to mitigate malware injection.
Answer: A
Explanation:
To enhance the security of your microservices architecture on Google Kubernetes Engine (GKE) and ensure that only approved container images are deployed, implementing Binary Authorization is a robust solution.
* Option A: Enforcing Binary Authorization in your GKE clusters ensures that only container images that meet your organization's security policies are deployed. By integrating container image vulnerability scanning into your Continuous Integration/Continuous Deployment (CI/CD) pipeline, you can assess images for known vulnerabilities before they are deployed. Binary Authorization can be configured to use these vulnerability scan results to make policy decisions, effectively preventing the deployment of insecure images. This approach leverages managed services provided by Google Cloud, ensuring scalability and compliance with security standards.
* Option B: Developing custom organization policies to restrict deployments to images within a specific Artifact Registry project helps in controlling the source of images but does not inherently assess the security posture of those images. Without integrated vulnerability scanning and enforcement mechanisms, this approach may not fully mitigate the risk of deploying vulnerable images.
* Option C: Building a system using third-party vulnerability databases and custom scripts requires significant maintenance and may not integrate seamlessly with GKE. This approach can be error-prone and lacks the efficiency of managed services designed for this purpose.
* Option D: Automatically deploying new images upon successful CI/CD builds ensures rapid deployment but does not address the need for security assessments of the images. While setting up firewall rules is good practice, it does not prevent the deployment of potentially vulnerable images.
Therefore, Option A is the most effective approach, as it utilizes Google Cloud's managed services to enforce security policies and integrate vulnerability assessments directly into the deployment process, ensuring that only approved and secure container images are deployed to your GKE clusters.
References:
* Binary Authorization Documentation
* Container Analysis Documentation
NEW QUESTION # 159
You are part of a security team that wants to ensure that a Cloud Storage bucket in Project A can only be readable from Project B.
You also want to ensure that data in the Cloud Storage bucket cannot be accessed from or copied to Cloud Storage buckets outside the network, even if the user has the correct credentials.
What should you do?
- A. Enable Domain Restricted Sharing Organization Policy and Bucket Policy Only on the Cloud Storage bucket.
- B. Enable VPC Service Controls, create a perimeter with Project A and B, and include Cloud Storage service.
- C. Enable Private Access in Project A and B networks with strict firewall rules to allow communication between the networks.
- D. Enable VPC Peering between Project A and B networks with strict firewall rules to allow communication between the networks.
Answer: A
NEW QUESTION # 160
You have created an OS image that is hardened per your organization's security standards and is being stored in a project managed by the security team. As a Google Cloud administrator, you need to make sure all VMs in your Google Cloud organization can only use that specific OS image while minimizing operational overhead. What should you do? (Choose two.)
- A. Grant users the compuce.imageUser role in their own projects.
- B. Store the image in every project that is spun up in your organization.
- C. Grant users the compuce.imageUser role in the OS image project.
- D. Set up an image access organization policy constraint, and list the security team managed project in the project's allow list.
- E. Remove VM instance creation permission from users of the projects, and only allow you and your team to create VM instances.
Answer: C,D
Explanation:
Explanation
https://cloud.google.com/resource-manager/docs/organization-policy/org-policy-constraints - constraints/compute.trustedImageProjects This list constraint defines the set of projects that can be used for image storage and disk instantiation for Compute Engine. If this constraint is active, only images from trusted projects will be allowed as the source for boot disks for new instances.
NEW QUESTION # 161
You define central security controls in your Google Cloud environment. For one of the folders in your organization, you set an organizational policy to deny the assignment of external IP addresses to VMs. Two days later, you receive an alert about a new VM with an external IP address under that folder.
What could have caused this alert?
- A. The VM was created with a static external IP address that was reserved in the project before the organizational policy rule was set.
- B. The organizational policy constraint wasn't properly enforced and is running in "dry run" mode.
- C. The policy constraint on the folder level does not have any effect because of an "allow" value for that constraint on the organizational level.
- D. A project level, the organizational policy control has been overwritten with an "allow" value.
Answer: D
Explanation:
https://cloud.google.com/resource-manager/docs/organization-policy/understanding-hierarchy
NEW QUESTION # 162
A large financial institution is moving its Big Data analytics to Google Cloud Platform. They want to have maximum control over the encryption process of data stored at rest in BigQuery.
What technique should the institution use?
- A. Use a Cloud Hardware Security Module (Cloud HSM).
- B. Use Cloud Storage as a federated Data Source.
- C. Customer-supplied encryption keys (CSEK).
- D. Customer-managed encryption keys (CMEK).
Answer: D
Explanation:
Explanation
If you want to manage the key encryption keys used for your data at rest, instead of having Google manage the keys, use Cloud Key Management Service to manage your keys. This scenario is known as customer-managed encryption keys (CMEK). https://cloud.google.com/bigquery/docs/encryption-at-rest
NEW QUESTION # 163
An employer wants to track how bonus compensations have changed over time to identify employee outliers and correct earning disparities. This task must be performed without exposing the sensitive compensation data for any individual and must be reversible to identify the outlier.
Which Cloud Data Loss Prevention API technique should you use to accomplish this?
- A. CryptoReplaceFfxFpeConfig
- B. Redaction
- C. CryptoHashConfig
- D. Generalization
Answer: D
Explanation:
By bucketing or generalizing, we achieve a reversible pseudonymised data that can still yield the required analysis. https://cloud.google.com/dlp/docs/concepts-bucketing
NEW QUESTION # 164
Your company is concerned about unauthorized parties gaining access to the Google Cloud environment by using a fake login page. You must implement a solution to protect against person-in-the-middle attacks.
Which security measure should you use?
- A. Security key
- B. Google prompt
- C. Google Authenticator application
- D. Text message or phone call code
Answer: A
Explanation:
A security key is a physical device that you can use for two-step verification, providing an additional layer of security for your Google Account. Security keys can defend against phishing and man-in-the-middle attacks, making your login process more secure.
NEW QUESTION # 165
Your organization is moving virtual machines (VMs) to Google Cloud. You must ensure that operating system images that are used across your projects are trusted and meet your security requirements.
What should you do?
- A. Automate a security scanner that verifies that no common vulnerabilities and exposures (CVEs) are present in your trusted image repository.
- B. Implement an organization policy constraint that enables the Shielded VM service on all projects to enforce the trusted image repository usage.
- C. Implement an organization policy to enforce that boot disks can only be created from images that come from the trusted image project.
- D. Create a Cloud Function that is automatically triggered when a new virtual machine is created from the trusted image repository Verify that the image is not deprecated.
Answer: C
Explanation:
* Define Trusted Image Projects:
* Identify the project or projects where your trusted operating system images are stored.
* Ensure these images meet your organization's security requirements and are regularly updated to mitigate vulnerabilities.
* Create an Organization Policy:
* Navigate to the Organization Policies page in the Google Cloud Console.
* Create a policy constraint that restricts the creation of boot disks to only those images stored in your trusted image project(s).
* The policy constraint to use is constraints/compute.trustedImageProjects.
* Apply the Policy:
* Apply this organization policy at the appropriate level (organization, folder, or project) to enforce that all new VM instances use images from the trusted repository.
* This ensures consistency in the security posture across all projects within the organization.
* Monitor Compliance:
* Regularly monitor the compliance with this policy using audit logs and other monitoring tools.
* Update the trusted images as necessary to ensure they remain secure and compliant with your security standards.
References:
* Organization Policy Service
* Trusted Image Projects Constraint
NEW QUESTION # 166
A manager wants to start retaining security event logs for 2 years while minimizing costs. You write a filter to select the appropriate log entries.
Where should you export the logs?
- A. Cloud Pub/Sub topics
- B. BigQuery datasets
- C. Cloud Storage buckets
- D. StackDriver logging
Answer: C
NEW QUESTION # 167
Your team wants to centrally manage GCP IAM permissions from their on-premises Active Directory Service. Your team wants to manage permissions by AD group membership.
What should your team do to meet these requirements?
- A. Set up SAML 2.0 Single Sign-On (SSO), and assign IAM permissions to the groups.
- B. Set up Cloud Directory Sync to sync groups, and set IAM permissions on the groups.
- C. Use the Cloud Identity and Access Management API to create groups and IAM permissions from Active Directory.
- D. Use the Admin SDK to create groups and assign IAM permissions from Active Directory.
Answer: A
Explanation:
Reference:
https://cloud.google.com/blog/products/identity-security/using-your-existing-identity-management- system-with-google-cloud-platform
NEW QUESTION # 168
Your organization wants to protect all workloads that run on Compute Engine VM to ensure that the instances weren't compromised by boot-level or kernel-level malware. Also, you need to ensure that data in use on the VM cannot be read by the underlying host system by using a hardware-based solution.
What should you do?
- A. 1. Activate Virtual Machine Threat Detection in Security Command Center (SCC) Premium.
2. Monitor the findings in SCC. - B. 1. Use Google Shielded VM including secure boot, Virtual Trusted Platform Module (vTPM), and integrity monitoring.
2. Activate Confidential Computing.
3. Enforce these actions by using organization policies. - C. 1. Use secure hardened images from the Google Cloud Marketplace.
2. When deploying the images, activate the Confidential Computing option.
3. Enforce the use of the correct images and Confidential Computing by using organization policies. - D. 1. Use Google Shielded VM including secure boot, Virtual Trusted Platform Module (vTPM), and integrity monitoring.
2. Create a Cloud Run function to check for the VM settings, generate metrics, and run the function regularly.
Answer: B
NEW QUESTION # 169
You are exporting application logs to Cloud Storage. You encounter an error message that the log sinks don't support uniform bucket-level access policies. How should you resolve this error?
- A. Change the access control model for the bucket
- B. Add the roles/logging.bucketWriter Identity and Access Management (IAM) role to the bucket for the log sink identity.
- C. Update your sink with the correct bucket destination.
- D. Add the roles/logging.logWriter Identity and Access Management (IAM) role to the bucket for the log sink identity.
Answer: C
NEW QUESTION # 170
Your organization's Google Cloud VMs are deployed via an instance template that configures them with a public IP address in order to host web services for external users. The VMs reside in a service project that is attached to a host (VPC) project containing one custom Shared VPC for the VMs. You have been asked to reduce the exposure of the VMs to the internet while continuing to service external users. You have already recreated the instance template without a public IP address configuration to launch the managed instance group (MIG). What should you do?
- A. Deploy an external HTTP(S) load balancer in the service project with the MIG as a backend.
- B. Deploy a Cloud NAT Gateway in the host (VPC) project for the MIG.
- C. Deploy an external HTTP(S) load balancer in the host (VPC) project with the MIG as a backend.
- D. Deploy a Cloud NAT Gateway in the service project for the MIG.
Answer: C
Explanation:
https://cloud.google.com/load-balancing/docs/https#shared-vpc
While you can create all the load balancing components and backends in the Shared VPC host project, this model does not separate network administration and service development responsibilities.
NEW QUESTION # 171
Your company's cloud security policy dictates that VM instances should not have an external IP address. You need to identify the Google Cloud service that will allow VM instances without external IP addresses to connect to the internet to update the VMs. Which service should you use?
- A. Cloud DNS
- B. TCP/UDP Load Balancing
- C. Cloud NAT
- D. Identity Aware-Proxy
Answer: C
NEW QUESTION # 172
You want to prevent users from accidentally deleting a Shared VPC host project. Which organization-level policy constraint should you enable?
- A. compute.restrictSharedVpcHostProjects
- B. compute.restrictXpnProjectLienRemoval
- C. compute.restrictSharedVpcSubnetworks
- D. compute.sharedReservationsOwnerProjects
Answer: B
Explanation:
Reference:
https://cloud.google.com/resource-manager/docs/organization-policy/org-policy-constraints#constraints-for-specific-services
- constraints/compute.restrictXpnProjectLienRemoval
- Restrict shared VPC project lien removal
This boolean constraint restricts the set of users that can remove a Shared VPC host project lien without organization-level permission where this constraint is set to True.
By default, any user with the permission to update liens can remove a Shared VPC host project lien. Enforcing this constraint requires that permission be granted at the organization level.
NEW QUESTION # 173
A customer deploys an application to App Engine and needs to check for Open Web Application Security Project (OWASP) vulnerabilities.
Which service should be used to accomplish this?
- A. Forseti Security
- B. Google Cloud Audit Logs
- C. Cloud Security Scanner
- D. Cloud Armor
Answer: C
Explanation:
Explanation/Reference: https://cloud.google.com/security-scanner/
NEW QUESTION # 174
......
Earning the Google Professional-Cloud-Security-Engineer certification can help professionals advance their careers in cloud security and demonstrate their expertise in cloud security best practices. It can also help organizations build and maintain secure and compliant cloud infrastructures on Google Cloud Platform, which is becoming the preferred choice for businesses of all sizes.
Verified Professional-Cloud-Security-Engineer dumps Q&As - 100% Pass from TrainingQuiz: https://www.trainingquiz.com/Professional-Cloud-Security-Engineer-practice-quiz.html
Pass Exam With Full Sureness - Professional-Cloud-Security-Engineer Dumps with 343 Questions: https://drive.google.com/open?id=1Ker8Cmt-KDYqTy2HHKyQf5qHusw0XdEz
