VendorsExamsEnterprise
Support
Request an ExamContact UsFAQ

Professional Cloud Security Engineer Free Sample Questions

20 free sample questions234 in the full practice test Other version: GCP-PCSE(180)

Try simulator

PCSE Sample Questions

  1. Question 1

    Advanced

    Securing communications and establishing boundary protection · Establishing private connectivity to Google APIs

    A financial services company is migrating its batch processing workloads to Google Cloud. A key regulatory requirement is that no virtual machine involved in processing can have a public IP address. Additionally, these VMs must be able to pull dependencies from a public container registry and access Google Cloud APIs like BigQuery and Cloud Storage. The security team has mandated the most restrictive network configuration possible. Which configuration meets these stringent requirements?

    Answer and explanation

    Correct answer: D

    This is the most secure and correct configuration. A Cloud NAT gateway allows the VMs without public IPs to access the public container registry. Using the restricted.googleapis.com virtual IP address ensures that traffic to Google APIs does not traverse the public internet and is protected by VPC Service Controls, which is a more restrictive method than standard Private Google Access.

  2. Question 2

    Intermediate

    Configuring access · Managing and implementing authorization controls

    A security auditor is reviewing your organization's resource hierarchy. They have identified a critical folder containing production projects. The auditor requires a non-modifiable policy that prevents any user, including Organization Administrators, from linking projects in this critical folder to a non-approved billing account. Which IAM feature should you use to enforce this?

    Answer and explanation

    Correct answer: B

    IAM Deny policies are evaluated before any allow policies and cannot be overridden by more permissive IAM roles, including Organization Administrator. This makes them ideal for creating preventative guardrails. An Organization Policy could be modified or overridden by a user with sufficient permissions, making it less suitable for a non-modifiable control.

  3. Question 3

    AdvancedMultiple answers

    Ensuring data protection · Protecting sensitive data and preventing data loss

    You are designing a security strategy for a large-scale data analytics platform on Google Cloud. The platform ingests sensitive customer data into Cloud Storage, which is then processed by Dataproc clusters. You need to ensure that the raw data is de-identified before being loaded into a BigQuery data warehouse for analysis. The de-identification must be format-preserving and reversible by a small, authorized group of data custodians for auditing purposes. Which combination of services should you use? (Select TWO)

    Answer and explanation

    Correct answers: A, B

  4. Question 4

    Intermediate

    Managing operations · Configuring logging, monitoring, and detection

    A healthcare organization is deploying a new patient portal application on Google Kubernetes Engine (GKE). To comply with HIPAA, they must log all administrator actions and all access events to patient data stored in a backend Cloud SQL database. The security team wants to retain these specific logs for 10 years in a low-cost, immutable storage solution for potential audits. What is the most efficient way to configure this?

    Answer and explanation

    Correct answer: C

    This approach is the most efficient and meets all requirements. A log sink can be configured with a specific filter to only export the required audit logs. Exporting to Cloud Storage is cost-effective for long-term archival. Applying a retention policy and Bucket Lock ensures the logs are immutable for the specified 10-year period, satisfying audit and compliance needs.

  5. Question 5

    Intermediate

    Configuring access · Managing Cloud Identity

    Your company uses an on-premises Active Directory (AD) as its primary identity provider. You need to grant developers access to Google Cloud projects based on their AD group memberships. The security policy requires that users authenticate directly against the on-premises AD, and their session with Google Cloud should be valid for a maximum of 8 hours. What should you configure to meet these requirements?

    Answer and explanation

    Correct answer: B

    This solution meets all requirements. Configuring SAML-based SSO ensures that authentication happens directly against the on-premises AD FS. GCDS is used to sync group memberships, allowing for group-based IAM policies in Google Cloud. Session duration is controlled by the identity provider (AD FS in this case), satisfying the 8-hour session limit requirement.

  6. Question 6

    Beginner

    Managing operations · Configuring and monitoring Security Command Center

    A startup has deployed its entire infrastructure on Google Cloud. The CTO is concerned about the security posture and wants to proactively identify misconfigurations, such as publicly exposed Cloud Storage buckets, overly permissive IAM policies, and open firewall rules. The solution must be a managed Google Cloud service that provides a centralized dashboard of findings and integrates with the existing resource hierarchy. Which service should they implement?

    Answer and explanation

    Correct answer: C

    Security Command Center (SCC) is Google Cloud's centralized security and risk management platform. Its built-in service, Security Health Analytics, automatically scans for common misconfigurations and vulnerabilities across the organization, providing findings in a centralized dashboard. This perfectly matches the CTO's requirements for a managed, proactive security posture management tool.

  7. Question 7

    Intermediate

    Securing communications and establishing boundary protection · Identifying use cases and configuring VPC Service Controls

    True or False: A VPC Service Controls perimeter, when configured with an access level based on IP address, can restrict access to Google Cloud APIs like BigQuery to only requests originating from a corporate on-premises network.

    Answer and explanation

    Correct answer: A

    This statement is true. A VPC Service Controls perimeter defines a virtual boundary for Google Cloud services. An Access Level is a condition that can be applied to this perimeter, and it can be based on attributes like IP address, device type, or user identity. By creating an access level that specifies the public IP ranges of the corporate network, you can enforce that only requests from that location can access the protected services within the perimeter.

  8. Question 8

    Intermediate

    Ensuring data protection · Managing encryption at rest, in transit, and in use

    A new regulation requires your company to use FIPS 140-2 Level 3 validated hardware security modules (HSMs) for managing the encryption keys used to protect your most sensitive data in Cloud Storage. Your security policy prohibits Google personnel from having any access to the key material. Which Cloud KMS solution should you implement?

    Answer and explanation

    Correct answer: C

    Cloud EKM allows you to use keys managed in a supported third-party key management system to protect data in Google Cloud. By connecting it to your own FIPS 140-2 Level 3 validated HSM, you retain full control over the keys, and Google personnel have no access to the key material. Cloud HSM is FIPS 140-2 Level 3 validated, but it is a Google-managed service, which doesn't meet the strict requirement of prohibiting any Google personnel access.

  9. Question 9

    AdvancedMultiple answers

    Configuring access · Securing and protecting service accounts

    You are the security lead for a retail company. During a post-incident review of a data breach, it was discovered that a compromised service account key with Project Owner permissions was used to exfiltrate data from a production project. To prevent this from happening again, you want to implement a defense-in-depth strategy that limits the potential damage of a compromised credential. Which TWO controls would be most effective? (Select TWO)

    Answer and explanation

    Correct answers: A, B

  10. Question 10

    Intermediate

    Configuring access · Defining the resource hierarchy

    An organization wants to enforce that all new Compute Engine instances are created from a set of approved, hardened OS images. They also need to prevent developers from enabling serial port access on any VM. Which Google Cloud feature should be used to enforce these two requirements across the entire organization?

    Answer and explanation

    Correct answer: C

    The Organization Policy Service is designed for this exact purpose. It allows administrators to enforce constraints on how resources can be configured. The compute.trustedImageProjects constraint can be used to define a list of projects from which images can be used, and compute.disableSerialPortAccess can be set to True to prevent serial port access. Applying these at the organization root enforces them everywhere.

Register free for 10 more questions

Or unlock all 234 PCSE questions with explanations, timed mode and flashcards.

Related practice tests

All Google practice exams