Free Preparation Discussions
MENU
Google Professional Cloud Security Engineer Exam Questions
Free Google Professional Cloud Security Engineer Exam Actual Questions
Note: Premium Questions for Professional Cloud Security Engineer were last updated On Jun. 01, 2026 (see below)
You are asked to recommend a solution to store and retrieve sensitive configuration data from an application that runs on Compute Engine. Which option should you recommend?
Objective: Store and retrieve sensitive configuration data for an application running on Compute Engine.
Solution: Use Secret Manager to securely store and manage access to sensitive configuration data.
Steps:
Step 1: Open the Google Cloud Console.
Step 2: Navigate to the Secret Manager section.
Step 3: Create a new secret and add the sensitive configuration data.
Step 4: Set appropriate IAM policies to control access to the secret.
Step 5: Update the application to retrieve the secret from Secret Manager using the appropriate client libraries or APIs.
Secret Manager provides a secure and centralized way to manage sensitive information, with fine-grained access control and audit logging capabilities.
Secret Manager Documentation
Storing and Accessing Secrets
You need to use Cloud External Key Manager to create an encryption key to encrypt specific BigQuery data at rest in Google Cloud. Which steps should you do first?
https://cloud.google.com/kms/docs/ekm#how_it_works
- First, you create or use an existing key in a supported external key management partner system. This key has a unique URI or key path.
- Next, you grant your Google Cloud project access to use the key, in the external key management partner system.
- In your Google Cloud project, you create a Cloud EKM key, using the URI or key path for the externally-managed key.
Your organization is using GitHub Actions as a continuous integration and delivery (Cl/CD) platform. You must enable access to Google Cloud resources from the Cl/CD pipelines in the most secure way.
What should you do?
Challenge:
Ensuring secure access to Google Cloud resources from GitHub Actions CI/CD pipelines without directly managing service account keys.
Workload Identity Federation:
Allows for the delegation of access to Google Cloud resources based on federated identities, such as those from GitHub.
Benefits:
This approach eliminates the need to manage service account keys, reducing the risk of key leakage.
It leverages GitHub's identity provider capabilities to authenticate and authorize access.
Steps to Configure Workload Identity Federation:
Step 1: Create a workload identity pool in Google Cloud.
Step 2: Add GitHub as an identity provider within the pool.
Step 3: Configure the necessary permissions and bindings for the identity pool to allow GitHub Actions to access Google Cloud resources.
Step 4: Update the GitHub Actions workflow to use the identity federation for authentication.
Workload Identity Federation
Configuring Workload Identity Federation with GitHub
location and to deploy different types of models in a consistent way You must ensure that your users can only access the approved models What should you do?
The problem states that the organization is using Model Garden and needs to ensure users can only access approved models This implies a need for a central, enforceable control mechanism
Organization Policies and Constraints: Google Cloud Organization Policy Service allows administrators to centrally control resources across an organization Constraints are specific types of restrictions that can be applied For AI Platform (which includes Vertex AI and Model Garden), there are specific constraints designed to control model usage
vertexaiallowedModels Constraint: This specific organization policy constraint is designed precisely to restrict which models can be used within a given organization, folder, or project It provides a centralized way to define a list of approved models that users are allowed to accessExtract Reference: 'The vertexaiallowedModels constraint allows you to specify a list of model URIs that are allowed to be used within the resource hierarchy' and 'This constraint helps organizations enforce compliance and control which models are consumed by their users' (Google Cloud documentation, typically found under Organization Policy Service constraints for Vertex AI or AI Platform)
Let's evaluate the other options:
A Configure IAM permissions on individual Model Garden to restrict access to specific models: IAM (Identity and Access Management) typically grants permissions at a broader resource level (eg, project, dataset, model resource) While you can control who can manage models, directly restricting access to specific models within Model Garden for consumption via IAM roles on individual models is not the primary mechanism for enforcing a list of approved models across an organization in a preventative way Organization policies are designed for this kind of broad, preventative control
B Regularly audit user activity logs in Vertex AI to identify and revoke access to unapproved models: Auditing logs is a reactive measure While important for monitoring and detecting violations, it does not prevent users from accessing unapproved models in the first place The requirement is to ensure they can only access approved models, implying a proactive control
C Train custom models within your Vertex AI project and restrict user access to these models: This is about managing access to custom-trained models, not about controlling access to the collection of models in Model Garden, which often includes pre-trained or publicly available models that need to be whitelisted It doesn't address the requirement of ensuring users only access approved models from the broader Model Garden collection
A company migrated their entire data/center to Google Cloud Platform. It is running thousands of instances across multiple projects managed by different departments. You want to have a historical record of what was running in Google Cloud Platform at any point in time.
What should you do?
To maintain a historical record of what was running in Google Cloud Platform at any point in time, you should use Forseti Security to automate inventory snapshots. Forseti Security is an open-source toolkit that helps to automate security and compliance in GCP by taking inventory snapshots of GCP resources.
Step-by-Step:
Install Forseti Security:
Follow the installation guide to deploy Forseti Security on your GCP environment.
Configure Inventory:
Set up the inventory module in Forseti to capture and store snapshots of GCP resources.
Schedule Snapshots:
Use Forseti's configuration to schedule regular inventory snapshots.
Access Historical Data:
Review and access historical records through Forseti's dashboard or by querying the Forseti database.
Compliance and Monitoring: Use Forseti to ensure compliance and monitor changes over time.
Forseti Security Overview
Inventory Module
- Select Question Types you want
- Set your Desired Pass Percentage
- Allocate Time (Hours : Minutes)
- Create Multiple Practice tests with Limited Questions
- Customer Support
Laura Cook
5 days agoPatricia Allen
17 days agoRobert Evans
1 month agoMark Martin
2 months agoOlivia Carter
1 month agoMaria Roberts
1 month agoKevin Sanchez
1 month agoChristopher Wilson
1 month agoMark Clark
1 month agoGayla
2 months agoBettina
2 months agoLeila
3 months agoOretha
3 months agoCarla
3 months agoCaitlin
4 months agoKimbery
4 months agoShakira
4 months agoPrecious
4 months agoHeidy
5 months agoMoon
5 months agoBillye
5 months agoGeorgeanna
5 months agoGeorgene
6 months agoMari
6 months agoLoren
6 months agoDesmond
6 months agoBettina
7 months agoAntonette
7 months agoLai
7 months agoIvette
7 months agoSantos
8 months agoMarget
8 months agoStephanie
8 months agoGlenna
8 months agoLetha
9 months agoLucina
9 months agoRoxanne
9 months agoLenny
11 months agoMalcom
12 months agoAntonio
1 year agoMargurite
1 year agoAugustine
1 year agoCraig
1 year agoMiles
1 year agoShawnta
1 year agoArlyne
2 years agoAn
2 years agoLaurel
2 years agoChun
2 years agoRenea
2 years agoRessie
2 years agoLashawna
2 years agoJospeh
2 years agoMiriam
2 years agoJavier
2 years agoJoesph
2 years agoBettina
2 years agoCurtis
2 years agoStefany
2 years agoChun
2 years agoKarina
2 years agoRaylene
2 years agoDaniela
2 years agoOcie
2 years agoKatie
2 years ago