Free Preparation Discussions
MENU
Google Professional Cloud Security Engineer Exam Questions
Free Google Professional Cloud Security Engineer Exam Actual Questions
Note: Premium Questions for Professional Cloud Security Engineer were last updated On Jul. 18, 2026 (see below)
Your financial services company has an audit requirement under a strict regulatory framework that requires comprehensive, immutable audit trails for all administrative and data access activity that ensures that data is kept for seven years. Your current logging is fragmented across individual projects. You need to establish a centralized, tamper-proof, long-term logging solution accessible for audits. What should you do?
The core requirements are: centralized, tamper-proof, long-term (seven years) immutable audit trails for administrative and data access activity.
Centralization: The current logging is fragmented. To centralize, you need to collect logs from across the organization. Cloud Logging sinks configured at the organization level are designed for this purpose. They allow you to route logs from all projects within an organization to a single destination.Extract Reference: 'Aggregated exports allow you to export logs from multiple Google Cloud projects, folders, or your entire organization. An aggregated export can include all logs from all included resources, or you can use queries to include only specific logs.' (Google Cloud documentation: https://cloud.google.com/logging/docs/export/aggregated_exports)
Long-Term Storage (Seven Years): Cloud Logging buckets have default retention periods (e.g., 30 days for Data Access logs, 400 days for Admin Activity logs) which are not sufficient for a seven-year requirement. Cloud Storage is ideal for long-term archival.Extract Reference: 'Cloud Storage is a highly scalable and durable object storage service suitable for archiving large volumes of data for extended periods.' (Google Cloud documentation, general overview of Cloud Storage features)
Tamper-Proof / Immutability: This is a critical requirement for audit trails in financial services under strict regulatory frameworks. Cloud Storage's 'object retention lock' feature provides immutability. Once an object retention lock is set on a bucket, objects within that bucket cannot be deleted or overwritten for a specified duration, ensuring data integrity for compliance purposes.Extract Reference: 'Object Retention Lock helps you meet compliance requirements by preventing data from being deleted or modified for a fixed amount of time or indefinitely. This feature satisfies SEC Rule 17a-4(f), FINRA Rule 4511(c), and CFTC Regulation 1.31(c)-(d) requirements.' (Google Cloud documentation: https://cloud.google.com/storage/docs/bucket-lock)
Let's evaluate the other options:
A . Implement Pub/Sub to stream all audit logs from each project in real-time to an external SIEM: While Pub/Sub can centralize real-time streaming to a SIEM, the solution described does not inherently guarantee tamper-proof storage or 7-year immutability within Google Cloud. The SIEM itself would need to provide those capabilities, which is outside the scope of Google Cloud's direct offering for this specific requirement.
C . Enable Security Command Center across the organization: Security Command Center (SCC) provides centralized visibility into security posture, threats, and compliance. However, SCC is a security management and monitoring platform; it does not serve as the primary long-term, immutable storage for raw audit logs. It consumes information from logs but doesn't store them in a way that meets the 7-year immutable archival requirement.
D . Individually configure Cloud Audit Logs for all Google Cloud services in each project. Store the logs in regional Cloud Logging buckets with 30-day retention policies: This fails on multiple counts: it's not centralized (requires individual configuration), and the 30-day retention in Cloud Logging buckets is far short of the seven-year requirement. It also doesn't explicitly guarantee tamper-proof storage beyond the default logging immutability.
Therefore, option B directly addresses all aspects of the requirement: centralization via organization-level sinks, long-term storage with Cloud Storage, and immutability/tamper-proofing with object retention lock.
A customer wants to make it convenient for their mobile workforce to access a CRM web interface that is hosted on Google Cloud Platform (GCP). The CRM can only be accessed by someone on the corporate network. The customer wants to make it available over the internet. Your team requires an authentication layer in front of the application that supports two-factor authentication
Which GCP product should the customer implement to meet these requirements?
Cloud Identity-Aware Proxy (Cloud IAP) provides a way to control access to your web applications and resources running on Google Cloud. It works by verifying the identity of a user trying to access the application and supports multi-factor authentication (MFA). Cloud IAP can restrict access to users on the corporate network and also supports access over the internet securely.
Steps:
Enable Cloud IAP: In the Google Cloud Console, navigate to the IAP section and enable IAP for your web application.
Configure OAuth Consent Screen: Set up the OAuth consent screen to manage how users grant access.
Set Up Authentication: Use Google Identity Platform to manage users and enable two-factor authentication.
Add Users: Grant users access to the application by adding their identities in the IAP settings.
Google Cloud: Identity-Aware Proxy
Setting up IAP
While migrating your organization's infrastructure to GCP, a large number of users will need to access GCP Console. The Identity Management team already has a well-established way to manage your users and want to keep using your existing Active Directory or LDAP server along with the existing SSO password.
What should you do?
To allow a large number of users to access the GCP Console while keeping the existing Active Directory or LDAP server for identity management, use Google Cloud Directory Sync (GCDS).
Install GCDS:
Download and install Google Cloud Directory Sync from here.
Configure GCDS:
Set up the synchronization by specifying the LDAP server details and the Google domain.
Map the LDAP attributes to Google attributes to ensure user data is synchronized correctly.
Run Synchronization:
Perform an initial synchronization to populate the Google domain with existing users from the LDAP server.
Schedule regular synchronizations to keep the data up-to-date.
Benefits:
Automated Sync: Ensures that user data is consistently updated without manual intervention.
Secure Access: Users can log in to the GCP Console using their existing credentials, enhancing security and user experience.
Google Cloud Directory Sync Documentation
GCDS Administration Guide
You are asked to recommend a solution to store and retrieve sensitive configuration data from an application that runs on Compute Engine. Which option should you recommend?
Objective: Store and retrieve sensitive configuration data for an application running on Compute Engine.
Solution: Use Secret Manager to securely store and manage access to sensitive configuration data.
Steps:
Step 1: Open the Google Cloud Console.
Step 2: Navigate to the Secret Manager section.
Step 3: Create a new secret and add the sensitive configuration data.
Step 4: Set appropriate IAM policies to control access to the secret.
Step 5: Update the application to retrieve the secret from Secret Manager using the appropriate client libraries or APIs.
Secret Manager provides a secure and centralized way to manage sensitive information, with fine-grained access control and audit logging capabilities.
Secret Manager Documentation
Storing and Accessing Secrets
You need to use Cloud External Key Manager to create an encryption key to encrypt specific BigQuery data at rest in Google Cloud. Which steps should you do first?
https://cloud.google.com/kms/docs/ekm#how_it_works
- First, you create or use an existing key in a supported external key management partner system. This key has a unique URI or key path.
- Next, you grant your Google Cloud project access to use the key, in the external key management partner system.
- In your Google Cloud project, you create a Cloud EKM key, using the URI or key path for the externally-managed key.
- Select Question Types you want
- Set your Desired Pass Percentage
- Allocate Time (Hours : Minutes)
- Create Multiple Practice tests with Limited Questions
- Customer Support
Frank Baker
19 days agoAdam Young
1 month agoLaura Cook
2 months agoPatricia Allen
2 months agoRobert Evans
3 months agoMark Martin
3 months agoOlivia Carter
3 months agoMaria Roberts
3 months agoKevin Sanchez
3 months agoChristopher Wilson
3 months agoMark Clark
3 months agoGayla
4 months agoBettina
4 months agoLeila
4 months agoOretha
4 months agoCarla
5 months agoCaitlin
5 months agoKimbery
5 months agoShakira
6 months agoPrecious
6 months agoHeidy
6 months agoMoon
6 months agoBillye
7 months agoGeorgeanna
7 months agoGeorgene
7 months agoMari
7 months agoLoren
8 months agoDesmond
8 months agoBettina
8 months agoAntonette
8 months agoLai
9 months agoIvette
9 months agoSantos
9 months agoMarget
9 months agoStephanie
10 months agoGlenna
10 months agoLetha
10 months agoLucina
11 months agoRoxanne
11 months agoLenny
1 year agoMalcom
1 year agoAntonio
1 year agoMargurite
1 year agoAugustine
1 year agoCraig
2 years agoMiles
2 years agoShawnta
2 years agoArlyne
2 years agoAn
2 years agoLaurel
2 years agoChun
2 years agoRenea
2 years agoRessie
2 years agoLashawna
2 years agoJospeh
2 years agoMiriam
2 years agoJavier
2 years agoJoesph
2 years agoBettina
2 years agoCurtis
2 years agoStefany
2 years agoChun
2 years agoKarina
2 years agoRaylene
2 years agoDaniela
2 years agoOcie
2 years agoKatie
2 years ago