Home
Google
Professional-Cloud-Security-Engineer: Professional Cloud Security Engineer Dumps

Free Google Professional Cloud Security Engineer Exam Dumps September 2026

Here you can find all the free questions related with Google Professional Cloud Security Engineer (Professional Cloud Security Engineer) exam. You can also find on this page links to recently updated premium files with which you can practice for actual Google Professional Cloud Security Engineer Exam. These premium versions are provided as Professional Cloud Security Engineer exam practice tests, both as desktop software and browser based application, you can use whatever suits your style. Feel free to try the Professional Cloud Security Engineer Exam premium files for free, Good luck with your Google Professional Cloud Security Engineer Exam.

Question No: 1

MultipleChoice

Your organization wants full control of the keys used to encrypt data at rest in their Google Cloud environments. Keys must be generated and stored outside of Google and integrate with many Google Services including BigQuery.

What should you do?

Options

ACreate a Cloud Key Management Service (KMS) key with imported key material Wrap the key for protection during import. Import the key generated on a trusted system in Cloud KMS.

BCreate a KMS key that is stored on a Google managed FIPS 140-2 level 3 Hardware Security Module (HSM) Manage the Identity and Access Management (IAM) permissions settings, and set up the key rotation period.

CUse Cloud External Key Management (EKM) that integrates with an external Hardware Security Module
(HSM) system from supported vendors.

DUse customer-supplied encryption keys (CSEK) with keys generated on trusted external systems Provide the raw CSEK as part of the API call.

Answer
CExplanation

Use Cloud External Key Management (EKM) that integrates with an external Hardware Security Module (HSM) system from supported vendors: Cloud EKM allows you to use encryption keys that are managed externally to Google Cloud. This means you can generate and store your keys in an on-premises HSM or another supported external HSM service, and integrate these keys with various Google Cloud services.

Integration with Google Services: Cloud EKM integrates seamlessly with many Google Cloud services, including BigQuery, Cloud Storage, Compute Engine, and more. This provides you with full control over your encryption keys while still taking advantage of Google Cloud's powerful services.

Cloud External Key Management (EKM) documentation

External Key Management overview

Question No: 2

MultipleChoice

Your organization has Google Cloud applications that require access to external web services You must monitor, control, and log access to these services What should you do?

Options

AConfigure VPC firewall rules to allow the services to access the IP addresses of required external web services

BSet up a Secure Web Proxy that allows access to the specific external web services Configure applications to use the proxy for the web service requests

CConfigure Google Cloud Armor to monitor and protect your applications by checking incoming traffic patterns for attack patterns

DSet up a Cloud NAT instance to allow egress traffic from your VPC

Answer
BExplanation

The problem states that Google Cloud applications need to access external web services and requires the ability to monitor, control, and log this access

Monitoring, Controlling, and Logging external web access: This specifically points to a proxy solution, which can intercept, inspect, and log HTTP/S traffic

Secure Web Proxy (SWP): Google Cloud's Secure Web Proxy is designed for exactly this use case It acts as an explicit forward proxy for HTTP(S) traffic, allowing organizations to implement granular access controls, inspect traffic for security threats, and log all outbound web requests from their Google Cloud environmentExtract Reference: 'Secure Web Proxy is a managed service that lets you deploy and manage an explicit forward proxy to protect your organization's internal resources from web-based threats and to control access to external web applications' and 'With Secure Web Proxy, you can: Enforce granular access policies based on different attributes, Log all HTTP(S) requests that are handled by the proxy, and Monitor web traffic for threats' (Google Cloud documentation: https://cloudgooglecom/secure-web-proxy)

Let's evaluate the other options:

A Configure VPC firewall rules to allow the services to access the IP addresses of required external web services: VPC firewall rules operate at Layer 4 (TCP/UDP) and Layer 3 (IP) While they can allow or deny traffic to specific IP addresses and ports, they cannot monitor, control, or log HTTP/S requests at the application layer They don't provide granular control over which web services are accessed or inspect the content of the requests

C Configure Google Cloud Armor to monitor and protect your applications by checking incoming traffic patterns for attack patterns: Google Cloud Armor is primarily a Distributed Denial of Service (DDoS) protection and Web Application Firewall (WAF) service It focuses on protecting applications from incoming threats (ingress traffic), not controlling and logging outgoing access to external web services

D Set up a Cloud NAT instance to allow egress traffic from your VPC: Cloud NAT allows instances without external IP addresses to connect to the internet While it enables egress, it does not provide monitoring, control, or logging capabilities for specific web services at the application layer It's a network address translation service, not an application-layer proxy

Therefore, setting up a Secure Web Proxy is the most appropriate solution to meet the requirements of monitoring, controlling, and logging access to external web services from Google Cloud applications

Question No: 3

MultipleChoice

You must ensure that the keys used for at-rest encryption of your data are compliant with your organization's security controls. One security control mandates that keys get rotated every 90 days. You must implement an effective detection strategy to validate if keys are rotated as required. What should you do?

Options

AAnalyze the crypto key versions of the keys by using data from Cloud Asset Inventory. If an active key is older than 90 days, send an alert message through your incident notification channel.

BIdentify keys that have not been rotated by using Security Health Analytics. If a key is not rotated after 90 days, a finding in Security Command Center is raised.

CAssess the keys in the Cloud Key Management Service by implementing code in Cloud Run. If a key is not rotated after 90 days, raise a finding in Security Command Center.

DDefine a metric that checks for timely key updates by using Cloud Logging. If a key is not rotated after 90 days, send an alert message through your incident notification channel.

Answer
A

Question No: 4

MultipleChoice

You are responsible for managing your company's identities in Google Cloud. Your company enforces 2-Step Verification (2SV) for all users. You need to reset a user's access, but the user lost their second factor for 2SV. You want to minimize risk. What should you do?

Options

AOn the Google Admin console, select the appropriate user account, and generate a backup code to allow the user to sign in. Ask the user to update their second factor.

BOn the Google Admin console, temporarily disable the 2SV requirements for all users. Ask the user to log in and add their new second factor to their account. Re-enable the 2SV requirement for all users.

COn the Google Admin console, select the appropriate user account, and temporarily disable 2SV for this account Ask the user to update their second factor, and then re-enable 2SV for this account.

DOn the Google Admin console, use a super administrator account to reset the user account's credentials. Ask the user to update their credentials after their first login.

Answer
AExplanation

If a user loses their second factor for 2-Step Verification (2SV), you can help them regain access with minimal risk by generating a backup code.

Generate a Backup Code (A):

In the Google Admin console, navigate to the user's account settings.

Generate a backup code for the user. This code allows them to sign in despite not having access to their usual second factor.

Instruct the user to log in using the backup code and then update their second factor in their account settings.

This method ensures that only the affected user's access is temporarily adjusted, minimizing risk while maintaining overall security policies.

Google Admin console 2-Step Verification documentation

Question No: 5

MultipleChoice

Your company must follow industry specific regulations. Therefore, you need to enforce customer-managed encryption keys (CMEK) for all new Cloud Storage resources in the organization called org1.

What command should you execute?

Options

A* organization policy: constraints/gcp.restrictStorageNonCraekServices
* binding at: orgl
* policy type: deny
* policy value: storage.gcogleapis.com

B* organization policy: constraints/gcp.restrictHonCmekServices
* binding at: orgl
* policy type: deny
* policy value: storage.googleapis.com

C* organization policy:constraints/gcp.restrictStorageNonCraekServices
* binding at: orgl
* policy type: allow
* policy value: all supported services

D* organization policy: constramts/gcp.restrictNonCmekServices
* binding at: orgl
* policy type: allow
* policy value: storage.googleapis.com

Answer
DExplanation

Requirement:

Enforce the use of Customer-Managed Encryption Keys (CMEK) for all new Cloud Storage resources in the organization.

Policy Constraint:

Use the constraints/gcp.restrictNonCmekServices constraint to enforce CMEK usage.

Policy Type and Value:

Set the policy type to allow to specify which services must use CMEK.

In this case, the policy value should be storage.googleapis.com to target Cloud Storage.

Command:

Applying the organization policy with the appropriate binding ensures that all new Cloud Storage resources under the organization will require CMEK.

Steps:

Step 1: Go to the Google Cloud Console.

Step 2: Navigate to the Organization Policies page.

Step 3: Apply the policy constraint constraints/gcp.restrictNonCmekServices with the allow policy type and storage.googleapis.com as the policy value.

Organization Policy Constraints

Customer-Managed Encryption Keys (CMEK)

Question No: 6

MultipleChoice

You want to evaluate GCP for PCI compliance. You need to identify Google's inherent controls.

Which document should you review to find the information?

Options

AGoogle Cloud Platform: Customer Responsibility Matrix

BPCI DSS Requirements and Security Assessment Procedures

CPCI SSC Cloud Computing Guidelines

DProduct documentation for Compute Engine

Answer
AExplanation

To evaluate Google Cloud Platform (GCP) for PCI compliance and identify Google's inherent controls, you should review the 'Google Cloud Platform: Customer Responsibility Matrix'. This document provides detailed information about the shared responsibility model, outlining the security controls managed by Google and those that are the responsibility of the customer.

Steps to access and use the document:

Access the Document:

Go to the Google Cloud compliance resource center.

Locate the 'Customer Responsibility Matrix' for PCI DSS compliance.

Review Inherent Controls:

The document lists various controls and specifies whether they are managed by Google, the customer, or both.

It covers different aspects such as infrastructure security, data protection, and compliance requirements.

Analyze PCI Compliance:

Use the matrix to understand which PCI DSS requirements are inherently addressed by Google Cloud.

Identify the controls you need to implement and manage as a customer to ensure full compliance.

By reviewing this document, you can gain a comprehensive understanding of the inherent controls provided by Google Cloud and the responsibilities you must fulfill to achieve PCI compliance.

Google Cloud Compliance Documentation

PCI DSS Compliance on Google Cloud

Question No: 7

MultipleChoice

A business unit at a multinational corporation signs up for GCP and starts moving workloads into GCP. The business unit creates a Cloud Identity domain with an organizational resource that has hundreds of projects.

Your team becomes aware of this and wants to take over managing permissions and auditing the domain resources.

Which type of access should your team grant to meet this requirement?

Options

AOrganization Administrator

BSecurity Reviewer

COrganization Role Administrator

DOrganization Policy Administrator

Answer
CExplanation

Here are the permissions available to organizationRoleAdmin

iam.roles.create

iam.roles.delete

iam.roles.undelete

iam.roles.get

iam.roles.list

iam.roles.update

resourcemanager.projects.get

resourcemanager.projects.getIamPolicy

resourcemanager.projects.list

resourcemanager.organizations.get

resourcemanager.organizations.getIamPolicy

There are sufficient as per least privilege policy. You can do user management as well as auditing.

https://cloud.google.com/iam/docs/understanding-custom-roles

Question No: 8

MultipleChoice

You want to prevent users from accidentally deleting a Shared VPC host project. Which organization-level policy constraint should you enable?

Options

Acompute.restrictSharedVpcHostProjects

Bcompute.restrictXpnProjectLienRemoval

Ccompute.restrictSharedVpcSubnetworks

Dcompute.sharedReservationsOwnerProjects

Answer
BExplanation

Enable the compute.restrictXpnProjectLienRemoval organization-level policy constraint:

This constraint prevents users from removing liens from Shared VPC host projects.

By enabling this constraint, you ensure that the Shared VPC host project cannot be accidentally deleted, as liens prevent deletion without proper authorization.

Apply this constraint via the Google Cloud Console or using the gcloud command-line tool.

Organization Policy Constraints

Shared VPC

Limited Time Offer

25%

Off

Get Premium Professional Cloud Security Engineer Questions as Interactive Web-Based Practice Test or PDF