Professional Cloud Security Engineer Practice Test

Answer choices

1. A. Establish a strict, unchanging firewall configuration for all resources, hindering adaptability, for the stated implementation and support requirements.
2. B. Employ a single, broad firewall rule across all projects to simplify administration, creating significant security risks, within the described operational context.
3. C. Use organization and folder policies for centralized control across projects, as the recommended implementation across the complete governed service lifecycle.
4. D. Apply equivalent organization-policy constraints separately in each project, as the proposed . configuring access (~25%) approach.

Wrong-answer review

• A. Establish a strict, unchanging firewall configuration for all resources, hindering adaptability, for the stated implementation and support requirements.: A strict, unchanging firewall configuration lacks the flexibility needed to adapt to evolving business requirements and security threats. It would hinder the ability to respond to new risks and potentially block legitimate traffic, impacting application functionality.
• B. Employ a single, broad firewall rule across all projects to simplify administration, creating significant security risks, within the described operational context.: A single, broad firewall rule is a significant security risk. It provides insufficient granularity and could inadvertently expose sensitive resources, making the entire environment vulnerable to attack. This approach also violates the principle of least privilege.
• D. Apply equivalent organization-policy constraints separately in each project, as the proposed . configuring access (~25%) approach.: Per-project duplication increases drift and administrative overhead compared with inheriting centrally governed policies through the hierarchy.

Answer choices

1. A. Apply layered AI controls to data, model access, prompts, outputs, identities, and supply chain, within the defined security and accountability boundaries.
2. B. Use public training data and rely on provider defaults for the model and prompt layer, within the proposed design.
3. C. Put the endpoint behind Cloud Armor and treat training and inference data as ordinary application data.
4. D. Choose CMEK for training data and defer model and prompt risks until after deployment, for the stated scenario.

Answer choices

1. A. Assume Google owns every security control because the workload runs on Google Cloud, under organization-wide implementation-governance requirements.
2. B. Treat every service as IaaS and require the customer to secure Google hardware, under the organization’s defined implementation and exception-management process.
3. C. Document the service responsibility split and map requirements to customer-managed controls, within the described operational context.
4. D. Use Access Approval as the main control for employee and application access to customer data.

Answer choices

1. A. Establish a strict log retention policy based solely on legal requirements, for the specified implementation requirement.
2. B. Define required events, data-access logging, retention, protected access, aggregation, routing, analysis, and response, for the required business outcome.
3. C. Prioritize logging only critical events based on initial risk assessments, within the documented operational, security, ownership, and validation requirements.
4. D. Implement a centralized logging solution without considering specific security requirements, for the stated implementation and support requirements.

Answer choices

1. A. Use Cloud DNS to rewrite the payment gateway name to an internal service address, as the organization’s selected response.
2. B. Assign public IP addresses to every node and allow the gateway to discover them dynamically, as the recommended response to this scenario.
3. C. Use Private Service Connect for the public gateway without configuring a NAT path, under the proposed approach.
4. D. Use Cloud NAT with a reserved external address for the node subnet and enforce egress policy separately, within the proposed design.

Answer choices

1. A. Binary Authorization, within the . ensuring data protection (~23%) context.
2. B. Cloud Armor WAF rules, for the stated scenario.
3. C. Security Command Center threat findings
4. D. Use Sensitive Data Protection, within the . ensuring data protection (~23%) context.

Answer choices

1. A. Use the provider's default configurations as evidence that every HIPAA requirement is already satisfied, within organization-wide risk-and-accountability boundaries.
2. B. Manually configure all Google Cloud services to meet each specific HIPAA requirement, ensuring granular control over every setting, as the organization’s selected response.
3. C. Implement a single, comprehensive security policy covering all Google Cloud environments, regardless of the specific compliance requirements, for the stated security, delivery, and accountability requirements.
4. D. Map in-scope resources to controls, evidence, ownership, and monitoring, for the described technical objective and its associated operational control requirements, for the stated requirement.

Answer choices

1. A. Enable Data Access audit logs, as the selected response to the described condition.
2. B. Increase VPC Flow Logs sampling to 100 percent
3. C. Use Cloud Armor request logging, for the affected environment.
4. D. Enable Access Transparency for employee reads, for the stated scenario.

Answer choices

1. A. Employ workload identity federation to eliminate the need for service account keys entirely, for the stated implementation and support requirements.
2. B. Generate long-lived service account keys and distribute them to all developers, as the recommended implementation across the complete governed service lifecycle.
3. C. Utilize service accounts with broad permissions to facilitate rapid application deployment, for the required outcome.
4. D. Store a service account key in Secret Manager and rotate it on a fixed schedule, under end-to-end security-and-governance requirements.

Answer choices

1. A. Utilize a traditional firewall with public IP addresses, within the defined security and accountability boundaries.
2. B. Implement a VPN tunnel to a Google Cloud bastion host, for this task.
3. C. Deploy Private Google Access to restrict public API access, for the described technical objective and its associated operational control requirements.
4. D. Configure Cloud Interconnect for direct network connectivity, within the documented operational, security, ownership, and validation requirements.