Google Cloud Professional Cloud Security Engineer - Full Practice Exam 1

1. A CI workload runs outside Google Cloud and can present a trusted repository identity token. It must deploy only one approved project without storing long-lived Google credentials. Which two design choices meet these requirements? Select 2 answers.
2. A company has hundreds of analysts with identical access requirements. Joiners and leavers must be managed without editing every project policy individually. Which approach best fits?
3. A company wants common IAM grants for every production project while keeping development grants separate. Projects already belong to one organization. Which approach best fits?
4. A company wants reviewers to identify unused privileges before removing access from existing production workloads. Which approach best fits?
5. A compliance team needs administrative activity evidence showing the principal, resource, and time of supported Google Cloud changes. Which approach best fits?
6. A Compute Engine VM's guest application logs and memory metrics are absent, although basic platform metrics are visible. Which approach best fits?
7. A connection is allowed by a stateful VPC firewall rule. The team asks whether a separate reverse rule is normally required only for its response packets. Which approach best fits?
8. A custom business role requires a stable set of supported permissions not covered narrowly by an existing predefined role. Which approach best fits?
9. A data platform must discover likely personal-information fields before analysts receive access. Which approach best fits?
10. A data service uses provider-managed encryption at rest, but policy additionally requires customer control of supported key lifecycle. Which approach best fits?
11. A database contains highly sensitive fields that only a limited reviewer group should read, while other users may query ordinary columns. Which approach best fits?
12. A deployment must use one exact immutable container image rather than whichever artifact a mutable tag points to later. Which approach best fits?
13. A design must distinguish control of packet reachability from control of access to supported managed-service data APIs. Which approach best fits?
14. A developer needs temporary access as a service account for debugging. Administrators want auditable delegation without sharing a private key. Which approach best fits?
15. A firewall rule should identify target VMs through their workload service account rather than a broad subnet range. Which approach best fits?
16. A network team must verify which firewall rule allowed or denied a specific supported flow before changing policy. Which approach best fits?
17. A new security policy conflicts with a business exception requested for one workload. The exception must be reviewed and time limited. Which approach best fits?
18. A policy requires encryption keys to remain under an approved external key-management system for a supported Google Cloud integration. Which approach best fits?
19. A policy requires the organization to control encryption-key lifecycle for a supported cloud data service. Which approach best fits?
20. A private service design must prevent clients from bypassing an approved proxy and reaching the backend directly. Which approach best fits?
21. A private workload needs Google API connectivity, but an engineer assumes a service perimeter creates its network route. Which approach best fits?
22. A production credential is confirmed compromised. The service has an alternative credential path and responders need immediate risk reduction. Which approach best fits?
23. A project already inherits a broad role from its parent folder. An administrator removes the same role from the project's local allow policy, but access remains. Which approach best fits?
24. A provider has compliance attestations, but a customer application uses broad permissions and unapproved data retention. Is the application automatically compliant?
25. A public application should resist volumetric or application-edge attacks using supported protections. Which approach best fits?
26. A regulated dataset must remain within approved locations, including backup copies. The architect needs a defensible deployment decision. Which approach best fits?
27. A reporting application should show each tenant only its own rows in a shared analytical table. Which approach best fits?
28. A security automation should notify and open a case for a supported high-risk finding without receiving broad cloud administration privileges. Which approach best fits?
29. A security finding is technically valid but concerns a low-impact test resource, while another exposes sensitive production data. Which approach best fits?
30. A security team needs to control allowed network flows between workload tiers using sources, targets, protocols, and ports. Which approach best fits?
31. A service account can read secrets but a developer should only be allowed to attach it to a workload, not mint arbitrary credentials as it. Which approach best fits?
32. A supported data service must deny requests crossing an approved service perimeter unless an explicit ingress rule permits them. Which approach best fits?
33. A supported encrypted data service becomes unavailable after its customer-managed encryption key is disabled. What should the incident team check first?
34. A supported internet-facing HTTP application needs application-edge filtering and protected backend access so clients cannot bypass the edge policy. Which two controls should the team combine? Select 2 answers.
35. A team fixes one cloud misconfiguration that is repeatedly recreated by the deployment template. Which approach best fits?
36. A team must prohibit service-account key creation across a governed resource hierarchy, rather than merely discouraging developers from creating keys. Which approach best fits?
37. A team wants to use a new cloud service for regulated data before checking its supported compliance features. Which approach best fits?
38. A threat model includes exposure of sensitive data while processed in memory on eligible compute hardware. Which approach best fits?
39. A workload processes regulated information through several managed services and exports. The compliance review covers all processing locations. Which approach best fits?
40. Administrators need identity-aware access to an internal web application without exposing unrestricted public access to its backend. Which approach best fits?
41. An analyst needs read-only access to one dataset. The administrator must avoid granting unrelated project administration permissions. Which approach best fits?
42. An application already has an IAM role but a request is blocked by a matching applicable deny policy. Adding another allow binding did not help. Which approach best fits?
43. An application emits an important business event only in logs. Operations needs a numerical time series counting those events for alerting. Which approach best fits?
44. An application needs versioned database passwords with controlled access, rather than keeping plaintext credentials in source code. Which approach best fits?
45. An application runs on a Compute Engine VM and needs Google API access as a workload identity, without embedding credentials in its image. Which approach best fits?
46. An application sends sensitive information between client and server over an unencrypted channel. Which approach best fits?
47. An artifact repository needs control over who may upload or download application container images. Which approach best fits?
48. An audit trail must remain available for a required period and protected from unauthorized deletion. Which approach best fits?
49. An emergency administrator needs elevated access only during an incident, with approval and auditability rather than a permanent broad grant. Which approach best fits?
50. An external workload federation trust accepts tokens from an entire identity-provider tenant, but only one repository should deploy production workloads. Which approach best fits?
51. An internet-facing web application needs HTTP-layer protection against common injection attacks and abusive request patterns at its supported load balancer. Which approach best fits?
52. An organization must route matching logs from multiple projects to a centralized destination according to defined inclusion filters. Which approach best fits?
53. An organization needs to detect security telemetry gaps when a log source unexpectedly stops sending events. Which approach best fits?
54. Analysts need consistent joinable replacements for customer identifiers without access to the original values. Which approach best fits?
55. Auditors request proof of who approved privileged access and what administrative actions followed. Which approach best fits?
56. Compliance requires cryptographic operations using keys backed by hardware security modules in the managed key service. Which approach best fits?
57. Different GKE applications need distinct Google API permissions without sharing the node's broad identity. Which approach best fits?
58. Responders see a possibly compromised service account and need to understand recent supported administrative activity before containment. Which approach best fits?
59. Security needs organization-wide discovery and prioritization of supported cloud misconfigurations and vulnerabilities. Which approach best fits?
60. Sensitive managed-service data should be protected against access paths outside an approved perimeter, in addition to valid IAM permissions. Which approach best fits?

Comments — 0