Home Certifications Editorials

Exam overview and study plan

Google Cloud Certified - Professional Cloud Security Engineer Practice Questions

Google Cloud Certified - Professional Cloud Security Engineer

Read questions, check verified answers and discuss the reasoning. Use reading options to shape your revision, or switch to the simulator for timed practice.

View 25 free questions

25 questions in this view

Page 1 of 5

Question 1

Your organization must follow the Payment Card Industry Data Security Standard (PCI DSS). To prepare for an audit, you must detect deviations on an infrastructure-as-a-service level in your Google Cloud landing zone. What should you do?

Create an Assured Workloads folder in your Google Cloud organization. Migrate existing projects into the folder and monitor for deviations in the PCI DSS.
Activate Security Command Center Premium. Use the Compliance Monitoring product to filter findings that may not be PCI DSS compliant.
Use the Google Cloud Compliance Reports Manager to download the latest version of the PCI DSS report. Analyze the report to detect deviations.
Create a data profile covering all payment relevant data types. Configure Data Discovery and a risk analysis job in Google Cloud Sensitive Data Protection to analyze findings.

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Question 2

Your organization is using Google Cloud to develop and host its applications. Following Google-recommended practices, the team has created dedicated projects for development and production. Your development team is located in Canada and Germany. The operations team works exclusively from Germany to adhere to local laws. You need to ensure that admin access to Google Cloud APIs is restricted to these countries and environments. What should you do?

Group all development and production projects in separate folders. Activate the organization policy on the folders to restrict resource location according to the requirements.
Create dedicated VPC Service Controls perimeters for development and production projects. Configure distinct ingress policies to allow access from the respective countries.
Create dedicated firewall policies for each environment at the organization level, and then apply these policies to the projects. Create a rule to restrict access based on geolocations.
Create dedicated IAM groups for the Canadian and German developers. Grant access to the development and production projects according to the requirements.

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Question 3

You are implementing communications restrictions for specific services in your Google Cloud organization. Your data analytics team works in a dedicated folder. You need to ensure that access to BigQuery is controlled for that folder and its projects. The data analytics team must be able to control the restrictions only at the folder level. What should you do?

Define a hierarchical firewall policy on the folder to deny BigQuery access. Assign the data analytics team the Compute Organization Firewall Policy Admin role to allow the team to configure rules for the firewall policy.
Create a scoped policy on the folder with a service perimeter to restrict BigQuery access. Assign the data analytics team the Access Context Manager Editor role on the scoped policy to allow the team to configure the scoped policy.
Enforce the Restrict Resource Service Usage organization policy constraint on the folder to restrict BigQuery access. Assign the data analytics team the Organization Policy Administrator role to allow the team to manage exclusions within the folder.
Create an organization-level access policy with a service perimeter to restrict BigQuery access. Assign the data analytics team the Access Context Manager Editor role on the access policy to allow the team to configure the access policy.

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Question 4

Your organization is using AI to improve products through innovation. The developers want to use Gemini in Vertex AI on a project. You need to provide a secure Google Cloud environment to prevent and detect information leakages. What should you do?

Grant the developers and AI engineers the Vertex AI User role. Monitor the audit trails with Cloud Logging.
Deploy Model Armor to protect the Vertex AI endpoint. Review Security Command Center findings to detect information leakages.
Set up VPC Service Controls perimeters around the Vertex AI project. Enable Data Loss Prevention API for content inspection.
Implement a firewall rule that allows all traffic to and from the Vertex AI API endpoint.

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Question 5

You work for a large financial institution that uses Google Cloud. Your company has a strict policy that requires encryption at rest for all data. You want to enforce the use of approved customer-managed encryption keys (CMEKs) for all supported resources across the organization. You also want to prevent the creation of resources that do not comply with the encryption policy. What should you do?

Create a custom IAM role that allows creating resources only if CMEK is specified. Assign this role to all developers.
Implement an organization policy that sets the gcp.resourceLocations constraint to only allow resource creation in regions where approved CMEKs are available.
Develop a Cloud function triggered by Cloud Audit Logs for resource creation events. Configure the function to inspect resource configurations for approved CMEK usage and automatically delete or quarantine non-compliant resources.
Implement an organization policy that restricts the gcp.restrictNonCmekServices constraint to enforce CMEK usage for supported services and restricts the gcp.restrictCmekCryptoKeyProjects constraint to limit which keys can be used.

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Question 6

Your company uses Cloud Intrusion Detection System (Cloud IDS) to monitor network traffic for malicious activity. You have configured Cloud IDS endpoints in several VPC networks. Recently, there have been several reported incidents where legitimate application traffic was flagged as potentially malicious which caused disruptions. You need to refine your Cloud IDS configuration to reduce false positives without compromising threat detection capabilities. What should you do?

Analyze Cloud IDS logs to find false positive patterns and adjust the severity level of the affected signatures.
Disable Cloud IDS for the VPC networks where false positives are most frequent. Use VPC firewall rules for network security.
Increase the Cloud IDS threat severity level threshold to the highest setting.
Reduce the Cloud IDS threat severity level threshold to the lowest setting.

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Page 1 of 5

Build confidence for exam day with expert-reviewed questions and realistic practice. Your next certification starts here.

Company

About Contact Our Authors FAQ

Trust and policies

Methodology Editorial policy Terms and conditions Privacy policy

Contact

ExamPrepare LLC5203 Juan Tabo Blvd STE 2BAlbuquerque, NM 87111[email protected]

© 2026 ExamPrepare LLC. All rights reserved. All certification names, exam codes and logos are the property of their respective owners. All associated trademark and copyright rights belong to those owners. ExamPrepare is not affiliated with, endorsed by, or sponsored by any certification vendor.