[Aug 27, 2026] Valid Professional-Cloud-Security-Engineer Test Answers & Google Professional-Cloud-Security-Engineer Exam PDF [Q29-Q49]

[Aug 27, 2026] Valid Professional-Cloud-Security-Engineer Test Answers & Google Professional-Cloud-Security-Engineer Exam PDF [Q29-Q49]

4.2/5 - (4 votes)

[Aug 27, 2026] Valid Professional-Cloud-Security-Engineer Test Answers & Google Professional-Cloud-Security-Engineer Exam PDF

Realistic Professional-Cloud-Security-Engineer Exam Dumps with Accurate & Updated Questions

Google Professional-Cloud-Security-Engineer exam is a challenging and comprehensive certification exam that requires a deep understanding of cloud security principles and GCP services. Earning this certification is a testament to a security engineer’s expertise in securing GCP environments and demonstrates a commitment to continuous learning and professional growth in the field of cloud security.

NEW QUESTION 29
Which Google Cloud service should you use to enforce access control policies for applications and resources?

Identity-Aware Proxy

Cloud NAT

Google Cloud Armor

Shielded VMs

NEW QUESTION 30
You are a member of your company’s security team. You have been asked to reduce your Linux bastion host external attack surface by removing all public IP addresses. Site Reliability Engineers (SREs) require access to the bastion host from public locations so they can access the internal VPC while off-site. How should you enable this access?

Implement Cloud VPN for the region where the bastion host lives.

Implement OS Login with 2-step verification for the bastion host.

Implement Identity-Aware Proxy TCP forwarding for the bastion host.

Implement Google Cloud Armor in front of the bastion host.

NEW QUESTION 31
Your organization operates in a highly regulated environment and has a stringent set of compliance requirements for protecting customer data. You must encrypt data while in use to meet regulations. What should you do?

Use customer-managed encryption keys (CMEK) and Cloud KSM to enable your organization to control their keys for data encryption in Cloud SQL

Enable the use of customer-supplied encryption keys (CSEK) keys in the Google Compute Engine VMs to give your organization maximum control over their VM disk encryption.

Establish a trusted execution environment with a Confidential VM.

Use a Shielded VM to ensure a secure boot with integrity monitoring for the application environment.

NEW QUESTION 32
In order to meet PCI DSS requirements, a customer wants to ensure that all outbound traffic is authorized.
Which two cloud offerings meet this requirement without additional compensating controls? (Choose two.)

App Engine

Cloud Functions

Compute Engine

Google Kubernetes Engine

Cloud Storage

NEW QUESTION 33
How should a customer reliably deliver Stackdriver logs from GCP to their on-premises SIEM system?

Send all logs to the SIEM system via an existing protocol such as syslog.

Configure every project to export all their logs to a common BigQuery DataSet, which will be queried by the SIEM system.

Configure Organizational Log Sinks to export logs to a Cloud Pub/Sub Topic, which will be sent to the SIEM via Dataflow.

Build a connector for the SIEM to query for all logs in real time from the GCP RESTful JSON APIs.

NEW QUESTION 34
A customer is running an analytics workload on Google Cloud Platform (GCP) where Compute Engine instances are accessing data stored on Cloud Storage. Your team wants to make sure that this workload will not be able to access, or be accessed from, the internet.
Which two strategies should your team use to meet these requirements? (Choose two.)

Configure Private Google Access on the Compute Engine subnet

Avoid assigning public IP addresses to the Compute Engine cluster.

Make sure that the Compute Engine cluster is running on a separate subnet.

Turn off IP forwarding on the Compute Engine instances in the cluster.

Configure a Cloud NAT gateway.

NEW QUESTION 35
A large e-retailer is moving to Google Cloud Platform with its ecommerce website. The company wants to ensure payment information is encrypted between the customer’s browser and GCP when the customers checkout online.
What should they do?

Configure an SSL Certificate on an L7 Load Balancer and require encryption.

Configure an SSL Certificate on a Network TCP Load Balancer and require encryption.

Configure the firewall to allow inbound traffic on port 443, and block all other inbound traffic.

Configure the firewall to allow outbound traffic on port 443, and block all other outbound traffic.

NEW QUESTION 36
For data residency requirements, you want your secrets in Google Clouds Secret Manager to only have payloads in europe-west1 and europe-west4. Your secrets must be highly available in both regions.
What should you do?

Create your secret with a user managed replication policy, and choose only compliant locations.

Create your secret with an automatic replication policy, and choose only compliant locations.

Create two secrets by using Terraform, one in europe-west1 and the other in europe-west4.

Create your secret with an automatic replication policy, and create an organizational policy to deny secret creation in non-compliant locations.

NEW QUESTION 37
A customer needs to rely on their existing user directory with the requirements of native authentication against it when developing for Google Cloud Platform (GCP). They want to leverage their existing tooling and functionality to gather insight on user activity from a familiar interface. Which action should you take to meet the customer’s requirements?

Provision users into Cloud Identity using Just-in-Time SAML 2.0 user provisioning with the customer User Directory as source.

Configure Cloud Identity as a SAML 2.0 Service Provider, using the customer’s User Directory as the Identity Provider.

Configure and enforce 2-Step Verification in Cloud Identity for all Super Admins.

Configure a third-party IdP (Octa or Ping Federate) to manage authentication.

NEW QUESTION 38
Your company has deployed an application on Compute Engine. The application is accessible by clients on port 587. You need to balance the load between the different instances running the application. The connection should be secured using TLS, and terminated by the Load Balancer.
What type of Load Balancing should you use?

Network Load Balancing

HTTP(S) Load Balancing

TCP Proxy Load Balancing

SSL Proxy Load Balancing

NEW QUESTION 39
You are on your company’s development team. You noticed that your web application hosted in staging on GKE dynamically includes user data in web pages without first properly validating the inputted dat a. This could allow an attacker to execute gibberish commands and display arbitrary content in a victim user’s browser in a production environment.
How should you prevent and fix this vulnerability?

Use Cloud IAP based on IP address or end-user device attributes to prevent and fix the vulnerability.

Set up an HTTPS load balancer, and then use Cloud Armor for the production environment to prevent the potential XSS attack.

Use Web Security Scanner to validate the usage of an outdated library in the code, and then use a secured version of the included library.

Use Web Security Scanner in staging to simulate an XSS injection attack, and then use a templating system that supports contextual auto-escaping.

NEW QUESTION 40
A database administrator notices malicious activities within their Cloud SQL instance. The database administrator wants to monitor the API calls that read the configuration or metadata of resources. Which logs should the database administrator review?

Admin Activity

System Event

Access Transparency

Data Access

NEW QUESTION 41
Your company has deployed an artificial intelligence model in a central project As this model has a lot of sensitive intellectual property and must be kept strictly isolated from the internet, you must expose the model endpoint only to a defined list of projects in your organization What should you do?

Create a central project to host Shared VPC networks that are provided to all other projects Centrally administer all firewall rules in this project to grant access to the model

Activate Private Google Access in both the model project as well as in each project that needs to connect to the model Create a firewall policy to allow connectivity to Private Google Access addresses

Within the model project, create an internal Application Load Balancer that points to the model endpoint Expose this load balancer with Private Service Connect to a configured list of projects

Within the model project, create an external Application Load Balancer that points to the model endpoint Create a Cloud Armor policy to restrict IP addresses to Google Cloud

The problem requires exposing a sensitive AI model endpoint internally (strictly isolated from the internet) to a defined list of projects within the organization Internal Exposure and Isolation: An “internal Application Load Balancer” is suitable for exposing services within your VPC network, ensuring they are not accessible from the internet Private Service Connect (PSC): This is the key technology for securely and privately exposing services from one VPC network (the service producer, where the model is) to other VPC networks (the service consumers, the defined list of projects) within the same or different organizations PSC allows consumers to access services using internal IP addresses, with traffic remaining on Google’s private network You can configure a service attachment that points to the internal load balancer, and then permit specific consumer projects to connect to this service attachmentExtract Reference: “Private Service Connect is a capability of Google Cloud networking that allows consumers to access managed services privately from inside their VPC network Similarly, it allows managed service producers to host these services in their own separate VPC networks and offer a private connection to their consumers” (Google Cloud Documentation: “Private Service Connect | VPC” – https://cloudgooglecom/vpc/docs/private-service-connect) Extract Reference: “Private Service Connect endpoints are internal IP addresses in a consumer VPC network that can be directly accessed by clients in that network Endpoints are created by deploying a forwarding rule that references a service attachment or a bundle of Google APIs” (Google Cloud Documentation: “About Private Service Connect | VPC” – https://cloudgooglecom/vpc/docs/private-service-connect) Extract Reference: “Private Service Connect can be used to access managed services that are owned by Google, third-party software as a service (SaaS) companies, or other teams within the consumer’s own company Both published services and Google APIs can be targets of Private Service Connect” (Google Cloud Documentation: “About Private Service Connect | VPC” – https://cloudgooglecom/vpc/docs/private-service-connect) Let’s evaluate the other options:
A Shared VPC and central firewall rules: While Shared VPC centralizes network management, it does not provide a direct managed service exposure mechanism like PSC for a model endpoint to specific projects It’s more about sharing subnets and network resources Administering all firewall rules centrally would also not meet the need for exposing only this specific model to a defined list of projects in a managed, private service pattern B Activate Private Google Access (PGA): Private Google Access allows VMs without external IP addresses to access Google APIs and services (like Cloud Storage, BigQuery, etc) privately from within their VPC network It’s for consuming Google services, not for exposing custom services hosted in a Google Cloud project to other projects D External Application Load Balancer + Cloud Armor: An “external Application Load Balancer” exposes the service to the internet While Cloud Armor can restrict access based on IP addresses, it still involves internet exposure, which contradicts the “strictly isolated from the internet” requirement Restricting to “Google Cloud IP addresses” doesn’t guarantee access only to a defined list of projects and still exposes the service externally Therefore, creating an internal Application Load Balancer and exposing it via Private Service Connect is the most suitable and secure solution for this scenario

NEW QUESTION 42
A customer’s internal security team must manage its own encryption keys for encrypting data on Cloud Storage and decides to use customer-supplied encryption keys (CSEK).
How should the team complete this task?

Upload the encryption key to a Cloud Storage bucket, and then upload the object to the same bucket.

Use the gsutil command line tool to upload the object to Cloud Storage, and specify the location of the encryption key.

Generate an encryption key in the Google Cloud Platform Console, and upload an object to Cloud Storage using the specified key.

Encrypt the object, then use the gsutil command line tool or the Google Cloud Platform Console to upload the object to Cloud Storage.

NEW QUESTION 43
Your application is deployed as a highly available cross-region solution behind a global external HTTP(S) load balancer. You notice significant spikes in traffic from multiple IP addresses but it is unknown whether the IPs are malicious. You are concerned about your application’s availability. You want to limit traffic from these clients over a specified time interval.
What should you do?

Configure a rate_based_ban action by using Google Cloud Armor and set the ban_duration_sec parameter to the specified time interval.

Configure a deny action by using Google Cloud Armor to deny the clients that issued too many requests over the specified time interval.

Configure a throttle action by using Google Cloud Armor to limit the number of requests per client over a specified time interval.

Configure a firewall rule in your VPC to throttle traffic from the identified IP addresses.

NEW QUESTION 44
Your organization operates in a highly regulated industry and needs to implement strict controls around temporary access to sensitive Google Cloud resources. You have been using Access Approval to manage this access, but your compliance team has mandated the use of a custom signing key. Additionally, they require that the key be stored in a hardware security module (HSM) located outside Google Cloud. You need to configure Access Approval to use a custom signing key that meets the compliance requirements. What should you do?

Create a new asymmetric signing key in Cloud Key Management System (Cloud KMS) using a supported algorithm and grant the Access Approval service account the IAM signerVerifier role on the key.

Export your existing Access Approval signing key as a PEM file. Upload the file to your external HSM and reconfigure Access Approval to use the key from the HSM.

Create a signing key in your external HSM. Integrate the HSM with Cloud External Key Manager (Cloud EKM) and make the key available within your project. Configure Access Approval to use this key.

Create a new asymmetric signing key in Cloud KMS and configure the key with a rotation period of
30 days. Add the corresponding public key to your external HSM.

NEW QUESTION 45
You are in charge of migrating a legacy application from your company datacenters to GCP before the current maintenance contract expires. You do not know what ports the application is using and no documentation is available for you to check. You want to complete the migration without putting your environment at risk.
What should you do?

Migrate the application into an isolated project using a “Lift & Shift” approach. Enable all internal TCP traffic using VPC Firewall rules. Use VPC Flow logs to determine what traffic should be allowed for the application to work properly.

Migrate the application into an isolated project using a “Lift & Shift” approach in a custom network.
Disable all traffic within the VPC and look at the Firewall logs to determine what traffic should be allowed for the application to work properly.

Refactor the application into a micro-services architecture in a GKE cluster. Disable all traffic from outside the cluster using Firewall Rules. Use VPC Flow logs to determine what traffic should be allowed for the application to work properly.

Refactor the application into a micro-services architecture hosted in Cloud Functions in an isolated project.
Disable all traffic from outside your project using Firewall Rules. Use VPC Flow logs to determine what traffic should be allowed for the application to work properly.

NEW QUESTION 46
You are implementing data protection by design and in accordance with GDPR requirements. As part of design reviews, you are told that you need to manage the encryption key for a solution that includes workloads for Compute Engine, Google Kubernetes Engine, Cloud Storage, BigQuery, and Pub/Sub. Which option should you choose for this implementation?

Cloud External Key Manager

Customer-managed encryption keys

Customer-supplied encryption keys

Google default encryption

NEW QUESTION 47
What are the steps to encrypt data using envelope encryption?

Generate a data encryption key (DEK) locally.
Use a key encryption key (KEK) to wrap the DEK.
Encrypt data with the KEK.
Store the encrypted data and the wrapped KEK.

Generate a key encryption key (KEK) locally.
Use the KEK to generate a data encryption key (DEK).
Encrypt data with the DEK.
Store the encrypted data and the wrapped DEK.

Generate a data encryption key (DEK) locally.
Encrypt data with the DEK.
Use a key encryption key (KEK) to wrap the DEK.
Store the encrypted data and the wrapped DEK.

Generate a key encryption key (KEK) locally.
Generate a data encryption key (DEK) locally.
Encrypt data with the KEK.
Store the encrypted data and the wrapped DEK.

NEW QUESTION 48
You manage a mission-critical workload for your organization, which is in a highly regulated industry The workload uses Compute Engine VMs to analyze and process the sensitive data after it is uploaded to Cloud Storage from the endpomt computers. Your compliance team has detected that this workload does not meet the data protection requirements for sensitive data. You need to meet these requirements;
* Manage the data encryption key (DEK) outside the Google Cloud boundary.
* Maintain full control of encryption keys through a third-party provider.
* Encrypt the sensitive data before uploading it to Cloud Storage
* Decrypt the sensitive data during processing in the Compute Engine VMs
* Encrypt the sensitive data in memory while in use in the Compute Engine VMs What should you do?
Choose 2 answers

Create a VPC Service Controls service perimeter across your existing Compute Engine VMs and Cloud Storage buckets

Migrate the Compute Engine VMs to Confidential VMs to access the sensitive data.

Configure Cloud External Key Manager to encrypt the sensitive data before it is uploaded to Cloud Storage and decrypt the sensitive data after it is downloaded into your VMs

Create Confidential VMs to access the sensitive data.

Configure Customer Managed Encryption Keys to encrypt the sensitive data before it is uploaded to Cloud Storage, and decrypt the sensitive data after it is downloaded into your VMs.

NEW QUESTION 49
You manage one of your organization’s Google Cloud projects (Project A). AVPC Service Control (SC) perimeter is blocking API access requests to this project including Pub/Sub. A resource running under a service account in another project (Project B) needs to collect messages from a Pub/Sub topic in your project Project B is not included in a VPC SC perimeter. You need to provide access from Project B to the Pub/Sub topic in Project A using the principle of least Privilege.
What should you do?

Configure an ingress policy for the perimeter in Project A and allow access for the service account in Project B to collect messages.

Create an access level that allows a developer in Project B to subscribe to the Pub/Sub topic that is located in Project A.

Create a perimeter bridge between Project A and Project B to allow the required communication between both projects.

Remove the Pub/Sub API from the list of restricted services in the perimeter configuration for Project A.

Google Professional-Cloud-Security-Engineer exam is a certification offered by Google Cloud that tests an individual’s proficiency in securing an organization’s assets and data on the cloud platform. Google Cloud Certified – Professional Cloud Security Engineer Exam certification validates the expertise of the individual in designing and implementing secure cloud solutions, ensuring compliance with industry regulations, and managing incident responses in case of a security breach.

Professional-Cloud-Security-Engineer Exam Dumps – PDF Questions and Testing Engine: https://www.test4engine.com/Professional-Cloud-Security-Engineer_exam-latest-braindumps.html