Free Professional Cloud Security Engineer Practice Questions

Sample Practice Questions

Try these 10 sample questions from the Professional Cloud Security Engineer practice bank. Each includes the answer and explanation. Continue with the interactive practice above to review the full question set.

1. 1An organization uses LDAP as its authoritative directory and plans to synchronize users and groups with Google using GCDS. What happens to the LDAP directory during synchronization?

   1. A. It receives changes made to Google user and group records.
   2. B. It remains unchanged while Google directory data is aligned to it.
   3. C. It is replaced by an exported copy of the Google directory.
   4. D. It receives Google group changes but retains local user records.

   Answer: B

   Explanation: Google states, "Performs a one-way synchronization. Data on your LDAP server is never updated or altered." LDAP remains authoritative; GCDS does not write Google-side changes back to it.

   Reference: About Google Cloud Directory Sync — Benefits of using GCDS to sync data

2. 2An HTTPS internal application must authorize access by employee identity and group membership without requiring a VPN. Which service provides this application access gate?

   1. A. Cloud NAT
   2. B. Identity-Aware Proxy
   3. C. Cloud DNS
   4. D. Cloud Interconnect

   Answer: B

   Explanation: IAP provides a "central authorization layer for applications accessed by HTTPS". It checks identity and IAM authorization without requiring a VPN. NAT, DNS, and Interconnect provide network services rather than this identity-based application gate.

   Reference: Identity-Aware Proxy overview — Overview; How IAP works

3. 3A Sensitive Data Protection transformation must remove each detected email address completely from submitted text, without inserting a replacement marker. Which primitive transformation meets this requirement?

   1. A. replaceConfig with a fixed marker
   2. B. characterMaskConfig with a masking character
   3. C. redactConfig
   4. D. cryptoReplaceFfxFpeConfig

   Answer: C

   Explanation: The documentation states that redactConfig "redacts a given value by removing it completely." Replacement, masking, and encryption leave substitute content, contrary to the required deletion of matched values.

   Reference: De-identifying sensitive data — Primitive transformations > redactConfig

4. 4A GKE deployment must reject container images that have not satisfied the organization's configured approval policy. Which control provides deploy-time enforcement?

   1. A. Artifact Registry image storage
   2. B. Artifact Analysis vulnerability scanning
   3. C. Binary Authorization enforcement
   4. D. Cloud Build build-history retention

   Answer: C

   Explanation: Binary Authorization provides "A deploy-time enforcer that prevents images that violate the policy from being deployed". Storing, scanning, or recording builds supplies information but does not itself enforce this admission policy.

   Reference: Binary Authorization overview — Features

5. 5Under Google's shared responsibility description for IaaS, which area is primarily part of the cloud provider's responsibility?

   1. A. Application authorization and business-role design
   2. B. Classification of confidential business data
   3. C. Underlying infrastructure and physical security
   4. D. Selection of workload-specific security policies

   Answer: C

   Explanation: For IaaS, the guide says provider responsibilities focus on "the underlying infrastructure and physical security." Customers retain workload-specific security duties, including their application access and data requirements.

   Reference: Shared responsibilities and shared fate on Google Cloud — Shared responsibility > Defined by workloads > IaaS

6. 6Contractors must use their external identity provider to access supported Google Cloud services without provisioning Google-managed user accounts. Which identity approach meets this requirement?

   1. A. Google Cloud Directory Sync with LDAP synchronization
   2. B. Password Sync with Microsoft Active Directory
   3. C. Workload Identity Federation for service workloads
   4. D. Workforce Identity Federation for external users

   Answer: D

   Explanation: The documentation states, "Workforce Identity Federation is sync-less" and "Workforce Identity Federation federates user identities whereas Workload Identity Federation federates workload identities." Workforce federation provides the required human identity access without account synchronization.

   Reference: Workforce Identity Federation — Federation versus synchronization; Workforce Identity Federation versus Workload Identity Federation

7. 7A Compute Engine application is protected by IAP at its load balancer, but its VM application-serving port remains directly reachable from other VMs. What security risk must be addressed?

   1. A. Direct connections inherit the load balancer's IAP authorization checks.
   2. B. IAP disables network firewall evaluation for the application's VM.
   3. C. Direct connections automatically use the caller's IAP session cookie.
   4. D. Direct connections can bypass IAP authentication at the load balancer.

   Answer: D

   Explanation: The overview states, "users who can access the application-serving port of the Virtual Machine (VM) can bypass IAP authentication." Backend network access must therefore be restricted appropriately rather than assuming every path crosses IAP.

   Reference: Identity-Aware Proxy overview — How IAP works > authentication and backend access

8. 8A legacy field accepts exactly 12 numeric characters. Sensitive Data Protection must reversibly tokenize its valid 12-digit identifiers while preserving their length and numeric alphabet. Which transformation should be configured with the numeric alphabet?

   1. A. cryptoReplaceFfxFpeConfig
   2. B. redactConfig
   3. C. replaceWithInfoTypeConfig
   4. D. fixedSizeBucketingConfig

   Answer: A

   Explanation: The FPE token is "The same length as the input value." The permitted alphabet includes "NUMERIC". The guide also states, "When you de-identify data using the CryptoReplaceFfxFpeConfig or CryptoDeterministicConfig infoType transformations, you can re-identify that data, as long as you have the CryptoKey used to originally de-identify the data." With a numeric alphabet and the necessary key retained, FPE meets both the 12-digit format and reversibility constraints. Redaction, infoType labels, and bucketing do not.

   Reference: De-identifying sensitive data — Primitive transformations > cryptoReplaceFfxFpeConfig; Reversible transformations

9. 9A CI pipeline creates a Binary Authorization attestation after an image passes its checks. What identifies the image in the signed attestation record?

   1. A. The registry path and image digest
   2. B. The mutable image tag and build log URL
   3. C. The GKE cluster name and namespace
   4. D. The repository display name and creation date

   Answer: A

   Explanation: The attestation "contains the registry path and digest of the image". The digest identifies the checked artifact, rather than a mutable tag or deployment metadata.

   Reference: Binary Authorization overview — Authorization

10. 10A company moves an application to a PaaS service. According to Google's shared responsibility guidance, what customer responsibility remains despite the provider managing more platform controls?

    1. A. Data security and client protection
    2. B. Physical data-center operation and maintenance
    3. C. Underlying physical network maintenance
    4. D. Hardware replacement and physical equipment security

    Answer: A

    Explanation: For PaaS, the guidance states, "You remain responsible for your data security and client protection." Moving to PaaS changes the division of platform controls, but does not transfer the customer's data and client obligations to Google.

    Reference: Shared responsibilities and shared fate on Google Cloud — Shared responsibility > Defined by workloads > PaaS