Professional Cloud Security Engineer

Last checked October 22, 2026 against the official Google Cloud exam page.

1. Question 1Configure access

   Developers must be able to deploy to production, but they must not hold standing project owner rights. Which approach best meets this requirement?

   1. AAdd the developers to the Organisation Administrator group so that they can fix production issues directly
   2. BGive the developers a shared service account key with Owner rights, and rotate that key every quarter
   3. CUse Privileged Access Manager for approved, time-bound elevated roles that expire automatically
   4. DGrant Project Owner at the organisation level so that no approval workflow slows down deployments
   Show answer and explanationHide answer

   Correct answer: C

   Privileged Access Manager grants elevated roles just in time, with approval and expiry, so no one holds standing owner rights. A shared key with Owner rights is a standing, widely shared credential. Organisation Administrator and organisation-level Owner grants are broader still, and both remove the approval step the requirement depends on.

2. Question 2Secure communications and establish boundary protection

   A company must stop data exfiltration from its projects to services outside the organisation, while keeping normal access to Google APIs for its own workloads. Which control fits best?

   1. ACloud NAT with allowlisted destination IP addresses configured for each Google API endpoint
   2. BA VPC Service Controls perimeter around the projects, enforcing restricted Google APIs
   3. CCloud Armor rules with web application firewall signatures that match the hostnames of Google APIs
   4. DAn external HTTPS load balancer with an SSL policy that restricts the cipher suites accepted
   Show answer and explanationHide answer

   Correct answer: B

   A VPC Service Controls perimeter blocks API calls that would copy data out of the perimeter, while still allowing authorised access from inside it. Allowlisted NAT addresses cannot follow Google API endpoints reliably and do not stop copies through API calls. Cloud Armor filters inbound web traffic, and SSL policies control only the TLS handshake.

3. Question 3Ensure data protection

   A company wants Cloud Storage data encrypted with keys it can revoke centrally, with key usage logged and key administration separated from data administration. Which option meets this?

   1. ACustomer-managed keys in Cloud KMS, with separate key administrators and audit logs
   2. BClient-side encryption with keys stored in each engineer's password manager
   3. CGoogle-managed default keys with no additional logging enabled on the key usage
   4. DCustomer-supplied keys delivered by email to each project owner when a bucket is created
   Show answer and explanationHide answer

   Correct answer: A

   Customer-managed keys in Cloud KMS let the company disable or revoke keys centrally, with separate administrator roles and audit logs of key use. Google-managed keys are not controlled by the customer, and client-side keys held in password managers are hard to govern. Emailing keys to project owners exposes them and separates no duties.

4. Question 4Manage operations

   A security team must be alerted as soon as an IAM policy is changed on a production project. Which approach is most reliable?

   1. AReviewing the IAM policy page in the console every Friday afternoon for unexpected entries
   2. BA log-based alert on the SetIamPolicy audit entry, routed to on-call staff
   3. CAsking project owners to email the security team after each change they make to the policy
   4. DEnabling VPC flow logs on the production subnet so that changes to access can be seen in traffic
   Show answer and explanationHide answer

   Correct answer: B

   A log-based alert on the SetIamPolicy audit entry fires as soon as the change is recorded and routes it to people who can respond. Weekly console reviews detect changes days late, and emailing owners depends on them remembering. Flow logs record network traffic, not IAM policy changes.

5. Question 5Support compliance requirements

   An auditor asks for evidence that access to customer data was limited to approved personnel over the last year. Which source is the strongest evidence?

   1. AData access audit logs exported to a locked bucket, plus IAM policy history from Asset Inventory
   2. BScreenshots of the IAM console taken on the day the auditor asks, showing the current users
   3. CA spreadsheet of approved personnel that the security team maintains, with no system records attached
   4. DBilling reports that show how many users were active in each project during the year
   Show answer and explanationHide answer

   Correct answer: A

   Data access audit logs show who accessed data and when, and exporting them to a locked bucket keeps them tamper-resistant, while Asset Inventory history shows the policy state over time. Screenshots show only one moment, and spreadsheets are not system evidence. Billing reports count activity but do not show who accessed what.