Free Professional Cloud Security Engineer practice test: 30 questions with answers

Privileged Access Manager grants elevated roles just in time, with approval and expiry, so no one holds standing owner rights. A shared key with Owner rights is a standing, widely shared credential. Organisation Administrator and organisation-level Owner grants are broader still, and both remove the approval step the requirement depends on.

Scoping roles to specific projects and using attached identities removes both the excess permissions and the downloadable key that could leak. An organisation-wide Editor grant turns one leaked key into a company-wide compromise. A shared account widens the blast radius, and disabling audit logs removes the means of detecting misuse.

Identity-Aware Proxy checks identity and, through access levels, device posture before forwarding a request, which matches the requirement without a VPN. Cloud Armor geographic rules control where requests come from rather than what device is used. Cloud NAT and VPC peering control network paths and do not check the device at all.

An organisation policy constraint set at the top of the hierarchy applies to existing and future projects, so key creation is blocked everywhere. Firewall rules do not govern IAM API calls made through the console or gcloud. Alerts detect key creation after the fact, and KMS rotation covers encryption keys, not service account keys.

IAM Conditions add attribute-based restrictions, such as request time, resource name or tags, to a role binding. They are attached to bindings, not to key files, and they only narrow access granted by a role. Conditions work with predefined and custom roles, so the claim that they are limited to basic roles is wrong.

Short-lived credentials from attached identities or workload identity federation avoid long-lived key files, and minimising and rotating user-managed keys limits exposure. Owner roles and a single shared account over-privilege workloads. Storing key files in a repository exposes them to everyone with read access.

A VPC Service Controls perimeter blocks API calls that would copy data out of the perimeter, while still allowing authorised access from inside it. Allowlisted NAT addresses cannot follow Google API endpoints reliably and do not stop copies through API calls. Cloud Armor filters inbound web traffic, and SSL policies control only the TLS handshake.

Cloud Armor security policies on the global external load balancer absorb volumetric attacks at the edge, and adaptive protection and rate rules address layer-7 abuse such as bots. Low-TTL DNS helps failover but does not filter attacks. Signed URLs and VPN tunnels restrict access to content and networks, which does not solve public DDoS and bot abuse.

Private Service Connect exposes a service to consumers through private IP addresses in their own VPC, without VPN tunnels or public exposure. It is not limited to Cloud Storage and does not publish public addresses. Its design avoids needing a VPN for connectivity between the consumer and the service.

A service mesh with mutual TLS encrypts service-to-service traffic and authenticates each workload at the proxy layer, so application code does not change. Flow logs record connections but do not encrypt or authenticate them. IP allowlists do not provide encryption or identity, and Cloud NAT is designed for outbound traffic to external destinations.

A minimum TLS version of 1.2 with a modern SSL policy blocks outdated protocols, and central certificate management keeps renewals and trust under control. Accepting TLS 1.0 weakens every connection that uses it. Disabling validation or using self-signed certificates on public endpoints removes the trust checks that protect clients.

Identity-Aware Proxy TCP forwarding checks IAM before a session reaches the port, and firewall rules that admit only the IAP range stop direct connections from the internet. Open SSH with passwords and public IPs on every VM widen the exposure. Disabling serial console logs reduces visibility without restricting access.

Customer-managed keys in Cloud KMS let the company disable or revoke keys centrally, with separate administrator roles and audit logs of key use. Google-managed keys are not controlled by the customer, and client-side keys held in password managers are hard to govern. Emailing keys to project owners exposes them and separates no duties.

Policy tags restrict individual columns, and masking rules let different user groups see obscured values of sensitive columns while the rest of the table stays readable. A public bucket exposes the data to anyone. Project Viewer grants unrestricted reading, and a shared password is an insecure credential.

Sensitive Data Protection inspection jobs use infoTypes such as credit card numbers to find and classify sensitive values in Cloud Storage. Monitoring counts objects rather than inspecting their content. Log exclusion reduces logging volume, and nightly copies protect availability rather than revealing sensitive content.

A resource location organisation policy blocks resource creation outside approved regions for every project beneath the node where it is applied. Labels and wiki guidance rely on people and do not enforce anything. Replication copies data to the EU but does not stop resources being created elsewhere.

Rotation creates a new key version for new encryption while older versions remain available to decrypt data already encrypted with them. Cloud KMS does not allow plain-text export of key material, and destruction can be scheduled rather than immediate. Sharing keys is done by granting access to a key, not by copying key material.

A separate project with restricted delete rights limits who can remove backups, and retention locks stop deletion before the retention period ends, even by administrators. Shared Project Owner access and manual deletion when costs rise both increase the risk of loss. Disabling snapshots removes the recovery point the business relies on.

A log-based alert on the SetIamPolicy audit entry fires as soon as the change is recorded and routes it to people who can respond. Weekly console reviews detect changes days late, and emailing owners depends on them remembering. Flow logs record network traffic, not IAM policy changes.

The Premium tier of Security Command Center includes threat detection that identifies cryptomining and anomalous IAM activity, along with posture management. An asset inventory lists resources without detecting threats. Uptime checks and billing alerts do not identify attacker behaviour.

Exporting logs with a sink to a bucket with a locked retention policy keeps them for seven years in a form that cannot be shortened or altered. Default Cloud Logging retention is shorter than seven years, and local files can be edited or lost with the instance. Deleting logs and keeping summaries does not satisfy a requirement for the original records.

Isolating the VM contains the threat, and capturing disk and memory evidence preserves what happened before anything changes. Deleting or restarting the VM destroys evidence. Rotating every password is a broad response that can be needed, but it does not preserve the VM's evidence and is not the first step.

Automated playbooks can contain a compromised instance within minutes, and pre-approved runbooks with on-call routing let people act without debating the response. Weekly mailbox review and turning off alerts both delay or hide response. Disabling logging removes the evidence needed to detect and investigate incidents.

Policy Analyzer answers who can access a resource and which bindings grant the access, across the resource hierarchy. Billing exports show cost, monitoring counts API calls without naming who holds the access, and transfer logs describe copy jobs. None of them answers the access question directly.

Data access audit logs show who accessed data and when, and exporting them to a locked bucket keeps them tamper-resistant, while Asset Inventory history shows the policy state over time. Screenshots show only one moment, and spreadsheets are not system evidence. Billing reports count activity but do not show who accessed what.

Compliance Reports Manager provides Google Cloud's third-party audit reports and certifications, which compliance teams use in their own assessments. A customer's network diagram describes their design, not Google's controls. The status dashboard and pricing calculator serve operations and budgeting.

An enforced organisation policy prevents public access in the first place, and its evaluation history shows the control applied continuously. A verbal confirmation and old screenshots are point-in-time and not verifiable. Random bucket names are obscurity, which does not prevent public access.

Security Health Analytics continuously checks configuration against security best practices and maps findings to benchmarks such as CIS in Security Command Center. Cloud Build tests code changes rather than live configuration, and scheduled reviews are periodic rather than continuous. Pub/Sub dead-letter topics handle messaging failures.

A resource location policy technically restricts where resources can be created, and an Assured Workloads folder applies a compliance regime with location restrictions and monitoring. Labels record intent but do not enforce it, and relying on defaults is not a documented control. A printed diagram does not demonstrate where resources run.

Exporting logs to a locked bucket in a separate project keeps the evidence outside the reach of the administrators whose actions it records. Editable logs in the same project and local VM copies can be changed by the people being audited. Monthly email extracts are partial and easy to alter.