Free Professional Cloud Security Engineer Exam Questions and Answers

Last updated: September 7, 2026

Provider

Google

Questions in our bank

1000+

Free to read

First 10, with answers

Official page

Official Exam website

Our test mode duration & pass mark

130 mins · 70%

Verified answers

Reviewed weekly

Recommended: Switch to Test Mode to start a practice test that simulates the real exam experience.

1. Question #1

   A customer has an analytics workload running on Compute Engine that should have limited internet access. Your team created an egress firewall rule to deny (priority 1000) all traffic to the internet. The Compute Engine instances now need to reach out to the public repository to get security updates. What should your team do?

   • A. Create an egress firewall rule to allow traffic to the CIDR range of the repository with a priority greater than 1000.
   • B. Create an egress firewall rule to allow traffic to the CIDR range of the repository with a priority less than 1000.
   • C. Create an egress firewall rule to allow traffic to the hostname of the repository with a priority greater than 1000.
   • D. Create an egress firewall rule to allow traffic to the hostname of the repository with a priority less than 1000.
   Reveal Answer

2. Question #2

   What are the steps to encrypt data using envelope encryption?

   • A. Generate a data encryption key (DEK) locally.Use a key encryption key (KEK) to wrap the DE
   • B. Encrypt data with the KE
   • C. Store the encrypted data and the wrapped KEK.
   • D. Generate a key encryption key (KEK) locally.Use the KEK to generate a data encryption key (DEK). Encrypt data with the DE
   Reveal Answer

3. Question #3

   How should a customer reliably deliver Stackdriver logs from GCP to their on-premises SIEM system?

   • A. Send all logs to the SIEM system via an existing protocol such as syslog.
   • B. Configure every project to export all their logs to a common BigQuery DataSet, which will be queried by the SIEM system.
   • C. Configure Organizational Log Sinks to export logs to a Cloud Pub/Sub Topic, which will be sent to the SIEM via Dataflow.
   • D. Build a connector for the SIEM to query for all logs in real time from the GCP RESTful JSON APIs.
   Reveal Answer

4. Question #4

   A customer deployed an application on Compute Engine that takes advantage of the elastic nature of cloud computing. How can you work with Infrastructure Operations Engineers to best ensure that Windows Compute Engine VMs are up to date with all the latest OS patches?

   • A. Build new base images when patches are available, and use a CI/CD pipeline to rebuild VMs, deploying incrementally.
   • B. Federate a Domain Controller into Compute Engine, and roll out weekly patches via Group Policy Object.
   • C. Use Deployment Manager to provision updated VMs into new serving Instance Groups (IGs).
   • D. Reboot all VMs during the weekly maintenance window and allow the StartUp Script to download the latest patches from the internet.
   Reveal Answer

5. Question #5

   A customer wants to deploy a large number of 3-tier web applications on Compute Engine. How should the customer ensure authenticated network separation between the different tiers of the application?

   • A. Run each tier in its own Project, and segregate using Project labels.
   • B. Run each tier with a different Service Account (SA), and use SA-based firewall rules.
   • C. Run each tier in its own subnet, and use subnet-based firewall rules.
   • D. Run each tier with its own VM tags, and use tag-based firewall rules.
   Reveal Answer

6. Question #6

   You need to follow Google-recommended practices to leverage envelope encryption and encrypt data at the application layer. What should you do?

   • A. Generate a data encryption key (DEK) locally to encrypt the data, and generate a new key encryptionkey (KEK) in Cloud KMS to encrypt the DE
   • B. Store both the encrypted data and the encrypted DEK.
   • C. Generate a data encryption key (DEK) locally to encrypt the data, and generate a new key encryption key (KEK) in Cloud KMS to encrypt the DE
   • D. Store both the encrypted data and the KEK.
   Reveal Answer

7. Question #7

   In an effort for your company messaging app to comply with FIPS 140-2, a decision was made to use GCP compute and network services. The messaging app architecture includes a Managed Instance Group (MIG) that controls a cluster of Compute Engine instances. The instances use Local SSDs for data caching and UDP for instance-to-instance communications. The app development team is willing to make any changes necessary to comply with the standard Which options should you recommend to meet the requirements?

   • A. Encrypt all cache storage and VM-to-VM communication using the BoringCrypto module.
   • B. Set Disk Encryption on the Instance Template used by the MIG to customer-managed key and use BoringSSL for all data transit between instances.
   • C. Change the app instance-to-instance communications from UDP to TCP and enable BoringSSL on clients' TLS connections.
   • D. Set Disk Encryption on the Instance Template used by the MIG to Google-managed Key and use BoringSSL library on all instance-to-instance communications.
   Reveal Answer

8. Question #8

   Last week, a company deployed a new App Engine application that writes logs to BigQuery. No other workloads are running in the project. You need to validate that all data written to BigQuery was done using the App Engine Default Service Account. What should you do?

   • A. * 1. Use StackDriver Logging and filter on BigQuery Insert Jobs.* 2. Click on the email address in line with the App Engine Default Service Account in the
   • B. * 4. Make sure the resulting list is empty.
   • C. * 1. Use StackDriver Logging and filter on BigQuery Insert Jobs.* 2. Click on the email address in line with the App Engine Default Service Account in the
   • D. * 4. Make sure the resulting list is empty.
   Reveal Answer

9. Question #9

   You are a member of the security team at an organization. Your team has a single GCP project with credit card payment processing systems alongside web applications and data processing systems. You want to reduce the scope of systems subject to PCI audit standards. What should you do?

   • A. Use multi-factor authentication for admin access to the web application.
   • B. Use only applications certified compliant with PA-DSS.
   • C. Move the cardholder data environment into a separate GCP project.
   • D. Use VPN for all connections between your office and cloud environments.
   Reveal Answer

10. Question #10

    Your team needs to obtain a unified log view of all development cloud projects in your SIEM. The development projects are under the NONPROD organization folder with the test and pre-production projects. The development projects share the ABC-BILLING billing account with the rest of the organization. Which logging export strategy should you use to meet the requirements?

    • A. 1. Export logs to a Cloud Pub/Sub topic with folders/NONPROD parent and includeChildren property set to True in a dedicated SIEM projec
    • B. 2. Subscribe SIEM to the topic.
    • C. 1. Create a Cloud Storage sink with billingAccounts/ABC-BILLING parent and includeChildren property set to False in a dedicated SIEM projec
    • D. 2. Process Cloud Storage objects in SIEM.
    Reveal Answer