Free Google Professional-Cloud-Security-Engineer Practice Test Questions

Question 1

A patch for a vulnerability has been released and a DevOps team in a healthcare technology company needs to update their running containers in Google Kubernetes Engine (GKE). What steps should the DevOps team take to accomplish this task?

A : Confirm whether auto-upgrade is turned on; if enabled, Google will handle node upgrades within a GKE cluster.

B : Set up the containers to automatically upgrade when the base image becomes available in the Container Registry.

C : Apply a patch or update the application code, construct a new image, and deploy it again.

D : Utilize Puppet or Chef to deploy the necessary patch to the container that's currently running.

Answer: C

Question 2

Your organization uses Google Workspace as the primary identity provider for Google Cloud Users in yourorganization initially created their passwords. You need to improve password security due to a recent securityevent. What should you do?

A : Audit user activity for suspicious logins by using the audit and investigation tool.

B : Conduct a security awareness training session, and set the password expiration settings to require more frequent updates.

C : Check the Enforce strong password box, and set the password expiration to occur more frequently.

D : Check the Enforce strong password box, and check Enforce password policy at the next sign-in.

Answer: D

Question 3

Your organization has established a highly sensitive project within a VPC Service Controls perimeter. Youneed to ensure that only users meeting specific contextual requirements such as having a company-manageddevice, a specific location, and a valid user identity can access resources within this perimeter. You want toevaluate the impact of this change without blocking legitimate access. What should you do?

A : Configure a VPC Service Controls perimeter in dry run mode, and enforce strict network segmentationusing firewall rules. Use multi-factor authentication (MFA) for user verification.

B : Use Cloud Audit Logs to monitor user access to the project resources. Use post-incident analysis toidentify unauthorized access attempts.

C : Establish a Context-Aware Access policy that specifies the required contextual attributes, and associatethe policy with the VPC Service Controls perimeter in dry run mode.

D : Use the VPC Service Control Violation dashboard to identify the impact of details about access denialsby service perimeters.

Answer: C

Question 4

Your organization needs to allow public web applications to upload files to a Cloud Storage bucket. You need to design a secure access mechanism that adheres to the principle of least privilege. What should you do?

A : Create a service account with write access to the Cloud Storage bucket. Distribute the service account key to the external web applications.

B : Implement a proxy service that authenticates the external web applications and then uploads the files to the Cloud Storage bucket on their behalf using a service account key

C : Grant the external web applications direct access to the Cloud Storage bucket by adding their IP addresses to the bucket's access control list (ACL)

D : Generate short-lived credentials in Workload Identity Federation for each upload request. Grant temporary and scoped access to the Cloud Storage bucket

Answer: D

Question 5

Your organization uses Google Workspace as the primary identity provider for Google Cloud Users in yourorganization initially created their passwords. You need to improve password security due to a recent securityevent. What should you do?

A : Audit user activity for suspicious logins by using the audit and investigation tool.

B : Conduct a security awareness training session, and set the password expiration settings to require more frequent updates.

C : Check the Enforce strong password box, and set the password expiration to occur more frequently.

D : Check the Enforce strong password box, and check Enforce password policy at the next sign-in.

Answer: D

Free Google Professional-Cloud-Security-Engineer Exam Practice Questions 2026