Free Professional-Cloud-Security-Engineer Practice Test Questions and Answers (2026)

To handle significant traffic spikes and potentially malicious IPs, you can use Google Cloud Armor to

configure rate-based bans. This approach allows you to automatically ban clients that exceed a

predefined request rate, protecting your application from potential denial-of-service attacks.

Access Google Cloud Console: Log in to your Google Cloud Console.

Navigate to Google Cloud Armor: Go to the "Security" section and select "Google Cloud Armor".

Create Security Policy: Create a new security policy or edit an existing one. Add a new rule to the

policy.

Configure Rate-Based Ban: Set the action to rate_based_ban. Define the rate limit (e.g., requests per

second) and set the ban_duration_sec parameter to the desired time interval.

Apply the Policy: Apply the security policy to your backend service or load balancer.

Monitor and Adjust: Monitor the traffic patterns and adjust the rate limits and ban durations as

necessary to balance security and availability.

Reference::

Google Cloud Armor Documentation

Rate Limiting with Cloud Armor

Objective: Store and retrieve sensitive configuration data for an application running on Compute

Engine.

Solution: Use Secret Manager to securely store and manage access to sensitive configuration data.

Steps:

Step 1: Open the Google Cloud Console.

Step 2: Navigate to the Secret Manager section.

Step 3: Create a new secret and add the sensitive configuration data.

Step 4: Set appropriate IAM policies to control access to the secret.

Step 5: Update the application to retrieve the secret from Secret Manager using the appropriate

client libraries or APIs.

Secret Manager provides a secure and centralized way to manage sensitive information, with fine-

grained access control and audit logging capabilities.

Reference::

Secret Manager Documentation

Storing and Accessing Secrets

The minimum length for passwords in Cloud Identity can be set to 8 characters. This aligns with

common security best practices for password policies, ensuring a basic level of complexity and

security.

Step-by-Step:

Access Admin Console: Log in to the Google Admin console.

Navigate to Security Settings: Go to Security > Password Management.

Set Minimum Length: Set the minimum length for passwords to 8 characters.

Save Changes: Save the settings and ensure that all user accounts adhere to the new policy.

Reference::

Google Cloud Identity Security Settings

Password Policy Best Practices

To enhance the security of your microservices architecture on Google Kubernetes Engine (GKE) and

ensure that only approved container images are deployed, implementing Binary Authorization is a

robust solution.

Option A: Enforcing Binary Authorization in your GKE clusters ensures that only container images that

meet your organization's security policies are deployed. By integrating container image vulnerability

scanning into your Continuous Integration/Continuous Deployment (CI/CD) pipeline, you can assess

images for known vulnerabilities before they are deployed. Binary Authorization can be configured to

use these vulnerability scan results to make policy decisions, effectively preventing the deployment

of insecure images. This approach leverages managed services provided by Google Cloud, ensuring

scalability and compliance with security standards.

Option B: Developing custom organization policies to restrict deployments to images within a specific

Artifact Registry project helps in controlling the source of images but does not inherently assess the

security posture of those images. Without integrated vulnerability scanning and enforcement

mechanisms, this approach may not fully mitigate the risk of deploying vulnerable images.

Option C: Building a system using third-party vulnerability databases and custom scripts requires

significant maintenance and may not integrate seamlessly with GKE. This approach can be error-

prone and lacks the efficiency of managed services designed for this purpose.

Option D: Automatically deploying new images upon successful CI/CD builds ensures rapid

deployment but does not address the need for security assessments of the images. While setting up

firewall rules is good practice, it does not prevent the deployment of potentially vulnerable images.

Therefore, Option A is the most effective approach, as it utilizes Google Cloud's managed services to

enforce security policies and integrate vulnerability assessments directly into the deployment

process, ensuring that only approved and secure container images are deployed to your GKE clusters.

Reference::

Binary Authorization Documentation

Container Analysis Documentation

To keep track of "who did what, where, and when?" within GCP projects, the administrator should

focus on Admin Activity logs and Data Access logs. Here’s a detailed explanation of why these two

log streams are essential:

Admin Activity Logs:

These logs capture administrative actions performed in your Google Cloud resources. This includes

actions like creating, modifying, or deleting resources.

Admin Activity logs provide detailed information about the user who performed the action, the

resource that was affected, the action performed, and the timestamp.

Data Access Logs:

These logs capture read and write operations on data within your Google Cloud services. This

includes actions like accessing or modifying data stored in databases, storage buckets, etc.

Data Access logs help track the access patterns of users and services to sensitive data, providing

insights into who accessed which data and when.

Steps to Enable and Access Logs:

Navigate to the Google Cloud Console.

Go to Logging in the left-hand menu.

Enable Admin Activity and Data Access logs if not already enabled.

Use Logs Explorer to filter and view specific logs based on your requirements.

By monitoring both Admin Activity and Data Access logs, administrators can gain comprehensive

visibility into the actions performed on their GCP resources and data, ensuring robust security and

compliance tracking.

Reference::

Google Cloud Logging Documentation

Audit Logs Overview

To migrate a legacy application to GCP without knowing what ports it uses and ensuring the

environment is secure, the best approach is to use a "Lift & Shift" method in an isolated project and

analyze the traffic using VPC Flow logs. Here’s a step-by-step explanation:

Isolated Project:

Create a new, isolated project within your GCP environment to host the legacy application. This

isolation ensures that any potential misconfigurations do not affect other projects.

Lift & Shift:

Migrate the application as-is (lift and shift) to the new isolated project. This involves moving the

application without altering its architecture.

Enable Internal TCP Traffic:

Configure VPC Firewall rules to allow all internal TCP traffic within the VPC network. This step

ensures that the application components can communicate internally without interruption.

Use VPC Flow Logs:

Enable VPC Flow logs to capture information about the traffic to and from your application. VPC Flow

logs provide details about the source, destination, port, and protocol of the traffic.

Analyze Traffic:

Analyze the VPC Flow logs to identify the necessary ports and protocols used by the application.

Based on this analysis, create specific firewall rules to allow only the required traffic, thereby

tightening security.

Implementation Steps:

Navigate to the VPC network section in the GCP Console.

Create a new VPC or use an existing one, and configure firewall rules to allow internal TCP traffic.

Enable VPC Flow logs from the VPC network settings.

Migrate your application to the new project.

Monitor and analyze the VPC Flow logs to refine your firewall rules.

By following these steps, you can safely migrate the application, understand its network

requirements, and secure it appropriately in the new GCP environment.

Reference::

Google Cloud VPC Documentation

VPC Flow Logs Documentation

Google Cloud Storage provides an Object Lifecycle Management feature that can help automate data

retention and deletion processes, ensuring compliance with data privacy regulations while

minimizing storage costs.

Lifecycle Management: Object Lifecycle Management allows you to define rules that automatically

delete objects after a specific period. This ensures that data is only retained for the required amount

of time and is deleted once it expires.

Configuration: You can configure lifecycle rules to delete objects based on conditions such as the age

of the object, the creation date, or custom metadata. This allows for precise control over the

retention period of your data.

Cost Efficiency: By using lifecycle policies to delete data automatically, you can reduce storage costs,

as you only pay for the storage you actively use.

Reference:

Cloud Storage Object Lifecycle Management

https://gsuite.google.com/learn-more/security/security-whitepaper/page-1.html

Shared responsibility “Security of the Cloud” - GCP is responsible for protecting the infrastructure

that runs all of the services offered in the GCP Cloud. This infrastructure is composed of the

hardware, software, networking, and facilities that run GCP Cloud services.

Reference:: https://cloud.google.com/kms/docs/envelope-encryption

Envelope Encryption: https://cloud.google.com/kms/docs/envelope-encryption

Here are best practices for managing DEKs:

-Generate DEKs locally.

-When stored, always ensure DEKs are encrypted at rest.

- For easy access, store the DEK near the data that it encrypts.

The DEK is encrypted (also known as wrapped) by a key encryption key (KEK). The process of

encrypting a key with another key is known as envelope encryption.

Here are best practices for managing KEKs:

-Store KEKs centrally. (KMS )

-Set the granularity of the DEKs they encrypt based on their use case. For example, consider a

workload that requires multiple DEKs to encrypt the workload's data chunks. You could use a single

KEK to wrap all DEKs that are responsible for that workload's encryption.

-Rotate keys regularly, and also after a suspected incident.

To provide temporary write access to a Cloud Storage bucket with the minimum permissions

necessary, you should:

Identify the Compute Engine instance’s default service account: Each Compute Engine instance has a

default service account that is used to interact with other Google Cloud services.

Assign the storage.objectCreator role: This predefined IAM role grants permissions to create objects

in a Cloud Storage bucket, which is sufficient for temporary write access. It does not grant

permissions to read or delete objects, thus adhering to the principle of least privilege.

Avoid using full permissions or long-lived keys: Options A and C suggest using broader permissions

than necessary or embedding long-lived keys, which could pose a security risk if compromised.

Service account impersonation (Option D) is not necessary for this task and would be more

appropriate for scenarios where you need to assume a different identity with different permissions.

Reference::

Google Cloud documentation on IAM roles for Cloud Storage, which lists the storage.objectCreator

role as providing permissions to create objects without granting full administrative access to the

bucket1.

Best practices for access control in Cloud Storage recommend using the least privilege necessary and

avoiding the use of long-lived service account keys2.

Using Identity-Aware Proxy (IAP) for managing SSH access to private VMs ensures secure access

control and avoids the need for public IPs. IAP allows you to enforce identity-based access control

policies.

Enable IAP: Ensure that IAP is enabled for your project. This can be done via the Google Cloud

Console under "Security" -> "Identity-Aware Proxy".

Set Up Firewall Rule: Create a firewall rule to allow SSH traffic from the IAP IP ranges.

Navigate to "VPC network" -> "Firewall".

Create a new rule allowing ingress traffic on port 22 (SSH) from the IAP IP ranges.

Assign IAP-Secured Tunnel User Role: Grant the roles/iap.tunnelResourceAccessor role to the

administrators who need SSH access.

Go to "IAM & Admin" -> "IAM".

Assign the IAP-Secured Tunnel User role to the relevant users or groups.

SSH Using IAP: Administrators can now use IAP to SSH into the instances. This can be done using the

gcloud command:

gcloud compute ssh [INSTANCE_NAME] --tunnel-through-iap

Reference::

Using Identity-Aware Proxy for TCP forwarding

Google Cloud Firewall Rules

Rotating a user-managed Service Account key involves creating a new key, updating your application

to use the new key, and then deleting the old key to maintain security. Here’s the step-by-step

process:

Create a New Key: Use the Google Cloud Console or gcloud command-line tool to create a new key

for the service account. This generates a new key pair and provides you with the private key.

gcloud iam service-accounts keys create new-key-file.json --iam-

account=YOUR_SERVICE_ACCOUNT_EMAIL

Update Application: Update your application configuration to use the new key. This might involve

replacing the old key file with the new one or updating the environment variables or configurations

that point to the key file.

Delete the Old Key: Once you have confirmed that the application is working correctly with the new

key, delete the old key from the service account to ensure it cannot be used for unauthorized access.

gcloud iam service-accounts keys delete OLD_KEY_ID --iam-

account=YOUR_SERVICE_ACCOUNT_EMAIL

This process ensures that your service account keys are regularly rotated, reducing the risk of key

compromise.

Reference:

Managing Service Account Keys

Service Account Key Rotation

Use Cryptographic Verification If there is a risk of IAP being turned off or bypassed, your app can

check to make sure the identity information it receives is valid. This uses a third web request header

added by IAP, called X-Goog-IAP-JWT-Assertion. The value of the header is a cryptographically signed

object that also contains the user identity data. Your application can verify the digital signature and

use the data provided in this object to be certain that it was provided by IAP without alteration.

To allow Compute Engine instances to access public repositories for security updates while an egress

firewall rule is in place to deny all internet traffic, you need to create a more specific egress rule that

permits traffic to the CIDR range of the repository. The priority of this rule should be lower (i.e., a

higher priority number) than the deny rule.

Steps:

Identify the CIDR Range: Determine the CIDR range of the public repository from which the security

updates will be fetched.

Create Egress Firewall Rule: Create a new egress firewall rule allowing traffic to the identified CIDR

range with a priority less than 1000.

Apply Firewall Rule: Use the Google Cloud Console or gcloud command-line tool to apply the new

firewall rule.

Reference::

Google Cloud: Firewall rules

Creating firewall rules

https://cloud.google.com/blog/products/g-suite/7-ways-admins-can-help-secure-accounts-againstphishing-g-suite

https://www.duocircle.com/content/email-security-services/email-security-incryptography#:~:text=Customer%20Login-

,Email%20Security%20In%20Cryptography%20Is%20One%20Of%20The%20Most,Measures%20To%2

0Prevent%20Phishing%20Attempts&text=Cybercriminals%20love%20emails%20the%20most,networ

ks%20all%20over%20the%20world.

To organize GCP projects based on different business units and manage IAM permissions, you should

create an organization node and assign folders for each business unit. This approach allows you to

logically separate projects under folders and apply IAM policies at the folder level.

Step-by-Step:

Create Organization Node: Ensure that your GCP account is linked to an organization.

Create Folders for Business Units:

Navigate to the GCP Console > IAM & Admin > Resource Manager.

Create a folder for each business unit under the organization node.

Move Projects to Folders:

Move existing projects into the respective folders according to the business unit.

Set IAM Policies:

Assign IAM roles and permissions at the folder level to manage access for each business unit

independently.

Monitor and Manage: Use Cloud Audit Logs and other GCP tools to monitor the activities and ensure

compliance with the organization’s policies.

Reference::

Creating and Managing Folders

Managing IAM Policies

To connect Compute Engine instances within a Google Cloud Platform project to workloads running

in a dedicated server room that can only be accessed from within the private company network, you

can use the following approaches:

Cloud VPN: Cloud VPN securely connects your on-premises network to your Google Cloud Virtual

Private Cloud (VPC) network through an IPsec VPN connection. This enables secure communication

between your GCP instances and your on-premises workloads over the internet.

Cloud Interconnect: Cloud Interconnect provides direct physical connections between your on-

premises network and Google's network. It offers higher bandwidth and lower latency compared to

Cloud VPN, making it suitable for workloads that require fast and reliable connectivity.

Both Cloud VPN and Cloud Interconnect allow you to securely connect your on-premises

environments to Google Cloud, ensuring that the workloads remain within the private company

network.

Reference:

Cloud VPN Overview

Cloud Interconnect Overview

This approach allows you to control network traffic at the folder level. By attaching external IP

addresses to the VMs in scope, you can ensure that the VMs have a unique, routable IP address for

outbound connections. Then, by defining and applying a hierarchical firewall policy at the folder

level, you can enforce that egress connections are limited to the specified IP range and only from the

specified VPC network.

To access a user's Google Drive on their behalf without relying on the user's credentials and following

Google-recommended practices, you should use a service account with domain-wide delegation.

Create a Service Account:

Go to the Cloud Console, navigate to IAM & Admin > Service Accounts.

Click "Create Service Account" and provide necessary details.

Grant Domain-Wide Delegation:

Edit the service account to enable "G Suite Domain-wide Delegation".

Download the JSON key file.

Configure API Access in G Suite:

Go to the Google Admin Console.

Navigate to Security > API Controls > Domain-wide Delegation.

Add a new API client and use the client ID from the service account.

Authorize the necessary API scopes (e.g., https://www.googleapis.com/auth/drive).

Implement in Application:

Use the Google API Client Library for the desired language.

Load the service account credentials and perform user impersonation to access Google Drive.

Reference::

Domain-wide Delegation of Authority

Using OAuth 2.0 for Server to Server Applications

To meet data residency requirements on Google Cloud, the recommended option is to use

Organization Policy Service constraints. This service allows you to define and enforce specific

constraints across your organization, including constraints related to the geographical location where

data is stored.

Organization Policy Service constraints allow administrators to enforce policies that restrict resources

to specific locations. For instance, you can set policies to ensure that all storage buckets, databases,

and other data resources reside within specific geographic boundaries. This helps in complying with

data residency requirements.

Reference:

Organization Policy Service documentation

Google Cloud Data Residency