Professional-Cloud-Security-Engineer Google Cloud Certified - Professional Cloud Security Engineer Free Practice Exam Questions (2025 Updated)

To ensure least-privilege access and provide necessary permissions to the DevOps team only during a deployment issue, follow these steps:

Create a Service Account:

In your Google Cloud project, create a new service account specifically for the DevOps team.

Assign Limited Permissions:

Grant the service account permissions with only the necessary list/view roles. For instance, you can create a custom IAM role with compute.instances.list and compute.instances.get permissions.

Grant Service Account User Role:

Assign the Service Account User role to the DevOps team members for the created service account. This allows them to act as the service account and use its permissions.

Access Control During Incidents:

During a deployment issue, the DevOps team can temporarily use the service account to access the resources. This ensures they have the least-privilege access required to investigate and resolve the issue.

Automation and Monitoring:

Implement automation to enable and disable the service account access as needed and monitor the usage to ensure compliance with the least-privilege principle.

Benefits:

Security: Limits access to only what is necessary, reducing the risk of unauthorized changes.

Flexibility: Provides necessary access during incidents without granting permanent elevated permissions.

References

Creating and Managing Service Accounts

Service Account User Role

The problem requires a publicly accessible Cloud Run service with HTTPS, TLS termination at the edge, threat mitigation, and geo-based access restrictions.

External HTTP(S) Load Balancer: This is the standard Google Cloud component for exposing public-facing web applications, providing a single global IP address, global load balancing, and crucially, TLS termination at the edge of Google's network.

Serverless Network Endpoint Group (NEG): A serverless NEG connects an HTTP(S) Load Balancer to a Cloud Run service (or other serverless backends like Cloud Functions or App Engine), allowing the load balancer to route traffic to the serverless application.Extract Reference: "You can use an external HTTP(S) Load Balancer with a serverless network endpoint group (NEG) to integrate Cloud Run services with advanced load balancing features, such as Cloud CDN, Google Cloud Armor, and Cloud Identity-Aware Proxy." (Google Cloud Documentation: "Connect a Cloud Run service to an HTTP(S) Load Balancer | Cloud Run Documentation" - https://cloud.google.com/run/docs/integrating/load-balancers)

Google-Managed Certificate for TLS Termination: Using Google-managed SSL certificates simplifies the management of HTTPS, as Google handles the provisioning, renewal, and deployment of certificates. The external HTTP(S) Load Balancer terminates TLS using these certificates.Extract Reference: "Google-managed SSL certificates let you use Google Cloud's globally distributed infrastructure to automatically provision and renew your certificates." (Google Cloud Documentation: "Google-managed SSL certificates overview | Load Balancing" - https://cloud.google.com/load-balancing/docs/ssl-certificates/google-managed-certs)

Cloud Armor for Threat Mitigation and Geo-Based Access Control: Cloud Armor is a Web Application Firewall (WAF) service that integrates with HTTP(S) Load Balancers. It provides DDoS protection, allows custom rules for threat mitigation (e.g., SQL injection, XSS), and supports geo-based access control rules to allow or deny traffic based on the source's geographic region.Extract Reference: "Google Cloud Armor helps protect your Google Cloud deployments from various threats, including Distributed Denial of Service (DDoS) attacks and application attacks such as cross-site scripting (XSS) and SQL injection (SQLi)." and "Google Cloud Armor supports geo-based access control, allowing you to filter requests based on geographic region." (Google Cloud Documentation: "Google Cloud Armor overview" - https://cloud.google.com/armor/docs/overview)

Let's evaluate the other options:

A. IAP for authentication and IP-based access control + custom SSL certs: IAP is primarily an authentication layer for users/identities, not a WAF for threat mitigation or geo-blocking for a publicly accessible service before any authentication takes place. While it can apply IP-based access, it's typically for post-authentication controls.

B. Assign custom domain, enable HTTPS, allUsers IAM, firewall rules & VPC SC: While Cloud Run supports custom domains and HTTPS, and allUsers makes it public, direct Cloud Run services do not leverage traditional VPC firewall rules for public ingress. VPC Service Controls are for API access and data exfiltration, not for WAF or geo-blocking of public web traffic.

D. Cloud DNS public zone, static IP, VPC firewall rules, threat signatures: Cloud Run services are managed and do not typically expose a static IP address that can be directly associated with VPC firewall rules for public traffic. VPC firewall rules apply to VMs within a VPC, not to the managed global infrastructure of Cloud Run's public endpoints.

Therefore, deploying an external HTTP(S) Load Balancer with a serverless NEG and integrating it with Google-managed certificates and Cloud Armor is the most comprehensive and Google-recommended solution for meeting all the specified security requirements for a publicly accessible Cloud Run application.

Enable automatic key version rotation on a regular schedule:

Regularly rotating keys reduces the impact of a potentially compromised key by limiting the amount of data encrypted with a single key version.

Set up automatic key rotation in Cloud KMS to ensure keys are rotated without manual intervention.

Limit the number of messages encrypted with each key version:

Reducing the number of messages encrypted with each key version minimizes the potential data exposure in case of a key compromise.

Implement policies to ensure that new key versions are used periodically to limit the usage of each key version.

The problem's critical requirements are: centralized collection of all audit logs (including Data Access logs) from a production folder to a central BigQuery dataset, with long-term retention, and most importantly, the ability to intercept and override any project-level log sinks to prevent duplicate storage or misrouting.

Aggregated Log Sink at Folder Level: To centralize logs from all current and future projects within the "production folder," an aggregated sink configured at the folder level is the correct approach. Logs generated in child projects will flow up to the folder level and be matched by this sink.

Extract Reference: "Aggregated exports allow you to export logs from multiple Google Cloud projects, folders, or your entire organization. An aggregated export can include all logs from all included resources, or you can use queries to include only specific logs." (Google Cloud Documentation: "Route logs to supported destinations | Cloud Logging" - https://cloud.google.com/logging/docs/export/aggregated_exports)

Intercepting Sink (--intercept-logs / overrideDestinations): This is the crucial feature to meet the "intercept and override" requirement. When an aggregated sink is configured as an "intercepting" sink, any log entries that match its filter are immediately routed to its destination and are not processed by any lower-level sinks (e.g., project-level sinks). This ensures that logs are not inadvertently routed elsewhere and prevents duplicate storage.

Extract Reference: "An intercepting sink is an aggregated sink that, if it includes the overrideDestinations field set to true, stops matched log entries from propagating to lower-level sinks in the Cloud Logging resource hierarchy." (Google Cloud Documentation: "Route logs to supported destinations | Cloud Logging" - https://cloud.google.com/logging/docs/export/aggregated_exports)

BigQuery Destination and IAM Permissions: BigQuery is specified as the long-term retention destination. The sink's writer_identity (a service account automatically created for the sink) needs appropriate IAM permissions (e.g., BigQuery Data Editor or BigQuery User) on the target BigQuery dataset to write logs.

Inclusion Filter for Audit Logs: An inclusion filter is necessary to ensure only the required audit logs, including Data Access logs (logName:"cloudaudit.googleapis.com" OR logName:"data_access"), are routed.

Let's evaluate the other options:

A. Standard aggregated log sink... Logs Bucket Writer: A standard aggregated sink does not intercept or override lower-level sinks. Also, Logs Bucket Writer role is for Cloud Logging buckets, not BigQuery. The correct role would be for BigQuery.

B. Log sink in each production project: This is not a centralized solution and would require manual configuration for every project, which is inefficient and error-prone for "all current and future projects." It also doesn't provide any override mechanism.

C. Aggregated log sink at the organization level... configure a log view: While an organization-level sink offers broad centralization, if the requirement is specifically for a production folder and not the entire organization, a folder-level intercepting sink is more targeted. A log view is for displaying logs, not for routing or overriding. The --include-children flag is implied for aggregated sinks but doesn't provide the intercepting behavior.

Therefore, creating an intercepting aggregated log sink at the production folder level, configured to send audit logs to BigQuery, is the precise solution to meet all the stated requirements, especially the crucial "intercept and override" condition.

Physical Token for MFA: Implement multi-factor authentication (MFA) using physical tokens (such as security keys) for super admin accounts. This adds an extra layer of security to the highest privilege accounts.

Non-Privileged Identities: Provide super admins with separate non-privileged accounts for daily activities. This practice minimizes the risk associated with using highly privileged accounts for routine tasks.

Account Management: Ensure that super admin accounts are only used for tasks requiring elevated privileges, reducing exposure to potential security threats. These measures enhance the security of super admin accounts, protecting your Google Cloud organization from unauthorized access. References:

Google Cloud - Best Practices for Securing Cloud Identity

Google Cloud - Using Security Keys

Requirement:

Enforce the use of Customer-Managed Encryption Keys (CMEK) for all new Cloud Storage resources in the organization.

Policy Constraint:

Use the constraints/gcp.restrictNonCmekServices constraint to enforce CMEK usage.

Policy Type and Value:

Set the policy type to allow to specify which services must use CMEK.

In this case, the policy value should be storage.googleapis.com to target Cloud Storage.

Command:

Applying the organization policy with the appropriate binding ensures that all new Cloud Storage resources under the organization will require CMEK.

Steps:

Step 1: Go to the Google Cloud Console.

Step 2: Navigate to the Organization Policies page.

Step 3: Apply the policy constraint constraints/gcp.restrictNonCmekServices with the allow policy type and storage.googleapis.com as the policy value.

Google Cloud Armor helps to protect applications from DDoS attacks and web application firewall (WAF) threats like XSS and SQLi. To use Google Cloud Armor security policies, certain requirements must be met:

External Load Balancers: Google Cloud Armor is specifically designed to work with external HTTP(S) load balancers, which handle traffic at the edge of the Google Cloud network. This type of load balancer provides a global frontend that can distribute traffic to various backends.

Load Balancing Scheme: The backend service associated with the Google Cloud Armor policy must have an EXTERNAL load balancing scheme. This scheme allows the service to accept traffic from outside the Google Cloud network, which is necessary for applying security policies effectively at the network edge.

These requirements ensure that Google Cloud Armor can inspect and filter incoming traffic before it reaches your web application's backend services, providing an additional layer of security against common web vulnerabilities.

References

Google Cloud Armor Documentation

External HTTP(S) Load Balancing Overview

https://cloud.google.com/logging/docs/access-control#considerations roles/logging.privateLogViewer (Private Logs Viewer) includes all the permissions contained by roles/logging.viewer, plus the ability to read Data Access audit logs in the _Default bucket.

To allow a large number of users to access the GCP Console while keeping the existing Active Directory or LDAP server for identity management, use Google Cloud Directory Sync (GCDS).

Install GCDS:

Download and install Google Cloud Directory Sync from here.

Configure GCDS:

Set up the synchronization by specifying the LDAP server details and the Google domain.

Map the LDAP attributes to Google attributes to ensure user data is synchronized correctly.

Run Synchronization:

Perform an initial synchronization to populate the Google domain with existing users from the LDAP server.

Schedule regular synchronizations to keep the data up-to-date.

Benefits:

Automated Sync: Ensures that user data is consistently updated without manual intervention.

Secure Access: Users can log in to the GCP Console using their existing credentials, enhancing security and user experience.

Objective: Store and retrieve sensitive configuration data for an application running on Compute Engine.

Solution: Use Secret Manager to securely store and manage access to sensitive configuration data.

Steps:

Step 1: Open the Google Cloud Console.

Step 2: Navigate to the Secret Manager section.

Step 3: Create a new secret and add the sensitive configuration data.

Step 4: Set appropriate IAM policies to control access to the secret.

Step 5: Update the application to retrieve the secret from Secret Manager using the appropriate client libraries or APIs.

Secret Manager provides a secure and centralized way to manage sensitive information, with fine-grained access control and audit logging capabilities.

When using Google Cloud's Platform-as-a-Service (PaaS) offerings like App Engine, Google manages the infrastructure, including the underlying OS, runtime, and scaling. However, securing the application code itself, such as defending against cross-site scripting (XSS) and SQL injection (SQLi) attacks, remains the responsibility of the user. This involves implementing secure coding practices, validating inputs, and employing appropriate security measures within the application.

The problem requires a cost-effective, scalable, and secure strategy to anonymize 3 TB of PII in BigQuery and Cloud SQL.

Cloud Sensitive Data Protection (Cloud DLP): Cloud DLP is Google Cloud's fully managed service designed for discovering, classifying, and de-identifying sensitive data, including PII, across various Google Cloud services and on-premises environments. It is specifically built for scale and security.

Extract Reference: "Sensitive Data Protection helps you discover, classify, and de-identify sensitive data." and "Sensitive Data Protection includes advanced de-identification techniques, such as tokenization, masking, and format-preserving encryption, to help you protect your sensitive data while preserving its utility for analysis." (Google Cloud Documentation: "Sensitive Data Protection overview" - https://cloud.google.com/sensitive-data-protection/docs/overview)

Data Profiling: Cloud DLP's data profiling feature automatically scans your data (e.g., BigQuery tables, Cloud SQL databases) to identify where sensitive data resides and to understand its characteristics. This is crucial for developing an effective de-identification strategy.

Extract Reference: "Data profiles provide metrics and insights about your sensitive and high-risk data, helping you make informed decisions about data protection, access, and storage." and "When you configure Sensitive Data Protection to profile data in BigQuery, Cloud Storage, and Datastore, it automatically scans your data for sensitive information." (Google Cloud Documentation: "About data profiles" - https://cloud.google.com/sensitive-data-protection/docs/concepts-data-profiles)

De-identification Templates and Custom Configurations: After profiling identifies the PII, Cloud DLP offers various de-identification methods, which can be applied using pre-built templates or custom configurations. This allows for flexible and targeted anonymization. For BigQuery specifically, DLP can integrate with remote functions for de-identification at query time, minimizing data movement.

Extract Reference: "De-identification techniques, like encryption, obfuscate raw sensitive identifiers in your data. These techniques let you preserve the utility of your data for joining or analytics, while reducing the risk of handling the data." and "You can use this tutorial to replace that pipeline with a SQL query for only re-identification or both de-identification and re-identification." (Google Cloud Documentation: "De-identify BigQuery data at query time | Sensitive Data Protection Documentation" - https://cloud.google.com/sensitive-data-protection/docs/deidentify-bq-tutorial)

Let's evaluate the other options:

B. Copy small subset... create a custom anonymization script... apply the script to the entire 3 TB dataset: Relying on a "custom anonymization script" for 3 TB of data is generally not scalable, cost-effective, or secure compared to a managed service like Cloud DLP. Custom scripts require significant development, testing, maintenance, and robust error handling for large datasets, and might introduce security vulnerabilities.

C. Export all 3TB of data... to Cloud Storage... anonymize... Re-import: While feasible, exporting and re-importing 3 TB of data is a very time-consuming and potentially costly process due to data transfer and storage operations. Cloud DLP can often process data in-place or integrate more efficiently, especially with BigQuery. This option might not be the most cost-effective or efficient.

D. Inspect a representative sample... develop a custom script: Similar to option B, this relies on a custom script, which is less ideal for scalability, cost-effectiveness, and security than a managed service like Cloud DLP for 3 TB of sensitive data. Sample inspection is a good initial step, but the subsequent custom script for anonymization is the weak point.

Therefore, using Cloud DLP's data profiling to inform a de-identification strategy with its managed templates and configurations is the most appropriate, scalable, secure, and cost-effective approach for anonymizing PII in BigQuery and Cloud SQL.

Enable VPC Service Controls:

VPC Service Controls help mitigate the risk of data exfiltration by allowing you to define a security perimeter around GCP resources.

Set up a service perimeter around your BigQuery project to restrict data access to within the defined perimeter.

Create Access Levels:

In the Google Cloud Console, navigate to the Access Context Manager.

Define access levels based on IP address conditions, specifying the authorized source IP addresses that are allowed to access your BigQuery resources.

These access levels are used to enforce policies that restrict who can access your sensitive data based on their IP addresses.

Apply Service Perimeter with Access Levels:

Apply the created access levels to the service perimeter to ensure that only requests originating from the specified IP addresses are able to access BigQuery tables.

This setup ensures that the sensitive PII data is not accessible from unauthorized IP addresses, reducing the risk of data exfiltration.

The problem focuses on securing "super administrator accounts for the organization" when Cloud Identity is synced with Microsoft Entra ID and uses Entra ID for SSO. The key requirements are the principle of least privilege and strong authentication.

Principle of Least Privilege & Dedicated Accounts: Google's best practices strongly recommend creating dedicated, non-federated accounts for super administrators that are distinct from regular user accounts. These accounts should only be used for super administrator tasks and not for daily activities. This segregation ensures that the highest privilege accounts are isolated and adhere to the principle of least privilege by not having combined responsibilities.

Extract Reference: "Designate Organization Administrators... We recommend keeping your super admin account separate from your Organization Administrator group." and "Give super admins a separate account that requires a separate login. For example, user alice@example.com could have a super admin account alice-admin@example.com." and "Use the super admin account only when needed. Delegate administrator tasks to user accounts with limited admin roles. Use the least privilege approach..." (Google Cloud Documentation: "Super administrator account best practices | Resource Manager Documentation" - https://cloud.google.com/resource-manager/docs/super-admin-best-practices)

Strong Authentication (Google 2-Step Verification): Even when using a third-party identity provider like Microsoft Entra ID for most users, Google recommends enforcing Google's own 2-Step Verification for the critical super administrator accounts. This provides a "break-glass" mechanism that is independent of the external IdP. If the Entra ID integration were to fail or become compromised, the Google-managed super administrator accounts, protected by Google's own 2SV, would still be accessible for emergency recovery.

Extract Reference: "Even when using the legacy SSO profile, super admins can't sign in with SSO in these cases: Admin console. When super administrators try to sign in to an SSO-enabled domain via admin.google.com, they must enter their full Google administrator account email address and associated Google password (not their SSO username and password), and click Sign in to directly access the Admin console. Google doesn't redirect them to the SSO sign-in page." (Google Cloud Identity Help: "Super administrator SSO" - https://support.google.com/cloudidentity/answer/6341409) - This highlights that super admin accounts can bypass SSO for direct Admin console access, making Google 's 2SV crucial.

Extract Reference: "It's especially important for super admins to use 2SV because their accounts control access to all business and employee data in the organization. Protect your business with 2-Step Verification. Use security keys for 2-Step Verification." (Cloud Identity Help: "Security best practices for administrator accounts" - https://support.google.com/cloudidentity/answer/9011373)

Options C and D are incorrect because combining "organization administrator" (IAM role for GCP resources) and "super administrator" (Google Workspace/Cloud Identity domain-level control) privileges violates the principle of least privilege. Option A is less secure than B because relying solely on Entra ID's 2SV for super administrators means a compromise of Entra ID or an outage would leave the Google Cloud organization vulnerable without an independent break-glass mechanism.

The problem states that Google Cloud applications need to access external web services and requires the ability to monitor, control, and log this access.

Monitoring, Controlling, and Logging external web access: This specifically points to a proxy solution, which can intercept, inspect, and log HTTP/S traffic.

Secure Web Proxy (SWP): Google Cloud's Secure Web Proxy is designed for exactly this use case. It acts as an explicit forward proxy for HTTP(S) traffic, allowing organizations to implement granular access controls, inspect traffic for security threats, and log all outbound web requests from their Google Cloud environment.Extract Reference: "Secure Web Proxy is a managed service that lets you deploy and manage an explicit forward proxy to protect your organization's internal resources from web-based threats and to control access to external web applications." and "With Secure Web Proxy, you can: Enforce granular access policies based on different attributes, Log all HTTP(S) requests that are handled by the proxy, and Monitor web traffic for threats." (Google Cloud documentation: https://cloud.google.com/secure-web-proxy)

Let's evaluate the other options:

A. Configure VPC firewall rules to allow the services to access the IP addresses of required external web services: VPC firewall rules operate at Layer 4 (TCP/UDP) and Layer 3 (IP). While they can allow or deny traffic to specific IP addresses and ports, they cannot monitor, control, or log HTTP/S requests at the application layer. They don't provide granular control over which web services are accessed or inspect the content of the requests.

C. Configure Google Cloud Armor to monitor and protect your applications by checking incoming traffic patterns for attack patterns: Google Cloud Armor is primarily a Distributed Denial of Service (DDoS) protection and Web Application Firewall (WAF) service. It focuses on protecting applications from incoming threats (ingress traffic), not controlling and logging outgoing access to external web services.

D. Set up a Cloud NAT instance to allow egress traffic from your VPC: Cloud NAT allows instances without external IP addresses to connect to the internet. While it enables egress, it does not provide monitoring, control, or logging capabilities for specific web services at the application layer. It's a network address translation service, not an application-layer proxy.

Therefore, setting up a Secure Web Proxy is the most appropriate solution to meet the requirements of monitoring, controlling, and logging access to external web services from Google Cloud applications.

Configure Binary Authorization:

Binary Authorization is a deploy-time security control that ensures only trusted container images are deployed on GKE. It uses attestations to verify the authenticity and integrity of the images.

Enable Binary Authorization in your project through the Google Cloud Console or using the gcloud command-line tool.

Define attestation policies that specify which attestors (trusted entities) must sign off on container images before deployment.

Set Up Attestors:

Create and configure attestors that will sign the container images. This involves generating cryptographic keys and setting up trusted authorities.

Attestors can be configured to sign images based on criteria such as vulnerability scanning results, compliance checks, and other security policies.

Create a Custom Organization Policy Constraint:

Define an organization policy constraint that enforces Binary Authorization across your GKE clusters.

This custom constraint ensures that all clusters in the organization must adhere to the Binary Authorization policy, preventing the deployment of unsigned or unauthorized container images.

Implement and Enforce the Policies:

Apply the Binary Authorization policy and the organization policy constraint to your GKE clusters.

Regularly review and update the policies and attestation rules to align with your security and compliance requirements.

https://cloud.google.com/resource-manager/docs/organization-policy/restricting-domains#setting_the_organization_policy

The domain restriction constraint is a type of list constraint. Google Workspace customer IDs can be added and removed from the allowed_values list of a domain restriction constraint. The domain restriction constraint does not support denying values, and an organization policy can't be saved with IDs in the denied_values list. All domains associated with a Google Workspace account listed in the allowed_values will be allowed by the organization policy. All other domains will be denied by the organization policy.