Professional-Cloud-Security-Engineer Google Cloud Certified - Professional Cloud Security Engineer Free Practice Exam Questions (2025 Updated)

"To support common use cases like setting a Time to Live (TTL) for objects, retaining noncurrent versions of objects, or "downgrading" storage classes of objects to help manage costs, Cloud Storage offers the Object Lifecycle Management feature. This page describes the feature as well as the options available when using it. To learn how to enable Object Lifecycle Management, and for examples of lifecycle policies, see Managing Lifecycles." https://cloud.google.com/storage/docs/lifecycle

To evaluate Google Cloud Platform (GCP) for PCI compliance and identify Google's inherent controls, you should review the "Google Cloud Platform: Customer Responsibility Matrix". This document provides detailed information about the shared responsibility model, outlining the security controls managed by Google and those that are the responsibility of the customer.

Steps to access and use the document:

Access the Document:

Go to the Google Cloud compliance resource center.

Locate the "Customer Responsibility Matrix" for PCI DSS compliance.

Review Inherent Controls:

The document lists various controls and specifies whether they are managed by Google, the customer, or both.

It covers different aspects such as infrastructure security, data protection, and compliance requirements.

Analyze PCI Compliance:

Use the matrix to understand which PCI DSS requirements are inherently addressed by Google Cloud.

Identify the controls you need to implement and manage as a customer to ensure full compliance.

By reviewing this document, you can gain a comprehensive understanding of the inherent controls provided by Google Cloud and the responsibilities you must fulfill to achieve PCI compliance.

Google Cloud Compliance Documentation

PCI DSS Compliance on Google Cloud

Configure Binary Authorization:

Binary Authorization is a deploy-time security control that ensures only trusted container images are deployed on GKE. It uses attestations to verify the authenticity and integrity of the images.

Enable Binary Authorization in your project through the Google Cloud Console or using the gcloud command-line tool.

Define attestation policies that specify which attestors (trusted entities) must sign off on container images before deployment.

Set Up Attestors:

Create and configure attestors that will sign the container images. This involves generating cryptographic keys and setting up trusted authorities.

Attestors can be configured to sign images based on criteria such as vulnerability scanning results, compliance checks, and other security policies.

Create a Custom Organization Policy Constraint:

Define an organization policy constraint that enforces Binary Authorization across your GKE clusters.

This custom constraint ensures that all clusters in the organization must adhere to the Binary Authorization policy, preventing the deployment of unsigned or unauthorized container images.

Implement and Enforce the Policies:

Apply the Binary Authorization policy and the organization policy constraint to your GKE clusters.

Regularly review and update the policies and attestation rules to align with your security and compliance requirements.

Requirement:

Enforce the use of Customer-Managed Encryption Keys (CMEK) for all new Cloud Storage resources in the organization.

Policy Constraint:

Use the constraints/gcp.restrictNonCmekServices constraint to enforce CMEK usage.

Policy Type and Value:

Set the policy type to allow to specify which services must use CMEK.

In this case, the policy value should be storage.googleapis.com to target Cloud Storage.

Command:

Applying the organization policy with the appropriate binding ensures that all new Cloud Storage resources under the organization will require CMEK.

Steps:

Step 1: Go to the Google Cloud Console.

Step 2: Navigate to the Organization Policies page.

Step 3: Apply the policy constraint constraints/gcp.restrictNonCmekServices with the allow policy type and storage.googleapis.com as the policy value.

To configure the behavior where each department member automatically has read-only access to all new project resources created by any department member, you should use Google Cloud's folder structure and IAM roles effectively. Here are the steps:

Create Folders for Departments: Create a folder under your Organization for each department. Folders help organize resources and provide a hierarchy for applying policies and permissions.

Assign IAM Roles to Google Groups: Assign the Project Viewer role to the Google Group associated with each department at the folder level. This ensures that all members of the group have the necessary permissions.

Inherited Permissions: When a department member creates a new project under their department's folder, the permissions assigned to the folder are inherited by the new project. Thus, all department members will automatically have read-only access to the project's resources.

Navigate to IAM & Admin in the GCP Console.

Select "Folders" from the left-hand menu.

For each department, create a new folder under the organization.

Select the newly created folder, and then go to the "Permissions" tab.

Click on "Add" to assign a new role.

Enter the email address of the Google Group for the department.

Assign the "Project Viewer" role to the group.

Access Restrictions: Since the permissions are applied at the folder level, only the members of the specific department's Google Group will have read-only access to the projects created in that folder. Other departments will not have access unless explicitly granted.

By following these steps, you ensure that department members have the required access to their respective projects without manual configuration for each new project.

Google Cloud IAM Documentation

Google Cloud Resource Manager Documentation

Objective: Create a Service Account that can list Compute Engine instances in the project following Google-recommended practices.

Solution: Create a custom role and assign it to the Service Account.

Steps:

Step 1: Open the Google Cloud Console.

Step 2: Navigate to the IAM & Admin page and select "Roles".

Step 3: Click on "Create Role" and define a new role with a suitable name and description.

Step 4: Add the permission compute.instances.list to the custom role.

Step 5: Save the custom role.

Step 6: Go to the "Service Accounts" section.

Step 7: Create a new Service Account or select an existing one.

Step 8: Assign the newly created custom role to the Service Account.

By creating a custom role with the specific permission to list Compute Engine instances, you follow the principle of least privilege, which is a recommended security practice.

The problem requires ensuring that only images that have passed vulnerability scanning and meet corporate policies are allowed to be deployed to GKE, with the process being automated and integrated into the existing CI/CD pipeline.

Binary Authorization: This Google Cloud service is purpose-built to enforce deployment policies on images before they are run on Google Kubernetes Engine (GKE), Cloud Run, and other deployable platforms. It acts as a policy gate that prevents the deployment of non-compliant images.

Extract Reference: "Binary Authorization is a deploy-time security control that ensures only trusted container images are deployed on Google Kubernetes Engine (GKE), Cloud Run, and Anthos clusters." and "With Binary Authorization, you can require images to be signed by trusted authorities and enforce validation policies during deployment." (Google Cloud Documentation: "Binary Authorization overview" - https://cloud.google.com/binary-authorization/docs/overview)

Artifact Analysis (part of Container Analysis): Artifact Analysis (which includes Container Analysis) provides vulnerability scanning capabilities for container images stored in Artifact Registry. It generates findings and metadata about vulnerabilities.

Extract Reference: "Container Analysis is a service that scans your images for known vulnerabilities and provides metadata about them." (Google Cloud Documentation: "Overview | Container Analysis" - https://cloud.google.com/container-analysis/docs/overview)

Binary Authorization can be configured to integrate with Artifact Analysis (or other attestors) to check for vulnerability scan results as part of its deployment policy.

Integration and Automation: Binary Authorization policies can require attestations before deployment. An attestation confirms that an image meets specific criteria (e.g., it has passed a vulnerability scan, it was signed by an approved CI/CD process, it adheres to corporate policies). Cloud Build can be configured to generate these attestations after a successful vulnerability scan (using Artifact Analysis). This fully automates the process and integrates directly into the CI/CD pipeline.

Extract Reference: "With Binary Authorization, you create a policy that enforces your requirements. The policy defines rules that govern deployment. For example, a policy can require all images to be signed by a trusted authority before deployment." (Google Cloud Documentation: "Binary Authorization overview" - https://cloud.google.com/binary-authorization/docs/overview)

Let's evaluate the other options:

A. Custom script in Cloud Build... Fail the build: While scanning during the build is good practice (shift-left security), failing the build only prevents the image from being pushed. It doesn't prevent a developer or an automated process from manually deploying an old or non-compliant image that might already exist in Artifact Registry, or from bypassing the build system. The enforcement needs to happen at deployment time.

B. Configure GKE to use only images from a specific... trusted Artifact Registry repository. Manually inspect all images: Manually inspecting images is not automated and does not scale for a "large number of containerized applications." It also doesn't programmatically enforce vulnerability scan results or corporate policies.

D. Enable Artifact Analysis vulnerability scanning and regularly scan images... Remove any images that do not meet... before deployment: This describes scanning and remediation, which are important. However, it's a reactive approach ("remove any images") rather than a proactive enforcement ("only images that... are allowed to be deployed"). There's still a window where a non-compliant image could be deployed before it's removed. Binary Authorization is the enforcement gate.

Therefore, configuring Binary Authorization with a policy that integrates with Artifact Analysis (or requires attestations based on its findings) is the most robust, automated, and Google-recommended solution for enforcing deployment policies based on vulnerability scanning and corporate compliance.

To securely access Google Cloud APIs from CI/CD pipelines running on Google Kubernetes Engine (GKE), follow these steps:

Create Service Accounts:

Create individual service accounts for each CI/CD pipeline. This ensures isolation and minimal permissions per pipeline.

Use a naming convention that includes an identifier for each pipeline, such as pipeline-a-sa, pipeline-b-sa, etc.

Configure Kubernetes Service Accounts:

Create Kubernetes service accounts for each CI/CD pipeline pod.

Map Kubernetes Service Accounts to Google Service Accounts:

Use Workload Identity to associate Kubernetes service accounts with the corresponding Google service accounts. This allows the pods to authenticate to Google Cloud APIs securely.

Example command to bind the Kubernetes service account to the Google service account:

gcloud iam service-accounts add-iam-policy-binding \ --role roles/iam.workloadIdentityUser \ --member "serviceAccount:.svc.id.goog[/]" \ @.iam.gserviceaccount.com

Deploy CI/CD Pipelines:

Ensure each pipeline runs in dedicated pods that use the specific Kubernetes service accounts configured earlier.

This setup ensures that each pipeline has the necessary permissions to interact with Google Cloud APIs securely, adhering to the principle of least privilege.

References

Using Workload Identity

Managing Service Accounts

To identify all principals who can change firewall rules, you need to determine which users or service accounts have permissions that allow them to modify firewall rules in your Google Cloud project. The correct permissions to check for this are compute.firewalls.create and compute.firewalls.delete. These permissions enable a user to create and delete firewall rules, respectively.

The Policy Analyzer tool in Google Cloud allows you to query and analyze IAM policies to identify which principals have specific permissions. By using Policy Analyzer, you can effectively identify all principals with the compute.firewalls.create and compute.firewalls.delete permissions.

Open Policy Analyzer: Go to the Google Cloud Console, navigate to IAM & Admin, and select Policy Analyzer.

Set Up Query: Create a new query specifying the permissions compute.firewalls.create and compute.firewalls.delete.

Run Query: Execute the query to retrieve a list of principals who have these permissions.

Review Results: Analyze the results to identify all users and service accounts with the capability to modify firewall rules.

This method ensures you have a comprehensive list of all principals who can change firewall rules, enhancing your audit and security posture.

Google Cloud Policy Analyzer Documentation

Google Cloud IAM Documentation

To allow a large number of users to access the GCP Console while keeping the existing Active Directory or LDAP server for identity management, use Google Cloud Directory Sync (GCDS).

Install GCDS:

Download and install Google Cloud Directory Sync from here.

Configure GCDS:

Set up the synchronization by specifying the LDAP server details and the Google domain.

Map the LDAP attributes to Google attributes to ensure user data is synchronized correctly.

Run Synchronization:

Perform an initial synchronization to populate the Google domain with existing users from the LDAP server.

Schedule regular synchronizations to keep the data up-to-date.

Benefits:

Automated Sync: Ensures that user data is consistently updated without manual intervention.

Secure Access: Users can log in to the GCP Console using their existing credentials, enhancing security and user experience.

Google Cloud Directory Sync Documentation

GCDS Administration Guide

Provide granular access to secrets: 2.Enforce access control to secrets using project-level identity and Access Management (IAM) bindings. Give you control over the rotation schedules for the encryption keys that wrap your secrets: 3. Use customer-managed encryption keys to encrypt secrets. Maintain environment separation: 1. Use separate Google Cloud projects to store Production and Non-Production secrets.

To ensure user-uploaded comments and product reviews do not include sensitive data before publication, use the Cloud Data Loss Prevention (DLP) API.

Enable DLP API:

Go to the Cloud Console and navigate to APIs & Services > Library.

Search for "Data Loss Prevention API" and enable it.

Configure DLP API:

Create an inspection template specifying the types of sensitive data to detect.

Set up de-identification templates if you want to redact or mask sensitive data.

Implement DLP in Application:

Use the Google Cloud DLP Client Library for the desired programming language.

Send the text data to the DLP API for inspection before saving or publishing.

from google.cloud import dlp_v2 dlp_client = dlp_v2.DlpServiceClient() parent = f"projects/{project_id}" item = {"value": "User comment text here"} inspect_config = {"info_types": [{"name": "PERSON_NAME"}, {"name": "CREDIT_CARD_NUMBER"}]} response = dlp_client.inspect_content(parent=parent, inspect_config=inspect_config, item=item)

Cloud Data Loss Prevention API Documentation

DLP API Client Libraries

https://cloud.google.com/network-intelligence-center/docs/firewall-insights/concepts/overview#shadowed-firewall-rules

Firewall Insights analyzes your firewall rules to detect firewall rules that are shadowed by other rules. A shadowed rule is a firewall rule that has all of its relevant attributes, such as its IP address and port ranges, overlapped by attributes from one or more rules with higher or equal priority, called shadowing rules.

To restrict access to the MySQL instance to only the frontend application while other VMs are present in the subnets, creating an ingress firewall rule is the most appropriate approach. This rule will specifically allow traffic from subnet A (where the frontend application resides) to the MySQL instance in subnet B on port 3306, using network tags to target the specific MySQL VM.

Steps:

Create Network Tags: Apply a network tag (e.g., "data-tag") to the MySQL VM in subnet B.

Create Ingress Firewall Rule: Configure an ingress firewall rule with the following settings:

Source IP Range: Subnet A's IP range.

Target Tag: "data-tag".

Allowed Protocol/Ports: TCP:3306 (for MySQL).

This setup ensures that only instances in subnet A can communicate with the MySQL instance on port 3306.

https://cloud.google.com/billing/docs/how-to/billing-access#overview-of-cloud-billing-roles-in-cloud-iam

Billing Account Costs Manager (roles/billing.costsManager)

- Manage budgets and view and export cost information of billing accounts (but not pricing information)

Billing Account Viewer (roles/billing.viewer)

- View billing account cost information and transactions.

A security key is a physical device that you can use for two-step verification, providing an additional layer of security for your Google Account. Security keys can defend against phishing and man-in-the-middle attacks, making your login process more secure.

https://cloud.google.com/vpc/docs/private-service-connect

An API bundle:

All APIs (all-apis): most Google APIs

(same as private.googleapis.com).

VPC-SC (vpc-sc): APIs that VPC Service Controls supports

(same as restricted.googleapis.com).

VMs in the same VPC network as the endpoint (all regions)

On-premises systems that are connected to the VPC network that contains the endpoint

The problem has two key requirements:

All applications must send data to a centralized security service.

Developers need high autonomy over firewall rules within their projects.

Prevent accidental blockage of access to the central security service.

This scenario requires a mechanism to enforce critical network policies at a higher level of the resource hierarchy while still allowing project-level flexibility.

Hierarchical Firewall Policies: Google Cloud's Hierarchical Firewall Policies (HFP) are designed precisely for this purpose. They allow administrators to define firewall rules at the organization or folder level, and these rules are inherited by all projects and VPC networks within that hierarchy. Crucially, HFP rules can be prioritized. Rules with higher priority (lower numerical value) are evaluated first. This means you can create high-priority "allow" rules for critical services that cannot be overridden or blocked by project-level firewall rules.Extract Reference: "Hierarchical firewall policies allow you to define and enforce consistent network security policies across your organization. Policies can be applied at the organization or folder level, and they are inherited by all projects and VPC networks within that hierarchy." and "Rules in a hierarchical firewall policy can take precedence over VPC network firewall rules based on priority. A rule with a lower priority value takes precedence over a rule with a higher priority value." (Google Cloud documentation: https://cloud.google.com/vpc/docs/firewall-policies-overview)

Preventing Accidental Blockage while Allowing Autonomy: By setting a high-priority "allow" rule for the central security service in a hierarchical firewall policy, you guarantee that this traffic will always be permitted, regardless of what project-level firewall rules developers might configure. This ensures the critical connectivity while still allowing developers to manage other, less critical firewall rules within their projects with high autonomy.

Let's evaluate the other options:

A. Deploy a central Secure Web Proxy and connect it to all VPC networks. Create a Secure Web Proxy policy to allow traffic to the central security service. A Secure Web Proxy is for HTTP/S outbound traffic to external web services. The central security service might not be an external web service, and this solution is focused on application-layer proxies, not general network connectivity like sending data to an internal service. Also, it doesn't directly address the challenge of developers blocking access with project-level firewall rules.

C. Create a central project to manage Shared VPC networks which will be accessible to all other projects. Administer all firewall rules centrally within this project. While Shared VPC centralizes network management, it means all firewall rules are administered centrally. This directly contradicts the requirement for developers to have "high autonomy to configure firewall rules within their projects." Shared VPC would centralize too much control for this specific scenario.

D. Use Terraform to automate the creation of the required firewall rule in all projects. Restrict rule change permissions solely to the Terraform service account. This approach automates the creation but doesn't prevent developers from creating conflicting or overriding rules in their projects (unless Terraform is used to manage all rules, again removing autonomy). It also relies on restricting IAM permissions for all firewall rules, which is against the "high autonomy" requirement for developers. Hierarchical firewall policies offer a more robust and native solution for overriding and enforcing specific rules.

Therefore, implementing a hierarchical firewall policy is the most effective solution, as it allows for the enforcement of critical security service connectivity at a higher level, while still granting developers the desired autonomy over their project-specific firewall rules.

Google Cloud Armor provides protection against DDoS attacks and allows you to define security policies to control access to your application. It enables you to block traffic from specific IP addresses or ranges, making it suitable for denying traffic from a list of malicious IP addresses while protecting your application from being directly exposed to the internet.

Steps:

Set Up Cloud Armor: Enable Cloud Armor in your Google Cloud Console.

Create Security Policies: Define security policies that specify the rules for allowing or denying traffic based on IP addresses.

Attach Policies to Backend Services: Apply these security policies to the backend services of your web application.