Google Professional Cloud Security Engineer Exam Questions Instant Access

Question 1

Your security team uses encryption keys to ensure confidentiality of user data. You want to establish a process to reduce the impact of a potentially compromised symmetric encryption key in Cloud Key Management Service (Cloud KMS).

Which steps should your team take before an incident occurs? (Choose two.)

ADisable and revoke access to compromised keys.

BEnable automatic key version rotation on a regular schedule.

CManually rotate key versions on an ad hoc schedule.

DLimit the number of messages encrypted with each key version.

EDisable the Cloud KMS API.

Answer : B, D

Enable automatic key version rotation on a regular schedule:

Regularly rotating keys reduces the impact of a potentially compromised key by limiting the amount of data encrypted with a single key version.

Set up automatic key rotation in Cloud KMS to ensure keys are rotated without manual intervention.

Limit the number of messages encrypted with each key version:

Reducing the number of messages encrypted with each key version minimizes the potential data exposure in case of a key compromise.

Implement policies to ensure that new key versions are used periodically to limit the usage of each key version.

Cloud KMS Key Rotation

Best Practices for Using Cryptographic Keys

Question 2

Your company has deployed an artificial intelligence model in a central project. This model has a lot of sensitive intellectual property and must be kept strictly isolated from the internet. You must expose the model endpoint only to a defined list of projects in your organization. What should you do?

AWithin the model project, create an internal Application Load Balancer that points to the model endpoint. Expose this load balancer with Private Service Connect to a configured list of projects.

BCreate a central project to host Shared VPC networks that are provided to all other projects. Centrally administer all firewall rules in this project to grant access to the model.

CWithin the model project, create an external Application Load Balancer that points to the model endpoint. Create a Cloud Armor policy to restrict IP addresses to Google Cloud.

DActivate Private Google Access in both the model project and in each project that needs to connect to the model. Create a firewall policy to allow connectivity to Private Google Access addresses.

Answer : A

To share a service (like an AI model) across project boundaries privately and securely---without complex VPC peering or exposing it to the internet---Private Service Connect (PSC) is the recommended solution.14

According to Google Cloud Documentation (Private Service Connect for Vertex AI/Custom Services):

'Private Service Connect allows a service producer to expose a service (via an Internal Load Balancer) to service consumers in other VPC networks or projects.15 The producer creates a Service Attachment that points to the load balancer.16 The consumer creates a PSC Endpoint in their own VPC. Traffic stays entirely within the Google backbone, and the producer can maintain an 'Allowlist' of Project IDs that are permitted to connect.'

Why this fits the requirements:

Isolation: The model remains in its own project and is not reachable via the internet (Option C is out).

Granular Control: PSC allows you to explicitly list which Project IDs can access the service attachment (Option A).17

Scalability: It avoids the 'transitive peering' and 'IP overlap' limitations often found in Shared VPC or Peering architectures (Option B).

Google Cloud Documentation: 'Private Service Connect overview' (https://cloud.google.com/vpc/docs/private-service-connect).

Vertex AI Documentation: 'Using Private Service Connect for online inference' (https://cloud.google.com/vertex-ai/docs/predictions/private-service-connect).

Question 3

You want to update your existing VPC Service Controls perimeter with a new access level. You need to avoid breaking the existing perimeter with this change, and ensure the least disruptions to users while minimizing overhead. What should you do?

ACreate an exact replica of your existing perimeter. Add your new access level to the replica. Update the original perimeter after the access level has been vetted.

BUpdate your perimeter with a new access level that never matches. Update the new access level to match your desired state one condition at a time to avoid being overly permissive.

CEnable the dry run mode on your perimeter. Add your new access level to the perimeter configuration. Update the perimeter configuration after the access level has been vetted.

DEnable the dry run mode on your perimeter. Add your new access level to the perimeter dry run configuration. Update the perimeter configuration after the access level has been vetted.

Answer : D

Enable Dry Run Mode: Start by enabling the dry run mode for your VPC Service Controls perimeter. This mode allows you to test changes without actually enforcing them, thus preventing any disruption to your current setup.

Add Access Level: Add your new access level to the dry run configuration. This way, you can monitor how the new access level would behave and interact with your existing setup without any real impact.

Vetting Process: Carefully vet the new access level by analyzing logs and monitoring the behavior in the dry run mode. Ensure that the new configuration meets your security and operational requirements.

Update Perimeter: Once you are confident that the new access level will not disrupt existing services and meets all requirements, update the actual perimeter configuration with the new access level. This approach minimizes risk by allowing you to test changes before they take effect, ensuring seamless updates with minimal disruption. Reference:

Google Cloud - Configuring VPC Service Controls

Google Cloud - Using Dry Run Mode

Question 4

You are responsible for managing your company's identities in Google Cloud. Your company enforces 2-Step Verification (2SV) for all users. You need to reset a user's access, but the user lost their second factor for 2SV. You want to minimize risk. What should you do?

AOn the Google Admin console, select the appropriate user account, and generate a backup code to allow the user to sign in. Ask the user to update their second factor.

BOn the Google Admin console, temporarily disable the 2SV requirements for all users. Ask the user to log in and add their new second factor to their account. Re-enable the 2SV requirement for all users.

COn the Google Admin console, select the appropriate user account, and temporarily disable 2SV for this account Ask the user to update their second factor, and then re-enable 2SV for this account.

DOn the Google Admin console, use a super administrator account to reset the user account's credentials. Ask the user to update their credentials after their first login.

Answer : A

If a user loses their second factor for 2-Step Verification (2SV), you can help them regain access with minimal risk by generating a backup code.

Generate a Backup Code (A):

In the Google Admin console, navigate to the user's account settings.

Generate a backup code for the user. This code allows them to sign in despite not having access to their usual second factor.

Instruct the user to log in using the backup code and then update their second factor in their account settings.

This method ensures that only the affected user's access is temporarily adjusted, minimizing risk while maintaining overall security policies.

Reference

Google Admin console 2-Step Verification documentation

Question 5

You are creating a new infrastructure CI/CD pipeline to deploy hundreds of ephemeral projects in your Google Cloud organization to enable your users to interact with Google Cloud. You want to restrict the use of the default networks in your organization while following Google-recommended best practices. What should you do?

AEnable the constraints/compute.skipDefaultNetworkCreation organization policy constraint at the organization level.

BCreate a cron job to trigger a daily Cloud Function to automatically delete all default networks for each project.

CGrant your users the 1AM Owner role at the organization level. Create a VPC Service Controls perimeter around the project that restricts the compute.googleapis.com API.

DOnly allow your users to use your CI/CD pipeline with a predefined set of infrastructure templates they can deploy to skip the creation of the default networks.

Answer : A

Organization Policy: Use the constraints/compute.skipDefaultNetworkCreation organization policy constraint to disable the creation of default networks in new projects.

Policy Application: Apply this constraint at the organization level to ensure it affects all projects within your organization, preventing the creation of default networks.

Best Practices Compliance: Following this best practice helps maintain a clean and secure network configuration by avoiding the use of default networks, which may not be properly segmented or secured.

Verification: Verify the policy application by creating new projects and ensuring that default networks are not created. Reference:

Google Cloud - Organization Policy Constraints

Google Cloud - Best Practices for Enterprise Organizations

Question 6

Your organization has recently migrated sensitive customer data to Cloud Storage buckets. For compliance reasons, you must ensure that all vendor data access and administrative access by Google personnel is logged. What should you do?

AConfigure Data Access audit logs for Cloud Storage on the project hosting the Cloud Storage buckets.

BEnable Access Transparency for the organization.

CConfigure Data Access audit logs for Cloud Storage at the organization level.

DEnable Access Transparency for the project hosting the Cloud Storage buckets.

Answer : B

The requirement to log access by Google personnel (e.g., Google administrators or support) is the specific function of Access Transparency.

Access Transparency logs provide records of actions taken by Google staff when they interact with your content, which is a requirement for many regulated industries. It is typically enabled at the Organization level to ensure consistent coverage, though it can be configured lower.

Extracts:

'Access Transparency logs provide records of actions taken by Google employees when accessing your data or configuration... Access Transparency allows you to monitor compliance with vendor access rules, including those for security and privacy.' (Source 9.1)

'Access Transparency is enabled for all supported Google Cloud services across your organization when enabled at the organization level.' (Source 9.2)

Option A and C (Data Access logs) record customer/user access to data, but do not record actions taken by Google personnel.

Question 7

Your team wants to limit users with administrative privileges at the organization level.

Which two roles should your team restrict? (Choose two.)

AOrganization Administrator

BSuper Admin

CGKE Cluster Admin

DCompute Admin

EOrganization Role Viewer

Answer : A, B

The Organization Administrator and Super Admin roles have extensive administrative privileges at the organization level. Restricting these roles is crucial to limit the number of users who have the ability to manage critical resources and configurations within the organization, thereby enhancing security and minimizing potential risks.

Organization Administrator: Has comprehensive permissions to manage all aspects of the Google Cloud organization, including projects, folders, and IAM policies.

Super Admin: In Google Workspace (formerly G Suite), the Super Admin has access to all administrative features and can manage user accounts, services, and settings across the organization.

Google Cloud IAM roles

Managing super admin roles in Google Workspace