10 beginner questions on the Professional Cloud Security Engineer exam guide sections: configuring access (least privilege, Workload Identity Federation, policy inheritance), boundary protection (Cloud Armor, VPC Service Controls, Cloud NAT), data protection (Secret Manager, CMEK), managing operations (Cloud Audit Logs) and compliance (Access Transparency).

Ready to test yourself? Take the graded Beginner test (free; sign in with Google, one click) to get your score.

  1. A team member only needs to read objects in one Cloud Storage bucket. Which grant follows the principle of least privilege?

    • A. The Editor basic role on the whole project
    • B. Storage Object Viewer on that bucket ✔ correct
    • C. The Owner basic role on the bucket's folder
    • D. Storage Admin on the organization

    Answer: B. roles/storage.objectViewer lets a principal view and list objects, and granting it on the single bucket limits the scope. Basic roles such as Editor and Owner, or Storage Admin at organization level, give far more access than needed.

    Source: docs.cloud.google.com/storage/docs/access-control/iam-roles · Domain: Configuring access

  2. A company's CI/CD pipeline runs outside Google Cloud and must deploy resources to a Google Cloud project. The security policy forbids long-lived service account keys. What should the security engineer configure?

    • A. A downloaded JSON key stored as a pipeline secret
    • B. A shared user account with 2-step verification turned off
    • C. Workload Identity Federation for the external identity provider ✔ correct
    • D. The Owner role for all authenticated users

    Answer: C. Workload Identity Federation lets external workloads exchange their own identity tokens for short-lived Google Cloud credentials, so no service account key needs to be created or stored. A JSON key is exactly the long-lived credential the policy forbids.

    Source: docs.cloud.google.com/iam/docs/workload-identity-federation · Domain: Configuring access

  3. An IAM allow policy set on a folder is inherited by the projects and resources under that folder.

    • A. True ✔ correct
    • B. False

    Answer: A. True. Resources inherit the allow policies of their parents in the resource hierarchy (organization, folders, projects, resources). The effective policy is the union of the policy set on the resource and the policies inherited from above.

    Source: docs.cloud.google.com/iam/docs/resource-hierarchy-access-control · Domain: Configuring access

  4. A company runs a public web application behind an external Application Load Balancer and wants to block SQL injection attempts and filter traffic by source IP. Which service should it use?

    • A. Google Cloud Armor security policies ✔ correct
    • B. Cloud NAT
    • C. VPC Flow Logs
    • D. Private Google Access

    Answer: A. Google Cloud Armor attaches security policies to load balancer backends, with preconfigured WAF rules (for example against SQL injection), IP allow and deny lists and DDoS protection. VPC Flow Logs only record traffic; they do not block it.

    Source: docs.cloud.google.com/armor/docs/cloud-armor-overview · Domain: Securing communications and establishing boundary protection

  5. A security team wants to reduce the risk that data in BigQuery and Cloud Storage is copied to projects outside the organization, even by a user who holds valid credentials. Which control is designed for this?

    • A. Firewall rules that allow only port 443
    • B. A Cloud DNS private zone for the project
    • C. Cloud Storage Object Versioning
    • D. A VPC Service Controls service perimeter ✔ correct

    Answer: D. VPC Service Controls create service perimeters around Google-managed services such as BigQuery and Cloud Storage to mitigate data exfiltration, adding a boundary on top of IAM. VPC firewall rules do not control access to these Google APIs.

    Source: docs.cloud.google.com/vpc-service-controls/docs/overview · Domain: Securing communications and establishing boundary protection

  6. Compute Engine VMs have only internal IP addresses for security reasons, but they must download OS updates from the internet. Which service lets them make outbound connections without external IPs?

    • A. Cloud Armor
    • B. Cloud NAT ✔ correct
    • C. Identity-Aware Proxy
    • D. Cloud Interconnect

    Answer: B. Cloud NAT provides outbound network address translation, so VMs without external IP addresses can reach the internet while staying unreachable from it. Identity-Aware Proxy controls inbound user access; it does not provide outbound internet.

    Source: docs.cloud.google.com/nat/docs/overview · Domain: Securing communications and establishing boundary protection

  7. A developer has hard-coded a database password in application source code. Where should the password be stored instead so that access is controlled by IAM, versioned and audited?

    • A. In the VM's instance metadata
    • B. In a public Cloud Storage bucket
    • C. In Secret Manager ✔ correct
    • D. In a Cloud Logging log entry

    Answer: C. Secret Manager stores API keys, passwords and certificates with IAM access control, versions and audit logging. Instance metadata can be read by any process on the VM and is not a secret store.

    Source: docs.cloud.google.com/secret-manager/docs/overview · Domain: Ensuring data protection

  8. Which two statements about encryption at rest in Google Cloud are true? (Select TWO)

    • A. Data stored in Google Cloud is encrypted at rest by default, with no action needed ✔ correct
    • B. Customer-managed encryption keys (CMEK) let you control your keys in Cloud KMS, such as rotating or disabling them ✔ correct
    • C. Data at rest stays unencrypted until you configure CMEK for each service
    • D. Default encryption at rest applies only to BigQuery tables
    • E. Disabling a CMEK key never affects the data that it protects

    Answer: A, B. All data stored in Google Cloud is encrypted at rest by default with Google-owned and Google-managed keys. CMEK adds customer control over keys in Cloud KMS (rotation, disabling, destroying); disabling a key makes the data it protects inaccessible.

    Source: docs.cloud.google.com/kms/docs/cmek · Domain: Ensuring data protection

  9. A security analyst needs to find out which user deleted a Compute Engine VM yesterday. Which logs record this kind of action and are always written?

    • A. VPC Flow Logs
    • B. Firewall Rules Logging
    • C. Data Access audit logs
    • D. Admin Activity audit logs ✔ correct

    Answer: D. Admin Activity audit logs record API calls that change resource configuration, such as creating or deleting VMs, including who made the call. They are always written and cannot be disabled. Data Access logs cover reading data and are mostly off by default.

    Source: docs.cloud.google.com/logging/docs/audit · Domain: Managing operations

  10. Access Transparency logs record actions that Google personnel take when they access customer data, which helps organizations meet audit and compliance requirements.

    • A. True ✔ correct
    • B. False

    Answer: A. True. Access Transparency log entries show the affected resource, the action, the time and the reason when Google staff access Customer Data. Access Approval goes further and lets you approve or deny such requests.

    Source: docs.cloud.google.com/assured-workloads/access-transparency/docs/overview · Domain: Supporting compliance requirements

Original practice questions written by xOps School (DevOpsSchool Private Limited) from the public Google Cloud exam objectives (Professional Cloud Security Engineer certification exam guide (current English PDF, checked 2026-10-25)), checked 2026-10-25. They are not actual exam questions. xOps School is not affiliated with or endorsed by Google Cloud; exam names are trademarks of their owners. Official exam page: cloud.google.com/learn/certification/cloud-security-engineer.

Last modified: Sunday, 25 October 2026, 9:57 PM