Google Cloud Professional Cloud Security Engineer Practice Exam

• A. Delete the consumer accounts, then create Cloud Identity users with the same addresses
• B. Send invitations from the transfer tool for unmanaged users in the Admin console Correct answer
• C. Reset each password in the Admin console and set the corporate address as recovery email
• D. Add the accounts to a Google Group in the domain as external members

Option B is correct because the Admin console's transfer tool for unmanaged users sends invitations that, once accepted, convert the existing consumer accounts into managed accounts under the organization while the users keep their data. Option A destroys the data the employees want to keep, option C is not possible for accounts the organization does not yet control, and option D only makes the accounts external group members without bringing them under administrative control.

• A. Add an exclusion rule for the account's address in the GCDS configuration Correct answer
• B. Run GCDS in simulation mode and review the proposed suspensions before each sync
• C. Raise the user deletion limit in the GCDS configuration above the current value
• D. Assign the account a delegated admin role so that GCDS leaves administrators untouched

Option A is correct because GCDS suspends accounts that exist in Cloud Identity but not in the LDAP source, and an exclusion rule for that address tells GCDS to leave the account alone while syncing continues on schedule. Option B only adds a manual review step before each sync, option C changes a safety limit rather than protecting the account, and option D is wrong because GCDS does not skip accounts based on delegated admin roles.

• A. Assign the SSO profile to the root organizational unit and move the contractors' accounts to a Google Group
• B. Assign the SSO profile to the Staff organizational unit and leave Partners with no SSO profile Correct answer
• C. Assign the SSO profile to the root organizational unit and set a shorter session length for Partners
• D. Assign the SSO profile to the root organizational unit and enforce security-key 2-Step Verification for Partners

Option B is correct because an SSO profile is assigned per organizational unit (or group), so assigning it only to Staff sends those users to the third-party provider while Partners, with no profile, keeps signing in with Google credentials. Options A, C and D assign the profile to the root OU, which the contractors inherit, so they would be forced to the provider where they have no accounts; session length and 2-Step Verification do not exempt anyone from SSO.

• A. Assign the pre-built Help Desk Admin role to the team's group, scoped to the whole domain
• B. Assign the pre-built User Management Admin role to the team's group, scoped to the Retail Stores organizational unit
• C. Assign the pre-built Groups Admin role to the team's group, scoped to the Retail Stores organizational unit
• D. Assign the pre-built Help Desk Admin role to the team's group, scoped to the Retail Stores organizational unit Correct answer

Option D is correct because the pre-built Help Desk Admin role grants password reset and basic user viewing and, scoped to the Retail Stores organizational unit, applies only to users there. Option A scopes it to the whole domain, which is more than needed. Options B and C use roles that either allow creating and deleting users or manage groups rather than resetting passwords.

• A. Give the rule a higher priority number than the existing allow rules
• B. Attach the rule to a staging backend service and replay checkout traffic
• C. Set the rule action to throttle with a conservative request rate limit
• D. Turn on preview mode for the rule and review the logged matches Correct answer

Option D is correct because preview mode logs the requests a Cloud Armor rule would have matched without enforcing the action, so the team can review the logged matches before turning the rule on. Option A changes evaluation order rather than showing impact, option B tests on a different backend with replayed traffic that may not represent production, and option C turns the rule into rate limiting instead of a deny.

• A. Opt the logged rule ID out of the preconfigured expression and keep sensitivity at level 2 Correct answer
• B. Move the rule to preview mode and keep it there until the application code is changed
• C. Lower the sensitivity level of the preconfigured expression to 1 for the entire rule set
• D. Add a higher-priority allow rule that matches the search path and skips WAF evaluation

Option A is correct because Cloud Armor lets you exclude individual signature IDs from a preconfigured expression, so only the signature that blocks legitimate searches is disabled and the rest stay at sensitivity level 2. Option C weakens every signature in the set, option B leaves the rule non-enforcing, and option D bypasses WAF evaluation for the search path altogether.

• A. A deny rule with a custom expression that matches the Tor Browser user agent string
• B. A deny rule whose expression evaluates the Google-maintained named IP list of Tor exit nodes Correct answer
• C. A deny rule using the preconfigured scanner detection expression at sensitivity 1
• D. A rate-based ban rule keyed on client IP with a low request threshold

Option B is correct because Cloud Armor provides Google-maintained named IP lists, including one for Tor exit nodes, that you can reference in a rule expression and that Google keeps current. Option A matches a user agent that attackers can change or omit, option C targets scanners rather than Tor exit addresses, and option D rate-limits all clients by IP without identifying Tor traffic.

• A. Set True-Client-IP as a user IP request header in the policy so rules see the visitor address Correct answer
• B. Add the CDN's published address ranges to an allow rule at the highest priority
• C. Set X-Forwarded-For as a user IP request header in the policy so rules see the visitor address
• D. Replace the deny rules with a rate-based ban rule keyed on the connecting IP address

Option A is correct because Cloud Armor can be told to read the client address from a user IP request header, and True-Client-IP is overwritten by the CDN on every request, so it is trustworthy. Option C uses X-Forwarded-For, which clients can pre-populate and the CDN passes through unchanged, so it can be spoofed. Option B allows CDN ranges, which never reveals the visitor address, and option D keys on the connecting CDN address.

• A. Inspect the images with Sensitive Data Protection and move the flagged files to a restricted bucket
• B. Apply character masking to CREDIT_CARD_NUMBER findings with a Sensitive Data Protection de-identification job
• C. Redact CREDIT_CARD_NUMBER findings from the images with Sensitive Data Protection image redaction Correct answer
• D. Encrypt the bucket with a customer-managed key and give reviewers the decrypter role

Option C is correct because Sensitive Data Protection image redaction detects text such as CREDIT_CARD_NUMBER inside images and returns a copy with those regions blocked out, so reviewers can still open the receipts. Option A only moves flagged files and leaves reviewers without the images, option B masks characters in structured or text content rather than in image pixels, and option D encrypts the data without hiding what is printed on the receipt.

• A. Schedule the scan as a job trigger with the timespan configuration populated automatically Correct answer
• B. Set the job to sample 10 percent of each file's bytes and keep the nightly schedule
• C. Run one inspection job per top-level folder in parallel and aggregate the findings in BigQuery
• D. Add a lifecycle rule that moves each object to a separate bucket after its first scan

Option A is correct because a job trigger can populate the timespan configuration automatically, so each run inspects only objects created or modified since the previous run while new files are still covered. Option B samples part of each file and can miss sensitive data, option C still rescans all 40 TB, and option D adds object moves that do not limit what the job reads.

• A. Turn on Sensitive Data Protection discovery for Cloud Run environment variables and review Security Command Center findings Correct answer
• B. Run a Sensitive Data Protection inspection job in each project against exported Cloud Run revision manifests
• C. Export Cloud Asset Inventory metadata for Cloud Run services to BigQuery and query the environment variable names for key-like patterns every week
• D. Enable Data Access audit logs for Secret Manager across the organization and alert on unusual secret reads

Option A is correct because Sensitive Data Protection discovery can scan Cloud Run environment variables continuously across an organization and publish findings to Security Command Center, which the SOC already uses. Option B needs a manual job per project on exported manifests, option C only matches variable names rather than values, and option D watches secret reads, which does not detect keys pasted into environment variables.

• A. Replace each detected value with the name of its infoType, such as [EMAIL_ADDRESS] Correct answer
• B. Redact each detected email address and phone number from the exported text Correct answer
• C. Replace each detected value with a surrogate-annotated token so it can be located again during re-identification
• D. Encrypt each detected value with format-preserving encryption under a Cloud KMS-wrapped key
• E. Replace each detected value with a deterministic encryption token under a Cloud KMS-wrapped key

Options A and B are correct because replacing a value with its infoType name and redacting it both discard the original value, so nobody can recover it from the shared file. Options C, D and E are reversible: surrogate-annotated tokens are made to be located and re-identified, and format-preserving or deterministic encryption under a Cloud KMS key can be decrypted by anyone who holds that key, including the retailer's own staff.

• A. Set the policy's enforcement mode to dry-run on the cluster for the length of the incident
• B. Add the hotfix image path to the policy's allowlist of exempt image patterns until the incident is closed
• C. Add the break-glass annotation to the Pod so it is admitted and the override is logged for later review Correct answer
• D. Sign the hotfix image manually with the pipeline attestor's key so the policy admits the deployment

Option C is correct because the break-glass annotation on the Pod lets Binary Authorization admit that one workload and writes an audit log entry, so the bypass is explicit, limited to that deployment and reviewable afterwards. Options A and B weaken the policy for the whole cluster or for every use of the image path, and Option D falsifies the CI attestation by signing outside the pipeline, so it is not an explicit, auditable exception.

• A. Run on-demand scanning on each built artifact and fail the build when critical vulnerabilities are found
• B. Sign every downloaded JAR with a Cloud KMS key in a build step and verify the signature at deploy time
• C. Resolve the covered libraries from Assured Open Source Software through its Artifact Registry repository Correct answer
• D. Create an Artifact Registry remote repository for Maven Central and enable vulnerability scanning on it

Option C is correct because Assured Open Source Software serves Java packages that Google has built from source, scanned and signed, so using its Artifact Registry repository meets the rule with no extra build steps. Options A and D only scan packages that still come from Maven Central, and Option B adds your own signature, which proves nothing about where Google built the package.

• A. Run Artifact Analysis on-demand scans on the images in running Pods and compare the results with the policy
• B. Switch the policy to dry-run mode and review the audit log entries for the deployments it would have blocked
• C. Enable continuous validation in the policy so running Pods are checked periodically and violations are logged Correct answer
• D. Restart every Deployment so the admission controller evaluates each image against the new policy

Option C is correct because continuous validation in the Binary Authorization policy periodically checks running Pods against the current policy and logs violations, without restarting anything. Option A is a manual comparison that does not evaluate the policy's attestation requirement, Option B only covers new deployments, and Option D requires restarts, which the scenario rules out.

• A. Add the vendor's registry path to the allowlist of images that the policy exempts from all checks
• B. Turn on continuous validation in the platform policy so that Pods running the vendor image are rechecked periodically
• C. Create an attestor, import the vendor's cosign public key into it, and require that attestor in the project's default admission rule
• D. Add a Sigstore signature check holding the vendor's public key to a check set scoped to the agent's namespace Correct answer
• E. Bind the platform policy to each cluster by setting the cluster's Binary Authorization evaluation mode to policy bindings together with project singleton policy enforcement Correct answer

Options D and E are correct. A Sigstore signature check with the vendor's public key in a check set scoped to the agent's namespace verifies the cosign signature on every admission without the team issuing attestations, and a platform policy only takes effect on clusters whose evaluation mode includes policy bindings; using the mode that combines policy bindings with project singleton policy enforcement keeps the project's CI attestation requirement in force. Option A would exempt the vendor image from every check, option B rechecks running Pods but does not verify at admission, and option C relies on attestors, which means issuing attestations.

• A. Create an Assured Workloads folder with the EU Data Boundary and Support control package and protect the data with Cloud HSM keys in the matching region
• B. Adopt a Sovereign Controls by Partners offering in which the local partner operates the controls, holds the keys in its external key manager and provides in-country support Correct answer
• C. Enable Access Approval and Access Transparency on the insurer's organization and have its security group approve every Google support access request
• D. Import the insurer's own key material into Cloud KMS keys in the national region and disable the key versions when the regulator asks for proof

Option B is correct because a sovereign-controls-by-partners offering lets a locally owned partner operate the controls, hold the keys in its own external key manager and provide in-country support, which is what the regulator asks for. Option A (Assured Workloads EU Data Boundary and Support) limits support to EU-based Google personnel but they are still Google staff. Option C gives approval over Google access but not local operation or key custody, and option D keeps the keys inside Google's Cloud KMS.

• A. An asymmetric Cloud KMS signing key in the Access Approval settings, so every approval is signed with a key the supplier controls Correct answer
• B. Data Access audit logs for the Access Approval API, so each approver's decision is recorded in Cloud Audit Logs with the approver's identity
• C. Cloud EKM keys protected by Key Access Justifications, so Google must state a justification before each use of the keys
• D. A Pub/Sub notification topic in the Access Approval settings, so each approval request and decision is mirrored to the supplier's SIEM

Option A is correct because Access Approval can sign each approval with a customer-controlled asymmetric Cloud KMS key, which gives the auditors verifiable proof that the approval came from the supplier and was not altered. Option B records who decided but does not provide a tamper-evident signature on the approval itself. Option C controls key use justifications, not Access Approval requests, and option D only mirrors notifications to a SIEM.

• A. Add conditional rules to the folder policy that match the entity tag, allowing in:eu-locations for eu projects and the asia-southeast1 locations for sg projects Correct answer
• B. Create a child folder for the Singapore teams with a policy that replaces the inherited one with the Singapore locations, and move the sg-tagged projects into it
• C. Allow both location groups in the folder policy and attach an IAM deny policy to the eu-tagged projects that blocks resource creation outside the EU regions
• D. Allow both in:eu-locations and in:asia-southeast1-locations in the folder policy, and alert on eu-tagged resources found outside the EU through a Cloud Asset Inventory feed

Option A is correct because organization policy rules can be conditional on resource tags, so one folder policy can allow in:eu-locations for eu-tagged projects and the Singapore locations for sg-tagged projects, and a retagged project follows the right rule without moving. Option B changes the folder hierarchy, which the stem forbids. Options C and D leave the folder policy permissive for eu projects, so the EU restriction is not preventively enforced (D only detects violations after the fact).

• A. Delete the requesting customer's entries one by one with the Logging API, leaving the rest of the bucket untouched
• B. Delete the checkout service's log with the logs.delete method so that stored entries holding email addresses are removed
• C. Add an exclusion filter for the requesting customer's email address to the _Default sink
• D. Have the service log a pseudonymous customer ID in place of the email address Correct answer
• E. Set the log bucket's retention period to 90 days Correct answer

Options D and E are correct. Logging a pseudonymous ID stops new entries from identifying the customer directly, and setting the bucket's retention to 90 days makes every stored entry, including those holding email addresses, expire within the DPO's limit while the bucket's other entries stay for the full 90 days. Option A is not possible because the Logging API cannot delete individual entries. Option B (logs.delete) removes the whole log, which destroys entries that must remain. Option C only filters future routing and does not touch stored entries.