support@Free-Braindumps.com
Register Login
Cisco
CompTIA
ISC
EC-Council
EXIN
Fortinet
ITIL
Juniper
Microsoft
VMware
Avaya
SAP
Google
NVIDIA
Salesforce
Amazon
Palo Alto Networks
ISC2
CrowdStrike
Anthropic
All Vendors
  1. Home
  2. Exams
  3. Google
  4. PROFESSIONAL CLOUD SECURITY ENGINEER

Free PROFESSIONAL CLOUD SECURITY ENGINEER Exam Braindumps
Professional Cloud Security Engineer Questions 161–165 (page: 34)

Updated On: 10-Feb-2026
Page 34 of 74
PDF with 376 Questions

You are implementing data protection by design and in accordance with GDPR requirements. As part of design reviews, you are told that you need to manage the encryption key for a solution that includes workloads for Compute Engine, Google Kubernetes Engine, Cloud Storage, BigQuery, and Pub/Sub.
Which option should you choose for this implementation?

  1. Cloud External Key Manager
  2. Customer-managed encryption keys
  3. Customer-supplied encryption keys
  4. Google default encryption

Answer(s): B



Which Identity-Aware Proxy role should you grant to an Identity and Access Management (IAM) user to access HTTPS resources?

  1. Security Reviewer
  2. IAP-Secured Tunnel User
  3. IAP-Secured Web App User
  4. Service Broker Operator

Answer(s): C



You need to audit the network segmentation for your Google Cloud footprint. You currently operate Production and Non-Production infrastructure-as-a-service (IaaS) environments. All your VM instances are deployed without any service account customization.

After observing the traffic in your custom network, you notice that all instances can communicate freely ­ despite tag-based VPC firewall rules in place to segment traffic properly ­ with a priority of 1000.
What are the most likely reasons for this behavior? (Choose two.)

  1. All VM instances are missing the respective network tags.
  2. All VM instances are residing in the same network subnet.
  3. All VM instances are configured with the same network route.
  4. A VPC firewall rule is allowing traffic between source/targets based on the same service account with priority 999.
  5. A VPC firewall rule is allowing traffic between source/targets based on the same service account with priority 1001.

Answer(s): A,D



You are creating a new infrastructure CI/CD pipeline to deploy hundreds of ephemeral projects in your Google Cloud organization to enable your users to interact with Google Cloud. You want to restrict the use of the default networks in your organization while following Google-recommended best practices.
What should you do?

  1. Enable the constraints/compute.skipDefaultNetworkCreation organization policy constraint at the organization level.
  2. Create a cron job to trigger a daily Cloud Function to automatically delete all default networks for each project.
  3. Grant your users the IAM Owner role at the organization level. Create a VPC Service Controls perimeter around the project that restricts the compute.googleapis.com API.
  4. Only allow your users to use your CI/CD pipeline with a predefined set of infrastructure templates they can deploy to skip the creation of the default networks.

Answer(s): A



You are a security administrator at your company and are responsible for managing access controls (identification, authentication, and authorization) on Google Cloud.
Which Google-recommended best practices should you follow when configuring authentication and authorization? (Choose two.)

  1. Use Google default encryption.
  2. Manually add users to Google Cloud.
  3. Provision users with basic roles using Google's Identity and Access Management (IAM) service.
  4. Use SSO/SAML integration with Cloud Identity for user authentication and user lifecycle management.
  5. Provide granular access with predefined roles.

Answer(s): D,E



  PDF
Viewing page 34 of 74
Viewing questions 166 - 170 out of 376 questions


Post your Comments and Discuss Google PROFESSIONAL CLOUD SECURITY ENGINEER exam prep with other Community members:

AI Tutor AI Tutor 👋 I’m here to help!