Google GCP-PCSE Certification Exam Sample Questions

GCP-PCSE Braindumps, GCP-PCSE Exam Dumps, GCP-PCSE Examcollection, GCP-PCSE Questions PDF, GCP-PCSE Sample Questions, Professional Cloud Security Engineer Dumps, Professional Cloud Security Engineer Official Cert Guide PDF, Professional Cloud Security Engineer VCEWe have prepared Google Professional Cloud Security Engineer (GCP-PCSE) certification sample questions to make you aware of actual exam properties. This sample question set provides you with information about the Professional Cloud Security Engineer exam pattern, question formate, a difficulty level of questions and time required to answer each question. To get familiar with Google Cloud Platform - Professional Cloud Security Engineer (GCP-PCSE) exam, we suggest you try our Sample Google GCP-PCSE Certification Practice Exam in simulated Google certification exam environment.

To test your knowledge and understanding of concepts with real-time scenario based Google GCP-PCSE questions, we strongly recommend you to prepare and practice with Premium Google Professional Cloud Security Engineer Certification Practice Exam. The premium Google Professional Cloud Security Engineer certification practice exam helps you identify topics in which you are well prepared and topics in which you may need further training to achieving great score in actual Google Cloud Platform - Professional Cloud Security Engineer (GCP-PCSE) exam.

Google GCP-PCSE Sample Questions:

01. A partner's employees authenticate against the partner's own SAML identity provider. They need read access to one BigQuery dataset in your organization for a three-month engagement, and your policy is not to create accounts in your directory for external people.
Which approach should you use?
a) Create a Cloud Identity account for each partner employee, and delete the accounts when the engagement ends.
b) Configure workload identity federation so the partner's users exchange their provider's tokens for Google Cloud credentials.
c) Create a service account for the partner, grant it the BigQuery Data Viewer role on that one dataset, and send the partner a downloaded service account key to use.
d) Configure workforce identity federation so the partner's users sign in with their own identity provider and receive short-lived credentials mapped to IAM.
 
02. Your organization is tightening the IAM bindings on a set of production projects after an access review found that most principals hold far more permission than their work requires.
Which two changes move the bindings toward least privilege?
(Choose two.)
a) Attach IAM conditions to the remaining bindings so that access applies only to named resources or only within a defined time window.
b) Have all administrators share a single service account and impersonate it for privileged work, so that only one identity holds the elevated roles.
c) Grant every principal the roles/viewer basic role on each project or folder so that read access is uniform and nobody has to request it.
d) Grant roles/owner to the project setup team so that new environments can be built without waiting on additional bindings.
e) Replace the broad predefined roles with custom roles that carry only the permissions each job actually calls.
 
03. Staff accounts live in Active Directory. When someone is disabled there, their Google Cloud access must be revoked without a ticket being raised, and new joiners must receive a Google Cloud account with no manual step.
Which tool should you implement?
a) Workforce identity federation, so that Active Directory users receive short-lived credentials without accounts being created for them.
b) Google Cloud Directory Sync, scheduled to synchronize the Active Directory organizational units into Cloud Identity.
c) Access Context Manager, with access levels that permit sign-in only from the corporate network and company-managed devices.
d) Identity-Aware Proxy, placed in front of the applications so that every request is authorized against the current directory state.
 
04. After deploying VPC Service Controls perimeters and hierarchical firewall policies, your team needs continuing evidence that those boundary controls are working as intended.
Which two sources provide that telemetry?
(Choose two.)
a) Cloud IDS detection metrics, which surface the threat activity observed on traffic crossing the boundary.
b) Identity-Aware Proxy, which authenticates and authorizes each request before it reaches a protected application.
c) Secret Manager version access logs, which show which principals retrieved each secret version and when.
d) Cloud Monitoring dashboards and alerts built on firewall rules logging and VPC Service Controls metrics.
e) Billing export data in BigQuery, using unexpected network egress charges as an indication that traffic is leaving.
 
05. Your security team must apply a constraint that governs every project the company has today and every project created in future, without anyone revisiting the setting as new teams are onboarded.
Where in the resource hierarchy should the policy be set?
a) On a folder containing the current business units, so that it applies to the teams that exist today
b) On each project individually, so that the setting is explicit everywhere it takes effect
c) On the Cloud Identity account for the domain, since it is what owns the organization resource
d) On the organization resource, so that it is inherited by every folder and project beneath it
 
06. As part of its HIPAA compliance program, a healthcare provider's internal control standard requires that the organization — not Google — control the lifecycle of the keys protecting patient data at rest in Cloud Storage, and be able to make that data unreadable by disabling a key.
Which configuration supports that requirement?
a) Configure the buckets to use a customer-managed encryption key from a Cloud KMS key ring in the same location, and grant the Cloud Storage service agent access to that key.
b) Rely on the default Google-managed encryption that already protects every object at rest, and record that control in the evidence package.
c) Supply a customer-supplied encryption key on every object write and read, and store those key strings in Secret Manager for the applications that need them.
d) Enable uniform bucket-level access and public access prevention on each bucket that holds the data.
 
07. Finance and Engineering must have different IAM allow policies and different organization policy constraints, and each team's administrators must not be able to change the other team's. Both teams stay under one Cloud Identity domain and one billing arrangement.
How should you structure the resource hierarchy?
a) Create a second organization node for Finance so that Engineering's administrators have no path to its policies at all.
b) Keep both teams in one project and separate them with IAM conditions on the individual resources each team uses.
c) Create a folder for each team under the organization node, and attach that team's allow policies and constraints to its own folder.
d) Create a billing account for each team and attach that team's allow policies and constraints to its own billing account.
 
08. Administrators occasionally need elevated rights on production projects for a short maintenance window, and the security team wants that elevation to expire on its own rather than depend on someone remembering to remove it.
Which two Google Cloud features enforce time-bound elevated access?
(Choose two.)
a) Membership of a Google group that holds the production roles, with the group's membership reviewed and pruned every quarter
b) Privileged Access Manager, which grants an entitlement for a bounded window after an approval and withdraws it automatically when the window ends
c) The Access Approval API, which requires a named approver to authorize a request before it takes effect
d) An IAM condition on the role binding that limits the grant to a date and time range using request.time
e) A permanent roles/owner grant on the production project that the administrator asks a colleague to remove after the maintenance window
 
09. Two teams in different projects want their VPC networks connected with VPC Network Peering, and you are reviewing what that peering does and does not change about the security posture.
Which two statements are correct?
(Choose two.)
a) Peering is transitive, so a network that is peered with two others can route traffic between those two networks without any further configuration on either spoke.
b) Traffic between peered networks is carried in an IPsec tunnel that is established automatically, as it is with Cloud VPN.
c) Peering exchanges routes between the networks but grants no IAM access, so principals in one project gain no permissions in the other.
d) A Cloud NAT gateway in one peered network provides outbound internet access for instances in the other network.
e) Each network keeps its own firewall rules, so traffic arriving from the peer is still evaluated against the receiving network's ingress rules.
 
10. Workloads in a private subnet must be able to reach a short list of approved external websites, and the security team needs to see and control the HTTPS requests those workloads make.
Which two capabilities does Secure Web Proxy provide for this?
(Choose two.)
a) Termination of high-availability VPN tunnels so that the workloads reach on-premises databases over private connectivity
b) Policy-based control of outbound HTTPS, including TLS inspection so that the destination and the request can be evaluated against an allow list
c) Filtering of inbound HTTP and HTTPS requests to internet-facing applications using web application firewall rules
d) Inline visibility into the web traffic leaving the network, with per-request logging that supports threat detection
e) Automatic enforcement of VPC Service Controls perimeter rules on every Google Cloud API call the workloads make

Answers:

Question: 01
Answer: d		 Question: 02
Answer: a, e		 Question: 03
Answer: b		 Question: 04
Answer: a, d		 Question: 05
Answer: d
Question: 06
Answer: a		 Question: 07
Answer: c		 Question: 08
Answer: b, d		 Question: 09
Answer: c, e		 Question: 10
Answer: b, d

Note: Please update us by writing an email on feedback@vmexam.com for any error in Google Cloud Platform - Professional Cloud Security Engineer (GCP-PCSE) certification exam sample questions

Rating: 4.9 / 5 (78 votes)