GCP Security Engineer Practice

Q: How many questions are in this practice set?

This practice set contains 60 questions with detailed explanations.

Q: What topics does this practice cover?

It covers the key topics and question types for Google Cloud Professional Cloud Security Engineer, including vocabulary, grammar, reading, and practical test skills.

Q: Are there explanations for every question?

Yes, every question includes a clear explanation so you can understand the correct answer and learn from mistakes.

Q: Can I save my progress and mistakes?

Your wrong answers, favorites, scores, and study streak are saved in your browser, so you can review them on the same device.

Q: What practice modes are available?

You can practice randomly, take a timed mock exam, filter by difficulty, type, and topic, search questions, and review wrong answers.

Practice 60 original Google Cloud Professional Cloud Security Engineer questions covering identity, data, network, workload, operations and compliance, with detailed explanations.

Level: Google Cloud Professional Cloud Security Engineer Difficulty: advanced 60 questions 60 min

Choose a practice mode, answer each GCP Security Engineer question, then review the explanation. Wrong answers are saved locally for review.

Practice mode Difficulty Topic Question type Search questions

Day streak: 0 days Saved only on this device

Question 1

What is Cloud IAM?

Select an answer A DNS serviceA service for managing access to Google Cloud resourcesA firewallA database

Question 2

What is a service account?

Select an answer An identity used by workloads and applicationsA human userA firewall ruleA storage bucket

Question 3

What is a custom role?

Select an answer A DNS recordA firewallA role with user-defined permissionsA built-in role

Question 4

What is an organization policy?

Select an answer A firewall ruleA DNS recordA load balancerConstraints applied across the organization

Question 5

What is workload identity federation?

Select an answer A firewallA DNS serviceA load balancerLetting external workloads assume Google identities

Question 6

What is Identity-Aware Proxy?

Select an answer A service that controls access based on identity and contextA firewallA DNS serverA database

Question 7

What is Cloud Identity?

Select an answer A CDNAn identity service for users and devicesA firewallA database

Question 8

What is a group in IAM?

Select an answer A storage bucketA DNS zoneA collection of users that can receive rolesA firewall

Question 9

What is least privilege?

Select an answer Encrypting dataCreating reportsGranting only the permissions requiredGranting all users full access

Question 10

Match each identity concept to its purpose.

IAMService accountIAPOrganization policy

Question 11

What is Cloud KMS?

Select an answer A databaseA firewallA DNS serviceA key management service

Question 12

What is a customer-managed encryption key?

Select an answer A firewall ruleA key controlled by the customer in Cloud KMSA Google-managed keyA DNS record

Question 13

What is Cloud DLP?

Select an answer A service for discovering and protecting sensitive dataA firewallA DNS serviceA load balancer

Question 14

What is encryption at rest?

Select an answer A DNS recordA firewallEncrypting stored dataEncrypting network traffic

Question 15

What is encryption in transit?

Select an answer Filtering trafficEncrypting data while it movesEncrypting stored filesCreating backups

Question 16

What is a retention policy?

Select an answer A firewallA DNS recordA load balancerRules that control how long data is kept

Question 17

What is Secret Manager?

Select an answer A databaseA firewallA DNS zoneA service for storing and managing secrets

Question 18

What is data access logging?

Select an answer Storage bucketsLogs of data reads and writesApplication logs onlyDNS records

Question 19

What is key rotation?

Select an answer Regularly replacing encryption keysDeleting keysCreating backupsFiltering traffic

Question 20

Match each data protection concept to its purpose.

KMSCMEKDLPSecret Manager

Question 21

What is a firewall rule?

Select an answer A DNS recordA load balancerA rule that controls traffic to resourcesA database

Question 22

What is Cloud Armor?

Select an answer A DNS serviceA databaseA load balancerA WAF and DDoS protection service

Question 23

What is VPC peering?

Select an answer Connecting two VPCs privatelyA public networkA DNS zoneA firewall

Question 24

What is Private Google Access?

Select an answer A firewallPrivate access from VMs to Google APIsA public IPA DNS record

Question 25

What is Cloud NAT?

Select an answer A firewallOutbound internet access for private instancesA load balancerA DNS server

Question 26

What is Shared VPC?

Select an answer A host project shares subnets with service projectsA public networkA DNS forwarderA backup

Question 27

What is packet mirroring?

Select an answer Blocking trafficResolving DNSAssigning IPsCopying network traffic for analysis

Question 28

What is VPC Service Controls?

Select an answer A DNS zoneA load balancerA security perimeter around Google Cloud servicesA firewall

Question 29

What is Private Service Connect?

Select an answer Private access to managed servicesA public websiteA DNS recordA firewall

Question 30

Match each network security concept to its purpose.

FirewallCloud ArmorVPC-SCPrivate Google Access

Question 31

What is GKE hardening?

Select an answer Deleting clustersCreating DNS recordsBacking up dataApplying secure configuration to Kubernetes clusters

Question 32

What is Binary Authorization?

Select an answer A DNS serviceA load balancerA deployment-time policy for signed container imagesA firewall

Question 33

What is Container Analysis?

Select an answer Filtering trafficScanning container images for vulnerabilitiesDeleting imagesCreating backups

Question 34

What is Workload Identity in GKE?

Select an answer Mapping Kubernetes service accounts to Google service accountsA firewallA DNS recordA load balancer

Question 35

What is a Shielded VM?

Select an answer A firewallA DNS recordA VM with verified firmware and boot integrityA regular VM

Question 36

What is a Confidential VM?

Select an answer A regular VMA firewallA load balancerA VM with encrypted memory in use

Question 37

What is OS patch management?

Select an answer Filtering trafficApplying security updates to operating systemsDeleting VMsCreating DNS records

Question 38

What is a namespace in Kubernetes?

Select an answer A way to isolate cluster resourcesA VMA firewallA DNS zone

Question 39

What is a private GKE cluster?

Select an answer A public clusterA firewallA DNS recordA cluster with no public node IPs

Question 40

Match each workload security concept to its purpose.

Binary AuthorizationShielded VMContainer AnalysisWorkload Identity

Question 41

What is Security Command Center?

Select an answer A security posture and findings platformA DNS serviceA databaseA load balancer

Question 42

What is Cloud Logging?

Select an answer A firewallA CDNA service that stores and queries logsA database

Question 43

What is Cloud Monitoring?

Select an answer A DNS serviceA load balancerA service that collects metrics and alertsA data warehouse

Question 44

What are audit logs?

Select an answer Storage bucketsLogs of admin and data activityApplication logs onlyDNS records

Question 45

What is an alerting policy?

Select an answer A firewall ruleA DNS recordA load balancerA rule that notifies when a condition is met

Question 46

What is Event Threat Detection?

Select an answer A service that detects threats from cloud logsA DNS serviceA databaseA firewall

Question 47

What is a vulnerability scan?

Select an answer Filtering trafficChecking systems for known weaknessesDeleting dataCreating backups

Question 48

What is a security finding?

Select an answer A firewall ruleA DNS recordA load balancerAn issue detected in a resource

Question 49

What is log-based alerting?

Select an answer A DNS recordA load balancerCreating alerts based on log contentA firewall rule

Question 50

Match each security operations concept to its purpose.

SCCCloud LoggingMonitoringEvent Threat Detection

Question 51

What is a compliance framework?

Select an answer A load balancerA set of requirements an organization must meetA firewallA DNS record

Question 52

What is a resource hierarchy?

Select an answer A database schemaA firewallA DNS zoneThe organization, folders, projects, and resources structure

Question 53

What is data residency?

Select an answer Keeping data in a specific regionDeleting dataEncrypting dataCreating reports

Question 54

What is Assured Workloads?

Select an answer A DNS serviceA load balancerA service for regulated workloads and compliance controlsA firewall

Question 55

What is Access Transparency?

Select an answer A DNS recordA load balancerLogs of Google staff access to customer dataA firewall

Question 56

What is a quota?

Select an answer A DNS recordA limit on resource usageA modelA dataset

Question 57

What is a label?

Select an answer A firewall ruleA DNS recordA load balancerA metadata tag for resources

Question 58

What is a folder in the resource hierarchy?

Select an answer A container for projects and policiesA VMA firewallA DNS zone

Question 59

What is a compliance report?

Select an answer A DNS recordA report that documents adherence to standardsA backupA firewall rule

Question 60

Match each compliance concept to its purpose.

Organization policyResource hierarchyData residencyAssured Workloads