2 packs: 15% off with code BUY2. 3 or more: 20% off with code BUY3.

Google Professional Cloud Security Engineer Exam Practice Questions, practice question pack
GOOGLE · Professional Cloud Security Engineer

Google Professional Cloud Security Engineer Exam Practice Questions

99% pass rateUpdated 1 Nov 2026376 questions2 PDFs, instant download
5.01 review
(1 customer review)

US$39

Every question with the correct answer and why the other options are wrong.

Download the free sample

Card, Apple Pay, Google Pay or PayPal. Download links are on your order page and in your email the moment you pay.

99% pass rate. Pass or your money back.Fail the exam after using this pack and we refund it, or swap it for any other pack. How the guarantee works
The main thing is that every topic was explained in depth, but without unnecessary details which i like the most. Great Job!
Farah AzizProfessional Cloud Security Engineer
Category:
TRY BEFORE YOU BUY

Three of the 376 questions in this pack

Question 1

Your team needs to make sure that a Compute Engine instance does not have access to the internet or to any Google APIs or services.

Which two settings must remain disabled to meet these requirements? (Choose two.)

  1. Public IP
  2. IP Forwarding
  3. Private Google Access
  4. Static routes
  5. IAM Network User Role
Show answer and explanation

Correct answer: A, C. Public IP; Private Google Access

To prevent a Compute Engine instance from accessing the internet or Google APIs, you must disable Public IP (which provides external internet connectivity) and Private Google Access (which allows private access to Google APIs without a public IP). Without a public IP, the instance cannot reach the internet directly. Without Private Google Access enabled, even instances with only private IPs cannot reach Google services. IP Forwarding is for routing between networks, Static routes define how traffic is routed, and IAM Network User Role controls who can use networks, none of these directly control API or internet access for the instance itself.

Why the other options are wrong

  • B. IP Forwarding allows the instance to route traffic between networks but doesn't prevent internet or API access.
  • D. Static routes define routing paths but don't inherently block internet or API access.
  • E. IAM Network User Role is an identity permission that doesn't control network connectivity.

Question 2

Which two implied firewall rules are defined on a VPC network? (Choose two.)

  1. A rule that allows all outbound connections
  2. A rule that denies all inbound connections
  3. A rule that blocks all inbound port 25 connections
  4. A rule that blocks all outbound connections
  5. A rule that allows all inbound port 80 connections
Show answer and explanation

Correct answer: A, B. A rule that allows all outbound connections; A rule that denies all inbound connections

Every VPC network has two implied firewall rules: one that allows all outbound connections by default, and one that denies all inbound connections by default. These baseline rules ensure that instances can initiate outbound traffic while protecting against unsolicited inbound traffic. Administrators must explicitly create firewall rules to allow specific inbound traffic. There are no default rules that specifically block port 25, block all outbound traffic, or allow inbound port 80.

Why the other options are wrong

  • C. There is no implied firewall rule blocking port 25; this would require an explicit rule.
  • D. Outbound connections are allowed by default, not blocked.
  • E. There is no implied rule allowing inbound port 80; all inbound traffic is denied by default.

Question 3

A customer needs an alternative to storing their plain text secrets in their source-code management (SCM) system.

How should the customer achieve this using Google Cloud Platform?

  1. Use Cloud Source Repositories, and store secrets in Cloud SQL.
  2. Encrypt the secrets with a Customer-Managed Encryption Key (CMEK), and store them in Cloud Storage.
  3. Run the Cloud Data Loss Prevention API to scan the secrets, and store them in Cloud SQL.
  4. Deploy the SCM to a Compute Engine VM with local SSDs, and enable preemptible VMs.
Show answer and explanation

Correct answer: B. Encrypt the secrets with a Customer-Managed Encryption Key (CMEK), and store them in Cloud Storage.

The best practice for storing secrets outside of source code is to encrypt them with a Customer-Managed Encryption Key (CMEK) and store them in Cloud Storage. This approach keeps secrets out of the SCM system while providing encryption at rest and access control. Cloud Source Repositories doesn't solve the secret storage problem. The Data Loss Prevention API scans for secrets but doesn't manage their storage. Deploying SCM to a Compute Engine VM replicates the on-premises problem and doesn't address secure secret management.

Why the other options are wrong

  • A. Cloud Source Repositories is a version control system and doesn't provide secure secret storage; storing secrets in Cloud SQL alongside code doesn't solve the SCM problem.
  • C. The Data Loss Prevention API detects secrets but doesn't provide a secure storage solution.
  • D. Running SCM on Compute Engine with local SSDs doesn't provide encryption or centralized secret management and replicates the original problem.

See all 94 free questions Get the full pack, US$39

REVIEWS

1 review for Google Professional Cloud Security Engineer Exam Practice Questions

  1. Farah Aziz –

    The main thing is that every topic was explained in depth, but without unnecessary details which i like the most. Great Job!

Only logged in customers who have purchased this product may leave a review.

How much of the Google Professional Cloud Security Engineer bank is free?

376 questions in the bank

Each step includes the one before, so buying only adds new questions.

  • You are here10questionsFree sampleThree on this page, all ten as a PDF.Download the sample
  • 9425% of the bankPractice pageFree on the site, every answer explained.Go to the practice page
  • 180the first half of the packHalf PackFree by email, as one PDF, every answer explained.Get the Half Pack
  • 376100%, the whole bankFull pack, US$39Plus the questions-only PDF, monthly updates, refund if you fail.Get the full pack
ABOUT THIS PACK

What’s in the Google Professional Cloud Security Engineer pack

  • 376 questions mapped to the Professional Cloud Security Engineer exam objectives
  • Answers and explanations for every question, including the wrong options
  • A questions-only PDF for timed practice runs
  • Instant delivery by email the moment you check out
  • Free monthly updates for as long as the exam is live
  • Pass or your money back

A failed attempt costs another US$200, plus the weeks it takes to get ready again. This pack is US$39, paid once, and refunded if you fail anyway.

What makes the Professional Cloud Security Engineer hard

The Professional Cloud Security Engineer is Google Cloud's specialist credential for anyone responsible for securing workloads on the platform.

What decides it is securing Google Cloud end to end: identity and access management, organisation structure and policies, boundary protection with VPC Service Controls and Cloud Armor, data protection with Cloud KMS, threat detection and security automation with Security Command Center, and supporting compliance requirements across the environment. The exam rewards deep, scenario-based security design.

It is 50 to 60 questions in two hours. This pack has 376 practice questions mapped to the Professional Cloud Security Engineer exam objectives, so the question style is familiar before exam day.

About the exam

The Google Cloud Professional Cloud Security Engineer certification validates the ability to design and implement secure infrastructure on Google Cloud, including IAM, network security, data protection, and threat management. Google recommends three or more years of industry experience including one or more year on Google Cloud. It is valid for two years.

Questions before you buy

How quickly do I receive it?

Straight away. The full PDF and a questions-only copy are emailed to you the moment your payment goes through, and the same links are on your order page.

Are updates included?

Yes. The pack is updated every month for as long as the exam is live, and updates are free for everyone who has bought it.

What if I fail the exam?

We refund the pack, or swap it for any other pack if you would rather keep studying. Sit the exam 7 to 30 days after buying, then send your official score report within 7 days of the exam date, as set out in the refund policy.

What is your pass rate?

99% of customers who prepare with a CertStash pack pass. If you do not, we refund the pack, or swap it for another pack.

Can I share it with colleagues?

Each purchase is licensed to one person. For a team, school or training organisation, email support@certstash.com for a licence that fits.

Related products