Free GCP Security mock test – Exam 1

Google Cloud Certified Professional Cloud Security Engineer

Free Google Cloud Certified Professional Cloud Security Engineer practice exam for GCP certification prep.

Q: Is this Google Cloud Certified Professional Cloud Security Engineer practice exam free?

Yes. This Google Cloud Certified Professional Cloud Security Engineer mock test is free to open, answer, and retake.

Q: Does this free GCP Security practice exam include explanations?

Yes. Each question includes detailed option-by-option explanations to help you review the Google Cloud IAM, Cloud Identity, Cloud KMS, Cloud Armor, Security Command Center, Cloud Logging, DLP, IAP, compliance, and threat protection concept being tested.

Use this free GCP Professional Cloud Security Engineer practice exam to review IAM, Cloud Identity, Cloud KMS, Cloud Armor, Security Command Center, Cloud Logging, DLP, IAP, compliance, and threat protection.

10 exam-style questions Free GCP Security mock test Detailed option explanations No signup required

Start Practice Exam 1 below. Answer each question first, then review the detailed explanation for every option to understand the Google Cloud IAM, Cloud Identity, Cloud KMS, Cloud Armor, Security Command Center, Cloud Logging, DLP, IAP, compliance, and threat protection pattern behind the answer.

Google Cloud Certified Professional Cloud Security Engineer Practice Exam 1

Free Google Cloud Certified Professional Cloud Security Engineer practice exam 1 with IAM, Cloud Identity, KMS, Cloud Armor, Security Command Center, Cloud Logging, and data protection questions with detailed explanations.

1 / 10

Question

Your company wants to use its on-premises Active Directory as the identity source for Google Cloud. Which two steps should you take? (Choose TWO.)

Which option meets the requirement?

A. Use Identity Platform to provision workforce users and groups.

B. Use Cloud Identity as the Google identity directory.

C. Install Google Cloud Directory Sync and connect it to Active Directory and Cloud Identity.

D. Create local Google accounts manually for every employee.

E. Grant all synced users project Owner so access management is simple.

2 / 10

Question

A Cloud Storage bucket in project prj-b must use a CMEK stored in Cloud KMS in project prj-a. The KMS key is in europe-west3, but the bucket is in europe-west1 and cannot access the key. What is the most likely problem?

Which option meets the requirement?

A. The Cloud Storage service agent for prj-b does not need IAM on the key.

B. The key and bucket locations are incompatible.

C. Cloud HSM keys cannot encrypt Cloud Storage objects.

D. CMEK cannot be used across projects.

3 / 10

Question

Some employees already created unmanaged Google accounts with your company email domain. You are creating managed Cloud Identity users. What should you do with the unmanaged accounts?

Which option meets the requirement?

A. Use GCDS search rules to overwrite the unmanaged accounts directly.

B. Use the transfer tool for unmanaged users to bring the accounts under organizational management.

C. Ask users to delete their accounts and recreate them manually.

D. Create duplicate managed accounts with different email aliases.

4 / 10

Question

Which two Google-recommended practices should you follow for authentication and authorization in Google Cloud? (Choose TWO.)

Which option meets the requirement?

A. Use groups for role assignment instead of manually granting roles to individual users.

B. Grant basic roles broadly to speed up onboarding.

C. Apply least privilege with predefined or custom IAM roles.

D. Use a single shared administrator account for emergency access.

E. Keep unused service account keys indefinitely for rollback.

5 / 10

Question

You are deploying containers to production GKE clusters and need to prevent containers with known vulnerabilities from being deployed with minimal operational overhead. Which two controls should you use? (Choose TWO.)

Which option meets the requirement?

A. Enable vulnerability scanning for container images in Artifact Registry.

B. Use Binary Authorization to enforce deployment policy based on attestations.

C. Manually inspect every Dockerfile before release.

D. Give developers cluster-admin so they can fix blocked releases quickly.

E. Disable image provenance checks to reduce build time.

6 / 10

Question

Two Cloud Run services form an application. Service A is the frontend and Service B is the backend. Only Service A should call Service B. What should you configure?

Which option meets the requirement?

A. Allow unauthenticated invocations for both services.

B. Require authentication on Service B and grant Service A's service account permission to invoke it.

C. Put both services on the same service account with Owner permissions.

D. Expose Service B publicly and rely on obscured URLs.

7 / 10

Question

For compliance, you must ensure that vendor administrative access and data access by Google personnel to Cloud Storage data is logged. What should you enable?

Which option meets the requirement?

A. Data Access audit logs only.

B. Access Transparency for the organization.

C. VPC Flow Logs on the storage network.

D. Cloud Storage object versioning.

8 / 10

Question

You need to reduce the PCI audit scope for a project that contains payment processing systems, web applications, and data processing systems. What should you do?

Which option meets the requirement?

A. Enable MFA only for web application administrators.

B. Use only PA-DSS certified applications.

C. Move the cardholder data environment into a separate Google Cloud project.

D. Require VPN for every office-to-cloud connection.

9 / 10

Question

Your SOC monitors VPC network anomalies using network logs, but now needs to inspect packet payloads and headers. Which Google Cloud product should you use?

Which option meets the requirement?

A. Cloud IDS only.

B. VPC Service Controls logs.

C. VPC Flow Logs.

D. Packet Mirroring.

10 / 10

Question

You have private VMs that administrators occasionally need to SSH into from remote locations. You want secure, cost-efficient access without public IP addresses. What should you configure?

Which option meets the requirement?

A. A site-to-site VPN for every remote administrator.

B. Public IPs restricted by corporate source IP ranges.

C. Identity-Aware Proxy TCP forwarding with firewall access from the IAP range and the IAP-secured tunnel role.

D. A public jump host VM.

Your score is

The average score is 0%

What Practice Exam 1 covers

Cloud Identity, Google Cloud Directory Sync, unmanaged users, and federation
IAM least privilege, service accounts, Cloud Run service-to-service access, and authentication
Cloud KMS, CMEK location rules, CSEK, external keys, and Key Access Justifications
Cloud Armor, IAP TCP forwarding, Packet Mirroring, and VPC security
Security Command Center, DLP de-identification, Access Transparency, and data residency

Who should take this free mock test

Use this free Google Cloud Certified Professional Cloud Security Engineer practice exam if you are preparing for the Professional Cloud Security Engineer certification and want focused practice with detailed answer explanations.

Browse GCP practice exams Visit DevOpsEngine

FAQ

Is this Google Cloud Certified Professional Cloud Security Engineer practice exam free?

Yes. This GCP Security mock test is free to open and retake for certification study.

Does the free practice exam include explanations?

Yes. Each question includes detailed explanations for the correct and incorrect options so you can learn the service tradeoff, not just memorize an answer.

How should I review missed questions?

Read every option explanation, map the scenario to the relevant Google Cloud service, then revisit the matching IAM, Cloud Identity, Cloud KMS, Cloud Armor, Security Command Center, Cloud Logging, DLP, IAP, compliance, and threat protection topic before retaking the free practice exam.

Free Google Professional Cloud Security Engineer Practice Exam 1 | GCP Security Mock Test

Free Google Cloud Certified Professional Cloud Security Engineer practice exam for GCP certification prep.

Question

Correct Answer: B, C

Explanation

Question

Correct Answer: B

Explanation

Question

Correct Answer: B

Explanation

Question

Correct Answer: A, C

Explanation

Question

Correct Answer: A, B

Explanation

Question

Correct Answer: B

Explanation

Question

Correct Answer: B

Explanation

Question

Correct Answer: C

Explanation

Question

Correct Answer: D

Explanation

Question

Correct Answer: C

Explanation

What Practice Exam 1 covers

Who should take this free mock test

FAQ

Is this Google Cloud Certified Professional Cloud Security Engineer practice exam free?

Does the free practice exam include explanations?

How should I review missed questions?