10 Google Cloud Security Engineer Questions Most Candidates Get Wrong
This set of practice questions is designed to mirror the rigor and breadth of the Google Cloud Professional Cloud Security Engineer exam. Each question targets a specific domain, from identity and access management to network security and data protection, ensuring you are tested on the practical application of security controls within Google Cloud.
Question 1
Your organization requires that all service account keys be automatically rotated every 30 days. You need to enforce this policy across all existing and future projects in your organization. What is the most efficient way to meet this requirement? This connects to what we discuss in Google Cloud Security Engineer Difficulty: What Actually Makes People Fail.
A. Use a Cloud Function to list all service account keys and delete those older than 30 days, running it on a Cloud Scheduler job.
B. Configure an Organization Policy with a constraint that sets the maximum age for service account keys.
C. Create a custom IAM role that denies the iam.serviceAccountKeys.create permission and assign it to all users.
D. Use Cloud Asset Inventory to export all keys and manually review them monthly.
Answer: B
Explanation: Google Cloud provides an Organization Policy constraint (iam.disableServiceAccountKeyCreation and iam.serviceAccountKeyMaxAge) specifically designed to enforce key rotation limits. Setting the max age at the org level automatically applies to all current and future projects, preventing the creation of keys that exceed the limit. The other options are manual, reactive, or do not enforce the 30-day age limit at the creation time.
Question 2
You are designing a VPC network for a multi-tier application. You need to ensure that the web server tier can only receive traffic from the internet on port 443, and the application tier can only receive traffic from the web server tier on port 8080. No other traffic should be allowed. Which two components should you use to implement this?
A. A single firewall rule with a tag for each tier, allowing all traffic between them.
B. Firewall rules with source and destination tags, and the use of VPC firewall rules to restrict ingress and egress.
C. A shared VPC with network tags to isolate the tiers.
D. A Cloud Armor policy attached to the web server tier.
Answer: B
Explanation: VPC firewall rules are the primary mechanism for controlling traffic within a VPC network. By using target tags (e.g., web and app) and source tags, you can create precise ingress rules: allow tcp:443 from 0.0.0.0/0 to web, and allow tcp:8080 from web to app, while having a default deny rule for all other traffic. A shared VPC (C) is for network administration, and Cloud Armor (D) is for DDoS protection at the edge, not internal network segmentation.
Question 3
You need to grant a data scientist read-only access to a BigQuery dataset, but they must not be able to view the data in a specific column that contains PII. You have already created a column-level security policy. What is the simplest way to grant this access?
A. Grant the data scientist the roles/bigquery.dataViewer role on the dataset and rely on the column policy to mask the data.
B. Create a new role with bigquery.tables.getData permission and grant it to the data scientist.
C. Export the dataset to a new dataset without the PII column and grant access to that new dataset.
D. Deny the data scientist access to the dataset and create a view that excludes the PII column.
Answer: A
Explanation: Google Cloud's column-level security (using taxonomy and policies) works by default with BigQuery. Once a policy tag is applied to a column, users with the roles/bigquery.dataViewer role will see the data according to the policy (e.g., masked or nullified) without needing additional, complex configuration. Creating a new dataset (C) is inefficient, and denying access (D) prevents them from seeing any data.
Question 4
Your company's security policy requires that all data stored in Cloud Storage buckets be encrypted with a customer-managed key (CMK) that is rotated every 90 days. You have created a key ring and a key. How can you ensure that all new objects written to a specific bucket are encrypted with this key?
A. Set the bucket's default encryption to use the Cloud KMS key.
B. Apply a bucket IAM policy that requires the roles/cloudkms.cryptoKeyEncrypter role for all users. We recommend pairing this with How to Renew Google Cloud Security Engineer Without Sitting the Exam Again.
C. Use a Cloud Function to re-encrypt all objects after they are uploaded.
D. Configure the bucket to use CSEK (customer-supplied encryption keys).
Answer: A
Explanation: Cloud Storage allows you to set a "default encryption" configuration on a bucket, which automatically encrypts all new objects with the specified Cloud KMS key. This is the standard and most efficient method for enforcing encryption at rest with a CMK. IAM policies (B) control permissions, not encryption defaults, and CSEK (D) uses a different key management model that does not involve Cloud KMS.
Question 5
You are deploying a Kubernetes cluster in GKE. You want to ensure that all secrets are encrypted with a key that you manage in Cloud KMS. Which GKE feature should you enable?
A. Shielded Nodes
B. Application-layer Secrets Encryption
C. Workload Identity
D. Binary Authorization
Answer: B
Explanation: GKE's Application-layer Secrets Encryption allows you to encrypt Kubernetes secrets using a customer-managed key stored in Cloud KMS. This provides an extra layer of encryption on top of the default disk encryption. Shielded Nodes (A) ensure node integrity, Workload Identity (C) is for IAM, and Binary Authorization (D) is for supply chain security.
Question 6
A security auditor needs to review all IAM policy changes made in your organization for the last 6 months. Which Google Cloud service should you use to retrieve this historical audit log data?
A. Cloud Monitoring
B. Cloud Logging
C. Cloud Asset Inventory
D. VPC Flow Logs
Answer: B
Explanation: Cloud Logging stores Admin Activity audit logs, which record all configuration changes including IAM policy modifications. You can query these logs for the required time range. Cloud Asset Inventory (C) provides a snapshot of the current state, not historical changes. Cloud Monitoring (A) is for metrics and alerts, and VPC Flow Logs (D) are for network traffic metadata.
Question 7
You are designing a multi-region architecture for a critical application. You need to protect against a regional outage. You want to use a load balancer that can route traffic to the nearest healthy backend. Which load balancing option should you choose?
A. Internal TCP/UDP Load Balancer
B. External HTTP(S) Load Balancer
C. Network Load Balancer
D. Internal HTTP(S) Load Balancer
Answer: B You can explore this further in 10 SC-900 Questions Most Candidates Get Wrong.
Explanation: The External HTTP(S) Load Balancer is a global, proxy-based load balancer that can route traffic to backends across multiple regions based on the user's location and backend health. It is the correct choice for global, internet-facing applications requiring regional failover. The Internal load balancers (A, D) are regional only, and the Network Load Balancer (C) is a passthrough load balancer that is also regional.
Question 8
Your organization uses Cloud Identity to manage user accounts. You need to ensure that a user's access to Google Cloud resources is automatically revoked when they are deactivated in your corporate identity provider. Which configuration is required?
A. Set up a Cloud Scheduler job to run a script that removes the user's IAM bindings.
B. Enable Google Cloud's built-in user deactivation, which automatically syncs with the identity provider.
C. Configure the identity provider to send a SAML assertion that includes a "deactivated" attribute.
D. This is not possible; you must manually remove the user from all IAM roles.
Answer: B
Explanation: Google Cloud's Identity (Cloud Identity) is designed to synchronize with your external identity provider (e.g., Okta, Azure AD) via SAML or OpenID Connect. When a user is deactivated in the IdP, the session is invalidated, and access to Google Cloud resources is denied upon the next authentication attempt. This is a core feature of federated identity, not a manual process.
Question 9
You are using Data Loss Prevention (DLP) to inspect a Cloud Storage bucket for sensitive data. You want to redact credit card numbers found in CSV files. What is the most efficient way to achieve this?
A. Use the DLP API to create a job that inspects the bucket and writes redacted results to a new bucket.
B. Manually download the files, use a text editor to remove the numbers, and re-upload them.
C. Use a Cloud Function to stream the files through the DLP API and write the output back to the same bucket.
D. Create a Cloud DLP inspection job and send the findings to Cloud Logging.
Answer: A
Explanation: The DLP API provides a jobs.create method for creating inspection and redaction jobs. You can specify a Cloud Storage bucket as the input and a new bucket as the output for the redacted files. This is a fully managed, serverless approach. Writing back to the same bucket (C) is risky and not a standard pattern, and option D only logs findings without redacting.
Question 10
You need to audit all network connections to your Compute Engine instances to identify potential malicious activity. Which feature provides the most detailed information about the source and destination of each network connection?
A. Cloud Audit Logs
B. VPC Flow Logs
C. Firewall Rules Logging
D. Cloud NAT Logs
Answer: B
Explanation: VPC Flow Logs record metadata about IP traffic flowing through your VPC network, including source/destination IP, port, and protocol. This is the definitive source for auditing network connections. Firewall Rules Logging (C) only logs when a rule is matched (allowed or denied), not the actual traffic flow. Cloud Audit Logs (A) are for admin activity, and Cloud NAT Logs (D) are specific to NAT gateway traffic.
These questions cover the core pillars of the Google Cloud Security Engineer exam: identity, network, data, and monitoring. Remember that hands-on experience with these services is crucial for the exam. The key is not just knowing what a service does, but understanding when to use it and how it interacts with other security controls in a real-world architecture.
If you want to map out your exam preparation, a free Google Cloud Professional Cloud Security Engineer study plan gives you a schedule that fits your available time.
Find out which topics need more attention by working through full-length Google Cloud Professional Cloud Security Engineer mock tests in exam mode.
Before you sit the exam, a free Google Cloud Professional Cloud Security Engineer readiness check gives you a quick way to spot the area that needs more review.