Practice Professional-Cloud-Security-Engineer Exam Online

Question 1

Your organization is using GitHub Actions as a continuous integration and delivery (Cl/CD) platform. You must enable access to Google Cloud resources from the Cl/CD pipelines in the most secure way. What should you do?

A : Create a service account key and add it to the GitHub pipeline configuration file

B : Create a service account key and add it to the GitHub repository content

C :

Configure a Google Kubernetes Engine cluster that uses Workload Identity to supply credentials to GitHub.

D : Configure workload identity federation to use GitHub as an identity pool provider.

Answer: D

Question 2

You run applications on Cloud Run. You already enabled container analysis for vulnerability scanning. However, you are concerned about the lack of control on the applications that are deployed. You must ensure that only trusted container images are deployed on Cloud Run. What should you do? Choose 2 answers

A : Enable Binary Authorization on the existing Kubernetes cluster.

B :

Set the organization policy constraint constraints/run. allowedBinaryAuthorizationPolicie to the list of allowed Binary Authorization policy names.

C :

Set the organization policy constraint constraints/compute.trustedimageProjects to the list of protects that contain the trusted container images

D : Enable Binary Authorization on the existing Cloud Run service.

E : Use Cloud Run breakglass to deploy an image that meets the Binary Authorization policy by default.

Answer: B,D

Question 3

An online legal service company is considering moving its data storage to Google Cloud Platform. They want to ensure maximum control over the encryption process of their data stored at rest. What technique should the company use?

A : Utilize Cloud Storage as a federated source of data.

B : CSEK refers to encryption keys that are provided by the customer.

C : Employ a Cloud HSM for enhanced security.

D : CMEK (Customer Managed Encryption Keys).

Answer: D

Question 4

You are responsible for protecting highly sensitive data in BigQuery. Your operations teams need access to this data, but given privacy regulations, you want to ensure that they cannot read the sensitive fields such as email addresses and first names. These specific sensitive fields should only be available on a need-to-know basis to the HR team. What should you do?

A : Perform data masking with the DLP API and store that data in BigQuery for later use

B : Perform data redaction with the DLP API and store that data in BigQuery for later use

C : Perform data inspection with the DLP API and store that data in BigQuery for later use.

D : Perform tokenization for Pseudonymization with the DLP API and store that data in BigQuery for later use.

Answer: D

Question 5

An organization is evaluating the use of Google Cloud Platform (GCP) for certain IT workloads. A wellestablished directory service is used to manage user identities and lifecycle management. This directory service must continue for the organization to use as the “source of truth” directory for identities. Which solution meets the organization's requirements?

A : Google Cloud Directory Sync (GCDS)

B : Cloud Identity

C : Security Assertion Markup Language (SAML)

D : Pub/Sub

Answer: A

Name:	Professional Cloud Security Engineer
Exam Code:	Professional-Cloud-Security-Engineer
Certification:	Google Cloud Certified
Vendor:	Google
Total Questions:	365
Last Updated:	Aug 02, 2026

Google Professional-Cloud-Security-Engineer Answers