GCP
Google Professional Cloud Security Engineer
340+ 기출 문제 (AI 검증 답안 포함)
실제 시험
기출 문제
상세
해설
실제 시험과
가장 유사AI 기반
3중 AI 검증 답안 및 해설
모든 Google Professional Cloud Security Engineer 답안은 3개의 최고 AI 모델로 교차 검증하여 최고의 정확도를 보장합니다. 선택지별 상세 해설과 심층 문제 분석을 제공합니다.
시험 도메인
실전 문제
Your company operates a single Google Cloud organization with 10 folders and 150 projects, and the SOC requires that all Google Cloud Console sign-in events and API calls that change resource configurations be streamed to an external SIEM in under 60 seconds, with coverage for all existing and future projects. Requirements:
- Collect and export the relevant logs for the entire organization hierarchy (folders and projects).
- Deliver logs to the SIEM in near real time (<60 seconds).
- Include Console login events and admin activity that modifies configurations. What should you do? (Choose two.)
Your healthcare analytics startup is building a multi-region telemetry pipeline on Google Cloud that spans Compute Engine VMs, a GKE Autopilot cluster, Cloud Storage buckets, BigQuery datasets (~50 TB), and Pub/Sub topics processing ~80,000 messages per second. Under your GDPR data protection by design program, the security review mandates that: (1) you—not Google—must control key creation, 90-day rotation, and IAM-scoped usage of encryption keys; (2) keys must reside in Google Cloud KMS/HSM with no dependency on external key stores; and (3) a single key management approach must be supported uniformly across all listed services. Which option should you choose to meet these requirements?
You lead network security for a fintech trading platform on Google Cloud. You currently detect anomalies using VPC Flow Logs exported to BigQuery with a 5-minute aggregation interval across three VPCs. A red team exercise now requires examining full packet payloads and L4/L7 headers for east-west traffic between two production subnets (10.20.0.0/24 and 10.20.1.0/24) in a single VPC and forwarding a copy of up to 8 Gbps of this traffic to a third-party NIDS running on a Compute Engine VM, without altering original packets. Which Google Cloud product should you use?
You deploy a Cloud Run job in us-central1 that executes every 4 hours for ~20 minutes to compress and upload up to 500 MB of log archives into a Cloud Storage bucket named cr-logs-archive; the job must have write-only access (no read, list, or delete) to the bucket during execution, you want to avoid long-lived credentials, and you must grant only the minimum permissions required to complete the uploads—what should you do?
A media-streaming startup must launch a public REST API on Cloud Run behind an external HTTP(S) Load Balancer within 48 hours, and the security team mandates minimizing the container image’s attack surface (target image size under 200 MB, no interactive shell or package manager, and only required runtime files) without changing networking or deployment tools; what should the team do to meet this requirement?
이동 중에도 모든 문제를 풀고 싶으신가요?
Cloud Pass를 다운로드하세요 — 모의고사, 학습 진도 추적 등을 제공합니다.
Your company has a three-level resource hierarchy: Organization > Business Unit folders > Team folders, and you are onboarding 12 platform squads that each receive a dedicated Terraform provisioner service account; each squad must be able to create and fully manage projects only under its assigned team folder (for example, folders/789012345678) while adhering to least privilege and preventing project creation in any other location; you need a scalable, centrally managed approach that supports Infrastructure as Code and avoids granting broad administrative control at the folder or organization level; what should you do?
Your retail company is standing up a brand-new Google Cloud organization backed by a fresh Cloud Identity domain, and you must create exactly two super administrator accounts for break-glass use while meeting internal security baselines aligned to CIS; the environment has only standard internet egress with TLS (no VPN/Interconnect) and you must complete setup within 24 hours—when creating these super admin accounts, which two actions should you take to meet best practices and reduce risk? (Choose two.)
Your fintech company stores regulated workloads on Compute Engine persistent disks, and the security team requires that a 256-bit AES key generated in your on-premises HSM (rotated every 90 days) be used directly to encrypt data at rest, with Google Cloud not storing the key and data becoming irrecoverable if the key is unavailable. What should you do?
Your company delegates project-level administration to each feature team by granting the Project Owner role on their own Google Cloud projects; the organization has approximately 2,300 projects across 90 VPC networks. Security Command Center Premium has surfaced 180 OPEN_REDIS_PORT (TCP/6379) findings where VMs with external IPs are reachable from the internet. You must enforce preventative guardrails that automatically apply to all current and future projects to stop these common exposure misconfigurations without relying on per-project maintenance. What should you do?
Your retail analytics platform runs on two Compute Engine instances behind a load balancer and authenticates to Google APIs using a user-managed service account key stored in Secret Manager (secret name: retail-sa-key), and your security policy mandates rotation every 90 days with no more than 2 minutes of reduced capacity. To follow Google-recommended practices when rotating this user-managed service account key, what should you do?
Your logistics company runs a route-optimization model as a managed Vertex AI Batch Predictions job on Google Cloud. Twenty external carriers upload up to 1,000 CSV files per day (each <= 100 MB) to a dedicated Cloud Storage bucket via 15-minute signed URLs; a Cloud Function triggers the batch predictions and writes results to partner-specific buckets. You are conducting a configuration review with stakeholders and must clearly describe your security responsibilities for this managed AI workflow. What should you do?
You are deploying an internal Cloud Run service that must read files from each employee's Google Drive and write a summary to BigQuery without any interactive user consent; the service must not rely on the currently signed-in user's credentials and must follow Google's recommended server-to-server approach. Your Google Workspace has 3,000 users, and the application should request only the https://www.googleapis.com/auth/drive.readonly scope and log which user was impersonated for each request; what should you do?
Your marketing analytics unit (120 users) plans to adopt Google Cloud for BigQuery and Vertex AI within 30 days, and company policy requires that all identities remain company-owned and all sign-ins use the corporate SAML 2.0 IdP; while attempting to create a new Cloud Identity tenant for example.com, the Platform Engineer discovers that example.com is already verified and actively used by an internal Google Workspace deployment with 850 active accounts and existing SAML SSO, and needs guidance on how to proceed with the least disruption and without violating the policy. What should you advise?
Your compliance team is launching an internal meeting-notes summarization pipeline on Google Cloud that uses a generative model to create summaries from audio transcripts, it must process up to 3,000 transcripts per day (average 1 MB each) with under 200 ms filtering latency per request, and company policy mandates that no personally identifiable information (PII)—such as names, email addresses, phone numbers, or government IDs—may appear in either the prompts sent to the model or the summaries returned, so you need a managed, scalable control that detects and automatically redacts PII on both ingress and egress before any storage or display; what should you do?
Your company exposes a payment reconciliation API running on Compute Engine VMs behind a regional Internal HTTP(S) Load Balancer in VPC prod-finance (10.20.0.0/16), reachable only from your on-premises network over two HA VPN tunnels (TCP 443); to meet a security mandate, all inbound TLS traffic from on-prem must be intercepted (decrypted, inspected for malware/C2), then re-encrypted before it reaches the backends, and the policy must be centrally enforced for all projects in the Apps-Prod folder without changing the application architecture. What should you do?
Your media-streaming company plans to migrate 120 microservices to Google Cloud within 90 days across 5 VPC networks spanning us-central1 and europe-west2; you must decide where to apply security controls and policies and determine which responsibilities are handled by Google versus your team, considering that you store 12 TB of GDPR-regulated PII for 200,000 EU customers and must retain audit logs for 365 days. What should you do?
Your organization runs a self-hosted CI/CD system on a Google Kubernetes Engine (GKE) Autopilot cluster in a dedicated build project. The cluster executes more than 300 pipeline jobs per day, using ephemeral build pods that terminate within 60 minutes, and the pipelines deploy resources across multiple Google Cloud projects in the same folder. Security policy requires no long-lived user credentials, enforcing least privilege, and minimizing the risk of credential exfiltration from build nodes; you can enforce Organization Policy constraints at the project level. What should you do to minimize the risk of the CI/CD system's credentials being stolen?
Your organization uses a Shared VPC where net-hub-prod is the host project, and all firewall rules, subnets, and an HA VPN with Cloud Router are configured in the host; you need to let the Data Science Blue group attach Compute Engine VMs in service project ml-svc-02 only to the us-central1 subnetwork 172.16.20.0/24 and prevent attachment to any other subnet—what should you grant to the group to meet this requirement?
Your online gaming platform runs UDP-based matchmaker services on Compute Engine instances in us-east1 and must record the original client IPs for per-player rate limiting and security audits; a cost policy mandates use of the Standard network tier and you expect up to 25,000 concurrent client connections—under these constraints, which Google Cloud load balancer should you deploy to preserve the client IP by default?
Your organization runs an Autopilot GKE cluster in us-central1 with three namespaces (ingest, transform, report) hosting about 80 Pods that must read from a Cloud Storage bucket (gs://media-raw) and write to another bucket (gs://media-processed) in a separate project; your security policy forbids distributing long-lived credentials to workloads and requires least privilege and low operational overhead. How should you grant the Pods secure access to the buckets while minimizing management effort?
합격 후기(6)
학습 기간: 2 months
I used Cloud Pass during my last week of study, and it helped reinforce everything from beyondcorp principles to securing workloads. It’s straightforward, easy to use, and genuinely helps you understand security trade-offs.
학습 기간: 1 month
문제 다 풀고 시험에 응했는데 바로 합격했어요! 시험이랑 문제는 비슷한게 40% 조금 넘었던거 같고, 처음 보는 유형은 제 개념 이해를 바탕으로 풀었어요.
학습 기간: 1 month
I would like to thanks the team of Cloud Pass for these greats materials. This helped me passing the exam last week. Most of the questions in exam as the sample questions and some were almost similar. Thank you again Cloud Pass
학습 기간: 1 month
Absolutely invaluable resource to prepare for the exam. Explanations and questions are spot on to give you a sense of what is expected from you on the actual test.
학습 기간: 1 month
I realized I was weak in log-based alerts and access boundary configurations. Solving questions here helped me quickly identify and fix those gaps. The question style wasn’t identical to the exam, but the concepts were spot-on.
다른 GCP 자격증
Google Professional Cloud DevOps Engineer
Professional
Google Associate Cloud Engineer
Associate
Google Professional Cloud Network Engineer
Professional
Google Associate Data Practitioner
Associate
Google Cloud Digital Leader
Foundational
Google Professional Cloud Architect
Professional
Google Professional Cloud Database Engineer
Professional
Google Professional Data Engineer
Professional
Google Professional Cloud Developer
Professional
Google Professional Machine Learning Engineer
Professional
지금 학습 시작하기
Cloud Pass를 다운로드하여 모든 Google Professional Cloud Security Engineer 기출 문제를 풀어보세요.
앱 받기