Practice Test #1
50개 문제와 120분 시간 제한으로 실제 시험을 시뮬레이션하세요. AI 검증 답안과 상세 해설로 학습하세요.
AI 기반
3중 AI 검증 답안 및 해설
모든 답안은 3개의 최고 AI 모델로 교차 검증하여 최고의 정확도를 보장합니다. 선택지별 상세 해설과 심층 문제 분석을 제공합니다.
기출 문제
Your healthcare analytics startup is building a multi-region telemetry pipeline on Google Cloud that spans Compute Engine VMs, a GKE Autopilot cluster, Cloud Storage buckets, BigQuery datasets (~50 TB), and Pub/Sub topics processing ~80,000 messages per second. Under your GDPR data protection by design program, the security review mandates that: (1) you—not Google—must control key creation, 90-day rotation, and IAM-scoped usage of encryption keys; (2) keys must reside in Google Cloud KMS/HSM with no dependency on external key stores; and (3) a single key management approach must be supported uniformly across all listed services. Which option should you choose to meet these requirements?
Your logistics company runs a route-optimization model as a managed Vertex AI Batch Predictions job on Google Cloud. Twenty external carriers upload up to 1,000 CSV files per day (each <= 100 MB) to a dedicated Cloud Storage bucket via 15-minute signed URLs; a Cloud Function triggers the batch predictions and writes results to partner-specific buckets. You are conducting a configuration review with stakeholders and must clearly describe your security responsibilities for this managed AI workflow. What should you do?
Your fintech organization operates 12 Google Cloud projects under 2 folders and uses 25 service accounts; an internal review found some accounts assigned roles/editor and external contractors from two partner domains with excessive access, and you must gain within 5 minutes detailed visibility into IAM policy changes, user activity, service account key usage, and access to three restricted projects, retain these records for at least 400 days, and correlate them centrally with AWS and on-prem security events without deploying any agents on VMs—what should you do?
A regional engineering group at a healthcare company registered a separate Google Workspace with Cloud Identity and created a new Organization resource. Within 90 days, they launched 180 projects across 8 folders to host regulated analytics workloads and connected them to a shared VPC. Your centralized platform security team must assume control of who can grant permissions across this Organization and ensure the ability to audit access and configuration activity across all projects and folders. Which type of access should be granted to your team at the Organization level to meet this requirement?
Your biomedical analytics team is migrating a bursty batch-processing render farm to a Compute Engine cluster that uses autoscaling Managed Instance Groups (MIGs) across 3 zones and can scale from 8 to 200 VMs in under 5 minutes, and security requires that you retain full control of the boot disk encryption key lifecycle (including quarterly rotation, immediate disablement during incidents, and audit visibility); which boot disk encryption solution should you configure to meet these requirements without slowing rapid instance creation?
이동 중에도 모든 문제를 풀고 싶으신가요?
Cloud Pass를 다운로드하세요 — 모의고사, 학습 진도 추적 등을 제공합니다.
You are designing the key management strategy for a U.S.-based fintech launching a payment tokenization API on Google Cloud. Requirements:
- Rotate the root (key-encryption) key at least every 45 days via a managed schedule.
- The system that stores the root key must be FIPS 140-2 Level 3 validated.
- Keep the root key within multiple regions in the United States for redundancy (US-only residency). Which option best satisfies these requirements?
You are the security lead for a fintech company with PCI DSS scope operating across 3 Google Cloud projects under a single organization. An external assessor requests downloadable evidence (CSV or JSON) listing who currently has which permissions to all 58 Cloud Storage buckets and 12 BigQuery datasets in the prod folder, including access granted via groups and inherited roles, as of today; you must produce this access review without changing any policies and be able to filter by principals and permissions for the audit. Which Google Cloud tool should you use?
Your company is onboarding a construction subcontractor for a 4-month engagement; the subcontractor uses an external SAML 2.0/OIDC IdP (e.g., Okta) for its 180 users, and you must provide them least-privilege access to two Google Cloud projects via both the Google Cloud Console and gcloud while strictly avoiding creation or synchronization of any subcontractor identities in Cloud Identity/Google Workspace, preventing any password storage/replication in your environment, and allowing the subcontractor to retain full user lifecycle control; what is the most secure way to enable SSO under these constraints?
You are investigating 403 access denied errors when Compute Engine instances in a service project (svc-proj-200) attached to a Shared VPC in a host project (host-proj-100) attempt to read objects from a Cloud Storage bucket (gs://org-logs-bucket) located in a data project (data-proj-300). The data project is protected by a VPC Service Controls service perimeter named perimeter-data that currently includes only data-proj-300 and restricts Cloud Storage and BigQuery. The instances have roles/storage.objectViewer, the subnet has Private Google Access enabled, and egress firewall rules allow Google APIs. You must resolve the errors without weakening the perimeter's protections. What should you do?
You administer 8 production projects under a parent folder named prod-services in organization org-123. Compliance requires centralizing all audit and application logs from those projects with a 400-day retention period. Analysts must query these logs using Logs Explorer from a dedicated project named sec-logging without being granted direct access to the production projects. What should you do?
합격 후기(6)
학습 기간: 2 months
I used Cloud Pass during my last week of study, and it helped reinforce everything from beyondcorp principles to securing workloads. It’s straightforward, easy to use, and genuinely helps you understand security trade-offs.
학습 기간: 1 month
문제 다 풀고 시험에 응했는데 바로 합격했어요! 시험이랑 문제는 비슷한게 40% 조금 넘었던거 같고, 처음 보는 유형은 제 개념 이해를 바탕으로 풀었어요.
학습 기간: 1 month
I would like to thanks the team of Cloud Pass for these greats materials. This helped me passing the exam last week. Most of the questions in exam as the sample questions and some were almost similar. Thank you again Cloud Pass
학습 기간: 1 month
Absolutely invaluable resource to prepare for the exam. Explanations and questions are spot on to give you a sense of what is expected from you on the actual test.
학습 기간: 1 month
I realized I was weak in log-based alerts and access boundary configurations. Solving questions here helped me quickly identify and fix those gaps. The question style wasn’t identical to the exam, but the concepts were spot-on.
지금 학습 시작하기
Cloud Pass를 다운로드하고 모든 Google Professional Cloud Security Engineer 기출 문제를 풀어보세요.
앱 받기