UUS Practice Tests⌕ Search
IT Certifications

Google Cloud Cloud Security Engineer Certification Exam Practice Test

The Google Cloud Cloud Security Engineer Certification Exam focuses on protecting cloud workloads, identities, networks, and data. Its security work includes applying access controls across resource hierarchies, limiting network exposure, securing service-to-service communication, and choosing storage and encryption configurations that support resilience and confidentiality.

Exam overview

Exam providerGoogle Cloud
Exam codeNot listed
CategoryIT Certifications

About the Google Cloud Cloud Security Engineer Certification Exam

Security engineering decisions span prevention, detection, and investigation. Teams use organization policies and resource hierarchy design to apply consistent constraints while preserving appropriate project-level administration. Network controls such as segmentation and private connectivity help restrict workload communication; identity federation connects applications to corporate identity providers. Data protection includes TLS for database connections, resilient storage placement, and understanding key-management records. Security operations also involve correlating findings with affected assets, interpreting activity from application and infrastructure events, and assessing Kubernetes configurations for security weaknesses. These tasks require matching a control or service to a specific risk, then considering how it affects administrators, workloads, and investigators. The practice bank uses scenarios involving these concepts, but its question topics are not a statement of official exam coverage.

Sample Practice Questions

Review a selection from this exam's published US Practice Tests practice bank.

Question 1

A team wants to centrally manage organization-wide security constraints while allowing project teams to administer their own resources. Which Google Cloud resource hierarchy arrangement best supports this goal?

  1. APlace projects under folders and apply organization policies at the organization or folder level
  2. BPlace the organization under each project and apply policies to individual users
  3. CCreate a separate organization for each project and share resources between them
  4. DApply all constraints only to individual virtual machine instances
Show answerCorrect answer: A

Google Cloud's resource hierarchy allows policies to be applied at organization and folder levels, with projects inheriting applicable constraints. This supports centralized governance while retaining delegated project administration.

Question 2

A security team wants to reduce the chance that an exposed application server can reach unrelated internal workloads. Which network design principle best addresses this goal?

  1. AUse segmented VPC networks and narrowly scoped firewall rules
  2. BAssign public IP addresses to all workloads
  3. CAllow ingress from 0.0.0.0/0 to every subnet
  4. DPlace all workloads in one unrestricted subnet
Show answerCorrect answer: A

Network segmentation combined with narrowly scoped firewall rules limits reachability and helps contain compromise. Broad public addressing and unrestricted rules increase exposure rather than reducing it.

Question 3

A company wants to establish encrypted connections between services inside its virtual private cloud without sending traffic over the public internet. Which approach best meets this requirement?

  1. AUse TLS for application traffic between the services
  2. BCreate a Cloud VPN tunnel between the services
  3. CEnable Cloud NAT for both subnets
  4. DRoute traffic through an external HTTP load balancer
Show answerCorrect answer: A

TLS can encrypt application traffic end to end between services while it travels over the VPC network. Cloud VPN is intended to connect networks across a tunnel, and Cloud NAT provides outbound address translation rather than encryption.

Question 4

A team is designing a Cloud Storage bucket for records that must remain available if a regional disruption affects its primary location. Which storage-location choice best supports geographic resilience?

  1. AA multi-region or dual-region location selected to meet the availability and data-residency requirements
  2. BA single-region location in the same zone as the application
  3. CA local SSD attached to a Compute Engine instance
  4. DA temporary bucket with an automatic deletion rule
Show answerCorrect answer: A

A multi-region or dual-region bucket can provide geographic redundancy, but the choice should account for the organization's recovery, latency, cost, and data-residency needs. A single-region location does not provide the same geographic resilience.

Question 5

A company needs to investigate security findings across its Google Cloud environment and correlate them with affected assets. Which service is intended to provide centralized security findings and asset context?

  1. ASecurity Command Center
  2. BCloud Scheduler
  3. CCloud Build
  4. DCloud Profiler
Show answerCorrect answer: A

Security Command Center provides centralized visibility into security findings and cloud assets, supporting investigation and prioritization. The other services are for scheduling, build automation, and application performance profiling.

Question 6

An application must authenticate users through a corporate identity provider using a federated, standards-based sign-in experience. Which Google Cloud service is intended to manage identity federation for applications?

  1. AIdentity Platform
  2. BCloud Tasks
  3. CCloud SQL
  4. DArtifact Registry
Show answerCorrect answer: A

Identity Platform provides authentication capabilities for applications, including support for federated identity providers. Cloud Tasks handles asynchronous task dispatch, Cloud SQL is a managed database, and Artifact Registry stores software artifacts.

Question 7

An organization wants to require encrypted transport for connections to a Cloud SQL instance and verify that clients use TLS. Which configuration is most directly relevant?

  1. AConfigure Cloud SQL connectivity to require SSL/TLS connections
  2. BEnable Cloud Storage object versioning on the database backups
  3. CAdd a Cloud DNS TXT record for the database hostname
  4. DEnable VPC flow logs on the subnet
Show answerCorrect answer: A

Cloud SQL connection security settings can require encrypted SSL/TLS connections, protecting data in transit between clients and the database. Object versioning, DNS records, and VPC flow logs do not enforce TLS for database connections.

How to use this practice test

Access the practice questions for free. Each session presents up to 20 random questions from the available bank, and results appear after the session. Use missed questions to identify whether you need to revisit a control choice, such as network isolation, federated identity, TLS enforcement, key-use auditing, or security findings analysis.

Preparation tips

  • Map Google Cloud resource hierarchy levels to where organization-wide constraints and project-specific administration should be applied.
  • For network scenarios, identify the traffic path and trust boundary, then distinguish workload segmentation from private service connectivity.
  • Practice selecting identity federation and database TLS controls by matching each requirement to the relevant authentication or transport layer.
  • Trace investigation needs to the right evidence source, including centralized security findings, asset context, application events, and key usage records.
  • Review how storage location affects resilience and how Kubernetes configuration assessments can expose security improvement areas.
Official sourceOfficial exam page ↗