Free Access Google.Professional-Cloud-Security-Engineer.v2022-08-22.q116 Practice Test (Page 6)

Question 21

Your customer is moving their corporate applications to Google Cloud Platform. The security team wants detailed visibility of all resources in the organization. You use Resource Manager to set yourself up as the org admin. What Cloud Identity and Access Management (Cloud IAM) roles should you give to the security team?

A.Org viewer, Project owner

B.Org viewer, Project viewer

C.Org admin, Project browser

D.Project owner, Network admin

Question 22

A customer has an analytics workload running on Compute Engine that should have limited internet access.
Your team created an egress firewall rule to deny (priority 1000) all traffic to the internet.
The Compute Engine instances now need to reach out to the public repository to get security updates.
What should your team do?

A.Create an egress firewall rule to allow traffic to the CIDR range of the repository with a priority greater than
1000.

B.Create an egress firewall rule to allow traffic to the CIDR range of the repository with a priority less than
1000.

C.Create an egress firewall rule to allow traffic to the hostname of the repository with a priority less than 1000.

D.Create an egress firewall rule to allow traffic to the hostname of the repository with a priority greater than
1000.

Question 23

You are a security administrator at your company. Per Google-recommended best practices, you implemented the domain restricted sharing organization policy to allow only required domains to access your projects. An engineering team is now reporting that users at an external partner outside your organization domain cannot be granted access to the resources in a project. How should you make an exception for your partner's domain while following the stated best practices?

A.Turn off the domain restriction sharing organization policy. Set the policy value to "Allow All."

B.Turn off the domain restricted sharing organization policy. Provide the external partners with the required permissions using Google's Identity and Access Management (IAM) service.

C.Turn off the domain restricted sharing organization policy. Add each partner's Google Workspace customer ID to a Google group, add the Google group as an exception under the organization policy, and then turn the policy back on.

D.Turn off the domain restricted sharing organization policy. Set the policy value to "Custom." Add each external partner's Cloud Identity or Google Workspace customer ID as an exception under the

Question 24

A customer has 300 engineers. The company wants to grant different levels of access and efficiently manage IAM permissions between users in the development and production environment projects.
Which two steps should the company take to meet these requirements? (Choose two.)

A.Create a Google Group for the Engineering team, and assign permissions at the folder level.

B.Create an Organizational Policy constraint for each folder environment.

C.Create a project with multiple VPC networks for each environment.

D.Create a folder for each development and production environment.

E.Create projects for each environment, and grant IAM rights to each engineering user.

Question 25

What are the steps to encrypt data using envelope encryption?

A.Generate a data encryption key (DEK) locally.
Use a key encryption key (KEK) to wrap the DEK. Encrypt data with the KEK.
Store the encrypted data and the wrapped KEK.

B.Generate a key encryption key (KEK) locally.
Use the KEK to generate a data encryption key (DEK). Encrypt data with the DEK.
Store the encrypted data and the wrapped DEK.

C.Generate a data encryption key (DEK) locally.
Encrypt data with the DEK.
Use a key encryption key (KEK) to wrap the DEK. Store the encrypted data and the wrapped DEK.

D.Generate a key encryption key (KEK) locally.
Generate a data encryption key (DEK) locally. Encrypt data with the KEK.
Store the encrypted data and the wrapped DEK.

Other Version: 2980Google.Professional-Cloud-Security-Engineer.v2022-10-17.q111; 3085Google.Professional-Cloud-Security-Engineer.v2022-01-23.q100

Latest Upload: 252PaloAltoNetworks.NGFW-Engineer.v2026-05-01.q43; 362Nokia.4A0-113.v2026-05-01.q69; 397EC-COUNCIL.312-49v11.v2026-04-30.q214; 307Microsoft.MB-820.v2026-04-30.q101; 248Salesforce.MC-202.v2026-04-30.q57; 275BICSI.INSTC_V8.v2026-04-29.q53; 411NMLS.MLO.v2026-04-28.q82; 275NCARB.Project-Management.v2026-04-28.q27; 494EMC.D-AV-DY-23.v2026-04-27.q184; 1303ServiceNow.CSA.v2026-04-27.q483

Question 21

Question 22

Question 23

Question 24

Question 25

Download PDF File