GOOGLE CYBERSECURITY PROFESSIONAL
CERTIFICATE ASSESSMENT WITH
QUESTIONS AND VERIFIED ANSWERS,
PLUS DETAILED RATIONALES/EXPERT
VERIFIED FOR GUARANTEED PASS
2026/LATEST UPDATE/INSTANT
DOWNLOAD PDF
1. A security analyst notices that an employee's workstation is
generating repeated outbound connections to an unfamiliar
external IP address every few minutes. The connections continue
even when the employee is not actively using the computer.
Network logs show that the workstation is communicating over a
nonstandard TCP port. Which activity should the analyst perform
first to determine whether the behavior represents a potential
compromise?
A. Immediately delete the suspicious files from the workstation
B. Examine network traffic, endpoint processes, and relevant logs to
establish a baseline and identify the communicating process
C. Disable every account belonging to the organization
D. Reinstall the operating system without collecting evidence
Answer: B. Examine network traffic, endpoint processes, and
relevant logs to establish a baseline and identify the communicating
process
Rationale: The analyst should first investigate and establish what
process, service, or application is responsible for the communication.
Network connections to unfamiliar infrastructure can indicate
command-and-control activity, but they can also result from legitimate
1
,software. Preserving evidence while correlating endpoint and network
information helps determine whether the behavior is malicious.
Immediately deleting files or reinstalling the system can destroy
valuable forensic evidence.
2. An organization wants to reduce the likelihood that stolen
employee passwords can be used to access corporate applications.
Which control provides the strongest additional protection against
password-only compromise?
A. Increasing the minimum password length from 8 to 9 characters
B. Requiring users to change passwords every 30 days
C. Implementing multifactor authentication
D. Disabling account lockout policies
Answer: C. Implementing multifactor authentication
Rationale: Multifactor authentication requires an additional
authentication factor beyond the password, such as a hardware token,
authenticator application, or biometric factor. If an attacker obtains a
password through phishing or credential theft, the additional factor
can prevent unauthorized access. Password length and rotation
policies can contribute to security, but they do not provide the same
protection against compromised credentials.
3. A security analyst receives an alert indicating that a user account
successfully authenticated from Nairobi and, two minutes later,
authenticated from an IP address associated with another
geographically distant country. What security concept is most
directly relevant to this investigation?
A. Data masking
B. Impossible travel
C. Network segmentation
D. Software hashing
2
,Answer: B. Impossible travel
Rationale: Impossible-travel detection identifies authentication events
that occur from geographically separated locations within a period
that would make legitimate physical travel implausible. The alert does
not automatically prove compromise because VPNs, proxies, mobile
networks, and cloud services can affect geolocation. The analyst
should correlate the event with authentication logs, device
information, MFA activity, and user behavior.
4. A company stores employee passwords in a database. Which
approach is most appropriate for protecting passwords if the
database is compromised?
A. Store passwords in plaintext
B. Encrypt every password using the same reversible encryption key
C. Hash passwords using a strong password-hashing algorithm with
unique salts
D. Encode passwords using Base64
Answer: C. Hash passwords using a strong password-hashing
algorithm with unique salts
Rationale: Passwords should normally be stored using a password-
specific hashing mechanism designed to resist brute-force and offline
attacks, with a unique salt for each password. Salting prevents
identical passwords from producing identical stored values and
reduces the effectiveness of precomputed rainbow tables. Base64 is
encoding rather than cryptographic protection, and reversible
encryption creates unnecessary exposure if the encryption key is
compromised.
5. A security team wants to identify whether a downloaded
executable has been modified after its original publication. Which
security mechanism is most appropriate?
3
, A. File hashing
B. Network address translation
C. Port forwarding
D. Data compression
Answer: A. File hashing
Rationale: Cryptographic hashes generate a fixed-length
representation of data. If the downloaded file is modified, its
cryptographic hash should change. Analysts can compare the
calculated hash with a trusted reference value to determine whether
the file matches the expected version. Hashing does not prove that a
file is safe by itself; it primarily provides integrity verification.
6. During a phishing investigation, an analyst discovers that a
suspicious email contains a link directing users to a domain that
closely resembles the organization's legitimate domain. Which
technique is most likely being used?
A. Domain impersonation
B. Network segmentation
C. Data deduplication
D. Privilege separation
Answer: A. Domain impersonation
Rationale: Attackers commonly register domains that visually
resemble legitimate domains to deceive users. Techniques may include
typosquatting, character substitution, additional words, or alternate
top-level domains. Analysts should inspect the complete URL, domain
registration information, DNS records, email headers, and certificate
information rather than relying only on how the link appears.
7. An employee receives an email claiming to be from the
organization's IT department. The message urgently requests that
4
CERTIFICATE ASSESSMENT WITH
QUESTIONS AND VERIFIED ANSWERS,
PLUS DETAILED RATIONALES/EXPERT
VERIFIED FOR GUARANTEED PASS
2026/LATEST UPDATE/INSTANT
DOWNLOAD PDF
1. A security analyst notices that an employee's workstation is
generating repeated outbound connections to an unfamiliar
external IP address every few minutes. The connections continue
even when the employee is not actively using the computer.
Network logs show that the workstation is communicating over a
nonstandard TCP port. Which activity should the analyst perform
first to determine whether the behavior represents a potential
compromise?
A. Immediately delete the suspicious files from the workstation
B. Examine network traffic, endpoint processes, and relevant logs to
establish a baseline and identify the communicating process
C. Disable every account belonging to the organization
D. Reinstall the operating system without collecting evidence
Answer: B. Examine network traffic, endpoint processes, and
relevant logs to establish a baseline and identify the communicating
process
Rationale: The analyst should first investigate and establish what
process, service, or application is responsible for the communication.
Network connections to unfamiliar infrastructure can indicate
command-and-control activity, but they can also result from legitimate
1
,software. Preserving evidence while correlating endpoint and network
information helps determine whether the behavior is malicious.
Immediately deleting files or reinstalling the system can destroy
valuable forensic evidence.
2. An organization wants to reduce the likelihood that stolen
employee passwords can be used to access corporate applications.
Which control provides the strongest additional protection against
password-only compromise?
A. Increasing the minimum password length from 8 to 9 characters
B. Requiring users to change passwords every 30 days
C. Implementing multifactor authentication
D. Disabling account lockout policies
Answer: C. Implementing multifactor authentication
Rationale: Multifactor authentication requires an additional
authentication factor beyond the password, such as a hardware token,
authenticator application, or biometric factor. If an attacker obtains a
password through phishing or credential theft, the additional factor
can prevent unauthorized access. Password length and rotation
policies can contribute to security, but they do not provide the same
protection against compromised credentials.
3. A security analyst receives an alert indicating that a user account
successfully authenticated from Nairobi and, two minutes later,
authenticated from an IP address associated with another
geographically distant country. What security concept is most
directly relevant to this investigation?
A. Data masking
B. Impossible travel
C. Network segmentation
D. Software hashing
2
,Answer: B. Impossible travel
Rationale: Impossible-travel detection identifies authentication events
that occur from geographically separated locations within a period
that would make legitimate physical travel implausible. The alert does
not automatically prove compromise because VPNs, proxies, mobile
networks, and cloud services can affect geolocation. The analyst
should correlate the event with authentication logs, device
information, MFA activity, and user behavior.
4. A company stores employee passwords in a database. Which
approach is most appropriate for protecting passwords if the
database is compromised?
A. Store passwords in plaintext
B. Encrypt every password using the same reversible encryption key
C. Hash passwords using a strong password-hashing algorithm with
unique salts
D. Encode passwords using Base64
Answer: C. Hash passwords using a strong password-hashing
algorithm with unique salts
Rationale: Passwords should normally be stored using a password-
specific hashing mechanism designed to resist brute-force and offline
attacks, with a unique salt for each password. Salting prevents
identical passwords from producing identical stored values and
reduces the effectiveness of precomputed rainbow tables. Base64 is
encoding rather than cryptographic protection, and reversible
encryption creates unnecessary exposure if the encryption key is
compromised.
5. A security team wants to identify whether a downloaded
executable has been modified after its original publication. Which
security mechanism is most appropriate?
3
, A. File hashing
B. Network address translation
C. Port forwarding
D. Data compression
Answer: A. File hashing
Rationale: Cryptographic hashes generate a fixed-length
representation of data. If the downloaded file is modified, its
cryptographic hash should change. Analysts can compare the
calculated hash with a trusted reference value to determine whether
the file matches the expected version. Hashing does not prove that a
file is safe by itself; it primarily provides integrity verification.
6. During a phishing investigation, an analyst discovers that a
suspicious email contains a link directing users to a domain that
closely resembles the organization's legitimate domain. Which
technique is most likely being used?
A. Domain impersonation
B. Network segmentation
C. Data deduplication
D. Privilege separation
Answer: A. Domain impersonation
Rationale: Attackers commonly register domains that visually
resemble legitimate domains to deceive users. Techniques may include
typosquatting, character substitution, additional words, or alternate
top-level domains. Analysts should inspect the complete URL, domain
registration information, DNS records, email headers, and certificate
information rather than relying only on how the link appears.
7. An employee receives an email claiming to be from the
organization's IT department. The message urgently requests that
4
