Google Professional Cloud Security Engineer QUESTIONS
AND ANSWERS | VERIFIED AND WELL DETAILED
ANSWERS | PLUS RATIONALES | GUARANTEED PASS |
LATEST EXAM UPDATE | EXAM PREP | STUDY GUIDE |
PRACTICE TEST
,Domain 1: Configuring Access (25 Questions)
1. A company wants to ensure that only employees from the finance department can access a specific Cloud
Storage bucket. What is the most granular IAM approach?
- A) Grant roles/storage.admin at the project level
- B) Grant roles/storage.objectViewer to a Google Group at the bucket level
- C) Grant roles/storage.objectViewer at the organization level
- D) Use a service account with storage.admin
Answer: B
Rationale: Bucket-level IAM allows granular control, and using a Google Group simplifies management.
Project/org-level grants are too broad.
2. What is the recommended way to grant temporary access to a resource for an external contractor?
- A) Create a new Google account for them
- B) Use IAM Conditions with a time-based expiry
,- C) Share the service account key
- D) Add them to the organization
Answer: B
Rationale: IAM Conditions support time-bound access, ensuring least privilege and automatic expiry.
3. Which IAM role allows a user to impersonate a service account?
- A) roles/iam.serviceAccountUser
- B) roles/iam.serviceAccountAdmin
- C) roles/iam.securityAdmin
- D) roles/owner
Answer: A
Rationale: The Service Account User role allows impersonation; Service Account Admin manages the account
itself.
, 4. A company needs to enforce that all IAM grants are reviewed before being applied. What should they use?
- A) Access Transparency
- B) Access Approval
- C) VPC Service Controls
- D) Cloud Audit Logs
Answer: B
Rationale: Access Approval requires explicit approval before Google support or employees access customer
data.
5. Which practice best supports least privilege for service accounts?
- A) Use default compute service account
- B) Grant primitive roles
- C) Create dedicated service accounts per workload with minimal roles
AND ANSWERS | VERIFIED AND WELL DETAILED
ANSWERS | PLUS RATIONALES | GUARANTEED PASS |
LATEST EXAM UPDATE | EXAM PREP | STUDY GUIDE |
PRACTICE TEST
,Domain 1: Configuring Access (25 Questions)
1. A company wants to ensure that only employees from the finance department can access a specific Cloud
Storage bucket. What is the most granular IAM approach?
- A) Grant roles/storage.admin at the project level
- B) Grant roles/storage.objectViewer to a Google Group at the bucket level
- C) Grant roles/storage.objectViewer at the organization level
- D) Use a service account with storage.admin
Answer: B
Rationale: Bucket-level IAM allows granular control, and using a Google Group simplifies management.
Project/org-level grants are too broad.
2. What is the recommended way to grant temporary access to a resource for an external contractor?
- A) Create a new Google account for them
- B) Use IAM Conditions with a time-based expiry
,- C) Share the service account key
- D) Add them to the organization
Answer: B
Rationale: IAM Conditions support time-bound access, ensuring least privilege and automatic expiry.
3. Which IAM role allows a user to impersonate a service account?
- A) roles/iam.serviceAccountUser
- B) roles/iam.serviceAccountAdmin
- C) roles/iam.securityAdmin
- D) roles/owner
Answer: A
Rationale: The Service Account User role allows impersonation; Service Account Admin manages the account
itself.
, 4. A company needs to enforce that all IAM grants are reviewed before being applied. What should they use?
- A) Access Transparency
- B) Access Approval
- C) VPC Service Controls
- D) Cloud Audit Logs
Answer: B
Rationale: Access Approval requires explicit approval before Google support or employees access customer
data.
5. Which practice best supports least privilege for service accounts?
- A) Use default compute service account
- B) Grant primitive roles
- C) Create dedicated service accounts per workload with minimal roles
