I85PREP
⌘ K
GCP Security Engineer study materials
GCP Security Engineer study resources

GCP Security Engineer practice questions

One question at a time. Build your GCP Security Engineer understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Configure access

A security engineer needs to grant a service account permission to read objects in a Cloud Storage bucket without granting access to any other resource. Which IAM role should be assigned to follow the principle of least privilege?

  1. roles/storage.objectViewer Correct answer.
  2. roles/storage.admin
  3. roles/editor
  4. roles/storage.objectCreator

Explanation

roles/storage.objectViewer grants read-only access to objects and their metadata, which is exactly the permission needed. Broader roles like storage.admin or editor include unrelated permissions and violate least privilege.

Question 2Configure access

Which IAM policy member type represents a group of users managed by a Google Workspace or Cloud Identity domain?

  1. domain:
  2. user:
  3. serviceAccount:
  4. group: Correct answer.

Explanation

The group: prefix binds a role to a Google Group, so membership is managed centrally in the directory. The domain: prefix applies to everyone in a domain, which is broader than a single group.

Question 3Configure access

An organization wants to prevent any principal from being granted the Owner role at the project level. Which control should be configured?

  1. A custom role with limited permissions
  2. An organization policy constraint on IAM allowed policy member domains
  3. An IAM deny policy attached at the organization node Correct answer.
  4. A VPC Service Controls perimeter

Explanation

IAM deny policies can explicitly deny specific role grants and take precedence over allow policies. Attaching a deny policy at the organization node blocks the Owner grant across all descendant projects.

Question 4Configure access

A team needs temporary elevated access for an on-call engineer to troubleshoot production for a few hours. Which mechanism best supports time-bound, auditable privilege elevation?

  1. Creating a new service account and sharing its key
  2. Adding the engineer to a group with permanent admin rights
  3. Using Privileged Access Manager grants with an approval workflow Correct answer.
  4. Granting the engineer roles/owner permanently

Explanation

Privileged Access Manager provides just-in-time, time-bound role grants with approval and audit logging. This aligns with least privilege better than permanent or key-based access.

Question 5Configure access

Which statement correctly describes how IAM roles are inherited in the Google Cloud resource hierarchy?

  1. Roles granted at a higher node are inherited by all descendant resources. Correct answer.
  2. Roles granted at a project override and remove roles granted at the organization.
  3. Roles granted at a folder apply only to resources directly in that folder, not to projects.
  4. Roles must be granted separately on every resource; there is no inheritance.

Explanation

IAM policies are hierarchical: a binding at an organization or folder is inherited by every resource beneath it. Effective permissions are the union of all inherited allow bindings.

Question 6Configure access

A security engineer wants to verify which permissions a principal effectively has on a specific resource before granting a new role. Which tool provides this analysis?

  1. Cloud Asset Inventory
  2. Policy Analyzer Correct answer.
  3. Policy Troubleshooter
  4. Access Transparency

Explanation

Policy Analyzer evaluates effective access by combining allow and deny policies across the hierarchy for a principal and resource. It answers whether a principal has a given permission and why.

Question 7Configure access

Which IAM condition attribute allows a role binding to be limited to requests made from a specific corporate network range?

  1. request.time
  2. resource.name
  3. compute.instanceName
  4. request.auth.access_levels Correct answer.

Explanation

The request.auth.access_levels condition attribute restricts a binding based on Access Context Manager access levels, such as trusted network ranges. This enables context-aware access control.

Question 8Configure access

An application running on Compute Engine needs to call a Cloud Storage API without storing long-lived credentials. What is the recommended approach?

  1. Embed a user's OAuth token in the application code
  2. Export a service account JSON key to the instance
  3. Attach a service account to the instance and use the metadata server Correct answer.
  4. Use the Compute Engine default service account with roles/editor

Explanation

Attaching a service account to the instance lets the application obtain short-lived tokens from the metadata server. This avoids distributing long-lived keys and supports least privilege.

Question 9Configure access

A security engineer must prevent service account keys from being created in a project. Which control enforces this?

  1. A firewall rule blocking the IAM API
  2. An organization policy constraint disabling service account key creation Correct answer.
  3. A custom role without iam.serviceAccounts.signBlob
  4. An Access Context Manager access level

Explanation

The org policy constraint iam.disableServiceAccountKeyCreation blocks creation of service account keys across the targeted scope. It is the standard guardrail for enforcing keyless authentication.

Question 10Configure access

Which of the following best describes the role of Workload Identity Federation in access configuration?

  1. It stores external credentials in Secret Manager for later use.
  2. It allows external workloads to obtain Google Cloud credentials without service account keys. Correct answer.
  3. It encrypts data at rest using customer-managed keys.
  4. It replicates IAM policies across multiple organizations.

Explanation

Workload Identity Federation exchanges credentials from an external identity provider for short-lived Google Cloud tokens. This eliminates the need to distribute service account keys to external workloads.

Question 11Configure access

A security engineer wants to grant a partner organization access to a specific Cloud Storage bucket. The partner uses their own Google identities. Which approach follows best practice?

  1. Create a service account and share its key with the partner
  2. Make the bucket public and rely on unguessable object names
  3. Grant roles/editor to the partner's domain at the project level
  4. Grant roles/storage.objectViewer to the partner's group on the bucket only Correct answer.

Explanation

Granting a narrowly scoped role to the partner's group on the specific bucket limits access to only the intended resource. Using a group simplifies membership management and avoids sharing keys.

Question 12Configure access

Which predefined role provides the ability to manage IAM policies on a project but does not grant access to the underlying data?

  1. roles/owner
  2. roles/viewer
  3. roles/iam.securityAdmin Correct answer.
  4. roles/editor

Explanation

roles/iam.securityAdmin allows managing IAM policies, including granting roles, without granting data access. Owner includes data access and billing, so it is broader than needed for policy management.

Question 13Configure access

An auditor needs a record of all IAM policy changes made in a project over the past 90 days. Which log source should be queried?

  1. Admin Activity audit logs Correct answer.
  2. Access Transparency logs
  3. Cloud Monitoring uptime checks
  4. VPC Flow Logs

Explanation

Admin Activity audit logs record changes to resource configurations, including IAM policy modifications. They are retained by default and are the correct source for auditing policy changes.

Question 14Configure access

A company wants to ensure that only identities from its corporate domain can be granted roles in its organization. Which control should be applied?

  1. An IAM deny policy on all roles
  2. The iam.allowedPolicyMemberDomains organization policy constraint Correct answer.
  3. An IAM condition on request.time
  4. A VPC firewall rule restricting egress

Explanation

The iam.allowedPolicyMemberDomains constraint restricts which domains can appear in IAM policy bindings. This prevents granting roles to identities outside the approved domain.

Question 15Configure access

Which statement about service accounts and their default behavior is correct?

  1. Service account keys never expire.
  2. Service accounts can only be used within a single project.
  3. Service accounts are both identities and resources that can have IAM policies attached. Correct answer.
  4. Service accounts cannot be granted IAM roles directly.

Explanation

A service account acts as an identity that can be granted roles, and it is also a resource to which policies can be attached. This dual nature is important when configuring access.

Question 16Configure access

A security engineer wants to require that all access to a sensitive BigQuery dataset comes through a trusted network and approved devices. Which combination best implements this?

  1. IAM conditions using Access Context Manager access levels Correct answer.
  2. Cloud Armor security policies
  3. Object Versioning on Cloud Storage
  4. Firewall rules on the default VPC

Explanation

IAM conditions can reference Access Context Manager access levels to enforce trusted network and device posture. This provides context-aware access control for API requests.

Question 17Configure access

Which IAM member type should be used to grant a role to all authenticated users, including those outside the organization?

  1. allUsers
  2. domain:example.com
  3. allAuthenticatedUsers Correct answer.
  4. group:[email protected]

Explanation

allAuthenticatedUsers includes any principal authenticated with a Google account, including external users. It is broader than a domain or group binding and should be used cautiously.

Question 18Configure access

A team reports that a principal can still access a resource after an allow binding was removed. Which factor most likely explains the continued access?

  1. An inherited binding at a parent folder or organization Correct answer.
  2. A missing firewall rule
  3. The absence of VPC Service Controls
  4. Cloud CDN caching of the IAM policy

Explanation

Effective access is the union of allow bindings inherited from all ancestors. A binding at a parent folder or organization can continue granting access even after the project-level binding is removed.

Question 19Configure access

Which predefined role is designed to allow a principal to view IAM policies and audit configurations without modifying them?

  1. roles/iam.securityReviewer Correct answer.
  2. roles/owner
  3. roles/iam.serviceAccountUser
  4. roles/iam.securityAdmin

Explanation

roles/iam.securityReviewer grants read-only access to IAM policies and related security configurations. It supports auditing without granting the ability to change policies.

Question 20Configure access

An engineer needs to let a CI/CD pipeline impersonate a deployment service account without downloading a key. Which configuration enables this?

  1. Add the pipeline identity to allAuthenticatedUsers
  2. Grant the pipeline identity roles/iam.serviceAccountTokenCreator on the service account Correct answer.
  3. Grant the pipeline identity roles/owner on the project
  4. Create a JSON key and store it in the pipeline variables

Explanation

The Service Account Token Creator role allows a principal to generate short-lived credentials for a service account. This supports keyless impersonation for CI/CD pipelines.

Question 21Configure access

Which of the following is the primary purpose of Access Transparency logs?

  1. Recording VPC network flows
  2. Recording actions taken by Google personnel on customer data Correct answer.
  3. Recording application error rates
  4. Recording customer IAM policy changes

Explanation

Access Transparency logs record when Google personnel access customer content, providing visibility for compliance. They are distinct from customer-initiated audit logs.

Question 22Configure access

A security engineer wants to restrict a role binding so it is only valid until the end of the quarter. Which IAM condition should be used?

  1. request.auth.access_levels in accessLevels
  2. request.time < timestamp("2025-03-31T23:59:59Z") Correct answer.
  3. api.getAttribute('iam.googleapis.com/modifiedServiceAccounts')
  4. resource.type == "storage.googleapis.com/Bucket"

Explanation

The request.time condition attribute limits a binding to a time window using a timestamp comparison. This creates temporary access that expires automatically.

Question 23Configure access

Which control should be used to ensure that a compromised service account key cannot be used to access resources from outside an approved network?

  1. A Cloud Armor rule blocking the key's IP address
  2. Object Lifecycle Management on the bucket
  3. An IAM condition requiring an Access Context Manager access level on the binding Correct answer.
  4. A custom role without storage permissions

Explanation

An IAM condition tied to an access level enforces that requests satisfy network or device context, limiting use of a leaked key. This is a context-aware access control mechanism.

Question 24Configure access

Which statement about IAM deny policies is correct?

  1. Deny policies grant permissions when no allow policy exists.
  2. Deny policies are evaluated before allow policies and take precedence. Correct answer.
  3. Deny policies are only available at the project level.
  4. Deny policies override organization policy constraints.

Explanation

IAM deny policies are evaluated first, and a matching deny takes precedence over any allow binding. They can be attached at organization, folder, or project levels.

Question 25Configure access

A security engineer needs to grant read-only access to billing data for finance staff. Which role is most appropriate?

  1. roles/billing.viewer Correct answer.
  2. roles/billing.admin
  3. roles/owner
  4. roles/viewer

Explanation

roles/billing.viewer grants read-only access to billing account information, which matches the finance team's need. It avoids the broader permissions of billing.admin or owner.

Question 26Configure access

A security engineer is designing access for a new project and wants to understand how IAM policy inheritance works. Which statement describes how allow policies are evaluated across the resource hierarchy?

  1. Allow policies are combined with a deny-by-default rule, so any level without a binding blocks access.
  2. Allow policies are subtractive: a binding at a lower level removes the matching binding inherited from a higher level.
  3. Allow policies are evaluated only at the resource where the request terminates, ignoring ancestors.
  4. Allow policies are additive: an allow binding at the organization, folder, or project level is inherited by all descendant resources. Correct answer.

Explanation

Google Cloud IAM allow policies are hierarchical and additive. A role granted at a higher node (organization, folder, or project) is inherited by every resource beneath it, and effective permissions are the union of all applicable allow bindings.

Question 27Configure access

A security engineer is choosing between basic, predefined, and custom roles for a team that needs to manage Compute Engine instances but must not be able to modify IAM policies. Which role type should be selected to follow least privilege?

  1. A basic role such as Editor
  2. A predefined role scoped to Compute Engine management Correct answer.
  3. The Owner basic role limited by an IAM condition
  4. A custom role containing only the required permissions

Explanation

Predefined roles are curated by Google to bundle a specific service's permissions, such as Compute Instance Admin, and they avoid the broad access of basic roles. A predefined Compute role grants instance management without the IAM-modification powers found in Editor or Owner.

Question 28Configure access

A security engineer must grant a group of contractors permission to view a single Cloud Storage bucket but nothing else in the project. Which approach correctly scopes the grant?

  1. Grant roles/storage.objectViewer to the group at the project level.
  2. Grant roles/viewer to the group at the organization level.
  3. Grant roles/storage.objectViewer to the group on the specific bucket resource. Correct answer.
  4. Grant roles/storage.admin to the group on the bucket.

Explanation

Resource-level IAM bindings let you attach a role to a specific bucket so the grant applies only to that resource. Granting objectViewer on the bucket gives read access to its objects without exposing other project resources.

Question 29Configure access

A security engineer is reviewing how service account permissions are determined when the service account acts as a principal. Which statement is accurate?

  1. A service account automatically inherits all permissions granted to its project's owners.
  2. A service account's permissions come only from the default Compute Engine role.
  3. A service account receives the permissions of the human user who created it.
  4. A service account has no permissions until it is added to a role binding, just like any other principal. Correct answer.

Explanation

A service account is a principal, and like any principal it starts with no permissions. Access is granted by binding roles to the service account's email identity, and effective permissions are the union of those bindings.

Question 30Configure access

A security engineer wants to allow a role binding to apply only when a request comes from a specific set of IP address ranges. Which IAM condition element should be used?

  1. request.auth.access_levels Correct answer.
  2. request.time
  3. resource.name
  4. resource.type

Explanation

The request.auth.access_levels condition checks the request's authentication context against Access Context Manager access levels, which can encode corporate IP ranges. This restricts the binding to requests matching the defined access level.

Question 31Configure access

A security engineer needs to let an on-premises application authenticate to Google Cloud APIs using its existing OIDC identity provider and no exported keys. Which configuration accomplishes this?

  1. Configure Workload Identity Federation with the OIDC provider and map attributes to a service account. Correct answer.
  2. Grant the OIDC provider's client secret the Editor role on the project.
  3. Create a service account key and embed it in the on-premises application configuration.
  4. Enable the default Compute Engine service account for the on-premises hosts.

Explanation

Workload Identity Federation lets external identities exchange credentials from an OIDC provider for short-lived Google Cloud access tokens. Attribute mapping and a service account impersonation binding let the application call APIs without any long-lived key.

Question 32Configure access

A security engineer wants to ensure that a principal cannot perform a specific high-risk action even if another binding grants it. Which IAM feature provides this guarantee?

  1. A service account with the action removed
  2. A predefined role that excludes the action
  3. An IAM allow binding with a request.time condition
  4. An IAM deny policy attached at the organization level Correct answer.

Explanation

IAM deny policies take precedence over allow bindings, so a denied permission cannot be granted by any allow policy. Attaching the deny policy high in the hierarchy ensures it applies to all descendant resources.

Question 33Configure access

A security engineer must prevent any principal from creating service account keys in a project. Which control most directly enforces this?

  1. An IAM deny policy that denies iam.serviceAccountKeys.create
  2. A predefined role that omits the key-creation permission
  3. A VPC Service Controls perimeter around the project
  4. An organization policy constraint on service account key creation Correct answer.

Explanation

The organization policy constraint constraints/iam.disableServiceAccountKeyCreation blocks creation of service account keys across the scoped resources. It enforces the rule regardless of which principal attempts the action.

Question 34Configure access

A security engineer is asked to grant a data analyst read access to a BigQuery dataset while ensuring the analyst cannot view or change IAM policies on the project. Which grant satisfies this?

  1. roles/editor on the project
  2. roles/bigquery.dataViewer on the dataset Correct answer.
  3. roles/bigquery.admin on the project
  4. roles/iam.securityAdmin on the dataset

Explanation

Granting bigquery.dataViewer at the dataset level provides read access to the dataset's data without project-wide administrative rights. It does not include permission to modify IAM policies.

Question 35Configure access

A security engineer needs to grant a partner's Google Workspace group access to a shared project without adding each user individually. Which member type should be bound to the role?

  1. A Google group email address Correct answer.
  2. A service account email address
  3. A single user email address
  4. The allAuthenticatedUsers special identifier

Explanation

Binding a role to a Google group grants access to all current and future group members, simplifying management for external collaborators. Membership changes in the group automatically adjust effective access.

Question 36Configure access

A security engineer is configuring a service account for a batch job and wants to limit where its credentials can be used. Which approach best reduces the risk of credential misuse if the token is exfiltrated?

  1. Grant the service account the Owner role to simplify permissions.
  2. Create multiple keys for the service account to spread usage.
  3. Disable the service account's audit logging to reduce noise.
  4. Bind the service account to an access level that restricts requests to trusted networks. Correct answer.

Explanation

Binding a role to the service account with an access-level condition limits token use to requests originating from approved networks. A stolen token used from elsewhere fails the condition check.

Question 37Configure access

A security engineer is troubleshooting a case where a principal still has access after an allow binding was removed. Which explanation is most likely?

  1. The principal's OAuth token was revoked.
  2. The principal is a member of a group that still has an equivalent role binding. Correct answer.
  3. IAM changes take 24 hours to propagate in all cases.
  4. The resource was recently recreated, resetting all policies.

Explanation

Effective permissions are the union of direct and inherited bindings, including those granted through group membership. Removing one binding does not remove access that a group membership still provides.

Question 38Configure access

A security engineer must ensure that all access to a sensitive project's APIs is limited to identities within the organization and cannot be reached from the public internet. Which combination should be used?

  1. IAM allow bindings for the organization plus Cloud Audit Logs
  2. Firewall rules plus organization policy constraints
  3. Cloud Armor policies plus IAM deny policies
  4. VPC Service Controls perimeter plus an access level for trusted networks Correct answer.

Explanation

VPC Service Controls create a security perimeter around project services to prevent data access from outside approved contexts. Pairing the perimeter with an access level restricts access to trusted networks and identities.

Question 39Configure access

A security engineer is designing a custom role and wants to understand how it interacts with predefined roles already granted to a principal. Which statement is correct?

  1. Custom roles and predefined roles are additive, and effective permissions are the union of all grants. Correct answer.
  2. A custom role can only be granted at the organization level.
  3. Granting a custom role replaces all previously granted predefined roles.
  4. Custom roles automatically deny any permission they do not list, overriding other grants.

Explanation

IAM evaluates all allow bindings together, so a custom role adds its permissions to those from predefined roles. Effective access is the union unless an explicit deny policy applies.

Question 40Configure access

A security engineer needs to give an automated pipeline permission to deploy to a project while ensuring the pipeline cannot escalate its own privileges. Which design best meets this requirement?

  1. Grant roles/iam.serviceAccountUser at the organization level.
  2. Grant the pipeline's service account roles/editor to cover all deployment needs.
  3. Grant a set of predefined deployment roles and add an IAM deny policy blocking IAM policy changes. Correct answer.
  4. Store a service account key with Owner in the pipeline's secret manager.

Explanation

Composing least-privilege predefined roles for deployment limits what the pipeline can do, and a deny policy on IAM modification prevents privilege escalation. Deny policies override any allow grant, closing the escalation path.

Question 41Secure communications and establish boundary protection

A security team needs to inspect outbound traffic from Compute Engine instances for malware signatures without routing it through a third-party appliance. Which Google Cloud service is designed for this inline traffic inspection?

  1. Firewall Rules Logging
  2. Cloud NAT with logging enabled
  3. Cloud IDS Correct answer.
  4. VPC Flow Logs

Explanation

Cloud IDS is a managed intrusion detection service that inspects traffic traversing a VPC network using packet mirroring, providing threat detection without a third-party appliance. It detects malware, spyware, and command-and-control activity inline.

Question 42Secure communications and establish boundary protection

An organization wants to ensure that all egress traffic from their VPC leaves through a controlled point where they can apply allowlisting. Which feature provides a managed egress gateway with a single IP for outbound connections?

  1. Shared VPC
  2. Private Service Connect
  3. VPC peering
  4. Cloud NAT Correct answer.

Explanation

Cloud NAT lets instances without external IP addresses reach the internet through a managed NAT gateway, presenting a controlled egress point with a stable set of external IPs. This supports egress allowlisting and hides internal addresses.

Question 43Secure communications and establish boundary protection

A company needs to give partners access to a specific service in their VPC without exposing it to the public internet and without exchanging VPC peerings. Which construct should they use?

  1. VPC Network Peering
  2. Cloud VPN with dynamic routing
  3. Private Service Connect service attachment Correct answer.
  4. External passthrough Network Load Balancer

Explanation

Private Service Connect service attachments let a producer expose a service privately to consumers who connect via PSC endpoints, without public exposure or peering. Consumers reach the service over private IP within Google's network.

Question 44Secure communications and establish boundary protection

A security engineer must ensure that traffic between two VPCs in the same project stays on Google's private backbone and is encrypted. Which option best satisfies this requirement with minimal operational overhead?

  1. Cloud VPN with HA tunnels
  2. HA VPN over Cloud Interconnect
  3. VPC Network Peering Correct answer.
  4. Cloud Interconnect with MACsec

Explanation

VPC Network Peering routes traffic between peered VPCs over Google's private network, and Google encrypts traffic in transit within its infrastructure. It requires no tunnel management, minimizing operational overhead.

Question 45Secure communications and establish boundary protection

Which Google Cloud firewall feature allows rules to be evaluated based on the identity of the service account attached to an instance rather than its IP address?

  1. VPC firewall rules with service account targets Correct answer.
  2. Hierarchical firewall policies
  3. Firewall Rules Logging
  4. Identity-Aware Proxy

Explanation

VPC firewall rules can specify service accounts as targets and sources, letting policy follow workload identity instead of mutable IP addresses. This reduces rule sprawl as instances scale.

Question 46Secure communications and establish boundary protection

An administrator wants to enforce a baseline set of firewall rules across every project in the organization that individual projects cannot override. What should they use?

  1. Firewall Rules Logging
  2. VPC firewall rules in each project
  3. Hierarchical firewall policies at the organization node Correct answer.
  4. Cloud Armor security policies

Explanation

Hierarchical firewall policies attached at the organization or folder level are evaluated before project-level VPC rules and can enforce baselines that projects cannot override. This provides centralized boundary control.

Question 47Secure communications and establish boundary protection

A web application is being targeted by a distributed layer 7 flood. Which Google Cloud service is purpose-built to filter this traffic before it reaches the backend?

  1. VPC Service Controls
  2. Cloud Armor security policy Correct answer.
  3. Cloud IDS
  4. Cloud NAT

Explanation

Cloud Armor provides edge-based protection against DDoS and application-layer attacks for HTTP(S) load-balanced services, filtering traffic before it reaches backends. It supports rules for rate limiting and OWASP-style signatures.

Question 48Secure communications and establish boundary protection

A security engineer wants to restrict which Google APIs a set of projects can call so that data cannot be exfiltrated to unauthorized services. Which control should they implement?

  1. Cloud Armor adaptive protection
  2. Private Google Access
  3. VPC Service Controls perimeter Correct answer.
  4. Cloud NAT

Explanation

VPC Service Controls defines a service perimeter that restricts data movement and API access across project boundaries, mitigating exfiltration. It enforces which services and identities can interact within the perimeter.

Question 49Secure communications and establish boundary protection

Which mechanism lets a Compute Engine instance reach Google APIs privately without an external IP address while still allowing access to the public internet through NAT?

  1. Cloud CDN
  2. Private Google Access Correct answer.
  3. Cloud Interconnect
  4. VPC Service Controls

Explanation

Private Google Access allows instances without external IP addresses to reach Google APIs and services using internal addresses. It is commonly combined with Cloud NAT for general internet egress.

Question 50Secure communications and establish boundary protection

An organization wants to require that all access to a sensitive internal application goes through identity verification and context-aware authorization rather than exposing the app via a public load balancer. Which service should they use?

  1. Cloud Armor
  2. Cloud VPN
  3. VPC Flow Logs
  4. Identity-Aware Proxy Correct answer.

Explanation

Identity-Aware Proxy enforces identity and context-aware access to applications and VMs, allowing access without exposing them publicly. It centralizes authorization based on user identity and device context.