Google Cloud

Google Cloud Certified – Professional Security Operations Engineer

PR000330

Get certified as a Professional Security Operations Engineer with exam code PR000330 to validate your security operations skills in Google Cloud.

486 questions 0 views Free

Start Mock Test Timed · Full-length · Scored

Q51

You are configuring IAM roles. What happens if a user has both roles that grant and deny permissions?

A Deny permissions take precedence
B Permit permissions take precedence
C Permissions are combined
D User is locked out entirely

Explanation In IAM, deny permissions always take precedence over allow permissions; the other options misrepresent IAM behavior.

Q52

Which service would you use for real-time threat detection?

A Cloud Security Command Center
B Cloud Pub/Sub
C Cloud SQL
D Cloud Storage

Explanation Cloud Security Command Center analyzes security risks; others do not focus on threat detection.

Q53

A company needs to control access to its GCP resources using attributes like department and project. What should they use?

A Cloud IAM Policies
B Service Accounts
C Resource Tags
D Firewall Rules

Explanation Cloud IAM Policies allow attribute-based access control; others cannot provide this functionality.

Q54

You are configuring a data encryption key management solution. What happens if you lose access to the Cloud Key Management Service (KMS) keys?

A Data is irretrievable
B Data is decrypted automatically
C Keys can be restored easily
D Data can still be accessed

Explanation Losing KMS keys means data is irretrievable; no alternative access exists.

Q55

Which service provides threat detection and alerts for GCP resources?

A Cloud Security Command Center
B Cloud Monitoring
C IAM Roles Manager
D VPC Service Controls

Explanation Cloud Security Command Center offers threat detection, while others do not focus on security alerts.

Q56

A company needs to enforce security policies on its GCP projects. What should they use?

A Organization Policies
B Cloud Armor
C VPC Flow Logs
D Cloud Functions

Explanation Organization Policies allow the enforcement of security policies across projects.

Q57

You are configuring a Pub/Sub topic with two subscribers. What happens if one subscriber fails to acknowledge a message?

A The message is lost permanently.
B The message is sent to the Dead Letter Queue.
C The message becomes available for redelivery.
D The system disconnects that subscriber.

Explanation Unacknowledged messages are available for redelivery after a configured timeout.

Q58

A company needs to manage Google Cloud IAM roles across multiple projects. Which service should they use?

A Organization Policy
B Cloud Identity
C Resource Manager
D Cloud Functions

Explanation Resource Manager allows you to define IAM policies at the organization or project level, making it easier to manage roles across projects. Organization Policy is more focused on resource constraints, and Cloud Identity relates to user management, while Cloud Functions does not pertain to IAM.

Q59

You are configuring VPC Service Controls for a Google Cloud project. What is their primary purpose?

A Limit outgoing traffic from VM instances
B Contain sensitive data within a perimeter
C Improve network performance
D Enforce IAM roles for users

Explanation VPC Service Controls are used to create security perimeters around Google Cloud resources to help contain sensitive data and prevent data exfiltration. The other options focus on different aspects of cloud security or performance.

Q60

What happens when a Cloud Function exceeds its memory limit?

A Function execution continues normally
B Function is terminated prematurely
C Function is redeployed automatically
D Function scales up memory automatically

Explanation If a Cloud Function exceeds its memory limit, it is terminated prematurely and fails to complete. The other options incorrectly suggest that execution or scaling occurs despite the limit.