• ホーム
  • ブログ
  • 2026年04月 Google Professional-Cloud-Security-Engineer実際にある問題と100%カバー率リアル試験問題 [Q76-Q100]

2026年04月 Google Professional-Cloud-Security-Engineer実際にある問題と100%カバー率リアル試験問題 [Q76-Q100]

Share

2026年04月 Google Professional-Cloud-Security-Engineer実際にある問題と100%カバー率リアル試験問題

Professional-Cloud-Security-Engineer無料試験問題と解答PDF最新問題2026年04月

質問 # 76
Your organization is using Active Directory and wants to configure Security Assertion Markup Language (SAML). You must set up and enforce single sign-on (SSO) for all users.
What should you do?

  • A. 1- Create a new SAML profile.
    * 2. Populate the sign-in and sign-out page URLs.
    * 3. Upload the X.509 certificate.
    * 4. Configure Entity ID and ACS URL in your IdP
  • B. 1. Manage SAML profile assignments.
    * 2. Enable OpenID Connect (OIDC) in your Active Directory (AD) tenant.
    * 3. Verify the domain.
  • C. 1. Create a new SAML profile.
    * 2. Upload the X.509 certificate.
    * 3. Enable the change password URL.
    * 4. Configure Entity ID and ACS URL in your IdP.
  • D. 1. Configure prerequisites for OpenID Connect (OIDC) in your Active Directory (AD) tenant
    * 2. Verify the AD domain.
    * 3. Decide which users should use SAML.
    * 4. Assign the pre-configured profile to the select organizational units (OUs) and groups.

正解：A

解説：
When configuring SAML-based Single Sign-On (SSO) in an organization that's using Active Directory, the general steps would involve setting up a SAML profile, specifying the necessary URLs for sign-in and sign-out processes, uploading an X.509 certificate for secure communication, and setting up the Entity ID and Assertion Consumer Service (ACS) URL in the Identity Provider (which in this case would be Active Directory).


質問 # 77
After completing a security vulnerability assessment, you learned that cloud administrators leave Google Cloud CLI sessions open for days. You need to reduce the risk of attackers who might exploit these open sessions by setting these sessions to the minimum duration.
What should you do?

  • A. Set the session duration for the Google session control to one hour.
  • B. Set the organization policy constraint
    constraints/iam.allowServiceAccountCredentialLifetimeExtension to one hour.
  • C. Set the organization policy constraint constraints/iam.serviceAccountKeyExpiryHours to one hour and inheritFromParent to false.
  • D. Set the reauthentication frequency for the Google Cloud Session Control to one hour.

正解：D

解説：
https://support.google.com/a/answer/9368756?hl=en


質問 # 78
Your team uses a service account to authenticate data transfers from a given Compute Engine virtual machine instance of to a specified Cloud Storage bucket. An engineer accidentally deletes the service account, which breaks application functionality. You want to recover the application as quickly as possible without compromising security.
What should you do?

  • A. Temporarily disable authentication on the Cloud Storage bucket.
  • B. Create a new service account with the same name as the deleted service account.
  • C. Use the undelete command to recover the deleted service account.
  • D. Update the permissions of another existing service account and supply those credentials to the applications.

正解：C

解説：
https://cloud.google.com/iam/docs/reference/rest/v1/projects.serviceAccounts/undelete


質問 # 79
You need to set up a Cloud interconnect connection between your company's on-premises data center and VPC host network. You want to make sure that on-premises applications can only access Google APIs over the Cloud Interconnect and not through the public internet. You are required to only use APIs that are supported by VPC Service Controls to mitigate against exfiltration risk to non-supported APIs. How should you configure the network?

  • A. Enable Private Google Access on the regional subnets and global dynamic routing mode.
  • B. Use restricted googleapis.com to access Google APIs using a set of IP addresses only routable from within Google Cloud, which are advertised as routes over the Cloud Interconnect connection.
  • C. Set up a Private Service Connect endpoint IP address with the API bundle of "all-apis", which is advertised as a route over the Cloud interconnect connection.
  • D. Use private.googleapis.com to access Google APIs using a set of IP addresses only routable from within Google Cloud, which are advertised as routes over the connection.

正解：B

解説：
https://cloud.google.com/vpc/docs/private-service-connect
An API bundle:
All APIs (all-apis): most Google APIs
(same as private.googleapis.com).
VPC-SC (vpc-sc): APIs that VPC Service Controls supports
(same as restricted.googleapis.com).
VMs in the same VPC network as the endpoint (all regions)
On-premises systems that are connected to the VPC network that contains the endpoint


質問 # 80
You have been tasked with implementing external web application protection against common web application attacks for a public application on Google Cloud. You want to validate these policy changes before they are enforced. What service should you use?

  • A. Google Cloud Armor's preconfigured rules in preview mode
  • B. Cloud Load Balancing firewall rules
  • C. The inherent protections of Google Front End (GFE)
  • D. Prepopulated VPC firewall rules in monitor mode
  • E. VPC Service Controls in dry run mode

正解：A

解説：
* Objective: Implement external web application protection and validate policy changes before enforcement.
* Solution: Use Google Cloud Armor's preconfigured rules in preview mode.
* Steps:
* Step 1: Open the Google Cloud Console.
* Step 2: Navigate to the Google Cloud Armor section.
* Step 3: Create or select a security policy.
* Step 4: Apply preconfigured rules to the policy.
* Step 5: Enable preview mode to simulate the effects of the rules without enforcing them.
* Step 6: Monitor the logs to validate the policy changes.
Google Cloud Armor's preview mode allows you to test and validate the impact of security policies on your application traffic before applying them, ensuring that they work as intended without disrupting the service.
References:
* Google Cloud Armor Documentation
* Using Preview Mode


質問 # 81
You are part of a security team that wants to ensure that a Cloud Storage bucket in Project A can only be readable from Project B.
You also want to ensure that data in the Cloud Storage bucket cannot be accessed from or copied to Cloud Storage buckets outside the network, even if the user has the correct credentials.
What should you do?

  • A. Enable Domain Restricted Sharing Organization Policy and Bucket Policy Only on the Cloud Storage bucket.
  • B. Enable Private Access in Project A and B networks with strict firewall rules to allow communication between the networks.
  • C. Enable VPC Peering between Project A and B networks with strict firewall rules to allow communication between the networks.
  • D. Enable VPC Service Controls, create a perimeter with Project A and B, and include Cloud Storage service.

正解：D

解説：
Explanation
https://cloud.google.com/vpc-service-controls/docs/overview#isolate


質問 # 82
You are creating an internal App Engine application that needs to access a user's Google Drive on the user's behalf. Your company does not want to rely on the current user's credentials. It also wants to follow Google-recommended practices.
What should you do?

  • A. Create a new Service account, and give all application users the role of Service Account User.
  • B. Create a new Service account, and add all application users to a Google Group. Give this group the role of Service Account User.
  • C. Create a new service account, and grant it G Suite domain-wide delegation. Have the application use it to impersonate the user.
  • D. Use a dedicated G Suite Admin account, and authenticate the application's operations with these G Suite credentials.

正解：A


質問 # 83
A customer is running an analytics workload on Google Cloud Platform (GCP) where Compute Engine instances are accessing data stored on Cloud Storage. Your team wants to make sure that this workload will not be able to access, or be accessed from, the internet.
Which two strategies should your team use to meet these requirements? (Choose two.)

  • A. Make sure that the Compute Engine cluster is running on a separate subnet.
  • B. Configure a Cloud NAT gateway.
  • C. Turn off IP forwarding on the Compute Engine instances in the cluster.
  • D. Avoid assigning public IP addresses to the Compute Engine cluster.
  • E. Configure Private Google Access on the Compute Engine subnet

正解：D、E

解説：
* Objective: Ensure that the analytics workload on Compute Engine instances accessing Cloud Storage does not interact with the public internet.
* Solution:
* Private Google Access: This allows Compute Engine instances that only have internal IP addresses to reach Google APIs and services through a private connection without the need for a public IP address.
* No Public IP Addresses: By avoiding public IP addresses for the instances, you ensure that they are not accessible from the internet and do not initiate internet connections.
Steps:
* Step 1: Open the Google Cloud Console.
* Step 2: Navigate to the VPC Network page and select the subnet where the Compute Engine instances are located.
* Step 3: Enable Private Google Access for the subnet.
* Step 4: Ensure that when launching the Compute Engine instances, no public IP addresses are assigned to them.
References:
* Configuring Private Google Access
* Preventing External IP Address Assignment


質問 # 84
A Cloud Development team needs to use service accounts extensively in their local development.
You need to provide the team with the keys for these service accounts. You want to follow Google-recommended practices. What should you do?

  • A. Create a Google Group with all developers. Assign the group the IAM role of Service Account User, and have developers generate and download their own keys.
  • B. Implement a daily key rotation process that generates a new key and commits it to the source code repository every day.
  • C. Create a Google Group with all developers. Assign the group the IAM role of Service Account Admin, and have developers generate and download their own keys.
  • D. Implement a daily key rotation process, and provide developers with a Cloud Storage bucket from which they can download the new key every day.

正解：D

解説：
A is not correct because source code repository isn't the place to store keys that expire/change.
B is correct because it allows for centralized admin managed key rotation process and doesn't delegate key creation to developers which is easier and secure way to manage keys.
C is not correct because the IAM role specified doesn't allow for creation of keys.
D is not correct because it veers away from best practices as the keys now reside in decentralized place and can be subjected to a leak.
https://cloud.google.com/blog/products/gcp/help-keep-your-google-cloud-service-account-keys-safe
https://cloud.google.com/iam/docs/understanding-service-accounts#best_practices
https://cloud.google.com/iam/docs/creating-managing-service-account-keys


質問 # 85
A company is running workloads in a dedicated server room. They must only be accessed from within the private company network. You need to connect to these workloads from Compute Engine instances within a Google Cloud Platform project.
Which two approaches can you take to meet the requirements? (Choose two.)

  • A. Configure the project with Cloud VPN.
  • B. Configure the project with VPC peering.
  • C. Configure the project with Shared VPC.
  • D. Configure all Compute Engine instances with Private Access.
  • E. Configure the project with Cloud Interconnect.

正解：B、D

解説：
https://cloud.google.com/solutions/secure-data-workloads-use-cases


質問 # 86
An organization is starting to move its infrastructure from its on-premises environment to Google Cloud Platform (GCP). The first step the organization wants to take is to migrate its current data backup and disaster recovery solutions to GCP for later analysis. The organization's production environment will remain on- premises for an indefinite time. The organization wants a scalable and cost-efficient solution.
Which GCP solution should the organization use?

  • A. Cloud Storage using a scheduled task and gsutil
  • B. Compute Engine Virtual Machines using Persistent Disk
  • C. Cloud Datastore using regularly scheduled batch upload jobs
  • D. BigQuery using a data pipeline job with continuous updates

正解：A

解説：
To migrate the current data backup and disaster recovery solutions to GCP while keeping the production environment on-premises, the most scalable and cost-efficient solution is using Google Cloud Storage with scheduled tasks and the gsutil command.
Setup Cloud Storage: Create a Cloud Storage bucket to store the backups.
Go to the Cloud Console and navigate to Cloud Storage.
Click "Create bucket" and follow the prompts to configure the storage bucket.
Install gsutil: Ensure gsutil is installed on the on-premises servers.
gsutil is a command-line tool for interacting with Cloud Storage.
Follow the installation guide here.
Create Backup Script: Write a script to upload data to Cloud Storage using gsutil.
#!/bin/bash gsutil -m cp -r /path/to/local/backup gs://your-bucket-name Schedule Backup Task: Use a scheduling tool like cron on Linux to run the backup script at regular intervals.
Edit the crontab file with crontab -e and add an entry like:
Cloud Storage Documentation
gsutil Documentation


質問 # 87
A company has been running their application on Compute Engine. A bug in the application allowed a malicious user to repeatedly execute a script that results in the Compute Engine instance crashing. Although the bug has been fixed, you want to get notified in case this hack re-occurs.
What should you do?

  • A. Log every execution of the script to Stackdriver Logging. Configure BigQuery as a log sink, and create a BigQuery scheduled query to count the number of executions in a specific timeframe.
  • B. Create an Alerting Policy in Stackdriver using the CPU usage metric. Set the threshold to 80% to be notified when the CPU usage goes above this 80%.
  • C. Log every execution of the script to Stackdriver Logging. Create a User-defined metric in Stackdriver Logging on the logs, and create a Stackdriver Dashboard displaying the metric.
  • D. Create an Alerting Policy in Stackdriver using a Process Health condition, checking that the number of executions of the script remains below the desired threshold. Enable notifications.

正解：B


質問 # 88
An employer wants to track how bonus compensations have changed over time to identify employee outliers and correct earning disparities. This task must be performed without exposing the sensitive compensation data for any individual and must be reversible to identify the outlier.
Which Cloud Data Loss Prevention API technique should you use to accomplish this?

  • A. CryptoHashConfig
  • B. Generalization
  • C. CryptoReplaceFfxFpeConfig
  • D. Redaction

正解：B

解説：
By bucketing or generalizing, we achieve a reversible pseudonymised data that can still yield the required analysis. https://cloud.google.com/dlp/docs/concepts-bucketing


質問 # 89
You have created an OS image that is hardened per your organization's security standards and is being stored in a project managed by the security team. As a Google Cloud administrator, you need to make sure all VMs in your Google Cloud organization can only use that specific OS image while minimizing operational overhead. What should you do? (Choose two.)

  • A. Grant users the compuce.imageUser role in their own projects.
  • B. Remove VM instance creation permission from users of the projects, and only allow you and your team to create VM instances.
  • C. Store the image in every project that is spun up in your organization.
  • D. Set up an image access organization policy constraint, and list the security team managed project in the project's allow list.
  • E. Grant users the compuce.imageUser role in the OS image project.

正解：A、D


質問 # 90
You work for a healthcare provider that is expanding into the cloud to store and process sensitive patient data. You must ensure the chosen Google Cloud configuration meets these strict regulatory requirements:
- Data must reside within specific geographic regions.
- Certain administrative actions on patient data require explicit
approval from designated compliance officers.
- Access to patient data must be auditable.
What should you do?

  • A. Select multiple standard Google Cloud regions for high availability. Implement Access Control Lists (ACLs) on individual storage objects containing patient data. Enable Cloud Audit Logs.
  • B. Select a standard Google Cloud region. Restrict access to patient data based on user location and job function by using Access Context Manager. Enable both Cloud Audit Logging and Access Transparency.
  • C. Deploy an Assured Workloads environment in multiple regions for redundancy. Utilize custom IAM roles with granular permissions. Isolate network-level data by using VPC Service Controls.
  • D. Deploy an Assured Workloads environment in an approved region. Configure Access Approval for sensitive operations on patient data. Enable both Cloud Audit Logs and Access Transparency.

正解：D

解説：
https://cloud.google.com/assured-workloads/docs/overview


質問 # 91
When creating a secure container image, which two items should you incorporate into the build if possible?
(Choose two.)

  • A. Remove any unnecessary tools not needed by the app.
  • B. Ensure that the app does not run as PID 1.
  • C. Use public container images as a base image for the app.
  • D. Package a single app as a container.
  • E. Use many container image layers to hide sensitive information.

正解：A、D


質問 # 92
After completing a security vulnerability assessment, you learned that cloud administrators leave Google Cloud CLI sessions open for days. You need to reduce the risk of attackers who might exploit these open sessions by setting these sessions to the minimum duration.
What should you do?

  • A. Set the organization policy constraint constraints/iam. serviceAccountKeyExpiryHours to one hour and inheritFromParent to false.
  • B. Set the session duration for the Google session control to one hour.
  • C. Set the organization policy constraint
    constraints/iam.allowServiceAccountCredentialLifetimeExtension to one hour.
  • D. Set the reauthentication frequency (or the Google Cloud Session Control to one hour.

正解：D

解説：
To mitigate the risk posed by long-running Google Cloud CLI sessions, it is essential to enforce a reauthentication frequency. This ensures that users must periodically reauthenticate, reducing the window of opportunity for an attacker to exploit an open session. Setting the reauthentication frequency to one hour forces users to reauthenticate after this period, thereby limiting the duration an attacker can use a compromised session.
Access Google Cloud Console: Log in to your Google Cloud Console using your admin credentials.
Navigate to Security Settings: Go to the "Security" section of the Cloud Console.
Set Session Control: Under the session management settings, locate the "Reauthentication frequency" setting. This controls how often users must reauthenticate.
Configure Reauthentication Frequency: Set the reauthentication frequency to "1 hour". This configuration will force users to reauthenticate every hour, thus limiting the duration of each session.
Save Changes: Confirm and save your changes. This setting will now apply to all users, ensuring that open sessions are minimized to a duration of one hour.
Reference:
Google Cloud IAM Documentation
Google Cloud Security Best Practices


質問 # 93
You want to evaluate GCP for PCI compliance. You need to identify Google's inherent controls.
Which document should you review to find the information?

  • A. PCI SSC Cloud Computing Guidelines
  • B. PCI DSS Requirements and Security Assessment Procedures
  • C. Google Cloud Platform: Customer Responsibility Matrix
  • D. Product documentation for Compute Engine

正解：A

解説：
Reference:
https://cloud.google.com/solutions/pci-dss-compliance-in-gcp


質問 # 94
An engineering team is launching a web application that will be public on the internet. The web application is hosted in multiple GCP regions and will be directed to the respective backend based on the URL request.
Your team wants to avoid exposing the application directly on the internet and wants to deny traffic from a specific list of malicious IP addresses Which solution should your team implement to meet these requirements?

  • A. Network Load Balancing
  • B. NAT Gateway
  • C. SSL Proxy Load Balancing
  • D. Cloud Armor

正解：D


質問 # 95
Which two security characteristics are related to the use of VPC peering to connect two VPC networks? (Choose two.)

  • A. Ability to share specific subnets across peered networks
  • B. Central management of routes, firewalls, and VPNs for peered networks
  • C. Non-transitive peered networks; where only directly peered networks can communicate
  • D. Firewall rules that can be created with a tag from one peered network to another peered network
  • E. Ability to peer networks that belong to different Google Cloud Platform organizations

正解：C、E

解説：
Objective: Understand the security characteristics of VPC peering.
Security Characteristics:
Non-transitive Peering: VPC peering connections are non-transitive. This means that peering is strictly between two VPC networks. If VPC A is peered with VPC B, and VPC B is peered with VPC C, VPC A cannot communicate with VPC C unless a direct peering connection is established.
Inter-Organization Peering: VPC peering allows you to connect VPC networks across different Google Cloud Platform organizations, facilitating private communication between distinct organizational units.
These characteristics ensure controlled and secure connectivity between VPC networks while preventing unintended data exposure.
Reference:
GCP VPC Peering Documentation
VPC Network Peering Overview


質問 # 96
You are a member of the security team at an organization. Your team has a single GCP project with credit card payment processing systems alongside web applications and data processing systems. You want to reduce the scope of systems subject to PCI audit standards.
What should you do?

  • A. Use only applications certified compliant with PA-DSS.
  • B. Use multi-factor authentication for admin access to the web application.
  • C. Use VPN for all connections between your office and cloud environments.
  • D. Move the cardholder data environment into a separate GCP project.

正解：C

解説：
Explanation/Reference: https://cloud.google.com/solutions/pci-dss-compliance-in-gcp


質問 # 97
When working with agents in a support center via online chat, an organization's customers often share pictures of their documents with personally identifiable information (PII). The organization that owns the support center is concerned that the PII is being stored in their databases as part of the regular chat logs they retain for review by internal or external analysts for customer service trend analysis.
Which Google Cloud solution should the organization use to help resolve this concern for the customer while still maintaining data utility?

  • A. Use Cloud Key Management Service (KMS) to encrypt the PII data shared by customers before storing it for analysis.
  • B. Use Object Lifecycle Management to make sure that all chat records with PII in them are discarded and not saved for analysis.
  • C. Use the generalization and bucketing actions of the DLP API solution to redact PII from the texts before storing them for analysis.
  • D. Use the image inspection and redaction actions of the DLP API to redact PII from the images before storing them for analysis.

正解：C

解説：
Reference:
https://cloud.google.com/dlp/docs/deidentify-sensitive-data


質問 # 98
In an effort for your company messaging app to comply with FIPS 140-2, a decision was made to use GCP compute and network services. The messaging app architecture includes a Managed Instance Group (MIG) that controls a cluster of Compute Engine instances. The instances use Local SSDs for data caching and UDP for instance-to-instance communications. The app development team is willing to make any changes necessary to comply with the standard Which options should you recommend to meet the requirements?

  • A. Encrypt all cache storage and VM-to-VM communication using the BoringCrypto module.
  • B. Set Disk Encryption on the Instance Template used by the MIG to customer-managed key and use BoringSSL for all data transit between instances.
  • C. Set Disk Encryption on the Instance Template used by the MIG to Google-managed Key and use BoringSSL library on all instance-to-instance communications.
  • D. Change the app instance-to-instance communications from UDP to TCP and enable BoringSSL on clients' TLS connections.

正解：B

解説：
To comply with FIPS 140-2 for the messaging app, you need to ensure that both data at rest and data in transit are encrypted according to the standard. Using customer-managed encryption keys (CMEK) ensures that you have control over the encryption keys, and BoringSSL is a library that meets FIPS 140-2 standards for encrypting data in transit.
Steps:
* Encrypt Local SSDs: Modify the instance template for the Managed Instance Group (MIG) to use customer-managed encryption keys (CMEK) for encrypting Local SSDs.
* Enable BoringSSL: Update the application to use the BoringSSL library for all instance-to-instance communication to ensure that all data in transit is encrypted according to FIPS 140-2 standards.
References:
* Google Cloud: Customer-managed encryption keys (CMEK)
* BoringSSL documentation


質問 # 99
Your security team wants to reduce the risk of user-managed keys being mismanaged and compromised. To achieve this, you need to prevent developers from creating user-managed service account keys for projects in their organization. How should you enforce this?

  • A. Enable an organization policy to disable service accounts from being created.
  • B. Configure Secret Manager to manage service account keys.
  • C. Remove the iam.serviceAccounts.getAccessToken permission from users.
  • D. Enable an organization policy to prevent service account keys from being created.

正解：D

解説：
To prevent developers from creating user-managed service account keys and reduce the risk of key mismanagement, you should enable an organization policy that specifically prohibits the creation of these keys.
* Enable an organization policy to prevent service account keys from being created (C):
* Google Cloud provides the capability to enforce organizational policies that restrict various actions, including the creation of service account keys. By enabling this policy, you ensure that developers cannot create new user-managed service account keys, thus minimizing the risk of key mismanagement and potential security breaches.
References
* Service Accounts documentation
* Organization Policy Service documentation


質問 # 100
......


この試験は、複数選択と複数選択の質問で構成されており、2時間の期間があります。候補者は、試験を受ける前に、Google Cloudプラットフォームでソリューションを設計および管理するために、少なくとも3年間の業界経験があり、少なくとも1年間の経験を持っていることをお勧めします。試験料は200ドルで、リモートまたはテストセンターで取得できます。


Google Professional-Cloud-Security-Engineerの認定試験は、Google Cloud Platform（GCP）環境内でアプリケーションとデータを保護する知識とスキルを評価するように設計されています。この認定は、GCP上でセキュリティソリューションを実装および管理する経験を持つセキュリティ専門家を対象としています。


この試験では、セキュリティマネジメント、データ保護、ネットワークセキュリティ、コンプライアンス、インシデントマネジメントなど、クラウドセキュリティに関連する広範囲のトピックがカバーされます。候補者は、GCPが提供するセキュリティ機能や機能性に深い理解を持ち、これらの機能をどのように構成し、管理するかを知っていることが期待されています。また、この試験は、業界のベストプラクティスを使用して、GCPで安全なソリューションを設計および実装する能力もテストします。

 

Google Professional-Cloud-Security-Engineerリアル2026年最新のブレーン問題集模擬試験問題集：https://www.goshiken.com/Google/Professional-Cloud-Security-Engineer-mondaishu.html

最新Professional-Cloud-Security-Engineer試験問題集で最近更新された320問題：https://drive.google.com/open?id=10bNFat8x81fQtZtXSiOM2V_wSm-HdlgW

関するブログ

もっと
Professional-Cloud-Security-Engineer無料問題集