Home Microsoft Exams Google Cloud Exams

Loading page

Curious about new developments and updates? Follow our social media.

Get a free certification question every week.

Microsoft Exams

AZ-104 Administrator
AZ-204 Developer
AZ-900 Fundamentals
All Microsoft Exams

Google Cloud Exams

Associate Data Practitioner
All Google Cloud Exams

Terms Privacy Cookies About Pricing

© 2026 StudyCerts. All rights reserved.

StudyCerts is an independent service and is not affiliated with, endorsed by, or sponsored by any certification body or cloud provider.

Loading page

Home
Google Cloud Exams
Professional Cloud Security Engineer
Continually monitoring and restricting configured APIs.
A security engineer needs to establish centralized detection…

Professional Cloud Security Engineer

Professional Cloud Security Engineer

Advanced

Prepare and test your skills

Description
Sample Question
Free Trial
Practice Test

Advanced

Prepare and test your skills

Description
Sample Question
Free Trial
Practice Test

Audit Monitor Api Policy Denials Alerts

Section: Continually monitoring and restricting configured APIs.

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

...

...

...

...

...

Explanations

...

View source documentation

Related questions

Keep the momentum going with these hand-picked practice scenarios

AdvancedProfessional Cloud Security Engineer

An enterprise is deploying confidential workloads onto Compute Engine instances within a custom VPC subnet that has no external IP addresses and no default internet gateway route. The security team has defined a VPC Service Controls (VPC-SC) perimeter protecting services such as Cloud Storage and BigQuery. To enforce strict perimeter boundaries and prevent data exfiltration, the architecture must satisfy these criteria: Compute Engine instances must communicate privately with Google APIs using internal routing. Instances must be blocked from sending requests to Google APIs and services that are not supported by VPC Service Controls. Network routes and DNS resolution within the VPC must guarantee that all API traffic resolves exclusively to the restricted VIP range. Which network and DNS configuration should the security engineer implement?

Continually monitoring and restricting configured APIs.

AdvancedProfessional Cloud Security Engineer

An enterprise organization is establishing perimeter security and API governance across its Google Cloud resource hierarchy. A security engineer must implement controls to meet the following requirements: Requirement 1: Prevent project owners in the Development folder from activating or consuming any unapproved Google Cloud APIs, ensuring only an explicit allowlist of authorized services (such as Compute Engine and Cloud Storage) can be used. Requirement 2: Secure external API keys used by backend web servers so that the keys can only be used from authorized server IP addresses and can only invoke the designated backend service API. Which combination of controls should the security engineer implement to satisfy these requirements?

Continually monitoring and restricting configured APIs.

AdvancedProfessional Cloud Security Engineer

A financial enterprise is subject to strict regulatory compliance mandates governing data residency, cryptographic boundary isolation, and access governance. The security team needs to enforce the following controls across their Google Cloud environment: Ensure that data analytics and storage services cannot provision unencrypted or default-encrypted resources. Restrict all Customer-Managed Encryption Keys (CMEK) to originate strictly from key rings located in authorized regulatory regions within a dedicated KMS host project. Maintain least privilege access by granting encryption/decryption capabilities only to the necessary Google-managed service identities. Which combination of controls and Organization Policies should the enterprise implement?

Mapping compliance requirements to Google Cloud services and security controls (e.g., network and access segmentation, audit log coverage).

AdvancedProfessional Cloud Security Engineer

An enterprise is architecting a high-throughput, low-latency transaction processing platform on Google Cloud using managed services such as Firestore in Datastore mode and Dataproc Metastore across the us multi-region. The security engineering team must establish a key management architecture that satisfies several operational and architectural requirements: Access and lifecycle control: The organization must maintain cryptographic key control, audit logging, and the ability to revoke keys independently of Google default encryption. Performance and latency: High-volume transactional read and write operations must not incur per-transaction cryptographic RPC overhead or latency degradation. High availability: Key resolution must support regional and multi-regional redundancy without depending on external infrastructure or off-cloud network links. Service integration: The keys must adhere to Google Cloud customer-managed encryption key (CMEK) location-matching constraints across regional and multi-regional deployments. Which cryptographic key management architecture should the organization implement to fulfill these requirements?

Determining when to use software and hardware keys

AdvancedProfessional Cloud Security Engineer

Two independent healthcare institutions want to collaborate by training a shared predictive machine learning model using their respective proprietary clinical datasets. The collaboration has the following strict security and governance requirements: Neither organization is permitted to expose raw data or cryptographic decryption keys to the other party. The infrastructure administrator executing the workload must not be able to view data in use in memory, access the underlying operating system, or extract intermediate computation states. Decryption keys stored in Cloud Key Management Service (Cloud KMS) must be released dynamically only after cryptographically verifying the identity, boot measurements, and container image digest of the executing workload. Which Google Cloud Confidential Computing solution should be implemented to support this multi-party collaboration?

Enabling Confidential Computing.

FundamentalAssociate Data Practitioner

LookML Sum Measure

Manipulate simple LookML parameters to modify a data model

Want more questions like this?

Get a free certification question every week.

Last updated August 28, 2026

Are you ready for the Professional Cloud Security Engineer?

50 questions in the full practice test

More Continually monitoring and restricting configured APIs. practice questions

Get a free certification question with a full explanation every week.

Professional Cloud Security Engineer

Provider: Google Cloud
Passing score: 70%
Questions: 50
Duration: 90 minutes

Other sections in this exam

Configuring access
Securing communications and establishing boundary protection
Ensuring data protection
Managing operations
Supporting compliance requirements

Ask Scout

Still curious? Scout, our AI tutor, can explain this concept further and answer your follow-up questions.

A security engineer needs to establish centralized detection and alerting across an enterprise Google Cloud organization for unauthorized API invocation attempts and policy violations blocked at the perimeter.

The solution must fulfill the following operational requirements:

Capture and distinguish between administrative configuration modifications and perimeter or policy denial events.
Enable automated near-real-time alerting in Cloud Monitoring when unauthorized or denied API invocation attempts spike across projects.
Ingest and centralize the required audit telemetry without incurring unexpected ingestion drop-offs due to default project settings.

Which configuration strategy should the engineer implement?

Configure an Istio AuthorizationPolicy with the AUDIT action inside Cloud Service Mesh on ingress gateways, and route the resulting envoy access logs directly to Cloud Monitoring using MQL alerting rules.

Aggregate organization-level Cloud Audit Logs for Admin Activity and Policy Denied logs (cloudaudit.googleapis.com%2Factivity and cloudaudit.googleapis.com%2Fpolicy) into a central project, create a logs-based metric filtered on policy denials and method calls, and attach a Cloud Monitoring alerting policy with notification channels.

Enable Data Access audit logs globally at the organization root, rely on the default _Default sink for storage in each individual project, and create project-level PromQL queries in Metrics Explorer to track cloudaudit.googleapis.com%2Fsystem_event.

Deploy the Google Cloud Ops Agent on all Compute Engine instances, configure a Prometheus endpoint to emit workload.googleapis.com metrics, and set up ActiveMQ integration alerting policies in Cloud Monitoring.

Configure an Istio AuthorizationPolicy with the AUDIT action inside Cloud Service Mesh on ingress gateways, and route the resulting envoy access logs directly to Cloud Monitoring using MQL alerting rules.

Aggregate organization-level Cloud Audit Logs for Admin Activity and Policy Denied logs (cloudaudit.googleapis.com%2Factivity and cloudaudit.googleapis.com%2Fpolicy) into a central project, create a logs-based metric filtered on policy denials and method calls, and attach a Cloud Monitoring alerting policy with notification channels.

What this solution is

This architecture centralizes organization-wide Cloud Audit Logs into a dedicated security logging project, establishes custom logs-based metrics targeting specific policy violation streams, and triggers automated alerts via Cloud Monitoring.

How it meets the requirements

Capturing administrative changes and perimeter denials: Cloud Audit Logs automatically records administrative actions in Admin Activity logs (cloudaudit.googleapis.com%2Factivity) and logs access blocks enforced by perimeter controls (such as VPC Service Controls and IAM) in Policy Denied logs (cloudaudit.googleapis.com%2Fpolicy).
Automated near-real-time alerting: Creating a user-defined logs-based counter metric on the aggregated Policy Denied log stream extracts counts of denied invocations. Cloud Monitoring evaluates these counts against defined threshold conditions and notifies on-call teams.
Centralized ingestion: An aggregated log sink defined at the organization root routes logs from all child folders and projects into a centralized log bucket, preventing disparate or dropped project-level auditing.

Key advantages

Immutability and default coverage: Admin Activity and Policy Denied audit logs are enabled by default and cannot be disabled by project owners, ensuring comprehensive tamper-resistant coverage.
Granular filter criteria: Logs include caller IP (RequestMetadata.caller_ip), method names (protoPayload.methodName), and resource identities, facilitating precise metric filtering.
Fast threat detection: Logs-based metrics populate time-series data immediately as log entries are ingested into Cloud Logging.

Enable Data Access audit logs globally at the organization root, rely on the default _Default sink for storage in each individual project, and create project-level PromQL queries in Metrics Explorer to track cloudaudit.googleapis.com%2Fsystem_event.

Deploy the Google Cloud Ops Agent on all Compute Engine instances, configure a Prometheus endpoint to emit workload.googleapis.com metrics, and set up ActiveMQ integration alerting policies in Cloud Monitoring.