PCSEGoogle Cloud Professional Cloud Security Engineer
What the exam covers
Study guide
From Google
About PCSE
Securing Google Cloud: identity and organisation policies, VPC Service Controls, Cloud Armor and firewall policies, KMS and CMEK, Sensitive Data Protection, Security Command Center and audit logging for compliance.
Who it's for. Security engineers protecting Google Cloud organisations.
How to prepare
- VPC Service Controls perimeters vs IAM is a classic: one stops data exfiltration, the other controls who can act.
- Know the key options: Google-managed keys, CMEK, CSEK, and Cloud External Key Manager.
- Organisation policy constraints are often the "prevent it everywhere" answer.
Sample PCSE questions
Try these with the answers on the page, then practise the full bank.
- Several pods on the same GKE node need different Cloud Storage permissions. Which feature lets each pod authenticate to Google Cloud APIs with its own IAM identity instead of the node's service account? Configuring access
- A research institute's security policy forbids any virtual machine in its Google Cloud organization from being assigned a public IP address. Which mechanism enforces this across all current and future projects? Securing communications and boundary protection
- A government agency must keep its encryption keys in its own on-premises key management system, and Google Cloud services must use those keys without the key material ever being stored in Google Cloud. Which option meets this requirement? Ensuring data protection
- Operators see unexplained CPU spikes on Compute Engine VMs and suspect cryptocurrency mining malware. They want detection that works without installing an agent on each VM. Which Security Command Center capability should they use? Managing operations and threat detection
- A media company needs to block requests that combine a particular header value, a URL path pattern and a specific country. Which Cloud Armor feature supports this kind of logic? Securing communications and boundary protection
- Every Compute Engine instance in a business unit's folder should authorize administrator logins through IAM roles, not through public keys stored in instance or project metadata. What is the most centralized way to enforce this? Configuring access
- A key administrator schedules a Cloud KMS key version for destruction and wants the most time possible to notice a mistake before the cryptographic material is removed. What is the longest pending window available? Ensuring data protection
- After a service account's key surfaced in a public repository, responders must list every project, folder, and bucket that the identity can reach, including access inherited from higher levels. Which tool gives them that view? Configuring access
- All 11 sample questions
Questions people ask
Is this PCSE practice exam free?
Yes. All 100 questions, the timed mock exam and the explanations are free, and there's no account to create.
Are these real exam questions?
No. Real exam questions are confidential under the Google Cloud candidate agreement. These are practice questions written to cover the same domains in the same scenario style, each with an explanation of why the answer is right.
How is the PCSE mock exam scored?
Questions are drawn from every domain in proportion to the exam guide, and you get a raw percentage with a breakdown by domain. Google Cloud uses scaled scoring, so treat 75% or more here as a sign you're ready rather than a predicted score.
Where is my progress saved?
In your browser, on this device. Nothing is sent to us apart from the answers you check, and clearing site data resets it.