Professional Cloud Security Engineer: What the Five Domains Expect You to Have Built
Two hours, 50-60 questions, $200, and three years of industry experience assumed. This is a build-it exam - the questions describe a boundary you were supposed to have designed, and ask which control enforces it.
- 50-60Questions
- 120 minTime
- $200Cost
- 2 yearsValid
Table of Contents
The Google Cloud Professional Cloud Security Engineer paper is 50-60 questions in 120 minutes and costs $200. Five domains and no published weights. Boundary protection and data protection carry the most distinctive Google-specific content, which is where candidates from other clouds lose marks.
What follows is the question split by domain, then five practice questions written to Google Cloud’s published objectives, each with the reasoning for the right answer and for every wrong one. These are original practice items, not real exam content – the point is to show you how the questions are shaped and where the traps sit.
How the 50-60 questions split
Google Cloud lists the exam sections but does not publish percentage weights for this exam, so nobody can tell you an exact question count per domain. The honest version is below: the sections, and what an even split across a 55-question paper would look like.
| Domain | Weight | If even | |
|---|---|---|---|
| Configure access | not published | ~11 | |
| Secure communications and establish boundary protection | not published | ~11 | |
| Ensure data protection | not published | ~11 | |
| Manage operations | not published | ~11 | |
| Support compliance requirements | not published | ~11 |
Be sceptical of precise weightings. Sites quoting exact percentages for this exam are inventing them. Google Cloud has not published them, so revise the sections evenly and spend your extra time on whichever one you can least explain out loud.
Five practice questions
Answer each one before reading the key underneath it.
A project holds regulated data that must not be readable from outside a defined perimeter, even by an identity with valid IAM permissions. Which control enforces this?
- A An organisation policy blocking public IP addresses
- B VPC Service Controls, which create a service perimeter around the resources
- C A firewall rule denying egress to the internet
- D Removing the Editor role from all users
Answer: B
VPC Service Controls add a perimeter around managed services so that data cannot be read across the boundary even when IAM would otherwise allow it. That defence against credential misuse is exactly what the stem describes.
Why the others fail
A Blocking public IPs constrains instance networking and does nothing about API access to managed services.
C Firewall rules govern VPC network traffic, not access to Google-managed service APIs.
D Reducing roles is good hygiene, but the requirement explicitly survives a valid permission.
A compliance rule requires the organisation to control and be able to revoke the encryption keys protecting data at rest. What should be implemented?
- A Rely on Google-managed encryption, which is enabled by default
- B Customer-managed encryption keys in Cloud KMS applied to the resources
- C Disable encryption and store data in a private VPC
- D Encrypt the data with a password in the application before writing it
Answer: B
CMEK puts the key in Cloud KMS under the customer's control, so it can be rotated, disabled or destroyed - which is what a revocation requirement means in practice.
Why the others fail
A Default encryption is real but the keys are Google's, so the customer cannot revoke them.
C Disabling encryption fails the requirement outright, and a private network is not encryption at rest.
D An application password is not key management and provides no rotation, audit or revocation.
An auditor needs to see who did what across the organisation, with the record protected from tampering by project owners. What provides this?
- A Cloud Audit Logs, with admin activity logs written automatically and exported to a protected sink
- B Asking each project owner to keep a change log
- C Enabling debug logging on every service
- D VPC Flow Logs
Answer: A
Admin activity audit logs are written automatically and cannot be disabled, and exporting them to a sink outside the project's control preserves them independently of project owners.
Why the others fail
B A manual log depends on the goodwill of the people being audited.
C Debug logging captures application detail, not authoritative administrative actions.
D Flow logs record network traffic, not who changed a configuration.
The organisation must guarantee that no project anywhere can create a Cloud Storage bucket that is publicly accessible. What enforces that centrally?
- A A documented standard that developers agree to follow
- B An organisation policy constraint applied at the organisation node
- C A weekly script that scans buckets and reports violations
- D Per-project IAM roles removing storage admin from developers
Answer: B
Organisation policy constraints are preventive and inherit down the hierarchy, so a constraint set at the organisation node applies everywhere, including in projects created afterwards.
Why the others fail
A A standard is not an enforcement mechanism.
C A scan is detective. The bucket is public until someone acts on the report.
D Role removal is per project and repeats for every new project, and a sufficiently privileged user can still act.
A security team wants a single place to see misconfigurations and threats across all projects in the organisation. Which service is intended?
- A Cloud Monitoring dashboards per project
- B Security Command Center
- C Cloud Logging queries run manually each morning
- D Cloud Asset Inventory exports to a spreadsheet
Answer: B
Security Command Center is Google Cloud's central security posture and threat surface, aggregating findings across the organisation rather than per project.
Why the others fail
A Monitoring dashboards track performance and are scoped per project.
C Manual queries do not aggregate posture findings and do not scale.
D Asset Inventory lists resources; a spreadsheet export is not a findings surface.
What catches people out
- VPC Service Controls versus firewall rules versus organisation policy is the exam's favourite confusion. Perimeter around services, traffic within networks, and preventive constraint across the hierarchy - three different jobs.
- Preventive beats detective. When an option scans and reports and another prevents, the preventive control is almost always the intended answer.
- This credential is valid two years, not the three years on Google's associate exams.
- Google publishes no weights or pass mark. Cover all five domains rather than betting on one.
What it really costs to pass
The sticker price is $200, but that is the cost of passing first time. The number worth budgeting is different.
- First attempt: $200.
- Resit: Google Cloud does not publish a discounted resit alongside the headline fee, so budget a second full fee unless the official page says otherwise when you book.
- Renewal: the credential lasts 2 years, so the honest cost is the fee divided across that period, plus whatever renewal Google Cloud requires at the end of it.
- Your time: 120 minutes in the chair, and realistically several weeks of preparation before it. That is the largest cost on this list and the only one you cannot pay to avoid.
There is no published pass mark. Google Cloud does not publish one for this exam, so you cannot calculate how many mistakes you can afford. Prepare for a comfortable margin rather than aiming at a threshold nobody has stated.
Who should sit it: there are no formal prerequisites, though Google recommends 3+ years in industry and 1+ year on Google Cloud. Going in well under that bar is usually how people end up paying the fee twice.
How to prepare
A workable sequence for this exam, assuming you already work near the material:
- Read the official guide first. Everything on this page is secondary to what Google Cloud publishes at the link in the sidebar, and guides get revised.
- Work the heaviest domain until you can teach it. Use the table above to decide which one that is.
- Practise under the clock. 120 minutes for 50-60 questions is roughly 131 seconds each. Knowing the material and being able to apply it at that pace are different skills.
- Review every wrong answer to the level of the distractor. Being able to say why the other three options fail is what turns a 60% into a pass.
Frequently asked questions
How long is the Professional Cloud Security Engineer exam?
Two hours for 50 to 60 multiple-choice and multiple-select questions.
What does the Professional Cloud Security Engineer exam cost?
$200 plus tax where applicable.
What experience is recommended?
Three or more years of industry experience including at least one year designing and managing solutions on Google Cloud. There are no formal prerequisites.
Is there a published passing score?
No. Google does not publish a passing score or domain percentage weights for this exam.
Sources
Every figure on this page comes from the certifying body rather than a third-party summary:
- https://cloud.google.com/learn/certification/cloud-security-engineer
- https://services.google.com/fh/files/misc/professional_cloud_security_engineer_exam_guide_english.pdf
Checked September 2, 2026. Formats and fees change – confirm against Google Cloud before you pay for anything.