Google Cloud Professional Security Network DevOps Engineer - Security GKE CICD SRE Networking

By Chris Anderson · Updated May 25, 2026

Questions25
Passing Score70%
Format100% Multiple Choice
Sessions Logged1,760
Your progressLog in / Register to track times taken, best score, questions mastered, and coverage on this quiz.
Rating
4.5 (38)

Topics covered

This quiz

Uncategorized25 (100%)

Uncategorized25 questions

Browse more · Report this quiz

Question catalog for this preview

Catalog listing of the 5 preview questions for this quiz.

Question 1

A Kubernetes deployment on GKE stores database passwords as environment variables hardcoded in the container image. A security audit flags this as a critical vulnerability. What is the recommended remediation?

Answer choices

  • A. Encrypt the environment variables using Cloud KMS in the Dockerfile

  • B. Use Kubernetes Secrets (or Google Secret Manager with Workload Identity) to inject credentials at runtime

  • C. Move the password to a ConfigMap for centralized management

  • D. Use a private container registry to prevent image inspection

Question 2

An SRE team uses error budgets. Their SLO is 99.5% availability over a 30-day period. After 15 days, they've used 80% of their monthly error budget. Which SRE action is most appropriate?

Answer choices

  • A. Immediately freeze all production deployments and focus on reliability work

  • B. Continue normal operations — 20% budget remains and the month isn't over

  • C. Lower the SLO to 99% to regain budget

  • D. Disable monitoring alerts to prevent further budget consumption

Question 3

A cloud network engineer implements Cloud NAT for a private subnet. After configuration, VMs can reach the internet but the engineer notices some long-lived connections (database backups) are being dropped. What should be adjusted?

Answer choices

  • A. Increase the minimum ports per VM in the Cloud NAT configuration

  • B. Increase the TCP established connection idle timeout in Cloud NAT

  • C. Change the Cloud NAT to a static NAT configuration

  • D. Disable Cloud NAT and use external IPs instead

Question 4

A company's GKE cluster was recently updated and pods are failing to pull images from Artifact Registry. The error shows `Failed to pull image: unauthorized`. What is the most likely cause?

Answer choices

  • A. Artifact Registry API is not enabled

  • B. The GKE node service account lacks `roles/artifactregistry.reader` on the registry

  • C. The container image tag is invalid

  • D. The Artifact Registry repository is in a different GCP project

Question 5

A security engineer needs to ensure that service account keys are never created manually by any user in the organization. Which control prevents this?

Answer choices

  • A. IAM deny policy on `iam.serviceAccountKeys.create`

  • B. Organization Policy constraint `constraints/iam.disableServiceAccountKeyCreation`

  • C. Cloud Security Command Center threat detection

  • D. VPC Service Controls perimeter