Professional Cloud Security Engineer Practice Test

What this test covers

One concept per question, across the topics Professional Cloud Security Engineer draws on.

• Attach a purpose-specific service account and grant only the role it needs
• Enforce at both build and admission so the control cannot be bypassed
• IAM conditions can bind access to time, resource names or other attributes
• Data access logs record reads and must be enabled deliberately
• Workload identity federation eliminates long-lived service account keys
• Custom roles exist for when no predefined role is narrow enough
• Secrets belong in a dedicated service with access control, versioning and audit
• Controlling the key is what enables cryptographic revocation of access
• Least privilege is both the narrowest role and the narrowest scope
• Data residency needs both correct placement and a preventative guardrail
• Separation of duties prevents a single identity holding conflicting powers
• Grant to groups so access follows role changes automatically
• Service perimeters address exfiltration by an authorised identity
• Detecting anomalous behaviour requires analysing activity logs, not configuration