Can you secure and monitor a Google Cloud organization? These practice tests check the knowledge a security operations engineer uses every day: controlling identities and access, protecting networks and data, collecting and keeping audit logs, and finding and responding to threats with Security Command Center.

You get 4 practice tests with 160 questions in total (40, 40, 40, 40). Every question was checked twice before release: once by the author against the official documentation, and once by an independent reviewer who answered it blind - any disagreement was settled with a source.

What makes the explanations useful

Each answer tells you why the right option is right and why each wrong option is wrong. The wrong options are real features, commands and settings that are easy to pick by mistake - that is where most of the learning is.

How the tests are built

• Practice Test 1: Identity, Access and Governance: Cloud Identity, 2-Step Verification, GCDS, IAM roles and custom roles, service accounts, Workload Identity Federation, IAM Conditions, the resource hierarchy, organization policies and shared responsibility.
• Practice Test 2: Network and Data Protection: VPC design, firewall rules and hierarchical firewall policies, Cloud DNS, load balancing, IAP, Cloud Armor, VPC Service Controls, Cloud KMS, CMEK and EKM, Sensitive Data Protection and Secret Manager.
• Practice Test 3: Logging, Detection and Workload Security: Cloud Audit Logs, log buckets and sinks, Cloud Asset Inventory, Security Command Center and its threat detection services, Shielded VMs, GKE security and Binary Authorization.
• Practice Test 4: Full Mock Exam: a mixed exam across all three areas - take it last, in one sitting.

Questions use single-answer and multiple-answer formats; the number of answers to pick is always stated. Suggested time: 60 minutes per test.

Versions: Google Cloud security services: Cloud Identity, IAM (roles, service accounts, Workload Identity Federation, IAM Conditions, Policy Intelligence), Organization Policy Service, VPC firewall rules and hierarchical firewall policies, Cloud DNS, Cloud Load Balancing, Cloud Armor, Identity-Aware Proxy, VPC Service Controls, Cloud KMS (Cloud HSM, Cloud EKM, Autokey), Sensitive Data Protection, Secret Manager, Cloud Logging and Cloud Audit Logs, Cloud Asset Inventory, Security Command Center (Standard, Premium, Enterprise) with Event, Container and VM Threat Detection, Shielded and Confidential VMs, GKE, Binary Authorization and Artifact Analysis, as of October 2026.

Please note: these are original practice questions written by an instructor. This course is not affiliated with or endorsed by Google Cloud; Google Cloud and Security Command Center are Google trademarks.