Google CloudProfessional level

Google Professional Data Engineer exam dumps: 279 free Google Professional Data Engineer practice questions

Free Google Professional Data Engineer practice questions for the Professional Data Engineer exam, with the correct answer and a full explanation for every option. Read the first 10 below, browse all 279 by number, or take a timed practice exam.

Question bank last updated December 2024

Start timed practice exam Browse all 279 questions

Free Google Professional Data Engineer practice questions

Questions 1 to 10 of 279

Pick an answer before you open the explanation. Each question also has its own page with a permalink.

Google Professional Data Engineer Question 1

Select 3Google Cloud Platform

You are designing a data pipeline in Google Cloud for a healthcare organization that must adhere to HIPAA compliance. Which of the following actions should you take to ensure the pipeline is both secure and compliant?

A
Enable Identity and Access Management (IAM) roles to control access to sensitive data.
B
Encrypt data in transit using SSL/TLS and at rest using Cloud Key Management Service (KMS).
C
Ensure data is stored in a single region to optimize performance rather than compliance.
D
Use VPC Service Controls to define service perimeters for your data pipeline.
E
Allow unrestricted public access to external APIs to facilitate data sharing with third parties.

Show answer and explanation

Correct answers: A, B, D

Explanation

To ensure HIPAA compliance and secure design for your data pipeline, you must implement robust access controls (IAM roles), encrypt data both in transit and at rest, and use VPC Service Controls to establish security perimeters. These measures protect sensitive healthcare data from unauthorized access and adhere to compliance standards. Avoid actions like allowing public access or prioritizing performance over security.

A. Correct.
Correct. IAM roles are essential for controlling access to data, ensuring that only authorized entities can access sensitive information, which aligns with HIPAA requirements.
B. Correct.
Correct. Encrypting data in transit and at rest is a fundamental security principle that ensures data confidentiality and integrity, meeting HIPAA compliance.
C. Incorrect.
Incorrect. Storing data in a single region is not necessarily a compliance requirement and prioritizes performance over security and compliance.
D. Correct.
Correct. VPC Service Controls add an additional layer of security by creating service perimeters to protect sensitive data from unauthorized access.
E. Incorrect.
Incorrect. Allowing unrestricted public access compromises data security and violates compliance standards like HIPAA, which require strict access controls.

Google Professional Data Engineer Question 2

Select 3Google Cloud Platform

You are designing a data pipeline that processes sensitive customer data for a financial institution using Google Cloud. To meet security and compliance requirements, you need to ensure data is encrypted both in transit and at rest, restrict access based on roles, and maintain an audit log of all access to the data. Which of the following approaches would best meet these requirements?

A
Use Cloud Storage with Customer-Managed Encryption Keys (CMEK) for storing data and enable audit logging.
B
Configure VPC Service Controls to restrict data movement across networks and secure sensitive resources.
C
Encrypt data only when it is at rest, as encryption in transit is handled automatically by Google Cloud services.
D
Use Identity and Access Management (IAM) to assign roles and permissions to users and services accessing the data.
E
Disable audit logging to improve the performance of the pipeline.

Show answer and explanation

Correct answers: A, B, D

Explanation

To design for security and compliance in this scenario, you must encrypt data both in transit and at rest, restrict access using IAM roles, and enable audit logging to track access. Additionally, VPC Service Controls provide an extra layer of security by restricting data movement across networks. Disabling audit logging or relying solely on encryption at rest does not meet compliance and security requirements.

A. Correct.
Using Cloud Storage with Customer-Managed Encryption Keys (CMEK) ensures that sensitive data is encrypted at rest, and enabling audit logging helps maintain a record of access for compliance purposes.
B. Correct.
Configuring VPC Service Controls helps prevent unauthorized data movement and enhances security by securing sensitive resources within a defined perimeter.
C. Incorrect.
Encrypting data only when at rest is insufficient because compliance often requires encryption both in transit and at rest. Google Cloud does handle encryption in transit, but this should not be ignored as part of the design.
D. Correct.
Using IAM to assign roles and permissions ensures that access to sensitive data is restricted based on the principle of least privilege, which is a critical security best practice.
E. Incorrect.
Disabling audit logging compromises compliance and security since you lose visibility into who accessed the data and when, which is essential for meeting regulatory requirements.

Google Professional Data Engineer Question 3

Select 3Google Cloud Platform

You are designing a data pipeline for a financial institution that handles sensitive customer information. The pipeline involves ingesting data into Google Cloud Storage, processing it with Dataflow, and storing the results in BigQuery. Which actions should you take to ensure the solution meets security and compliance requirements?

A
Enable Customer-Managed Encryption Keys (CMEK) for all storage and processing services.
B
Use a public bucket in Google Cloud Storage to share data with external partners.
C
Implement Identity and Access Management (IAM) policies to restrict access to data and resources.
D
Ensure all data in transit is encrypted using TLS.
E
Disable audit logging for the pipeline to optimize performance.

Show answer and explanation

Correct answers: A, C, D

Explanation

To design a secure and compliant data pipeline, you need to protect sensitive data at rest (e.g., using CMEK) and in transit (e.g., using TLS). Implementing IAM policies ensures only authorized access to resources, while audit logging enables tracking and compliance verification. Using a public bucket or disabling audit logging would compromise security and compliance.

A. Correct.
Enabling CMEK allows you to control the encryption keys used to protect your data, which is critical for meeting compliance requirements in industries like finance.
B. Incorrect.
Using a public bucket would expose sensitive customer data and violate security and compliance requirements.
C. Correct.
IAM policies are essential for ensuring that only authorized users and systems have access to sensitive data and resources.
D. Correct.
Encrypting data in transit using TLS ensures that the data remains secure while moving between services, which is a key compliance requirement.
E. Incorrect.
Disabling audit logging would prevent you from tracking access and changes to your resources, which is often a regulatory requirement in financial and other sensitive industries.

Google Professional Data Engineer Question 4

Single answerGoogle Cloud Platform

Your organization has recently adopted Google Cloud, and you are responsible for setting up access controls for a team of data analysts. The analysts need read-only access to BigQuery datasets in a specific project, but they should not have the ability to modify or delete the datasets. Additionally, an organization policy enforces strict adherence to the principle of least privilege. What is the best way to configure access for the data analysts?

A
Assign the 'BigQuery Admin' role at the project level to the data analysts.
B
Assign the 'BigQuery Data Viewer' role at the project level to the data analysts.
C
Assign the 'Viewer' role at the project level to the data analysts.
D
Assign the 'BigQuery Data Viewer' role at the dataset level to the data analysts.

Show answer and explanation

Correct answer: D

Explanation

To comply with the principle of least privilege, access should be granted at the most granular level necessary to fulfill the requirements. Assigning the 'BigQuery Data Viewer' role at the dataset level allows the data analysts to have read-only access to the required datasets without exposing other resources or granting unnecessary permissions.

A. Incorrect.
The 'BigQuery Admin' role grants full administrative access to BigQuery resources, including the ability to modify or delete datasets. This violates the principle of least privilege.
B. Incorrect.
The 'BigQuery Data Viewer' role at the project level allows read-only access to all datasets in the project. While it provides the needed read-only access, it exceeds the principle of least privilege by granting access to potentially unnecessary datasets.
C. Incorrect.
The 'Viewer' role at the project level grants read-only access to all resources in the project, not just BigQuery datasets. This violates the principle of least privilege.
D. Correct.
The 'BigQuery Data Viewer' role at the dataset level grants read-only access to specific datasets, adhering to the principle of least privilege and meeting the access requirements for the data analysts.

Google Professional Data Engineer Question 5

Select 2Google Cloud Platform

Your organization has a Google Cloud project where sensitive financial data is processed. You need to ensure that only a specific group of users can access this data and that any access attempt is logged for auditing purposes. Which combination of actions should you take to meet these requirements?

A
Assign the 'Owner' role to the specific group of users at the project level.
B
Use Cloud IAM to grant the 'Viewer' role to the specific group of users on the sensitive data resources.
C
Create a custom IAM role with the necessary permissions and assign it to the specific group of users.
D
Enable Audit Logs for the project and ensure 'Data Access' logs are included.
E
Apply an organization policy to restrict access to sensitive data resources to only the specific group of users.

Show answer and explanation

Correct answers: C, D

Explanation

To meet the requirements, you need to ensure the group has access only to sensitive financial data and that access attempts are logged. A custom IAM role provides the exact permissions required, adhering to the principle of least privilege. Enabling 'Data Access' logs ensures all access attempts are tracked for auditing. Other options either violate security best practices or do not fulfill the scenario requirements.

A. Incorrect.
Assigning the 'Owner' role at the project level gives users full administrative control over the project, including permissions they don't need for accessing sensitive financial data. This violates the principle of least privilege.
B. Incorrect.
The 'Viewer' role grants read-only access to resources, but it may also allow access to non-sensitive resources unintentionally. It is not fine-grained enough for sensitive data.
C. Correct.
Creating a custom IAM role with only the necessary permissions ensures that the specific group of users has the exact level of access required for sensitive data, following the principle of least privilege.
D. Correct.
Enabling Audit Logs and ensuring 'Data Access' logs are included allows you to track all access attempts to the sensitive data, which is essential for compliance and auditing purposes.
E. Incorrect.
Applying an organization policy can restrict access at a higher level, but this does not inherently grant permissions to the specific group. Instead, it enforces restrictions, which is not the requirement in this scenario.

Google Professional Data Engineer Question 6

Single answerGoogle Cloud Platform

Your company has a Google Cloud project that contains sensitive data stored in BigQuery. The security team has mandated that only members of the 'data-analyst' group should be able to query the data in BigQuery, and all other access should be denied. A new intern has joined the team and has been mistakenly granted the 'roles/bigquery.admin' role. What is the most effective way to ensure compliance with the security policy while still allowing the intern to perform their assigned tasks under supervision?

A
Use an organization policy to deny the 'roles/bigquery.admin' role to all users in the project.
B
Remove the 'roles/bigquery.admin' role from the intern and assign them the 'roles/bigquery.reader' role instead.
C
Use a conditional IAM policy to restrict the intern's access to specific datasets in BigQuery.
D
Create a custom role with only the necessary permissions for the intern and replace 'roles/bigquery.admin' with this custom role.

Show answer and explanation

Correct answer: D

Explanation

To comply with the security policy, it is crucial to limit access to only what is necessary for the intern to perform their tasks. The 'roles/bigquery.admin' role is overly permissive and goes against the principle of least privilege. By creating a custom role with only the required permissions, you can ensure the intern has access to what they need while maintaining compliance with the security policy and protecting sensitive data.

A. Incorrect.
Using an organization policy to deny the 'roles/bigquery.admin' role would unnecessarily restrict access for other legitimate users in the project who may need admin privileges.
B. Incorrect.
Simply removing the 'roles/bigquery.admin' role and assigning 'roles/bigquery.reader' may limit the intern's access too much, preventing them from performing their assigned tasks effectively.
C. Incorrect.
While using a conditional IAM policy could work, there are no guarantees that the intern will not accidentally gain access to more than necessary since the 'roles/bigquery.admin' role is overly permissive.
D. Correct.
Creating a custom role with only the specific permissions the intern requires is the most effective and secure way to ensure they have the access they need without violating the security policy.

Google Professional Data Engineer Question 7

Single answerGoogle Cloud Platform

You are designing a data pipeline on Google Cloud to process sensitive customer data. As part of the security requirements, you need to ensure that all stored data is encrypted and that encryption keys are managed in a way that allows you full control over them. Which approach should you choose to meet these requirements?

A
Use default Google-managed encryption for data at rest.
B
Use Customer-Managed Encryption Keys (CMEK) with Cloud Key Management Service (KMS).
C
Manually encrypt the data using an external encryption library before storing it in Google Cloud Storage.
D
Use Customer-Supplied Encryption Keys (CSEK) for encrypting data at rest.

Show answer and explanation

Correct answer: B

Explanation

Customer-Managed Encryption Keys (CMEK) with Cloud KMS is the best approach to meet the requirements of encrypting data and maintaining full control over the encryption keys. CMEK ensures that you have centralized control over your keys, including key rotation and access policies, while benefiting from integration with Google Cloud services. Other options either do not provide full control over the keys or introduce unnecessary complexity.

A. Incorrect.
Google-managed encryption is the default option in Google Cloud, but it does not provide full control over encryption keys as the keys are managed entirely by Google.
B. Correct.
Customer-Managed Encryption Keys (CMEK) with Cloud KMS allows you to use your own encryption keys stored in Google Cloud Key Management Service, giving you full control over key rotation and access policies.
C. Incorrect.
Manually encrypting data using an external library introduces operational complexity and is generally not recommended unless there are specific requirements that cannot be met with integrated Google Cloud encryption features.
D. Incorrect.
Customer-Supplied Encryption Keys (CSEK) allow you to supply your own keys, but they are not stored or managed by Google Cloud, making key management more complex and potentially less secure.

Google Professional Data Engineer Question 8

Single answerGoogle Cloud Platform

You are designing a data pipeline on Google Cloud that processes sensitive customer information. To meet regulatory compliance requirements, you need to ensure that the data is encrypted at rest and that the encryption keys are managed securely. Which approach would best meet these requirements?

A
Use Google Cloud Storage with default encryption and let Google manage the encryption keys.
B
Use Google Cloud Storage Customer-Managed Encryption Keys (CMEK) and store the keys in Cloud Key Management Service (Cloud KMS).
C
Use Google Cloud Storage and manually encrypt the data before uploading it, storing the encryption keys in a secure on-premises server.
D
Use Google Cloud Storage with default encryption, and periodically rotate the encryption keys manually.

Show answer and explanation

Correct answer: B

Explanation

Customer-Managed Encryption Keys (CMEK) with Cloud KMS is the best option because it provides strong encryption at rest and allows you to manage your encryption keys, meeting both security and regulatory compliance requirements. This approach strikes a balance between control over your keys and leveraging Google Cloud's built-in security features.

A. Incorrect.
Using Google Cloud Storage with default encryption relies on Google-managed encryption keys. While secure, it does not provide the level of key management required for regulatory compliance in many cases.
B. Correct.
Using Customer-Managed Encryption Keys (CMEK) with Cloud KMS allows you to control and manage your encryption keys while leveraging the security and scalability of Google Cloud. This approach meets the requirements for encryption at rest and secure key management.
C. Incorrect.
Manually encrypting the data before uploading it and storing the keys on-premises can be complex and error-prone. It also does not leverage the built-in security features of Google Cloud, making it harder to manage and audit.
D. Incorrect.
Default encryption with manual key rotation is not a supported approach in Google Cloud. Key rotation is automatically managed by Google in default encryption, and there is no manual rotation option.

Google Professional Data Engineer Question 9

Select 3Google Cloud Platform

You are designing a data pipeline in Google Cloud to process sensitive customer information. To comply with regulatory requirements, all data stored in Google Cloud Storage must be encrypted using a customer-managed encryption key (CMEK). Additionally, you need to ensure that unauthorized access to the encryption key is prevented. Which steps should you take to meet these requirements?

A
Enable CMEK for the Cloud Storage bucket and configure it to use a key stored in Cloud Key Management Service (Cloud KMS).
B
Grant 'roles/cloudkms.cryptoKeyEncrypterDecrypter' IAM role on the encryption key to the storage bucket's service account.
C
Restrict access to the encryption key by using IAM policies to allow only specific users or service accounts.
D
Disable default encryption on the Cloud Storage bucket, as it conflicts with CMEK.
E
Rotate the encryption key periodically in Cloud KMS to enhance security.

Show answer and explanation

Correct answers: A, C, E

Explanation

To meet data security requirements for sensitive customer information, you should use CMEK with Cloud KMS, restrict access to the encryption key using IAM policies, and periodically rotate the key to ensure compliance and enhance security. Granting too broad access to the encryption key or misunderstanding default encryption settings could lead to non-compliance or security risks.

A. Correct.
Correct: Enabling CMEK and using Cloud KMS for key management ensures that you meet the requirement for customer-managed encryption keys.
B. Incorrect.
Incorrect: Granting the 'roles/cloudkms.cryptoKeyEncrypterDecrypter' role to the storage bucket's service account would allow unauthorized services to access the key, which does not comply with the requirement to prevent unauthorized access.
C. Correct.
Correct: Restricting access to the encryption key using IAM policies ensures that only authorized users or services can manage or use the key.
D. Incorrect.
Incorrect: Default encryption does not conflict with CMEK; instead, CMEK overrides the default encryption settings when configured.
E. Correct.
Correct: Rotating the encryption key periodically is a best practice that enhances security and complies with many regulatory requirements.

Google Professional Data Engineer Question 10

Single answerGoogle Cloud Platform

Your organization stores sensitive customer data, including personally identifiable information (PII), in Google Cloud Storage. To ensure compliance with data privacy regulations, you have been tasked with identifying and redacting sensitive information from these files. Which approach would best meet this requirement using Google Cloud tools?

A
Use the Cloud Data Loss Prevention (DLP) API to scan and redact sensitive information from the files.
B
Enable encryption on the Cloud Storage bucket to automatically redact sensitive information.
C
Use Cloud Pub/Sub to identify and redact sensitive information in real-time.
D
Manually review and redact sensitive information from the files before uploading them to Cloud Storage.

Show answer and explanation

Correct answer: A

Explanation

The Cloud Data Loss Prevention (DLP) API is a purpose-built tool for detecting and managing sensitive data, including PII, in Google Cloud. It provides advanced capabilities to scan data in storage, identify sensitive elements, and take actions such as redaction or masking. This makes it the most appropriate solution for the scenario compared to other options.

A. Correct.
Correct. The Cloud Data Loss Prevention (DLP) API is specifically designed to detect, classify, and optionally redact sensitive information, such as PII, from structured and unstructured data stored in Google Cloud.
B. Incorrect.
Incorrect. Encryption ensures data security during storage and transmission but does not identify or redact sensitive information from the files.
C. Incorrect.
Incorrect. Cloud Pub/Sub is a messaging service and does not have any built-in capabilities to identify or redact sensitive information.
D. Incorrect.
Incorrect. Manual review is not scalable, prone to errors, and inefficient, especially when dealing with large amounts of data.

Timed practice exam

Take a Google Professional Data Engineer practice test under exam conditions

60 questions in 120 minutes, drawn from this bank, with a score report and a per-question review when you finish.

Start timed exam

What the Google Professional Data Engineer exam covers

Official Professional Data Engineer exam domains and weightings.

Design Data Processing Systems
22% of exam
Ingest and Process Data
25% of exam
Store Data
20% of exam
Prepare and Use Data for Analysis
18% of exam
Maintain and Automate Data Workloads
15% of exam

All 279 Google Professional Data Engineer practice questions

Every question has a page with the answer and explanation. Numbers are stable, so you can bookmark or share them.

Google Professional Data Engineer exam dumps FAQ

Are these Google Professional Data Engineer dumps real exam questions?

No. These are original practice questions written to the Professional Data Engineer exam objectives, not questions copied from a live exam. Memorising leaked questions violates Google Cloud's candidate agreement and stops working the moment the question pool rotates. Use this bank to check your understanding of each domain and to find the topics you still need to study.

How many Google Professional Data Engineer practice questions are there?

279 questions, each with the correct answer, an explanation of the answer, and a note on why every other option is wrong. The first 10 are on this page and every question has its own page linked below.

Are the Google Professional Data Engineer exam dumps free?

Yes. Every question, answer and explanation on this page and the linked question pages is free to read without an account. A free HydraNode account adds timed practice exams, scoring and progress tracking across attempts.

How do I take a timed Google Professional Data Engineer practice test?

Sign in and start the Professional Data Engineer exam on HydraNode. A session gives you 60 questions drawn from this bank in 120 minutes, then a score report with a per-question review.

What topics does the Google Professional Data Engineer exam cover?

The official exam domains are: Design Data Processing Systems; Ingest and Process Data; Store Data; Prepare and Use Data for Analysis; Maintain and Automate Data Workloads.

More Google Cloud exam dumps

All Google Cloud exams

375 questions

Google Associate Cloud Engineer exam dumps

Associate Cloud Engineer

259 questions

Google Professional Cloud Database Engineer exam dumps

Professional Cloud Database Engineer

268 questions

Google Professional Cloud DevOps Engineer exam dumps

Professional Cloud DevOps Engineer

481 questions

Google Professional Cloud Developer exam dumps

Professional Cloud Developer

790 questions

Google Professional Cloud Network Engineer exam dumps

Professional Cloud Network Engineer

501 questions

Google Professional Cloud Security Engineer exam dumps

Professional Cloud Security Engineer

522 questions

Google Professional Machine Learning Engineer exam dumps

Professional Machine Learning Engineer