[Mar 01, 2023] Professional-Cloud-Security-Engineer Exam Dumps - Google Practice Test Questions
New Real Professional-Cloud-Security-Engineer Exam Dumps Questions
Network Security Configuration
This domain is created to measure the expertise of the individuals in designing network security. This includes their knowledge of security properties of a VPC network, shared VPC, VPC peering, and firewall rules. The test takers should also be conversant with data encapsulation & network isolation for N tier application design, usage of DNSSEC, private versus public addressing, and app-to-app security policy. The section also covers one’s competency in configuring network segmentation, including an understanding of network perimeter controls as well as load balancing. Lastly, the candidates need to show their ability to establish private connectivity, including Private RFC1918 connectivity between Google Cloud projects and VPC networks, Private RFC1918 connectivity between the VPC network and data centers, as well as enabling private connectivity between Google APIs and VPC.
NEW QUESTION 68
You are troubleshooting access denied errors between Compute Engine instances connected to a Shared VPC and BigQuery datasets. The datasets reside in a project protected by a VPC Service Controls perimeter. What should you do?
- A. Create a perimeter bridge between the service project where the Compute Engine instances reside and the perimeter that contains the protected BigQuery datasets.
- B. Add the host project containing the Shared VPC to the service perimeter.
- C. Add the service project where the Compute Engine instances reside to the service perimeter.
- D. Create a service perimeter between the service project where the Compute Engine instances reside and the host project that contains the Shared VPC.
Answer: D
NEW QUESTION 69
Your security team wants to implement a defense-in-depth approach to protect sensitive data stored in a Cloud Storage bucket. Your team has the following requirements:
The Cloud Storage bucket in Project A can only be readable from Project B.
The Cloud Storage bucket in Project A cannot be accessed from outside the network.
Data in the Cloud Storage bucket cannot be copied to an external Cloud Storage bucket.
What should the security team do?
- A. Enable VPC Service Controls, create a perimeter around Projects A and B. and include the Cloud Storage API in the Service Perimeter configuration.
- B. Enable Private Access in both Project A and B's networks with strict firewall rules that allow communication between the networks.
- C. Enable domain restricted sharing in an organization policy, and enable uniform bucket-level access on the Cloud Storage bucket.
- D. Enable VPC Peering between Project A and B's networks with strict firewall rules that allow communication between the networks.
Answer: D
NEW QUESTION 70
You are tasked with exporting and auditing security logs for login activity events for Google Cloud console and API calls that modify configurations to Google Cloud resources. Your export must meet the following requirements:
Export related logs for all projects in the Google Cloud organization.
Export logs in near real-time to an external SIEM.
What should you do? (Choose two.)
- A. Enable Google Workspace audit logs to be shared with Google Cloud in the Admin Console.
- B. Enable Data Access audit logs at the organization level to apply to all projects.
- C. Create a Log Sink at the organization level with a Pub/Sub destination.
- D. Ensure that the SIEM processes the AuthenticationInfo field in the audit log entry to gather identity information.
- E. Create a Log Sink at the organization level with the includeChildren parameter, and set the destination to a Pub/Sub topic.
Answer: A,E
NEW QUESTION 71
Your company has deployed an application on Compute Engine. The application is accessible by clients on port 587. You need to balance the load between the different instances running the application. The connection should be secured using TLS, and terminated by the Load Balancer.
What type of Load Balancing should you use?
- A. HTTP(S) Load Balancing
- B. Network Load Balancing
- C. SSL Proxy Load Balancing
- D. TCP Proxy Load Balancing
Answer: C
Explanation:
Explanation/Reference: https://cloud.google.com/load-balancing/docs/ssl/
NEW QUESTION 72
Your team wants to make sure Compute Engine instances running in your production project do not have public IP addresses. The frontend application Compute Engine instances will require public IPs. The product engineers have the Editor role to modify resources. Your team wants to enforce this requirement.
How should your team meet these requirements?
- A. Set up a VPC network with two subnets: one with public IPs and one without public IPs.
- B. Enable Private Access on the VPC network in the production project.
- C. Set up an organization policy to only permit public IPs for the front-end Compute Engine instances.
- D. Remove the Editor role and grant the Compute Admin IAM role to the engineers.
Answer: C
Explanation:
Reference:
https://cloud.google.com/compute/docs/ip-addresses/reserve-static-external-ip-address
NEW QUESTION 73
An organization is starting to move its infrastructure from its on-premises environment to Google Cloud Platform (GCP). The first step the organization wants to take is to migrate its ongoing data backup and disaster recovery solutions to GCP. The organization's on-premises production environment is going to be the next phase for migration to GCP. Stable networking connectivity between the on-premises environment and GCP is also being implemented.
Which GCP solution should the organization use?
- A. BigQuery using a data pipeline job with continuous updates via Cloud VPN
- B. Cloud Datastore using regularly scheduled batch upload jobs via Cloud VPN
- C. Compute Engines Virtual Machines using Persistent Disk via Cloud Interconnect
- D. Cloud Storage using a scheduled task and gsutil via Cloud Interconnect
Answer: D
Explanation:
Explanation
https://cloud.google.com/solutions/dr-scenarios-for-data#production_environment_is_on-premises
https://medium.com/@pvergadia/cold-disaster-recovery-on-google-cloud-for-applications-running-on-premises-1
NEW QUESTION 74
Your team sets up a Shared VPC Network where project co-vpc-prod is the host project. Your team has configured the firewall rules, subnets, and VPN gateway on the host project. They need to enable Engineering Group A to attach a Compute Engine instance to only the 10.1.1.0/24 subnet.
What should your team grant to Engineering Group A to meet this requirement?
- A. Compute Network User Role at the subnet level.
- B. Compute Network User Role at the host project level.
- C. Compute Shared VPC Admin Role at the host project level.
- D. Compute Shared VPC Admin Role at the service project level.
Answer: C
Explanation:
https://cloud.google.com/vpc/docs/shared-vpc
NEW QUESTION 75
You plan to deploy your cloud infrastructure using a CI/CD cluster hosted on Compute Engine. You want to minimize the risk of its credentials being stolen by a third party. What should you do?
- A. Create a custom service account for the cluster Enable the constraints/iam.disableServiceAccountKeyCreation organization policy at the project level.
- B. Create a dedicated Cloud Identity user account for the cluster. Enable the constraints/iam.disableServiceAccountCreation organization policy at the project level.
- C. Create a custom service account for the cluster Enable the constraints/iam.allowServiceAccountCredentialLifetimeExtension organization policy at the project level.
- D. Create a dedicated Cloud Identity user account for the cluster. Use a strong self-hosted vault solution to store the user's temporary credentials.
Answer: A
Explanation:
Explanation
Disable service account key creation You can use the iam.disableServiceAccountKeyCreation boolean constraint to disable the creation of new external service account keys. This allows you to control the use of unmanaged long-term credentials for service accounts. When this constraint is set, user-managed credentials cannot be created for service accounts in projects affected by the constraint.
https://cloud.google.com/resource-manager/docs/organization-policy/restricting-service-accounts#example_polic
NEW QUESTION 76
An organization is starting to move its infrastructure from its on-premises environment to Google Cloud Platform (GCP). The first step the organization wants to take is to migrate its ongoing data backup and disaster recovery solutions to GCP. The organization's on-premises production environment is going to be the next phase for migration to GCP. Stable networking connectivity between the on-premises environment and GCP is also being implemented.
Which GCP solution should the organization use?
- A. BigQuery using a data pipeline job with continuous updates via Cloud VPN
- B. Cloud Datastore using regularly scheduled batch upload jobs via Cloud VPN
- C. Compute Engines Virtual Machines using Persistent Disk via Cloud Interconnect
- D. Cloud Storage using a scheduled task and gsutil via Cloud Interconnect
Answer: D
Explanation:
Explanation/Reference: https://cloud.google.com/solutions/migration-to-google-cloud-building-your-foundation
NEW QUESTION 77
A customer wants to deploy a large number of 3-tier web applications on Compute Engine.
How should the customer ensure authenticated network separation between the different tiers of the application?
- A. Run each tier with its own VM tags, and use tag-based firewall rules.
- B. Run each tier in its own subnet, and use subnet-based firewall rules.
- C. Run each tier in its own Project, and segregate using Project labels.
- D. Run each tier with a different Service Account (SA), and use SA-based firewall rules.
Answer: D
Explanation:
Explanation
"Isolate VMs using service accounts when possible" "even though it is possible to uses tags for target filtering in this manner, we recommend that you use service accounts where possible. Target tags are not access-controlled and can be changed by someone with the instanceAdmin role while VMs are in service.
Service accounts are access-controlled, meaning that a specific user must be explicitly authorized to use a service account. There can only be one service account per instance, whereas there can be multiple tags. Also, service accounts assigned to a VM can only be changed when the VM is stopped."
https://cloud.google.com/solutions/best-practices-vpc-design#isolate-vms-service-accounts
NEW QUESTION 78
Your team wants to limit users with administrative privileges at the organization level.
Which two roles should your team restrict? (Choose two.)
- A. Organization Administrator
- B. Super Admin
- C. Organization Role Viewer
- D. Compute Admin
- E. GKE Cluster Admin
Answer: A,B
NEW QUESTION 79
When creating a secure container image, which two items should you incorporate into the build if possible? (Choose two.)
- A. Ensure that the app does not run as PID 1.
- B. Remove any unnecessary tools not needed by the app.
- C. Use public container images as a base image for the app.
- D. Use many container image layers to hide sensitive information.
- E. Package a single app as a container.
Answer: B,E
Explanation:
Reference:
https://cloud.google.com/solutions/best-practices-for-building-containers
NEW QUESTION 80
As adoption of the Cloud Data Loss Prevention (DLP) API grows within the company, you need to optimize usage to reduce cost. DLP target data is stored in Cloud Storage and BigQuery. The location and region are identified as a suffix in the resource name.
Which cost reduction options should you recommend?
- A. Use rowsLimit and bytesLimitPerFile to sample data and use CloudStorageRegexFileSet to limit scans.
- B. Use FindingLimits and TimespanContfig to sample data and minimize transformation units.
- C. Set appropriate rowsLimit value on BigQuery data hosted outside the US and set appropriate bytesLimitPerFile value on multiregional Cloud Storage buckets.
- D. Set appropriate rowsLimit value on BigQuery data hosted outside the US, and minimize transformation units on multiregional Cloud Storage buckets.
Answer: A
Explanation:
https://cloud.google.com/dlp/docs/reference/rest/v2/InspectJobConfig
NEW QUESTION 81
Applications often require access to "secrets" - small pieces of sensitive data at build or run time. The administrator managing these secrets on GCP wants to keep a track of "who did what, where, and when?" within their GCP projects.
Which two log streams would provide the information that the administrator is looking for? (Choose two.)
- A. VPC Flow logs
- B. Data Access logs
- C. System Event logs
- D. Admin Activity logs
- E. Agent logs
Answer: B,D
Explanation:
Explanation
https://cloud.google.com/secret-manager/docs/audit-logging
NEW QUESTION 82
Your company runs a website that will store PII on Google Cloud Platform. To comply with data privacy regulations, this data can only be stored for a specific amount of time and must be fully deleted after this specific period. Data that has not yet reached the time period should not be deleted. You want to automate the process of complying with this regulation.
What should you do?
- A. Store the data in a single BigTable table and set an expiration time on the column families.
- B. Store the data in a single BigQuery table and set the appropriate table expiration time.
- C. Store the data in a single Persistent Disk, and delete the disk at expiration time.
- D. Store the data in a single Cloud Storage bucket and configure the bucket's Time to Live.
Answer: D
Explanation:
Explanation
"To support common use cases like setting a Time to Live (TTL) for objects, retaining noncurrent versions of objects, or "downgrading" storage classes of objects to help manage costs, Cloud Storage offers the Object Lifecycle Management feature. This page describes the feature as well as the options available when using it.
To learn how to enable Object Lifecycle Management, and for examples of lifecycle policies, see Managing Lifecycles." https://cloud.google.com/storage/docs/lifecycle
NEW QUESTION 83
......
Professional-Cloud-Security-Engineer Certification Exam Dumps Questions in here: https://drive.google.com/open?id=1HdKbBYp3bkGZP_W5PdpsvuMEG6viCQK0
Pass Your Professional-Cloud-Security-Engineer Exam Easily with Accurate PDF Questions: https://www.validvce.com/Professional-Cloud-Security-Engineer-exam-collection.html
