Best Way To Study For Google Professional-Cloud-Security-Engineer Exam Brilliant Professional-Cloud-Security-Engineer Exam Questions PDF
Updated Verified Pass Professional-Cloud-Security-Engineer Exam - Real Questions and Answers
NEW QUESTION 59
While migrating your organization's infrastructure to GCP, a large number of users will need to access GCP Console. The Identity Management team already has a well-established way to manage your users and want to keep using your existing Active Directory or LDAP server along with the existing SSO password.
What should you do?
- A. Use Google Cloud Directory Sync to synchronize the data in Google domain with your existing Active Directory or LDAP server.
- B. Manually synchronize the data in Google domain with your existing Active Directory or LDAP server.
- C. Users sign in using OpenID (OIDC) compatible IdP, receive an authentication token, then use that token to log in to the GCP Console.
- D. Users sign in directly to the GCP Console using the credentials from your on-premises Kerberos compliant identity provider.
Answer: A
Explanation:
https://cloud.google.com/blog/products/identity-security/using-your-existing-identity-management- system-with-google-cloud-platform
NEW QUESTION 60
A customer needs to launch a 3-tier internal web application on Google Cloud Platform (GCP).
The customer's internal compliance requirements dictate that end-user access may only be allowed if the traffic seems to originate from a specific known good CIDR. The customer accepts the risk that their application will only have SYN flood DDoS protection. They want to use GCP's native SYN flood protection.
Which product should be used to meet these requirements?
- A. Cloud Identity and Access Management
- B. Cloud Armor
- C. Cloud CDN
- D. VPC Firewall Rules
Answer: B
Explanation:
https://cloud.google.com/blog/products/identity-security/understanding-google-cloud-armors-new- waf-capabilities
NEW QUESTION 61
You are responsible for protecting highly sensitive data in BigQuery. Your operations teams need access to this data, but given privacy regulations, you want to ensure that they cannot read the sensitive fields such as email addresses and first names. These specific sensitive fields should only be available on a need-to-know basis to the HR team. What should you do?
- A. Perform data redaction with the DLP API and store that data in BigQuery for later use.
- B. Perform data inspection with the DLP API and store that data in BigQuery for later use.
- C. Perform data masking with the DLP API and store that data in BigQuery for later use.
- D. Perform tokenization for Pseudonymization with the DLP API and store that data in BigQuery for later use.
Answer: B
NEW QUESTION 62
You need to set up a Cloud interconnect connection between your company's on-premises data center and VPC host network. You want to make sure that on-premises applications can only access Google APIs over the Cloud Interconnect and not through the public internet. You are required to only use APIs that are supported by VPC Service Controls to mitigate against exfiltration risk to non-supported APIs. How should you configure the network?
- A. Enable Private Google Access on the regional subnets and global dynamic routing mode.
- B. Set up a Private Service Connect endpoint IP address with the API bundle of "all-apis", which is advertised as a route over the Cloud interconnect connection.
- C. Use private.googleapis.com to access Google APIs using a set of IP addresses only routable from within Google Cloud, which are advertised as routes over the connection.
- D. Use restricted googleapis.com to access Google APIs using a set of IP addresses only routable from within Google Cloud, which are advertised as routes over the Cloud Interconnect connection.
Answer: B
NEW QUESTION 63
A security team at an e-commerce company wants to define an automatic incident response process for fraudulent credit card usage attempts. The team targets a 10-minute or faster response time for such incidents. The fraudulent card list is updated every 60 seconds. The e- commerce servers log the transaction details in near-real time. Which option should you recommend to the security team?
- A. Maintain a log ingestion exclusion filter based on the fraudulent credit card lists.
- B. Create a new logging export with a filter to match the transaction and a sink pointing to a Cloud Pub/Sub topic.
- C. Define a log-based metric for each fraudulent credit card, and set a Stackdriver alert for these metrics.
- D. Use AutoML to automatically build models based on the fraudulent credit card lists.
Answer: B
Explanation:
A is not correct because creating a metric for every credit card will not scale well.
B is not correct because it will exclude the transactions that are relevant to the security team.
C is not correct because while we could use AutoML to build models, this solution is incomplete without deploying and running the model, as well as wiring them up with some consumer service.
D is correct because this will capture the important events and pass them to Pub/Sub which in turn can send the message to a consumer service like a chat notification webhook.
https://cloud.google.com/logging/docs/export/configure_export_v2
NEW QUESTION 64
When working with agents in a support center via online chat, an organization's customers often share pictures of their documents with personally identifiable information (PII). The organization that owns the support center is concerned that the PII is being stored in their databases as part of the regular chat logs they retain for review by internal or external analysts for customer service trend analysis.
Which Google Cloud solution should the organization use to help resolve this concern for the customer while still maintaining data utility?
- A. Use the generalization and bucketing actions of the DLP API solution to redact PII from the texts before storing them for analysis.
- B. Use Cloud Key Management Service (KMS) to encrypt the PII data shared by customers before storing it for analysis.
- C. Use Object Lifecycle Management to make sure that all chat records with PII in them are discarded and not saved for analysis.
- D. Use the image inspection and redaction actions of the DLP API to redact PII from the images before storing them for analysis.
Answer: A
Explanation:
Explanation/Reference:
Reference; https://cloud.google.com/dlp/docs/deidentify-sensitive-data
NEW QUESTION 65
You have defined subnets in a VPC within Google Cloud Platform. You need multiple projects to create Compute Engine instances with IP addresses from these subnets. What should you do?
- A. Change the VPC subnets to enable private Google access.
- B. Use Shared VPC to share the subnets with the other projects.
- C. Set up VPC peering between all related projects.
- D. Configure Cloud VPN between the projects.
Answer: B
Explanation:
A is not correct as Cloud VPN between projects does not provide you the functionality to share a subnet to host resources on.
B is not correct because peering two VPCs does allow traffic between the two shared networks, but it's only bi-directional. Peered VPC networks remain administratively separate.
C is not correct because private Google access allows you to access APIs from a private IP, but it does not have any impact on creating Compute instances on a specific subnet.
D is correct because s Shared VPC allows you to share a VPC into multiple projects, keep administrative oversight in the host project, while restricting the other projects to only create VMs on IPs in the shared VPC.
https://cloud.google.com/vpc/docs/shared-vpc
https://cloud.google.com/vpc/docs/vpc-peering
NEW QUESTION 66
You want to limit the images that can be used as the source for boot disks. These images will be stored in a dedicated project.
What should you do?
- A. Use the Organization Policy Service to create a compute.trustedimageProjects constraint on the organization level. List the trusted project as the whitelist in an allow operation.
- B. In Resource Manager, edit the project permissions for the trusted project. Add the organization as member with the role: Compute Image User.
- C. Use the Organization Policy Service to create a compute.trustedimageProjects constraint on the organization level. List the trusted projects as the exceptions in a deny operation.
- D. In Resource Manager, edit the organization permissions. Add the project ID as member with the role:
Compute Image User.
Answer: C
Explanation:
https://cloud.google.com/compute/docs/images/restricting-image-access
NEW QUESTION 67
What are the steps to encrypt data using envelope encryption?
- A. Generate a key encryption key (KEK) locally.
Use the KEK to generate a data encryption key (DEK). Encrypt data with the DEK.
Store the encrypted data and the wrapped DEK. - B. Generate a data encryption key (DEK) locally.
Use a key encryption key (KEK) to wrap the DEK. Encrypt data with the KEK.
Store the encrypted data and the wrapped KEK. - C. Generate a key encryption key (KEK) locally.
Generate a data encryption key (DEK) locally. Encrypt data with the KEK.
Store the encrypted data and the wrapped DEK. - D. Generate a data encryption key (DEK) locally.
Encrypt data with the DEK.
Use a key encryption key (KEK) to wrap the DEK. Store the encrypted data and the wrapped DEK.
Answer: D
Explanation:
Reference:
https://cloud.google.com/kms/docs/envelope-encryption
NEW QUESTION 68
A customer needs to launch a 3-tier internal web application on Google Cloud Platform (GCP). The customer's internal compliance requirements dictate that end-user access may only be allowed if the traffic seems to originate from a specific known good CIDR. The customer accepts the risk that their application will only have SYN flood DDoS protection. They want to use GCP's native SYN flood protection.
Which product should be used to meet these requirements?
- A. Cloud Identity and Access Management
- B. Cloud Armor
- C. Cloud CDN
- D. VPC Firewall Rules
Answer: B
Explanation:
Reference:
https://cloud.google.com/blog/products/identity-security/understanding-google-cloud-armors-new- waf-capabilities
NEW QUESTION 69
You are part of a security team investigating a compromised service account key. You need to audit which new resources were created by the service account.
What should you do?
- A. Query Admin Activity logs.
- B. Query Stackdriver Monitoring Workspace.
- C. Query Access Transparency logs.
- D. Query Data Access logs.
Answer: A
NEW QUESTION 70
You will create a new Service Account that should be able to list the Compute Engine instances in the project. You want to follow Google-recommended practices.
What should you do?
- A. Create a custom role with the permission compute.instances.list and grant the Service Account this role.
- B. Create an Instance Template, and allow the Service Account Read Only access for the Compute Engine Access Scope.
- C. Give the Service Account the role of Project Viewer, and use the new Service Account for all instances.
- D. Give the Service Account the role of Compute Viewer, and use the new Service Account for all instances.
Answer: A
NEW QUESTION 71
You are a member of the security team at an organization. Your team has a single GCP project with credit card payment processing systems alongside web applications and data processing systems. You want to reduce the scope of systems subject to PCI audit standards.
What should you do?
- A. Use only applications certified compliant with PA-DSS.
- B. Use VPN for all connections between your office and cloud environments.
- C. Use multi-factor authentication for admin access to the web application.
- D. Move the cardholder data environment into a separate GCP project.
Answer: B
NEW QUESTION 72
You need to connect your organization's on-premises network with an existing Google Cloud environment that includes one Shared VPC with two subnets named Production and Non-Production. You are required to:
Use a private transport link.
Configure access to Google Cloud APIs through private API endpoints originating from on-premises environments.
Ensure that Google Cloud APIs are only consumed via VPC Service Controls.
What should you do?
- A. 1. Set up a Partner Interconnect link between the on-premises environment and Google Cloud.
2. Configure private access using the private.googleapis.com domains in on-premises DNS configurations. - B. 1. Set up a Dedicated Interconnect link between the on-premises environment and Google Cloud.
2. Configure private access using the restricted.googleapis.com domains in on-premises DNS configurations. - C. 1. Set up a Cloud VPN link between the on-premises environment and Google Cloud.
2. Configure private access using the restricted googleapis.com domains in on-premises DNS configurations. - D. 1. Set up a Direct Peering link between the on-premises environment and Google Cloud.
2. Configure private access for both VPC subnets.
Answer: D
NEW QUESTION 73
Your company wants to collect and analyze CVE information for packages in container images, and wants to prevent images with known security issues from running in your Google Kubernetes Engine environment. Which two security features does Google recommend including in a container build pipeline?
- A. Vulnerability scanning
- B. Deployment policies
- C. Network isolation
- D. Password policies
Answer: B
Explanation:
A is correct because deployment policies defined in Binary Authorization ensure that only trusted images can be deployed in Google Kubernetes Engine clusters. Binary Authorization can integrate with Container Analysis which scans container images stored in Container Registry for vulnerabilities and stores trusted metadata used in the authorization process.
B is not correct because it doesn't address the use case.
C is correct because vulnerability scanning can be performed by Container Analysis to discover package vulnerability information in container base images and obtain CVE data from respective Linux distributions.
D is not correct because it doesn't address the use case.
https://cloud.google.com/binary-authorization/docs/overview
https://cloud.google.com/container-registry/docs/container-analysis
NEW QUESTION 74
In order to meet PCI DSS requirements, a customer wants to ensure that all outbound traffic is authorized.
Which two cloud offerings meet this requirement without additional compensating controls? (Choose two.)
- A. Cloud Functions
- B. Google Kubernetes Engine
- C. Compute Engine
- D. Cloud Storage
- E. App Engine
Answer: B,C
Explanation:
App Engine ingress firewall rules are available, but egress rules are not currently available. Per requirements 1.2.1 and 1.3.4, you must ensure that all outbound traffic is authorized. SAQ A-EP and SAQ D-type merchants must provide compensating controls or use a different Google Cloud product. Compute Engine and GKE are the preferred alternatives. https://cloud.google.com/solutions/pci-dss-compliance-in-gcp
NEW QUESTION 75
Your company is using GSuite and has developed an application meant for internal usage on Google App Engine. You need to make sure that an external user cannot gain access to the application even when an employee's password has been compromised.
What should you do?
- A. Enforce 2-factor authentication in GSuite for all users.
- B. Configure Cloud VPN between your private network and GCP.
- C. Provision user passwords using GSuite Password Sync.
- D. Configure Cloud Identity-Aware Proxy for the App Engine Application.
Answer: A
NEW QUESTION 76
An engineering team is launching a web application that will be public on the internet. The web application is hosted in multiple GCP regions and will be directed to the respective backend based on the URL request.
Your team wants to avoid exposing the application directly on the internet and wants to deny traffic from a specific list of malicious IP addresses Which solution should your team implement to meet these requirements?
- A. NAT Gateway
- B. Cloud Armor
- C. SSL Proxy Load Balancing
- D. Network Load Balancing
Answer: B
NEW QUESTION 77
A company is backing up application logs to a Cloud Storage bucket shared with both analysts and the administrator. Analysts should only have access to logs that do not contain any personally identifiable information (PII). Log files containing PII should be stored in another bucket that is only accessible by the administrator.
What should you do?
- A. On the bucket shared with both the analysts and the administrator, configure Object Lifecycle Management to delete objects that contain any PII.
- B. On the bucket shared with both the analysts and the administrator, configure a Cloud Storage Trigger that is only triggered when PII data is uploaded. Use Cloud Functions to capture the trigger and delete such files.
- C. Use Cloud Pub/Sub and Cloud Functions to trigger a Data Loss Prevention scan every time a file is uploaded to the shared bucket. If the scan detects PII, have the function move into a Cloud Storage bucket only accessible by the administrator.
- D. Upload the logs to both the shared bucket and the bucket only accessible by the administrator. Create a job trigger using the Cloud Data Loss Prevention API. Configure the trigger to delete any files from the shared bucket that contain PII.
Answer: A
NEW QUESTION 78
In order to meet PCI DSS requirements, a customer wants to ensure that all outbound traffic is authorized.
Which two cloud offerings meet this requirement without additional compensating controls? (Choose two.)
- A. Cloud Functions
- B. Compute Engine
- C. Cloud Storage
- D. App Engine
- E. Google Kubernetes Engine
Answer: B,D
Explanation:
Explanation/Reference: https://cloud.google.com/solutions/pci-dss-compliance-in-gcp
NEW QUESTION 79
A cloud customer has an on-premises key management system and wants to generate, protect, rotate, and audit encryption keys with it. How can the customer use Cloud Storage with their own encryption keys?
- A. Declare usage of default encryption at rest in the audit report on compliance
- B. Use Customer-Supplied Encryption Keys (CSEK)
- C. Upload encryption keys to the same Cloud Storage bucket
- D. Use Customer Managed Encryption Keys (CMEK)
Answer: B
Explanation:
A is not correct because default encryption at rest uses Google-generated and Google-managed keys, hence does not address the use case.
B is not correct because you'll first need the encryption keys in order to decrypt the data in this Cloud Storage Bucket, but you won't be able to have these encryption keys until you actually decrypt it. Customer-supplied encryption keys are not stored on Google's infrastructure.
C is not correct because it doesn't address this scenario in which customer wants to use their own encryption keys from their own key management system. This option will however be valid if the customer wants to use Google-generated and customer-managed keys.
D is correct because you can choose to provide your own AES-256 key when using Cloud Storage. This key is known as a customer-supplied encryption key (CSEK). If you provide a CSEK, Cloud Storage does not permanently store your key on Google's servers or otherwise manage your key. Instead, you provide your key for each Cloud Storage operation, and your key is purged from Google's servers after the operation is complete. Cloud Storage stores only a cryptographic hash of the key so that future requests can be validated against the hash.
https://cloud.google.com/security/encryption-at-rest/
https://cloud.google.com/storage/docs/encryption/using-customer-supplied-keys
https://cloud.google.com/storage/docs/encryption/customer-supplied-keys
https://cloud.google.com/storage/docs/encryption/customer-managed-keys
NEW QUESTION 80
......
Updated PDF (New 2022) Actual Google Professional-Cloud-Security-Engineer Exam Questions: https://www.dumpexams.com/Professional-Cloud-Security-Engineer-real-answers.html
Dumps Moneyack Guarantee - Professional-Cloud-Security-Engineer Dumps Approved Dumps: https://drive.google.com/open?id=19I5xa_wY2RQ5kWoxkcYzJ981cAfrYBJu