[Nov 15, 2022] Valid Professional-Cloud-Security-Engineer Test Answers & Google Professional-Cloud-Security-Engineer Exam PDF
Realistic Professional-Cloud-Security-Engineer Exam Dumps with Accurate & Updated Questions
Available Skill Badges
The Google skill badges are a form of training that allows candidates to demonstrate their understanding of Google concepts at this level. For the Google Professional Cloud Security Engineer exam, the most popular badges include the following:
- Ensure Access and Identity in Google Cloud
- Secure Workloads in Google Kubernetes Engine
- Create and Manage Cloud Resources
- Build and Secure Networks in Google Cloud
3. Security in Google Cloud
This is the last course that candidates should go through to prepare for the Google Professional Cloud Security Engineer exam. This training covers the security controls on Google Cloud from a wider perspective. The domains addressed here include the mitigation techniques used to manage attacks at different points within a Google-centered infrastructure. These include phishing attacks, threats associated with content use or classification, and the distributed denial-of-service (DDoS).
NEW QUESTION 49
A company is running workloads in a dedicated server room. They must only be accessed from within the private company network. You need to connect to these workloads from Compute Engine instances within a Google Cloud Platform project.
Which two approaches can you take to meet the requirements? (Choose two.)
- A. Configure all Compute Engine instances with Private Access.
- B. Configure the project with Shared VPC.
- C. Configure the project with Cloud VPN.
- D. Configure the project with VPC peering.
- E. Configure the project with Cloud Interconnect.
Answer: A,D
Explanation:
Explanation/Reference: https://cloud.google.com/solutions/secure-data-workloads-use-cases
NEW QUESTION 50
You need to connect your organization's on-premises network with an existing Google Cloud environment that includes one Shared VPC with two subnets named Production and Non-Production. You are required to:
Use a private transport link.
Configure access to Google Cloud APIs through private API endpoints originating from on-premises environments.
Ensure that Google Cloud APIs are only consumed via VPC Service Controls.
What should you do?
- A. 1. Set up a Dedicated Interconnect link between the on-premises environment and Google Cloud.
2. Configure private access using the restricted.googleapis.com domains in on-premises DNS configurations. - B. 1. Set up a Cloud VPN link between the on-premises environment and Google Cloud.
2. Configure private access using the restricted googleapis.com domains in on-premises DNS configurations. - C. 1. Set up a Partner Interconnect link between the on-premises environment and Google Cloud.
2. Configure private access using the private.googleapis.com domains in on-premises DNS configurations. - D. 1. Set up a Direct Peering link between the on-premises environment and Google Cloud.
2. Configure private access for both VPC subnets.
Answer: D
NEW QUESTION 51
You are a member of the security team at an organization. Your team has a single GCP project with credit card payment processing systems alongside web applications and data processing systems. You want to reduce the scope of systems subject to PCI audit standards.
What should you do?
- A. Use VPN for all connections between your office and cloud environments.
- B. Use only applications certified compliant with PA-DSS.
- C. Move the cardholder data environment into a separate GCP project.
- D. Use multi-factor authentication for admin access to the web application.
Answer: C
Explanation:
https://cloud.google.com/solutions/best-practices-vpc-design
"Setting up your payment-processing environment" section in https://cloud.google.com/solutions/pci-dss-compliance-in-gcp.
NEW QUESTION 52
An organization's typical network and security review consists of analyzing application transit routes, request handling, and firewall rules. They want to enable their developer teams to deploy new applications without the overhead of this full review.
How should you advise this organization?
- A. Use Forseti with Firewall filters to catch any unwanted configurations in production.
- B. Mandate use of infrastructure as code and provide static analysis in the CI/CD pipelines to enforce policies.
- C. All production applications will run on-premises. Allow developers free rein in GCP as their dev and QA platforms.
- D. Route all VPC traffic through customer-managed routers to detect malicious patterns in production.
Answer: B
Explanation:
Explanation
NEW QUESTION 53
A company has redundant mail servers in different Google Cloud Platform regions and wants to route customers to the nearest mail server based on location.
How should the company accomplish this?
- A. Use Cloud CDN to route the mail traffic to the closest origin mail server based on client IP address.
- B. Use Cross-Region Load Balancing with an HTTP(S) load balancer to route traffic to the nearest region.
- C. Configure TCP Proxy Load Balancing as a global load balancing service listening on port 995.
- D. Create a Network Load Balancer to listen on TCP port 995 with a forwarding rule to forward traffic based on location.
Answer: A
NEW QUESTION 54
You are the Security Admin in your company. You want to synchronize all security groups that have an email address from your LDAP directory in Cloud IAM.
What should you do?
- A. Configure Google Cloud Directory Sync to sync security groups using LDAP search rules that have "user email address" as the attribute to facilitate one-way sync.
- B. Use a management tool to sync the subset based on group object class attribute. Create a group in the Google domain. A group created in a Google domain will automatically have an explicit Google Cloud Identity and Access Management (IAM) role.
- C. Configure Google Cloud Directory Sync to sync security groups using LDAP search rules that have "user email address" as the attribute to facilitate bidirectional sync.
- D. Use a management tool to sync the subset based on the email address attribute. Create a group in the Google domain. A group created in a Google domain will automatically have an explicit Google Cloud Identity and Access Management (IAM) role.
Answer: D
NEW QUESTION 55
Your team needs to make sure that a Compute Engine instance does not have access to the internet or to any Google APIs or services.
Which two settings must remain disabled to meet these requirements? (Choose two.)
- A. Static routes
- B. Private Google Access
- C. IP Forwarding
- D. Public IP
- E. IAM Network User Role
Answer: A,B
Explanation:
Reference:
https://cloud.google.com/vpc/docs/configure-private-google-access
NEW QUESTION 56
A customer needs an alternative to storing their plain text secrets in their source-code management (SCM) system.
How should the customer achieve this using Google Cloud Platform?
- A. Run the Cloud Data Loss Prevention API to scan the secrets, and store them in Cloud SQL.
- B. Encrypt the secrets with a Customer-Managed Encryption Key (CMEK), and store them in Cloud Storage.
- C. Use Cloud Source Repositories, and store secrets in Cloud SQL.
- D. Deploy the SCM to a Compute Engine VM with local SSDs, and enable preemptible VMs.
Answer: B
NEW QUESTION 57
Your team needs to make sure that their backend database can only be accessed by the frontend application and no other instances on the network.
How should your team design this network?
- A. Create two VPC networks, and connect the two networks using VPC peering to ensure network isolation.
- B. Create a different subnet for the frontend application and database to ensure network isolation.
- C. Create an ingress firewall rule to allow access only from the application to the database using firewall tags.
- D. Create two VPC networks, and connect the two networks using Cloud VPN gateways to ensure network isolation.
Answer: C
NEW QUESTION 58
Last week, a company deployed a new App Engine application that writes logs to BigQuery. No other workloads are running in the project. You need to validate that all data written to BigQuery was done using the App Engine Default Service Account.
What should you do?
- A. 1. Use StackDriver Logging and filter on BigQuery Insert Jobs.
2. Click on the email address in line with the App Engine Default Service Account in the authentication field.
3. Click Hide Matching Entries.
4. Make sure the resulting list is empty. - B. 1. Go to the IAM section on the project.
2. Validate that the App Engine Default Service Account is the only account that has a role that can write to BigQuery.
Section: (none)
Explanation - C. 1. Use StackDriver Logging and filter on BigQuery Insert Jobs.
2. Click on the email address in line with the App Engine Default Service Account in the authentication field.
3. Click Show Matching Entries.
4. Make sure the resulting list is empty. - D. 1. In BigQuery, select the related dataset.
2. Make sure the App Engine Default Service Account is the only account that can write to the dataset.
Answer: D
NEW QUESTION 59
An engineering team is launching a web application that will be public on the internet. The web application is hosted in multiple GCP regions and will be directed to the respective backend based on the URL request.
Your team wants to avoid exposing the application directly on the internet and wants to deny traffic from a specific list of malicious IP addresses Which solution should your team implement to meet these requirements?
- A. SSL Proxy Load Balancing
- B. NAT Gateway
- C. Cloud Armor
- D. Network Load Balancing
Answer: C
Explanation:
https://cloud.google.com/armor/docs/security-policy-concepts
NEW QUESTION 60
Your team needs to make sure that a Compute Engine instance does not have access to the internet or to any Google APIs or services.
Which two settings must remain disabled to meet these requirements? (Choose two.)
- A. Static routes
- B. Private Google Access
- C. IP Forwarding
- D. Public IP
- E. IAM Network User Role
Answer: A,B
Explanation:
https://cloud.google.com/vpc/docs/configure-private-google-access
NEW QUESTION 61
You are the security admin of your company. You have 3,000 objects in your Cloud Storage bucket. You do not want to manage access to each object individually. You also do not want the uploader of an object to always have full control of the object. However, you want to use Cloud Audit Logs to manage access to your bucket.
What should you do?
- A. Set up an ACL with OWNER permission to a scope of allUsers.
- B. Set up an ACL with READER permission to a scope of allUsers.
- C. Set up a default bucket ACL and manage access for users using IAM.
- D. Set up Uniform bucket-level access on the Cloud Storage bucket and manage access for users using IAM.
Answer: A
Explanation:
https://cloud.google.com/storage/docs/access-control/lists
NEW QUESTION 62
Your Security team believes that a former employee of your company gained unauthorized access to Google Cloud resources some time in the past 2 months by using a service account key. You need to confirm the unauthorized access and determine the user activity. What should you do?
- A. Use the Cloud Monitoring console to filter audit logs by user.
- B. Use the Logs Explorer to search for user activity.
- C. Use Security Health Analytics to determine user activity.
- D. Use the Cloud Data Loss Prevention API to query logs in Cloud Storage.
Answer: A
NEW QUESTION 63
A customer deploys an application to App Engine and needs to check for Open Web Application Security Project (OWASP) vulnerabilities.
Which service should be used to accomplish this?
- A. Cloud Security Scanner
- B. Cloud Armor
- C. Google Cloud Audit Logs
- D. Forseti Security
Answer: A
Explanation:
Reference:
https://cloud.google.com/security-scanner/
NEW QUESTION 64
You want to prevent users from accidentally deleting a Shared VPC host project. Which organization-level policy constraint should you enable?
- A. compute.restrictSharedVpcSubnetworks
- B. compute.restrictSharedVpcHostProjects
- C. compute.restrictXpnProjectLienRemoval
- D. compute.sharedReservationsOwnerProjects
Answer: C
NEW QUESTION 65
A business unit at a multinational corporation signs up for GCP and starts moving workloads into GCP. The business unit creates a Cloud Identity domain with an organizational resource that has hundreds of projects.
Your team becomes aware of this and wants to take over managing permissions and auditing the domain resources.
Which type of access should your team grant to meet this requirement?
- A. Organization Policy Administrator
- B. Security Reviewer
- C. Organization Administrator
- D. Organization Role Administrator
Answer: A
Explanation:
https://cloud.google.com/resource-manager/docs/access-control-org
NEW QUESTION 66
An engineering team is launching a web application that will be public on the internet. The web application is hosted in multiple GCP regions and will be directed to the respective backend based on the URL request.
Your team wants to avoid exposing the application directly on the internet and wants to deny traffic from a specific list of malicious IP addresses Which solution should your team implement to meet these requirements?
- A. SSL Proxy Load Balancing
- B. NAT Gateway
- C. Cloud Armor
- D. Network Load Balancing
Answer: C
Explanation:
Reference:
https://cloud.google.com/armor/docs/security-policy-concepts
NEW QUESTION 67
Your company is using Cloud Dataproc for its Spark and Hadoop jobs. You want to be able to create, rotate, and destroy symmetric encryption keys used for the persistent disks used by Cloud Dataproc. Keys can be stored in the cloud.
What should you do?
- A. Use the Cloud Key Management Service to manage the data encryption key (DEK).
- B. Use customer-supplied encryption keys to manage the key encryption key (KEK).
- C. Use customer-supplied encryption keys to manage the data encryption key (DEK).
- D. Use the Cloud Key Management Service to manage the key encryption key (KEK).
Answer: A
NEW QUESTION 68
Your team sets up a Shared VPC Network where project co-vpc-prod is the host project. Your team has configured the firewall rules, subnets, and VPN gateway on the host project. They need to enable Engineering Group A to attach a Compute Engine instance to only the 10.1.1.0/24 subnet.
What should your team grant to Engineering Group A to meet this requirement?
- A. Compute Shared VPC Admin Role at the service project level.
- B. Compute Network User Role at the host project level.
- C. Compute Network User Role at the subnet level.
- D. Compute Shared VPC Admin Role at the host project level.
Answer: D
Explanation:
Explanation/Reference: https://cloud.google.com/vpc/docs/shared-vpc
NEW QUESTION 69
Applications often require access to "secrets" -small pieces of sensitive data at build or run time.
The administrator managing these secrets on GCP wants to keep a track of "who did what, where, and when?" within their GCP projects.
Which two log streams would provide the information that the administrator is looking for?
(Choose two.)
- A. System Event logs
- B. Agent logs
- C. Data Access logs
- D. VPC Flow logs
- E. Admin Activity logs
Answer: C,E
Explanation:
https://cloud.google.com/kms/docs/secret-management
NEW QUESTION 70
A customer wants to run a batch processing system on VMs and store the output files in a Cloud Storage bucket. The networking and security teams have decided that no VMs may reach the public internet.
How should this be accomplished?
- A. Create a firewall rule to block internet traffic from the VM.
- B. Provision a NAT Gateway to access the Cloud Storage API endpoint.
- C. Enable Private Google Access on the VPC.
- D. Mount a Cloud Storage bucket as a local filesystem on every VM.
Answer: C
NEW QUESTION 71
Applications often require access to "secrets" - small pieces of sensitive data at build or run time. The administrator managing these secrets on GCP wants to keep a track of "who did what, where, and when?" within their GCP projects.
Which two log streams would provide the information that the administrator is looking for? (Choose two.)
- A. System Event logs
- B. Agent logs
- C. Data Access logs
- D. VPC Flow logs
- E. Admin Activity logs
Answer: C,E
Explanation:
Explanation/Reference: https://cloud.google.com/kms/docs/secret-management
NEW QUESTION 72
What are the steps to encrypt data using envelope encryption?
- A. Generate a data encryption key (DEK) locally.
Encrypt data with the DEK.
Use a key encryption key (KEK) to wrap the DEK.
Store the encrypted data and the wrapped DEK. - B. Generate a data encryption key (DEK) locally.
Use a key encryption key (KEK) to wrap the DEK.
Encrypt data with the KEK.
Store the encrypted data and the wrapped KEK. - C. Generate a key encryption key (KEK) locally.
Use the KEK to generate a data encryption key (DEK).
Encrypt data with the DEK.
Store the encrypted data and the wrapped DEK. - D. Generate a key encryption key (KEK) locally.
Generate a data encryption key (DEK) locally.
Encrypt data with the KEK.
Store the encrypted data and the wrapped DEK.
Answer: A
Explanation:
https://cloud.google.com/kms/docs/envelope-encryption
NEW QUESTION 73
......
Professional-Cloud-Security-Engineer Exam Dumps - PDF Questions and Testing Engine: https://www.dumpexams.com/Professional-Cloud-Security-Engineer-real-answers.html
Professional-Cloud-Security-Engineer Dumps - The Sure Way To Pass Exam: https://drive.google.com/open?id=1QrIidcbiTBZeojmsqm6hF0o_KAzh4loF