ExamGecko
Home Home / Google / Professional Cloud Security Engineer

Google Professional Cloud Security Engineer Practice Test - Questions Answers, Page 17

Question list
Search
Search

List of questions

Search

Related questions











Question 161

Report
Export
Collapse

You are implementing data protection by design and in accordance with GDPR requirements. As part of design reviews, you are told that you need to manage the encryption key for a solution that includes workloads for Compute Engine, Google Kubernetes Engine, Cloud Storage, BigQuery, and Pub/Sub. Which option should you choose for this implementation?

A.
Cloud External Key Manager
A.
Cloud External Key Manager
Answers
B.
Customer-managed encryption keys
B.
Customer-managed encryption keys
Answers
C.
Customer-supplied encryption keys
C.
Customer-supplied encryption keys
Answers
D.
Google default encryption
D.
Google default encryption
Answers
Suggested answer: B

Explanation:

https://cloud.google.com/kms/docs/using-other-products#cmek_integrations https://cloud.google.com/kms/docs/using-other-products#cmek_integrations CMEK is supported for all the listed google services.

asked 18/09/2024
Marcel Engelbrecht
44 questions

Question 162

Report
Export
Collapse

Which Identity-Aware Proxy role should you grant to an Identity and Access Management (IAM) user to access HTTPS resources?

A.
Security Reviewer
A.
Security Reviewer
Answers
B.
lAP-Secured Tunnel User
B.
lAP-Secured Tunnel User
Answers
C.
lAP-Secured Web App User
C.
lAP-Secured Web App User
Answers
D.
Service Broker Operator
D.
Service Broker Operator
Answers
Suggested answer: C

Explanation:

IAP-Secured Tunnel User: Grants access to tunnel resources that use IAP. IAP-Secured Web App User: Access HTTPS resources which use Identity-Aware Proxy, Grants access to App Engine, Cloud Run, and Compute Engine resources.

https://cloud.google.com/iap/docs/managing-access#roles

asked 18/09/2024
mr yosh
37 questions

Question 163

Report
Export
Collapse

You need to audit the network segmentation for your Google Cloud footprint. You currently operate Production and Non-Production infrastructure-as-a-service (IaaS) environments. All your VM instances are deployed without any service account customization.

After observing the traffic in your custom network, you notice that all instances can communicate freely -- despite tag-based VPC firewall rules in place to segment traffic properly -- with a priority of 1000. What are the most likely reasons for this behavior?

A.
All VM instances are missing the respective network tags.
A.
All VM instances are missing the respective network tags.
Answers
B.
All VM instances are residing in the same network subnet.
B.
All VM instances are residing in the same network subnet.
Answers
C.
All VM instances are configured with the same network route.
C.
All VM instances are configured with the same network route.
Answers
D.
A VPC firewall rule is allowing traffic between source/targets based on the same service account with priority 999.
D.
A VPC firewall rule is allowing traffic between source/targets based on the same service account with priority 999.
Answers
E.
A VPC firewall rule is allowing traffic between source/targets based on the same service account with priority 1001.
E.
A VPC firewall rule is allowing traffic between source/targets based on the same service account with priority 1001.
Answers
Suggested answer: A, D
asked 18/09/2024
Rama Krishna
38 questions

Question 164

Report
Export
Collapse

You are creating a new infrastructure CI/CD pipeline to deploy hundreds of ephemeral projects in your Google Cloud organization to enable your users to interact with Google Cloud. You want to restrict the use of the default networks in your organization while following Google-recommended best practices. What should you do?

Become a Premium Member for full access
Unlock Premium Member  Unlock Premium Member

Question 165

Report
Export
Collapse

You are a security administrator at your company and are responsible for managing access controls (identification, authentication, and authorization) on Google Cloud. Which Google-recommended best practices should you follow when configuring authentication and authorization? (Choose two.)

Become a Premium Member for full access
Unlock Premium Member  Unlock Premium Member

Question 166

Report
Export
Collapse

You have been tasked with inspecting IP packet data for invalid or malicious content. What should you do?

Become a Premium Member for full access
Unlock Premium Member  Unlock Premium Member

Question 167

Report
Export
Collapse

You have the following resource hierarchy. There is an organization policy at each node in the hierarchy as shown. Which load balancer types are denied in VPC A?

Become a Premium Member for full access
Unlock Premium Member  Unlock Premium Member

Question 168

Report
Export
Collapse

Your security team wants to implement a defense-in-depth approach to protect sensitive data stored in a Cloud Storage bucket. Your team has the following requirements:

The Cloud Storage bucket in Project A can only be readable from Project B.

The Cloud Storage bucket in Project A cannot be accessed from outside the network.

Data in the Cloud Storage bucket cannot be copied to an external Cloud Storage bucket.

What should the security team do?

Become a Premium Member for full access
Unlock Premium Member  Unlock Premium Member

Question 169

Report
Export
Collapse

You need to create a VPC that enables your security team to control network resources such as firewall rules. How should you configure the network to allow for separation of duties for network resources?

Become a Premium Member for full access
Unlock Premium Member  Unlock Premium Member

Question 170

Report
Export
Collapse

You are onboarding new users into Cloud Identity and discover that some users have created consumer user accounts using the corporate domain name. How should you manage these consumer user accounts with Cloud Identity?

Become a Premium Member for full access
Unlock Premium Member  Unlock Premium Member
Total 235 questions
Go to page: of 24