Home / Google / Professional Cloud Security Engineer

Google Professional Cloud Security Engineer Practice Test - Questions Answers, Page 17

Question list

List of questions

Question 161

(0)

You are implementing data protection by design and in accordance with GDPR requirements. As part of design reviews, you are told that you need to manage the encryption key for a solution that includ

Question 162

(0)

Which Identity-Aware Proxy role should you grant to an Identity and Access Management (IAM) user to access HTTPS resources?

Question 163

(0)

You need to audit the network segmentation for your Google Cloud footprint. You currently operate Production and Non-Production infrastructure-as-a-service (IaaS) environments. All your VM instances

Question 164

(0)

You are creating a new infrastructure CI/CD pipeline to deploy hundreds of ephemeral projects in your Google Cloud organization to enable your users to interact with Google Cloud. You want to restri

Question 165

(0)

You are a security administrator at your company and are responsible for managing access controls (identification, authentication, and authorization) on Google Cloud. Which Google-recommended best p

Question 166

(0)

You have been tasked with inspecting IP packet data for invalid or malicious content. What should you do?

Question 167

(0)

You have the following resource hierarchy. There is an organization policy at each node in the hierarchy as shown. Which load balancer types are denied in VPC A?

Question 168

(0)

Your security team wants to implement a defense-in-depth approach to protect sensitive data stored in a Cloud Storage bucket. Your team has the following requirements: The Cloud Storage bucket in P

Question 169

(0)

You need to create a VPC that enables your security team to control network resources such as firewall rules. How should you configure the network to allow for separation of duties for network resou

Question 170

(0)

You are onboarding new users into Cloud Identity and discover that some users have created consumer user accounts using the corporate domain name. How should you manage these consumer user accounts

Question 161

You are implementing data protection by design and in accordance with GDPR requirements. As part of design reviews, you are told that you need to manage the encryption key for a solution that includes workloads for Compute Engine, Google Kubernetes Engine, Cloud Storage, BigQuery, and Pub/Sub. Which option should you choose for this implementation?

Cloud External Key Manager

Customer-managed encryption keys

Customer-supplied encryption keys

Google default encryption

Show Answer Comment (0)

Question 162

Which Identity-Aware Proxy role should you grant to an Identity and Access Management (IAM) user to access HTTPS resources?

Security Reviewer

lAP-Secured Tunnel User

lAP-Secured Web App User

Service Broker Operator

Show Answer Comment (0)

Question 163

You need to audit the network segmentation for your Google Cloud footprint. You currently operate Production and Non-Production infrastructure-as-a-service (IaaS) environments. All your VM instances are deployed without any service account customization.

After observing the traffic in your custom network, you notice that all instances can communicate freely -- despite tag-based VPC firewall rules in place to segment traffic properly -- with a priority of 1000. What are the most likely reasons for this behavior?

All VM instances are missing the respective network tags.

All VM instances are residing in the same network subnet.

All VM instances are configured with the same network route.

A VPC firewall rule is allowing traffic between source/targets based on the same service account with priority 999.

A VPC firewall rule is allowing traffic between source/targets based on the same service account with priority 1001.

Show Answer Comment (0)

Question 164

You are creating a new infrastructure CI/CD pipeline to deploy hundreds of ephemeral projects in your Google Cloud organization to enable your users to interact with Google Cloud. You want to restrict the use of the default networks in your organization while following Google-recommended best practices. What should you do?

Enable the constraints/compute.skipDefaultNetworkCreation organization policy constraint at the organization level.

Create a cron job to trigger a daily Cloud Function to automatically delete all default networks for each project.

Grant your users the IAM Owner role at the organization level. Create a VPC Service Controls perimeter around the project that restricts the compute.googleapis.com API.

Only allow your users to use your CI/CD pipeline with a predefined set of infrastructure templates they can deploy to skip the creation of the default networks.

Show Answer Comment (0)

Question 165

You are a security administrator at your company and are responsible for managing access controls (identification, authentication, and authorization) on Google Cloud. Which Google-recommended best practices should you follow when configuring authentication and authorization? (Choose two.)

Use Google default encryption.

Manually add users to Google Cloud.

Provision users with basic roles using Google's Identity and Access Management (IAM) service.

Use SSO/SAML integration with Cloud Identity for user authentication and user lifecycle management.

Provide granular access with predefined roles.

Show Answer Comment (0)

Question 166

You have been tasked with inspecting IP packet data for invalid or malicious content. What should you do?

Use Packet Mirroring to mirror traffic to and from particular VM instances. Perform inspection using security software that analyzes the mirrored traffic.

Enable VPC Flow Logs for all subnets in the VPC. Perform inspection on the Flow Logs data using Cloud Logging.

Configure the Fluentd agent on each VM Instance within the VPC. Perform inspection on the log data using Cloud Logging.

Configure Google Cloud Armor access logs to perform inspection on the log data.

Show Answer Comment (0)

Question 167

You have the following resource hierarchy. There is an organization policy at each node in the hierarchy as shown. Which load balancer types are denied in VPC A?

All load balancer types are denied in accordance with the global node's policy.

INTERNAL_TCP_UDP, INTERNAL_HTTP_HTTPS is denied in accordance with the folder's policy.

EXTERNAL_TCP_PROXY, EXTERNAL_SSL_PROXY are denied in accordance with the project's policy.

EXTERNAL_TCP_PROXY, EXTERNAL_SSL_PROXY, INTERNAL_TCP_UDP, and INTERNAL_HTTP_HTTPS are denied in accordance with the folder and project's policies.

Show Answer Comment (0)

Question 168

Your security team wants to implement a defense-in-depth approach to protect sensitive data stored in a Cloud Storage bucket. Your team has the following requirements:

The Cloud Storage bucket in Project A can only be readable from Project B.

The Cloud Storage bucket in Project A cannot be accessed from outside the network.

Data in the Cloud Storage bucket cannot be copied to an external Cloud Storage bucket.

What should the security team do?

Enable domain restricted sharing in an organization policy, and enable uniform bucket-level access on the Cloud Storage bucket.

Enable VPC Service Controls, create a perimeter around Projects A and B. and include the Cloud Storage API in the Service Perimeter configuration.

Enable Private Access in both Project A and B's networks with strict firewall rules that allow communication between the networks.

Enable VPC Peering between Project A and B's networks with strict firewall rules that allow communication between the networks.

Show Answer Comment (0)

Question 169

You need to create a VPC that enables your security team to control network resources such as firewall rules. How should you configure the network to allow for separation of duties for network resources?

Set up multiple VPC networks, and set up multi-NIC virtual appliances to connect the networks.

Set up VPC Network Peering, and allow developers to peer their network with a Shared VPC.

Set up a VPC in a project. Assign the Compute Network Admin role to the security team, and assign the Compute Admin role to the developers.

Set up a Shared VPC where the security team manages the firewall rules, and share the network with developers via service projects.

Show Answer Comment (0)

Question 170

You are onboarding new users into Cloud Identity and discover that some users have created consumer user accounts using the corporate domain name. How should you manage these consumer user accounts with Cloud Identity?

Use Google Cloud Directory Sync to convert the unmanaged user accounts.

Create a new managed user account for each consumer user account.

Use the transfer tool for unmanaged user accounts.

Configure single sign-on using a customer's third-party provider.

Show Answer Comment (0)

Total 235 questions