Home / Google / Professional Cloud Security Engineer

Google Professional Cloud Security Engineer Practice Test - Questions Answers, Page 21

Question list

List of questions

Question 201

(0)

Your organization recently activated the Security Command Center {SCO standard tier. There are a few Cloud Storage buckets that were accidentally made accessible to the public. You need to investiga

Question 202

(0)

Your organization uses the top-tier folder to separate application environments (prod and dev). The developers need to see all application development audit logs but they are not permitted to review

Question 203

(0)

Your organization s customers must scan and upload the contract and their driver license into a web portal in Cloud Storage. You must remove all personally identifiable information (Pll) from files

Question 204

(0)

After completing a security vulnerability assessment, you learned that cloud administrators leave Google Cloud CLI sessions open for days. You need to reduce the risk of attackers who might exploit

Question 205

(0)

Your application is deployed as a highly available cross-region solution behind a global external HTTP(S) load balancer. You notice significant spikes in traffic from multiple IP addresses but it is

Question 206

(0)

You have numerous private virtual machines on Google Cloud. You occasionally need to manage the servers through Secure Socket Shell (SSH) from a remote location. You want to configure remote access

Question 207

(0)

Your organization has on-premises hosts that need to access Google Cloud APIs You must enforce private connectivity between these hosts minimize costs and optimize for operational efficiency What s

Question 208

(0)

Your organization s record data exists in Cloud Storage. You must retain all record data for at least seven years This policy must be permanent. What should you do?

Question 209

(0)

Your organization wants to protect all workloads that run on Compute Engine VM to ensure that the instances weren't compromised by boot-level or kernel-level malware. Also, you need to ensure that d

Question 210

(0)

Your company uses Google Cloud and has publicly exposed network assets. You want to discover the assets and perform a security audit on these assets by using a software tool in the least amount of t

Question 201

Your organization recently activated the Security Command Center {SCO standard tier. There are a few Cloud Storage buckets that were accidentally made accessible to the public. You need to investigate the impact of the incident and remediate it.

What should you do?

* 1 Remove the Identity and Access Management (IAM) granting access to allusers from the buckets * 2 Apply the organization policy storage. unifromBucketLevelAccess to prevent regressions * 3 Query the data access logs to report on unauthorized access

* 1 Change bucket permissions to limit access * 2 Query the data access audit logs for any unauthorized access to the buckets * 3 After the misconfiguration is corrected mute the finding in the Security Command Center

* 1 Change permissions to limit access for authorized users * 2 Enforce a VPC Service Controls perimeter around all the production projects to immediately stop any unauthorized access * 3 Review the administrator activity audit logs to report on any unauthorized access

* 1 Change the bucket permissions to limit access * 2 Query the buckets usage logs to report on unauthorized access to the data * 3 Enforce the organization policy storage.publicAccessPrevention to avoid regressions

Show Answer Comment (0)

Question 202

Your organization uses the top-tier folder to separate application environments (prod and dev). The developers need to see all application development audit logs but they are not permitted to review production logs. Your security team can review all logs in production and development environments. You must grant Identity and Access Management (IAM) roles at the right resource level tor the developers and security team while you ensure least privilege.

What should you do?

* 1 Grant logging, viewer rote to the security team at the organization resource level. * 2 Grant logging, viewer rote to the developer team at the folder resource level that contains all the dev projects.

* 1 Grant logging. viewer rote to the security team at the organization resource level. * 2 Grant logging. admin role to the developer team at the organization resource level.

* 1 Grant logging.admin role to the security team at the organization resource level. * 2 Grant logging. viewer rote to the developer team at the folder resource level that contains all the dev projects.

* 1 Grant logging.admin role to the security team at the organization resource level. * 2 Grant logging.admin role to the developer team at the organization resource level.

Show Answer Comment (0)

Question 203

Your organization s customers must scan and upload the contract and their driver license into a web portal in Cloud Storage. You must remove all personally identifiable information (Pll) from files that are older than 12 months. Also you must archive the anonymized files for retention purposes.

What should you do?

Set a time to live (TTL) of 12 months for the files in the Cloud Storage bucket that removes PH and moves the files to the archive storage class.

Create a Cloud Data Loss Prevention (DLP) inspection job that de-identifies Pll in files created more than 12 months ago and archives them to another Cloud Storage bucket. Delete the original files.

Schedule a Cloud Key Management Service (KMS) rotation period of 12 months for the encryption keys of the Cloud Storage files containing Pll to de-identify them Delete the original keys.

Configure the Autoclass feature of the Cloud Storage bucket to de-identify Pll Archive the files that are older than 12 months Delete the original files.

Show Answer Comment (0)

Question 204

After completing a security vulnerability assessment, you learned that cloud administrators leave Google Cloud CLI sessions open for days. You need to reduce the risk of attackers who might exploit these open sessions by setting these sessions to the minimum duration.

What should you do?

Set the session duration for the Google session control to one hour.

Set the reauthentication frequency (or the Google Cloud Session Control to one hour.

Set the organization policy constraint constraints/iam.allowServiceAccountCredentialLifetimeExtension to one hour.

Set the organization policy constraint constraints/iam. serviceAccountKeyExpiryHours to one hour and inheritFromParent to false.

Show Answer Comment (0)

Question 205

Your application is deployed as a highly available cross-region solution behind a global external HTTP(S) load balancer. You notice significant spikes in traffic from multiple IP addresses but it is unknown whether the IPs are malicious. You are concerned about your application's availability. You want to limit traffic from these clients over a specified time interval.

What should you do?

Configure a rate_based_ban action by using Google Cloud Armor and set the ban_duration_sec parameter to the specified time interval.

Configure a deny action by using Google Cloud Armor to deny the clients that issued too many requests over the specified time interval.

Configure a throttle action by using Google Cloud Armor to limit the number of requests per client over a specified time interval.

Configure a firewall rule in your VPC to throttle traffic from the identified IP addresses.

Show Answer Comment (0)

Question 206

You have numerous private virtual machines on Google Cloud. You occasionally need to manage the servers through Secure Socket Shell (SSH) from a remote location. You want to configure remote access to the servers in a manner that optimizes security and cost efficiency.

What should you do?

Create a site-to-site VPN from your corporate network to Google Cloud.

Configure server instances with public IP addresses Create a firewall rule to only allow traffic from your corporate IPs.

Create a firewall rule to allow access from the Identity-Aware Proxy (IAP) IP range Grant the role of an IAP- secured Tunnel User to the administrators.

Create a jump host instance with public IP Manage the instances by connecting through the jump host.

Show Answer Comment (0)

Question 207

Your organization has on-premises hosts that need to access Google Cloud APIs You must enforce private connectivity between these hosts minimize costs and optimize for operational efficiency

What should you do?

Route all on-premises traffic to Google Cloud through an IPsec VPN tunnel to a VPC with Private Google Access enabled.

Set up VPC peering between the hosts on-premises and the VPC through the internet.

Enforce a security policy that mandates all applications to encrypt data with a Cloud Key Management. Service (KMS) key before you send it over the network.

Route all on-premises traffic to Google Cloud through a dedicated or Partner interconnect to a VPC with Private Google Access enabled.

Show Answer Comment (0)

Question 208

Your organization s record data exists in Cloud Storage. You must retain all record data for at least seven years This policy must be permanent.

What should you do?

* 1 Identify buckets with record data * 2 Apply a retention policy and set it to retain for seven years * 3 Monitor the bucket by using log-based alerts to ensure that no modifications to the retention policy occurs

* 1 Identify buckets with record data * 2 Apply a retention policy and set it to retain for seven years * 3 Remove any Identity and Access Management (IAM) roles that contain the storage buckets update permission

* 1 Identify buckets with record data * 2 Enable the bucket policy only to ensure that data is retained * 3 Enable bucket lock

* 1 Identify buckets with record data * 2 Apply a retention policy and set it to retain for seven years * 3 Enable bucket lock

Show Answer Comment (0)

Question 209

Your organization wants to protect all workloads that run on Compute Engine VM to ensure that the instances weren't compromised by boot-level or kernel-level malware. Also, you need to ensure that data in use on the VM cannot be read by the underlying host system by using a hardware-based solution.

What should you do?

* 1 Use Google Shielded VM including secure boot Virtual Trusted Platform Module (vTPM) and integrity monitoring * 2 Create a Cloud Run function to check for the VM settings generate metrics and run the function regularly

* 1 Activate Virtual Machine Threat Detection in Security Command Center (SCO Premium * 2 Monitor the findings in SCC

* 1 Use Google Shielded VM including secure boot Virtual Trusted Platform Module (vTPM) and integrity monitoring * 2 Activate Confidential Computing * 3 Enforce these actions by using organization policies

* 1 Use secure hardened images from the Google Cloud Marketplace * 2 When deploying the images activate the Confidential Computing option * 3 Enforce the use of the correct images and Confidential Computing by using organization policies

Show Answer Comment (0)

Question 210

Your company uses Google Cloud and has publicly exposed network assets. You want to discover the assets and perform a security audit on these assets by using a software tool in the least amount of time.

What should you do?

Run a platform security scanner on all instances in the organization.

Notify Google about the pending audit and wait for confirmation before performing the scan.

Contact a Google approved security vendor to perform the audit.

Identify all external assets by using Cloud Asset Inventory and then run a network security scanner against them.

Show Answer Comment (0)

Total 235 questions