Home / Google / Professional Cloud Security Engineer

Google Professional Cloud Security Engineer Practice Test - Questions Answers, Page 23

Question list

List of questions

Question 221

(0)

Your company conducts clinical trials and needs to analyze the results of a recent study that are stored in BigQuery. The interval when the medicine was taken contains start and stop dates The inter

Question 222

(0)

You are setting up a new Cloud Storage bucket in your environment that is encrypted with a customer managed encryption key (CMEK). The CMEK is stored in Cloud Key Management Service (KMS). in projec

Question 223

(0)

You are deploying regulated workloads on Google Cloud. The regulation has data residency and data access requirements. It also requires that support is provided from the same geographical location a

Question 224

(0)

You are migrating an application into the cloud The application will need to read data from a Cloud Storage bucket. Due to local regulatory requirements, you need to hold the key material used for e

Question 225

(0)

Your organization develops software involved in many open source projects and is concerned about software supply chain threats You need to deliver provenance for the build to demonstrate the softwar

Question 226

(0)

You control network traffic for a folder in your Google Cloud environment. Your folder includes multiple projects and Virtual Private Cloud (VPC) networks You want to enforce on the folder level tha

Question 227

(0)

Your Google Cloud environment has one organization node, one folder named Apps.' and several projects within that folder The organizational node enforces the constraints/iam.allowedPolicyMemberDomai

Question 228

(0)

You manage a fleet of virtual machines (VMs) in your organization. You have encountered issues with lack of patching in many VMs. You need to automate regular patching in your VMs and view the patch

Question 229

(0)

Employees at your company use their personal computers to access your organization s Google Cloud console. You need to ensure that users can only access the Google Cloud console from their corporate

Question 230

(0)

You are developing a new application that uses exclusively Compute Engine VMs Once a day. this application will execute five different batch jobs Each of the batch jobs requires a dedicated set of p

Question 221

Your company conducts clinical trials and needs to analyze the results of a recent study that are stored in BigQuery. The interval when the medicine was taken contains start and stop dates The interval data is critical to the analysis, but specific dates may identify a particular batch and introduce bias You need to obfuscate the start and end dates for each row and preserve the interval data.

What should you do?

Use bucketing to shift values to a predetermined date based on the initial value.

Extract the date using TimePartConfig from each date field and append a random month and year

Use date shifting with the context set to the unique ID of the test subject

Use the FFX mode of format preserving encryption (FPE) and maintain data consistency

Show Answer Comment (0)

Question 222

You are setting up a new Cloud Storage bucket in your environment that is encrypted with a customer managed encryption key (CMEK). The CMEK is stored in Cloud Key Management Service (KMS). in project 'pr j -a', and the Cloud Storage bucket will use project 'prj-b'. The key is backed by a Cloud Hardware Security Module (HSM) and resides in the region europe-west3. Your storage bucket will be located in the region europe-west1. When you create the bucket, you cannot access the key. and you need to troubleshoot why.

What has caused the access issue?

A firewall rule prevents the key from being accessible.

Cloud HSM does not support Cloud Storage

The CMEK is in a different project than the Cloud Storage bucket

The CMEK is in a different region than the Cloud Storage bucket.

Show Answer Comment (0)

Question 223

You are deploying regulated workloads on Google Cloud. The regulation has data residency and data access requirements. It also requires that support is provided from the same geographical location as where the data resides.

What should you do?

Enable Access Transparency Logging.

Deploy resources only to regions permitted by data residency requirements

Use Data Access logging and Access Transparency logging to confirm that no users are accessing data from another region.

Deploy Assured Workloads.

Show Answer Comment (0)

Question 224

You are migrating an application into the cloud The application will need to read data from a Cloud Storage bucket. Due to local regulatory requirements, you need to hold the key material used for encryption fully under your control and you require a valid rationale for accessing the key material.

What should you do?

Encrypt the data in the Cloud Storage bucket by using Customer Managed Encryption Keys. Configure an IAM deny policy for unauthorized groups

Encrypt the data in the Cloud Storage bucket by using Customer Managed Encryption Keys backed by a Cloud Hardware Security Module (HSM). Enable data access logs.

Generate a key in your on-premises environment and store it in a Hardware Security Module (HSM) that is managed on-premises Use this key as an external key in the Cloud Key Management Service (KMS). Activate Key Access Justifications (KAJ) and set the external key system to reject unauthorized accesses.

Generate a key in your on-premises environment to encrypt the data before you upload the data to the Cloud Storage bucket Upload the key to the Cloud Key Management Service (KMS). Activate Key Access Justifications (KAJ) and have the external key system reject unauthorized accesses.

Show Answer Comment (0)

Question 225

Your organization develops software involved in many open source projects and is concerned about software supply chain threats You need to deliver provenance for the build to demonstrate the software is untampered.

What should you do?

* 1- Generate Supply Chain Levels for Software Artifacts (SLSA) level 3 assurance by using Cloud Build. * 2. View the build provenance in the Security insights side panel within the Google Cloud console.

* 1. Review the software process. * 2. Generate private and public key pairs and use Pretty Good Privacy (PGP) protocols to sign the output software artifacts together with a file containing the address of your enterprise and point of contact. * 3. Publish the PGP signed attestation to your public web page.

* 1, Publish the software code on GitHub as open source. * 2. Establish a bug bounty program, and encourage the open source community to review, report, and fix the vulnerabilities.

* 1. Hire an external auditor to review and provide provenance * 2. Define the scope and conditions. * 3. Get support from the Security department or representative. * 4. Publish the attestation to your public web page.

Show Answer Comment (0)

Question 226

You control network traffic for a folder in your Google Cloud environment. Your folder includes multiple projects and Virtual Private Cloud (VPC) networks You want to enforce on the folder level that egress connections are limited only to IP range 10.58.5.0/24 and only from the VPC network dev-vpc.' You want to minimize implementation and maintenance effort

What should you do?

* 1. Attach external IP addresses to the VMs in scope. * 2. Configure a VPC Firewall rule in 'dev-vpc' that allows egress connectivity to IP range 10.58.5.0/24 for all source addresses in this network.

* 1. Attach external IP addresses to the VMs in scope. * 2. Define and apply a hierarchical firewall policy on folder level to deny all egress connections and to allow egress to IP range 10 58.5.0/24 from network dev-vpc.

* 1. Leave the network configuration of the VMs in scope unchanged. * 2. Create a new project including a new VPC network 'new-vpc.' * 3 Deploy a network appliance in 'new-vpc' to filter access requests and only allow egress connections from -dev-vpc' to 10.58.5.0/24.

* 1 Leave the network configuration of the VMs in scope unchanged * 2 Enable Cloud NAT for dev-vpc' and restrict the target range in Cloud NAT to 10.58.5 0/24.

Show Answer Comment (0)

Question 227

Your Google Cloud environment has one organization node, one folder named Apps.' and several projects within that folder The organizational node enforces the constraints/iam.allowedPolicyMemberDomains organization policy, which allows members from the terramearth.com organization The 'Apps' folder enforces the constraints/iam.allowedPolicyMemberDomains organization policy, which allows members from the flowlogistic.com organization. It also has the inheritFromParent: false property.

You attempt to grant access to a project in the Apps folder to the user [email protected].

What is the result of your action and why?

The action fails because a constraints/iam.allowedPolicyMemberDomains organization policy must be defined on the current project to deactivate the constraint temporarily.

The action fails because a constraints/iam.allowedPolicyMemberDomains organization policy is in place and only members from the flowlogistic.com organization are allowed.

The action succeeds because members from both organizations, terramearth. com or flowlogistic.com, are allowed on projects in the 'Apps' folder

The action succeeds and the new member is successfully added to the project's Identity and Access Management (IAM) policy because all policies are inherited by underlying folders and projects.

Show Answer Comment (0)

Question 228

You manage a fleet of virtual machines (VMs) in your organization. You have encountered issues with lack of patching in many VMs. You need to automate regular patching in your VMs and view the patch management data across multiple projects.

What should you do?

Choose 2 answers

Deploy patches with VM Manager by using OS patch management

View patch management data in VM Manager by using OS patch management.

Deploy patches with Security Command Center by using Rapid Vulnerability Detection.

View patch management data in a Security Command Center dashboard.

View patch management data in Artifact Registry.

Show Answer Comment (0)

Question 229

Employees at your company use their personal computers to access your organization s Google Cloud console. You need to ensure that users can only access the Google Cloud console from their corporate-issued devices and verify that they have a valid enterprise certificate

What should you do?

Implement an Identity and Access Management (IAM) conditional policy to verify the device certificate

Implement a VPC firewall policy Activate packet inspection and create an allow rule to validate and verify the device certificate.

Implement an organization policy to verify the certificate from the access context.

Implement an Access Policy in BeyondCorp Enterprise to verify the device certificate Create an access binding with the access policy just created.

Show Answer Comment (0)

Question 230

You are developing a new application that uses exclusively Compute Engine VMs Once a day. this application will execute five different batch jobs Each of the batch jobs requires a dedicated set of permissions on Google Cloud resources outside of your application. You need to design a secure access concept for the batch jobs that adheres to the least-privilege principle

What should you do?

1. Create a general service account 'g-sa' to execute the batch jobs. * 2 Grant the permissions required to execute the batch jobs to g-sa. * 3. Execute the batch jobs with the permissions granted to g-sa

1. Create a general service account 'g-sa' to orchestrate the batch jobs. * 2. Create one service account per batch job Mb-sa-[1-5],' and grant only the permissions required to run the individual batch jobs to the service accounts. * 3. Grant the Service Account Token Creator role to g-sa Use g-sa to obtain short-lived access tokens for b-sa-[1-5] and to execute the batch jobs with the permissions of b-sa-[1-5].

1. Create a workload identity pool and configure workload identity pool providers for each batch job * 2 Assign the workload identity user role to each of the identities configured in the providers. * 3. Create one service account per batch job Mb-sa-[1-5]'. and grant only the permissions required to run the individual batch jobs to the service accounts * 4 Generate credential configuration files for each of the providers Use these files to execute the batch jobs with the permissions of b-sa-[1-5].

* 1. Create a general service account 'g-sa' to orchestrate the batch jobs. * 2 Create one service account per batch job 'b-sa-[1-5)\ Grant only the permissions required to run the individual batch jobs to the service accounts and generate service account keys for each of these service accounts * 3. Store the service account keys in Secret Manager. Grant g-sa access to Secret Manager and run the batch jobs with the permissions of b-sa-[1-5].

Show Answer Comment (0)

Total 235 questions