ExamGecko
Login
Ask Question

Google Professional Cloud Security Engineer Practice Test - Questions Answers, Page 11

List of questions

Question 101

Report
Export
Collapse

Your company wants to determine what products they can build to help customers improve their credit scores depending on their age range. To achieve this, you need to join user information in the company's banking app with customers' credit score data received from a third party. While using this raw data will allow you to complete this task, it exposes sensitive data, which could be propagated into new systems.

This risk needs to be addressed using de-identification and tokenization with Cloud Data Loss Prevention while maintaining the referential integrity across the database. Which cryptographic token format should you use to meet these requirements?

Deterministic encryption
Deterministic encryption
Secure, key-based hashes
Secure, key-based hashes
Format-preserving encryption
Format-preserving encryption
Cryptographic hashing
Cryptographic hashing
Suggested answer: A

Explanation:

''This encryption method is reversible, which helps to maintain referential integrity across your database and has no character-set limitations.'' https://cloud.google.com/blog/products/identity-security/take-charge-of-your-data-how-tokenization-makes-data-usable-without-sacrificing-privacy

https://cloud.google.com/dlp/docs/pseudonymization

FPE provides fewer security guarantees compared to other deterministic encryption methods such as AES-SIV. For these reasons, Google strongly recommends using deterministic encryption with AES-SIV instead of FPE for all security sensitive use cases. Other methods like deterministic encryption using AES-SIV provide these stronger security guarantees and are recommended for tokenization use cases unless length and character set preservation are strict requirements---for example, for backward compatibility with a legacy data system.

asked 18/09/2024
Sander de Beus
36 questions

Question 102

Report
Export
Collapse

An office manager at your small startup company is responsible for matching payments to invoices and creating billing alerts. For compliance reasons, the office manager is only permitted to have the Identity and Access Management (IAM) permissions necessary for these tasks. Which two IAM roles should the office manager have? (Choose two.)

Organization Administrator
Organization Administrator
Project Creator
Project Creator
Billing Account Viewer
Billing Account Viewer
Billing Account Costs Manager
Billing Account Costs Manager
Billing Account User
Billing Account User
Suggested answer: C, D

Explanation:

https://cloud.google.com/billing/docs/how-to/billing-access#overview-of-cloud-billing-roles-in-cloud-iam

Billing Account Costs Manager (roles/billing.costsManager)

- Manage budgets and view and export cost information of billing accounts (but not pricing information)

Billing Account Viewer (roles/billing.viewer)

- View billing account cost information and transactions.

asked 18/09/2024
Brian Carlo Hubilla
36 questions

Question 103

Report
Export
Collapse

You are designing a new governance model for your organization's secrets that are stored in Secret Manager. Currently, secrets for Production and Non-Production applications are stored and accessed using service accounts. Your proposed solution must:

Provide granular access to secrets

Give you control over the rotation schedules for the encryption keys that wrap your secrets

Maintain environment separation

Provide ease of management

Which approach should you take?

1. Use separate Google Cloud projects to store Production and Non-Production secrets. 2. Enforce access control to secrets using project-level identity and Access Management (IAM) bindings. 3. Use customer-managed encryption keys to encrypt secrets.
1. Use separate Google Cloud projects to store Production and Non-Production secrets. 2. Enforce access control to secrets using project-level identity and Access Management (IAM) bindings. 3. Use customer-managed encryption keys to encrypt secrets.
1. Use a single Google Cloud project to store both Production and Non-Production secrets. 2. Enforce access control to secrets using secret-level Identity and Access Management (IAM) bindings. 3. Use Google-managed encryption keys to encrypt secrets.
1. Use a single Google Cloud project to store both Production and Non-Production secrets. 2. Enforce access control to secrets using secret-level Identity and Access Management (IAM) bindings. 3. Use Google-managed encryption keys to encrypt secrets.
1. Use separate Google Cloud projects to store Production and Non-Production secrets. 2. Enforce access control to secrets using secret-level Identity and Access Management (IAM) bindings. 3. Use Google-managed encryption keys to encrypt secrets.
1. Use separate Google Cloud projects to store Production and Non-Production secrets. 2. Enforce access control to secrets using secret-level Identity and Access Management (IAM) bindings. 3. Use Google-managed encryption keys to encrypt secrets.
1. Use a single Google Cloud project to store both Production and Non-Production secrets. 2. Enforce access control to secrets using project-level Identity and Access Management (IAM) bindings. 3. Use customer-managed encryption keys to encrypt secrets.
1. Use a single Google Cloud project to store both Production and Non-Production secrets. 2. Enforce access control to secrets using project-level Identity and Access Management (IAM) bindings. 3. Use customer-managed encryption keys to encrypt secrets.
Suggested answer: A

Explanation:

Provide granular access to secrets: 2.Enforce access control to secrets using project-level identity and Access Management (IAM) bindings. Give you control over the rotation schedules for the encryption keys that wrap your secrets: 3. Use customer-managed encryption keys to encrypt secrets. Maintain environment separation: 1. Use separate Google Cloud projects to store Production and Non-Production secrets.

asked 18/09/2024
Katherin Aragon Calderon
32 questions

Question 104

Report
Export
Collapse

You are a security engineer at a finance company. Your organization plans to store data on Google Cloud, but your leadership team is worried about the security of their highly sensitive data Specifically, your company is concerned about internal Google employees' ability to access your company's data on Google Cloud. What solution should you propose?

Use customer-managed encryption keys.
Use customer-managed encryption keys.
Use Google's Identity and Access Management (IAM) service to manage access controls on Google Cloud.
Use Google's Identity and Access Management (IAM) service to manage access controls on Google Cloud.
Enable Admin activity logs to monitor access to resources.
Enable Admin activity logs to monitor access to resources.
Enable Access Transparency logs with Access Approval requests for Google employees.
Enable Access Transparency logs with Access Approval requests for Google employees.
Suggested answer: D

Explanation:

https://cloud.google.com/access-transparency Access approval Explicitly approve access to your data or configurations on Google Cloud. Access Approval requests, when combined with Access Transparency logs, can be used to audit an end-to-end chain from support ticket to access request to approval, to eventual access.

asked 18/09/2024
Olusola Adebayo
44 questions

Question 105

Report
Export
Collapse

You want to use the gcloud command-line tool to authenticate using a third-party single sign-on (SSO) SAML identity provider. Which options are necessary to ensure that authentication is supported by the third-party identity provider (IdP)? (Choose two.)

SSO SAML as a third-party IdP
SSO SAML as a third-party IdP
Identity Platform
Identity Platform
OpenID Connect
OpenID Connect
Identity-Aware Proxy
Identity-Aware Proxy
Cloud Identity
Cloud Identity
Suggested answer: A, C

Explanation:

To provide users with SSO-based access to selected cloud apps, Cloud Identity as your IdP supports the OpenID Connect (OIDC) and Security Assertion Markup Language 2.0 (SAML) protocols. https://cloud.google.com/identity/solutions/enable-sso

asked 18/09/2024
Vahit Erciyas
44 questions

Question 106

Report
Export
Collapse

You work for a large organization where each business unit has thousands of users. You need to delegate management of access control permissions to each business unit. You have the following requirements:

Each business unit manages access controls for their own projects.

Each business unit manages access control permissions at scale.

Business units cannot access other business units' projects.

Users lose their access if they move to a different business unit or leave the company.

Users and access control permissions are managed by the on-premises directory service.

What should you do? (Choose two.)

Use VPC Service Controls to create perimeters around each business unit's project.
Use VPC Service Controls to create perimeters around each business unit's project.
Organize projects in folders, and assign permissions to Google groups at the folder level.
Organize projects in folders, and assign permissions to Google groups at the folder level.
Group business units based on Organization Units (OUs) and manage permissions based on OUs.
Group business units based on Organization Units (OUs) and manage permissions based on OUs.
Create a project naming convention, and use Google's IAM Conditions to manage access based on the prefix of project names.
Create a project naming convention, and use Google's IAM Conditions to manage access based on the prefix of project names.
Use Google Cloud Directory Sync to synchronize users and group memberships in Cloud Identity.
Use Google Cloud Directory Sync to synchronize users and group memberships in Cloud Identity.
Suggested answer: B, E
asked 18/09/2024
Chan Man Wong
43 questions

Question 107

Report
Export
Collapse

Your organization recently deployed a new application on Google Kubernetes Engine. You need to deploy a solution to protect the application. The solution has the following requirements:

Scans must run at least once per week

Must be able to detect cross-site scripting vulnerabilities

Must be able to authenticate using Google accounts

Which solution should you use?

Google Cloud Armor
Google Cloud Armor
Web Security Scanner
Web Security Scanner
Security Health Analytics
Security Health Analytics
Container Threat Detection
Container Threat Detection
Suggested answer: B

Explanation:

Web Security Scanner identifies security vulnerabilities in your App Engine, Google Kubernetes Engine (GKE), and Compute Engine web applications. https://cloud.google.com/security-command-center/docs/concepts-web-security-scanner-overview

asked 18/09/2024
Nisanka Mandara
39 questions

Question 108

Report
Export
Collapse

An organization is moving applications to Google Cloud while maintaining a few mission-critical applications on-premises. The organization must transfer the data at a bandwidth of at least 50 Gbps. What should they use to ensure secure continued connectivity between sites?

Dedicated Interconnect
Dedicated Interconnect
Cloud Router
Cloud Router
Cloud VPN
Cloud VPN
Partner Interconnect
Partner Interconnect
Suggested answer: A

Explanation:

https://cloud.google.com/network-connectivity/docs/interconnect/concepts/overview

asked 18/09/2024
Ahmed Khalifa
47 questions

Question 109

Report
Export
Collapse

Your organization has had a few recent DDoS attacks. You need to authenticate responses to domain name lookups. Which Google Cloud service should you use?

Cloud DNS with DNSSEC
Cloud DNS with DNSSEC
Cloud NAT
Cloud NAT
HTTP(S) Load Balancing
HTTP(S) Load Balancing
Google Cloud Armor
Google Cloud Armor
Suggested answer: A

Explanation:

The Domain Name System Security Extensions (DNSSEC) is a feature of the Domain Name System (DNS) that authenticates responses to domain name lookups. It does not provide privacy protections for those lookups, but prevents attackers from manipulating or poisoning the responses to DNS requests. https://cloud.google.com/dns/docs/dnssec

asked 18/09/2024
Johan Benavides
42 questions

Question 110

Report
Export
Collapse

Your Security team believes that a former employee of your company gained unauthorized access to Google Cloud resources some time in the past 2 months by using a service account key. You need to confirm the unauthorized access and determine the user activity. What should you do?

Use Security Health Analytics to determine user activity.
Use Security Health Analytics to determine user activity.
Use the Cloud Monitoring console to filter audit logs by user.
Use the Cloud Monitoring console to filter audit logs by user.
Use the Cloud Data Loss Prevention API to query logs in Cloud Storage.
Use the Cloud Data Loss Prevention API to query logs in Cloud Storage.
Use the Logs Explorer to search for user activity.
Use the Logs Explorer to search for user activity.
Suggested answer: D

Explanation:

We use audit logs by searching the Service Account and checking activities in the past 2 months. (the user identity will not be seen since he used the SA identity but we can make correlations based on ip address, working hour, etc. )

asked 18/09/2024
Isidre Piguillem
42 questions
Total 235 questions
Go to page: of 24
Search
Open VPLUS File
Convert VPLUS to PDF

Related questions

A company is using Google Kubernetes Engine (GKE) with container images of a mission-critical application The company wants to scan the images for known security issues and securely share the report with the security team without exposing them outside Google Cloud. What should you do?
Your security team wants to implement a defense-in-depth approach to protect sensitive data stored in a Cloud Storage bucket. Your team has the following requirements: The Cloud Storage bucket in Project A can only be readable from Project B. The Cloud Storage bucket in Project A cannot be accessed from outside the network. Data in the Cloud Storage bucket cannot be copied to an external Cloud Storage bucket. What should the security team do?
Your organization acquired a new workload. The Web and Application (App) servers will be running on Compute Engine in a newly created custom VPC. You are responsible for configuring a secure network communication solution that meets the following requirements: Only allows communication between the Web and App tiers. Enforces consistent network security when autoscaling the Web and App tiers. Prevents Compute Engine Instance Admins from altering network traffic. What should you do?
You have been tasked with inspecting IP packet data for invalid or malicious content. What should you do?
You have been tasked with implementing external web application protection against common web application attacks for a public application on Google Cloud. You want to validate these policy changes before they are enforced. What service should you use?
You are on your company's development team. You noticed that your web application hosted in staging on GKE dynamically includes user data in web pages without first properly validating the inputted data. This could allow an attacker to execute gibberish commands and display arbitrary content in a victim user's browser in a production environment. How should you prevent and fix this vulnerability?
For compliance reasons, an organization needs to ensure that in-scope PCI Kubernetes Pods reside on ''in- scope'' Nodes only. These Nodes can only contain the ''in-scope'' Pods. How should the organization achieve this objective?
A company allows every employee to use Google Cloud Platform. Each department has a Google Group, with all department members as group members. If a department member creates a new project, all members of that department should automatically have read-only access to all new project resources. Members of any other department should not have access to the project. You need to configure this behavior. What should you do to meet these requirements?
An employer wants to track how bonus compensations have changed over time to identify employee outliers and correct earning disparities. This task must be performed without exposing the sensitive compensation data for any individual and must be reversible to identify the outlier. Which Cloud Data Loss Prevention API technique should you use to accomplish this?
You are responsible for managing your company's identities in Google Cloud. Your company enforces 2-Step Verification (2SV) for all users. You need to reset a user's access, but the user lost their second factor for 2SV. You want to minimize risk. What should you do?