Google Professional Cloud Security Engineer Practice Test - Questions Answers, Page 18

List of questions

Question 171

You have created an OS image that is hardened per your organization's security standards and is being stored in a project managed by the security team. As a Google Cloud administrator, you need to make sure all VMs in your Google Cloud organization can only use that specific OS image while minimizing operational overhead. What should you do? (Choose two.)

Grant users the compuce.imageUser role in their own projects.

Grant users the compuce.imageUser role in the OS image project.

Store the image in every project that is spun up in your organization.

Set up an image access organization policy constraint, and list the security team managed project in the projects allow list.

Remove VM instance creation permission from users of the projects, and only allow you and your team to create VM instances.

Show Answer Comment (0)

Question 172

You're developing the incident response plan for your company. You need to define the access strategy that your DevOps team will use when reviewing and investigating a deployment issue in your Google Cloud environment. There are two main requirements:

Least-privilege access must be enforced at all times.

The DevOps team must be able to access the required resources only during the deployment issue.

How should you grant access while following Google-recommended best practices?

Assign the Project Viewer Identity and Access Management (IAM) role to the DevOps team.

Create a custom IAM role with limited list/view permissions, and assign it to the DevOps team.

Create a service account, and grant it the Project Owner IAM role. Give the Service Account User Role on this service account to the DevOps team.

Create a service account, and grant it limited list/view permissions. Give the Service Account User Role on this service account to the DevOps team.

Show Answer Comment (0)

Question 173

You are working with a client who plans to migrate their data to Google Cloud. You are responsible for recommending an encryption service to manage their encrypted keys. You have the following requirements:

The master key must be rotated at least once every 45days.

The solution that stores the master key must be FIPS 140-2 Level 3 validated.

The master key must be stored in multiple regions within the US for redundancy.

Which solution meets these requirements?

Customer-managed encryption keys with Cloud Key Management Service

Customer-managed encryption keys with Cloud HSM

Customer-supplied encryption keys

Google-managed encryption keys

Show Answer Comment (0)

Question 174

You manage your organization's Security Operations Center (SOC). You currently monitor and detect network traffic anomalies in your VPCs based on network logs. However, you want to explore your environment using network payloads and headers. Which Google Cloud product should you use?

Cloud IDS

VPC Service Controls logs

VPC Flow Logs

Google Cloud Armor

Packet Mirroring

Show Answer Comment (0)

Question 175

You are consulting with a client that requires end-to-end encryption of application data (including data in transit, data in use, and data at rest) within Google Cloud. Which options should you utilize to accomplish this? (Choose two.)

External Key Manager

Customer-supplied encryption keys

Hardware Security Module

Confidential Computing and Istio

Client-side encryption

Show Answer Comment (0)

Question 176

You need to enforce a security policy in your Google Cloud organization that prevents users from exposing objects in their buckets externally. There are currently no buckets in your organization. Which solution should you implement proactively to achieve this goal with the least operational overhead?