Get Special Discount Offer of Professional-Cloud-Security-Engineer Certification Exam Sample Questions and Answers
New Professional-Cloud-Security-Engineer Dumps For Preparing Google Cloud Certified Certified Google Exam Well
NEW QUESTION # 83
Your company's cloud security policy dictates that VM instances should not have an external IP address. You need to identify the Google Cloud service that will allow VM instances without external IP addresses to connect to the internet to update the VMs. Which service should you use?
- A. Identity Aware-Proxy
- B. TCP/UDP Load Balancing
- C. Cloud NAT
- D. Cloud DNS
Answer: C
NEW QUESTION # 84
You have stored company approved compute images in a single Google Cloud project that is used as an image repository. This project is protected with VPC Service Controls and exists in the perimeter along with other projects in your organization. This lets other projects deploy images from the image repository project. A team requires deploying a third-party disk image that is stored in an external Google Cloud organization. You need to grant read access to the disk image so that it can be deployed into the perimeter.
What should you do?
- A. 1. Update the perimeter.
2. Configure the ingressFrom field to set identityType to ANY_IDENTITY.
3. Configure the ingressTo field to include the external Google Cloud project number as an allowed resource and the serviceName to compute.googleapis.com. - B. 1. Update the perimeter.
2. Configure the egressTo field to set identityType to ANY_IDENTITY.
3. Configure the egressFrom field to include the external Google Cloud project number as an allowed resource and the serviceName to compute.googleapis.com. - C. 1. Update the perimeter.
2. Configure the egressTo field to include the external Google Cloud project number as an allowed resource and the serviceName to compute.googleapis.com.
3. Configure the egressFrom field to set identityType to ANY_IDENTITY. - D. Allow the external project by using the organizational policy,
constraints/compute.trustedImageProjects.
Answer: C
Explanation:
A Compute Engine client within a service perimeter calling a Compute Engine create operation where the image resource is outside the perimeter.
https://cloud.google.com/vpc-service-controls/docs/ingress-egress-
rules#:~:text=Egress%20Refers%20to%20any%20access,resource%20is%20outside%20the%20 perimeter.
NEW QUESTION # 85
Your organization uses the top-tier folder to separate application environments (prod and dev). The developers need to see all application development audit logs but they are not permitted to review production logs. Your security team can review all logs in production and development environments. You must grant Identity and Access Management (1AM) roles at the right resource level tor the developers and security team while you ensure least privilege.
What should you do?
- A. * 1 Grant logging.admin role to the security team at the organization resource level.
* 2 Grant logging. viewer rote to the developer team at the folder resource level that contains all the dev projects. - B. * 1 Grant logging. viewer rote to the security team at the organization resource level.
* 2 Grant logging. admin role to the developer team at the organization resource level. - C. * 1 Grant logging.admin role to the security team at the organization resource level.
* 2 Grant logging.admin role to the developer team at the organization resource level. - D. * 1 Grant logging, viewer rote to the security team at the organization resource level.
* 2 Grant logging, viewer rote to the developer team at the folder resource level that contains all the dev projects.
Answer: A
Explanation:
To ensure that the developers can view audit logs for the development environment and the security team can review all logs, you should grant IAM roles at the appropriate resource levels:
* Grant logging.admin Role to the Security Team:
* Assign the logging.admin role to the security team at the organization resource level.
* This grants the security team full access to all logging data across the organization, including both production and development environments.
* Grant logging.viewer Role to the Developer Team:
* Assign the logging.viewer role to the developer team at the folder resource level that contains all the development projects.
* This restricts the developers' access to only view logs in the development environment, ensuring they do not have access to production logs.
By using these roles and assigning them at the appropriate levels, you ensure that each team has the access they need while adhering to the principle of least privilege.
References:
* IAM Roles for Cloud Logging
* Resource Hierarchy in Google Cloud
NEW QUESTION # 86
A company's application is deployed with a user-managed Service Account key. You want to use Google- recommended practices to rotate the key.
What should you do?
- A. Create a new key, and use the new key in the application. Delete the old key from the Service Account.
- B. Open Cloud Shell and run gcloud iam service-accounts enable-auto-rotate --iam- account=IAM_ACCOUNT.
- C. Open Cloud Shell and run gcloud iam service-accounts keys rotate --iam- account=IAM_ACCOUNT --key=NEW_KEY.
- D. Create a new key, and use the new key in the application. Store the old key on the system as a backup key.
Answer: A
Explanation:
Explanation/Reference: https://cloud.google.com/iam/docs/understanding-service-accounts
NEW QUESTION # 87
Your company has been creating users manually in Cloud Identity to provide access to Google Cloud resources. Due to continued growth of the environment, you want to authorize the Google Cloud Directory Sync (GCDS) instance and integrate it with your on-premises LDAP server to onboard hundreds of users.
You are required to:
Replicate user and group lifecycle changes from the on-premises LDAP server in Cloud Identity.
Disable any manually created users in Cloud Identity.
You have already configured the LDAP search attributes to include the users and security groups in scope for Google Cloud. What should you do next to complete this solution?
- A. 1. Configure the option to suspend domain users not found in LDAP.2. Set up a recurring GCDS task.
- B. 1. Configure the LDAP search attributes to exclude manually created Cloud Identity users not found in LDAP.2. Set up a recurring GCDS task.
- C. 1. Configure the option to delete domain users not found in LDAP.2. Run GCDS after user and group lifecycle changes.
- D. 1. Configure the LDAP search attributes to exclude manually created Cloud identity users not found in LDAP.2. Run GCDS after user and group lifecycle changes.
Answer: A
NEW QUESTION # 88
Your Google Cloud organization allows for administrative capabilities to be distributed to each team through provision of a Google Cloud project with Owner role (roles/ owner). The organization contains thousands of Google Cloud Projects Security Command Center Premium has surfaced multiple cpen_myscl_port findings. You are enforcing the guardrails and need to prevent these types of common misconfigurations.
What should you do?
- A. Create a Google Cloud Armor security policy to deny traffic from 0 0 0 0/0.
- B. Create a firewall rule for each virtual private cloud (VPC) to deny traffic from 0 0 0 0/0 with priority 0.
- C. Create a hierarchical firewall policy configured at the organization to deny all connections from 0 0 0 0/0.
- D. Create a hierarchical firewall policy configured at the organization to allow connections only from internal IP ranges
Answer: D
Explanation:
Challenge:
Prevent common misconfigurations that expose services (e.g., MYSQL) to the public internet.
Hierarchical Firewall Policies:
These policies can be applied at the organization level to enforce consistent network security rules across all projects.
Solution:
Create a hierarchical firewall policy that allows connections only from internal IP ranges.
This policy ensures that services like MySQL are not exposed to 0.0.0.0/0 (the entire internet).
Steps:
Step 1: Define the hierarchical firewall policy at the organization level.
Step 2: Set the rule to allow traffic only from internal IP ranges.
Step 3: Apply the policy to all projects under the organization.
Benefits:
Centralized management of network security.
Prevents accidental exposure of services to the public internet, enhancing security.
Reference:
Hierarchical Firewall Policies
Securing MySQL on GCP
NEW QUESTION # 89
A customer wants to use Cloud Identity as their primary IdP. The customer wants to use other non-GCP SaaS products for CRM, messaging, and customer ticketing management. The customer also wants to improve employee experience with Single Sign-On (SSO) capabilities to securely access GCP and non-GCP applications. Only authorized individuals should be able to access these third-party applications. What action should the customer take to meet these requirements?
- A. Configure third-party applications to federate authentication and authorization to the GCP IdP.
- B. Remove the employee from Cloud Identity, set the correct license for the individuals, and resync them to Cloud Identity for the changes to take effect.
- C. Copy user personas from Cloud Identity to all third-party applications for the domain.
- D. Remove the individuals from the third-party applications, add the license to Cloud Identity, and resync the individuals back to the third-party applications.
Answer: A
Explanation:
A is not correct because Users should continue to be in Cloud Identity as central source of truth.
B is correct because cloud identity will serve as SAML auth for third party apps.
C is not correct because it doesn't help to automate user provisioning.
D is not correct because it doesn't help to automate user provisioning and deprovisioning on a continual basis.
https://cloud.google.com/identity/solutions/enable-sso
NEW QUESTION # 90
Your organization wants full control of the keys used to encrypt data at rest in their Google Cloud environments. Keys must be generated and stored outside of Google and integrate with many Google Services including BigQuery.
What should you do?
- A. Use Cloud External Key Management (EKM) that integrates with an external Hardware Security Module (HSM) system from supported vendors.
- B. Create a Cloud Key Management Service (KMS) key with imported key material. Wrap the key for protection during import. Import the key generated on a trusted system in Cloud KMS.
- C. Use customer-supplied encryption keys (CSEK) with keys generated on trusted external systems.
Provide the raw CSEK as part of the API call. - D. Create a KMS key that is stored on a Google managed FIPS 140-2 level 3 Hardware Security Module (HSM). Manage the Identity and Access Management (IAM) permissions settings, and set up the key rotation period.
Answer: A
Explanation:
https://cloud.google.com/kms/docs/ekm
NEW QUESTION # 91
You are responsible for managing your company's identities in Google Cloud. Your company enforces 2-Step Verification (2SV) for all users. You need to reset a user's access, but the user lost their second factor for 2SV. You want to minimize risk. What should you do?
- A. On the Google Admin console, use a super administrator account to reset the user account's credentials. Ask the user to update their credentials after their first login.
- B. On the Google Admin console, temporarily disable the 2SV requirements for all users. Ask the user to log in and add their new second factor to their account. Re-enable the 2SV requirement for all users.
- C. On the Google Admin console, select the appropriate user account, and generate a backup code to allow the user to sign in. Ask the user to update their second factor.
- D. On the Google Admin console, select the appropriate user account, and temporarily disable 2SV for this account Ask the user to update their second factor, and then re-enable 2SV for this account.
Answer: B
NEW QUESTION # 92
A customer has an analytics workload running on Compute Engine that should have limited internet access.
Your team created an egress firewall rule to deny (priority 1000) all traffic to the internet.
The Compute Engine instances now need to reach out to the public repository to get security updates. What should your team do?
- A. Create an egress firewall rule to allow traffic to the hostname of the repository with a priority greater than 1000.
- B. Create an egress firewall rule to allow traffic to the CIDR range of the repository with a priority less than 1000.
- C. Create an egress firewall rule to allow traffic to the hostname of the repository with a priority less than
1000. - D. Create an egress firewall rule to allow traffic to the CIDR range of the repository with a priority greater than 1000.
Answer: B
Explanation:
To allow Compute Engine instances to access public repositories for security updates while an egress firewall rule is in place to deny all internet traffic, you need to create a more specific egress rule that permits traffic to the CIDR range of the repository. The priority of this rule should be lower (i.e., a higher priority number) than the deny rule.
Steps:
* Identify the CIDR Range: Determine the CIDR range of the public repository from which the security updates will be fetched.
* Create Egress Firewall Rule: Create a new egress firewall rule allowing traffic to the identified CIDR range with a priority less than 1000.
* Apply Firewall Rule: Use the Google Cloud Console or gcloud command-line tool to apply the new firewall rule.
References:
* Google Cloud: Firewall rules
* Creating firewall rules
NEW QUESTION # 93
Users are reporting an outage on your public-facing application that is hosted on Compute Engine. You suspect that a recent change to your firewall rules is responsible. You need to test whether your firewall rules are working properly. What should you do?
- A. In a pre-production environment, disable all firewall rules individually to determine which one is blocking user traffic.
- B. Enable Firewall Rules Logging on the latest rules that were changed. Use Logs Explorer to analyze whether the rules are working correctly.
- C. Enable VPC Flow Logs in your VPC. Use Logs Explorer to analyze whether the rules are working correctly.
- D. Connect to a bastion host in your VPC. Use a network traffic analyzer to determine at which point your requests are being blocked.
Answer: B
Explanation:
Reference:
https://cloud.google.com/vpc/docs/firewall-rules-logging
NEW QUESTION # 94
A company is using Google Kubernetes Engine (GKE) with container images of a mission-critical application The company wants to scan the images for known security issues and securely share the report with the security team without exposing them outside Google Cloud.
What should you do?
- A. * 1. Get a GitHub subscription.
* 2. Build the images in Cloud Build and store them in GitHub for automatic scanning
* 3. Download the report from GitHub and share with the Security Team - B. 1. Enable Container Threat Detection in the Security Command Center Premium tier.
* 2. Upgrade all clusters that are not on a supported version of GKE to the latest possible GKE version.
* 3. View and share the results from the Security Command Center - C. * 1. Use an open source tool in Cloud Build to scan the images.
* 2. Upload reports to publicly accessible buckets in Cloud Storage by using gsutil
* 3. Share the scan report link with your security department. - D. * 1. Enable vulnerability scanning in the Artifact Registry settings.
* 2. Use Cloud Build to build the images
* 3. Push the images to the Artifact Registry for automatic scanning.
* 4. View the reports in the Artifact Registry.
Answer: D
Explanation:
Explanation
"The service evaluates all changes and remote access attempts to detect runtime attacks in near-real time." :
https://cloud.google.com/security-command-center/docs/concepts-container-threat-detection-overview This has nothing to do with KNOWN security Vulns in images
NEW QUESTION # 95
You are backing up application logs to a shared Cloud Storage bucket that is accessible to both the administrator and analysts. Analysts should not have access to logs that contain any personally identifiable information (PII). Log files containing PII should be stored in another bucket that is only accessible to the administrator. What should you do?
- A. On the shared bucket, configure Object Lifecycle Management to delete objects that contain Pll.
- B. On the shared bucket, configure a Cloud Storage trigger that is only triggered when Pll is uploaded. Use Cloud Functions to capture the trigger and delete the files that contain Pll.
- C. Use Pub/Sub and Cloud Functions to trigger a Cloud Data Loss Prevention scan every time a file is uploaded to the administrator's bucket. If the scan does not detect Pll, have the function move the objects into the shared Cloud Storage bucket.
- D. Upload the logs to both the shared bucket and the bucket with Pll that is only accessible to the administrator. Use the Cloud Data Loss Prevention API to create a job trigger. Configure the trigger to delete any files that contain Pll from the shared bucket.
Answer: C
Explanation:
Use Pub/Sub and Cloud Functions to trigger a Cloud Data Loss Prevention scan every time a file is uploaded to the administrator's bucket. If the scan does not detect PII, have the function move the objects into the shared Cloud Storage bucket:
Configure a Pub/Sub topic to publish notifications when new files are uploaded to the administrator's bucket.
Create a Cloud Function that is triggered by the Pub/Sub topic. This function uses the Cloud Data Loss Prevention (DLP) API to scan the uploaded files for PII.
If the scan does not detect PII, the function moves the file to the shared Cloud Storage bucket. This ensures that only non-sensitive data is accessible to analysts, while PII remains secure in the administrator's bucket.
Reference:
Using Pub/Sub with Cloud Functions
Cloud Data Loss Prevention API
NEW QUESTION # 96
An organization is starting to move its infrastructure from its on-premises environment to Google Cloud Platform (GCP). The first step the organization wants to take is to migrate its ongoing data backup and disaster recovery solutions to GCP. The organization's on-premises production environment is going to be the next phase for migration to GCP. Stable networking connectivity between the on-premises environment and GCP is also being implemented.
Which GCP solution should the organization use?
- A. Cloud Storage using a scheduled task and gsutil via Cloud Interconnect
- B. Cloud Datastore using regularly scheduled batch upload jobs via Cloud VPN
- C. Compute Engines Virtual Machines using Persistent Disk via Cloud Interconnect
- D. BigQuery using a data pipeline job with continuous updates via Cloud VPN
Answer: A
Explanation:
Objective: Migrate ongoing data backup and disaster recovery solutions to GCP.
Solution: Use Cloud Storage with scheduled tasks and gsutil.
Steps:
Step 1: Set up a Cloud Interconnect to ensure stable networking connectivity between the on-premises environment and GCP.
Step 2: Create a Cloud Storage bucket to store backups.
Step 3: Use gsutil, a command-line tool for Cloud Storage, to create scripts for data transfer.
Step 4: Schedule these scripts using cron jobs or another scheduling tool to automate the backup process.
Using Cloud Storage with scheduled tasks and gsutil ensures efficient and reliable backup and disaster recovery while leveraging stable connectivity provided by Cloud Interconnect.
Reference:
Cloud Storage Documentation
gsutil Tool Documentation
Cloud Interconnect Documentation
NEW QUESTION # 97
You want to prevent users from accidentally deleting a Shared VPC host project. Which organization-level policy constraint should you enable?
- A. compute.sharedReservationsOwnerProjects
- B. compute.restrictSharedVpcSubnetworks
- C. compute.restrictSharedVpcHostProjects
- D. compute.restrictXpnProjectLienRemoval
Answer: D
NEW QUESTION # 98
Which Identity-Aware Proxy role should you grant to an Identity and Access Management (IAM) user to access HTTPS resources?
- A. Service Broker Operator
- B. IAP-Secured Tunnel User
- C. IAP-Secured Web App User
- D. Security Reviewer
Answer: C
Explanation:
https://cloud.google.com/iap/docs/managing-access
"IAP-Secured Web App User: Grants access to the app and other HTTPS resources that use IAP."
NEW QUESTION # 99
......
The Google Professional-Cloud-Security-Engineer exam covers a wide range of topics related to cloud security, including security management, data protection, network security, compliance, and incident management. The candidates are expected to have a deep understanding of the security features and functionalities offered by GCP and know how to configure and manage these features. Professional-Cloud-Security-Engineer exam also tests the candidate’s ability to design and implement secure solutions on GCP using industry best practices.
Updated Professional-Cloud-Security-Engineer Dumps Questions Are Available For Passing Google Exam: https://dumpsstar.vce4plus.com/Google/Professional-Cloud-Security-Engineer-valid-vce-dumps.html