Professional-Cloud-Security-Engineer Dumps Free Test Engine Player Verified Updated [Jun 28, 2026]
Q&As with Explanations Verified & Correct Answers
NEW QUESTION # 99
Which type of load balancer should you use to maintain client IP by default while using the standard network tier?
- A. Internal TCP/UDP
- B. TCP Proxy
- C. SSL Proxy
- D. TCP/UDP Network
Answer: D
Explanation:
Explanation
https://cloud.google.com/load-balancing/docs/load-balancing-overview
https://cloud.google.com/load-balancing/docs/load-balancing-overview#choosing_a_load_balancer
NEW QUESTION # 100
You work for an organization in a regulated industry that has strict data protection requirements. The organization backs up their data in the cloud. To comply with data privacy regulations, this data can only be stored for a specific length of time and must be deleted after this specific period.
You want to automate the compliance with this regulation while minimizing storage costs. What should you do?
- A. Store the data in a Cloud Storage bucket, and configure the bucket's Object Lifecycle Management feature.
- B. Store the data in a Cloud Bigtable table, and set an expiration time on the column families.
- C. Store the data in a BigQuery table, and set the table's expiration time.
- D. Store the data in a persistent disk, and delete the disk at expiration time.
Answer: A
Explanation:
Explanation
To miminize costs, it's always GCS even though BQ comes as a close 2nd. But, since the question did not specify what kind of data it is (raw files vs tabular data), it is safe to assume GCS is the preferred option with LifeCycle enablement.
NEW QUESTION # 101
You are consulting with a client that requires end-to-end encryption of application data (including data in transit, data in use, and data at rest) within Google Cloud. Which options should you utilize to accomplish this? (Choose two.)
- A. Confidential Computing and Istio
- B. External Key Manager
- C. Hardware Security Module
- D. Customer-supplied encryption keys
- E. Client-side encryption
Answer: A,E
Explanation:
Explanation
Google Cloud customers with additional requirements for encryption of data over WAN can choose to implement further protections for data as it moves from a user to an application, or virtual machine to virtual machine. These protections include IPSec tunnels, Gmail S/MIME, managed SSL certificates, and Istio.
https://cloud.google.com/docs/security/encryption-in-transit
NEW QUESTION # 102
A customer wants to run a batch processing system on VMs and store the output files in a Cloud Storage bucket. The networking and security teams have decided that no VMs may reach the public internet.
How should this be accomplished?
- A. Provision a NAT Gateway to access the Cloud Storage API endpoint.
- B. Mount a Cloud Storage bucket as a local filesystem on every VM.
- C. Enable Private Google Access on the VPC.
- D. Create a firewall rule to block internet traffic from the VM.
Answer: C
Explanation:
Objective: Ensure VMs can access Cloud Storage without reaching the public internet.
Solution: Enable Private Google Access on the VPC network, allowing VMs with only internal IP addresses to access Google APIs and services privately.
Steps:
Step 1: Open the Google Cloud Console.
Step 2: Go to the VPC Network section.
Step 3: Select the relevant VPC network and subnet.
Step 4: Enable Private Google Access for the subnet.
Private Google Access ensures that instances can access Google APIs and services (such as Cloud Storage) over a private network connection, without requiring a public IP address.
Reference:
Configuring Private Google Access
Best Practices for Secure Access
NEW QUESTION # 103
A customer wants to make it convenient for their mobile workforce to access a CRM web interface that is hosted on Google Cloud Platform (GCP). The CRM can only be accessed by someone on the corporate network. The customer wants to make it available over the internet.
Your team requires an authentication layer in front of the application that supports two-factor authentication Which GCP product should the customer implement to meet these requirements?
- A. Cloud Endpoints
- B. Cloud Armor
- C. Cloud VPN
- D. Cloud Identity-Aware Proxy
Answer: C
NEW QUESTION # 104
Your organization recently activated the Security Command Center {SCO standard tier. There are a few Cloud Storage buckets that were accidentally made accessible to the public. You need to investigate the impact of the incident and remediate it.
What should you do?
- A. * 1 Change the bucket permissions to limit access
* 2 Query the buckets usage logs to report on unauthorized access to the data
* 3 Enforce the organization policy storage.publicAccessPrevention to avoid regressions - B. * 1 Change bucket permissions to limit access
* 2 Query the data access audit logs for any unauthorized access to the buckets
* 3 After the misconfiguration is corrected mute the finding in the Security Command Center - C. * 1 Change permissions to limit access for authorized users
* 2 Enforce a VPC Service Controls perimeter around all the production projects to immediately stop any unauthorized access
* 3 Review the administrator activity audit logs to report on any unauthorized access - D. * 1 Remove the Identity and Access Management (IAM) granting access to allusers from the buckets
* 2 Apply the organization policy storage. unifromBucketLevelAccess to prevent regressions
* 3 Query the data access logs to report on unauthorized access
Answer: B
Explanation:
To investigate and remediate the issue of public access to Cloud Storage buckets, you can follow these steps:
Change Bucket Permissions:
Navigate to the Cloud Storage section in the Google Cloud Console.
For each affected bucket, remove any public access permissions (e.g., removing allUsers or allAuthenticatedUsers from the IAM policy).
Ensure that only authorized users have the necessary permissions to access the buckets.
Query Data Access Audit Logs:
Go to the Logging section in the Google Cloud Console.
Query the audit logs for the affected buckets to identify any unauthorized access. You can use filters to search for access by unauthorized users.
Correct the Misconfiguration:
After correcting the permissions, mute the relevant findings in the Security Command Center to indicate that the issue has been resolved.
This helps in maintaining a clear view of ongoing security issues and ensures the findings are not flagged again unless there's a new occurrence.
By following these steps, you ensure that the buckets are no longer publicly accessible, investigate any potential unauthorized access, and update the Security Command Center status to reflect the resolution of the issue.
Reference:
Cloud Storage IAM Permissions
Viewing Audit Logs
Security Command Center Documentation
NEW QUESTION # 105
Your organization develops software involved in many open source projects and is concerned about software supply chain threats You need to deliver provenance for the build to demonstrate the software is untampered.
What should you do?
- A. * 1. Review the software process.* 2. Generate private and public key pairs and use Pretty Good Privacy (PGP) protocols to sign the output software artifacts together with a file containing the address of your enterprise and point of contact.* 3. Publish the PGP signed attestation to your public web page.
- B. * 1- Generate Supply Chain Levels for Software Artifacts (SLSA) level 3 assurance by using Cloud Build.* 2. View the build provenance in the Security insights side panel within the Google Cloud console.
- C. * 1. Hire an external auditor to review and provide provenance* 2. Define the scope and conditions.* 3.Get support from the Security department or representative.* 4. Publish the attestation to your public web page.
- D. * 1, Publish the software code on GitHub as open source.* 2. Establish a bug bounty program, and encourage the open source community to review, report, and fix the vulnerabilities.
Answer: B
Explanation:
Generate Supply Chain Levels for Software Artifacts (SLSA) level 3 assurance by using Cloud Build: SLSA is a framework for ensuring the integrity of software artifacts. By using Cloud Build, you can automate the build process and generate SLSA level 3 compliance, which includes verifiable build steps and provenance.
View the build provenance in the Security insights side panel within the Google Cloud console: The build provenance provides a detailed history of how the software was built, including the source code, build process, and any dependencies. This information is accessible through the Security insights side panel in the Google Cloud console, allowing you to verify the integrity and authenticity of your software artifacts.
References
Supply Chain Levels for Software Artifacts (SLSA) documentation
Cloud Build documentation
Security insights in Google Cloud console
NEW QUESTION # 106
You will create a new Service Account that should be able to list the Compute Engine instances in the project.
You want to follow Google-recommended practices.
What should you do?
- A. Create an Instance Template, and allow the Service Account Read Only access for the Compute Engine Access Scope.
- B. Create a custom role with the permission compute.instances.listand grant the Service Account this role.
- C. Give the Service Account the role of Project Viewer, and use the new Service Account for all instances.
- D. Give the Service Account the role of Compute Viewer, and use the new Service Account for all instances.
Answer: A
NEW QUESTION # 107
You are designing a new governance model for your organization's secrets that are stored in Secret Manager.
Currently, secrets for Production and Non-Production applications are stored and accessed using service accounts. Your proposed solution must:
Provide granular access to secrets
Give you control over the rotation schedules for the encryption keys that wrap your secrets Maintain environment separation Provide ease of management Which approach should you take?
- A. 1. Use separate Google Cloud projects to store Production and Non-Production secrets.2. Enforce access control to secrets using secret-level Identity and Access Management (IAM) bindings.3. Use Google-managed encryption keys to encrypt secrets.
- B. 1. Use separate Google Cloud projects to store Production and Non-Production secrets.2. Enforce access control to secrets using project-level identity and Access Management (IAM) bindings.3. Use customer-managed encryption keys to encrypt secrets.
- C. 1. Use a single Google Cloud project to store both Production and Non-Production secrets.2. Enforce access control to secrets using secret-level Identity and Access Management (IAM) bindings.3. Use Google-managed encryption keys to encrypt secrets.
- D. 1. Use a single Google Cloud project to store both Production and Non-Production secrets.2. Enforce access control to secrets using project-level Identity and Access Management (IAM) bindings.3. Use customer-managed encryption keys to encrypt secrets.
Answer: B
Explanation:
Provide granular access to secrets: 2.Enforce access control to secrets using project-level identity and Access Management (IAM) bindings. Give you control over the rotation schedules for the encryption keys that wrap your secrets: 3. Use customer-managed encryption keys to encrypt secrets. Maintain environment separation:
1. Use separate Google Cloud projects to store Production and Non-Production secrets.
NEW QUESTION # 108
Your Google Cloud organization is subdivided into three folders: production, development, and networking, Networking resources for the organization are centrally managed in the networking folder. You discovered that projects in the production folder are attaching to Shared VPCs that are outside of the networking folder which could become a data exfiltration risk. You must resolve the production folder issue without impacting the development folder. You need to use the most efficient and least disruptive approach. What should you do?
- A. Enable the Restrict Shared VPC Host Projects organization policy at the project level for each of the production projects. Create a custom rule and configure the policy type to Allow. In the Custom value section, enter under:folders/networking.
- B. Enable the Restrict Shared VPC Host Projects organization policy on the production folder. Create a custom rule and configure the policy type to Allow. In the Custom value section, enter under:folders/networking.
- C. Enable the Restrict Shared VPC Host Projects organization policy at the organization level. Create a custom rule and configure the policy type to Allow. In the Custom value section, enter under:folders/networking.
- D. Enable the Restrict Shared VPC Host Projects organization policy on the networking folder only.
Create a new custom rule and configure the policy type to Allow. In the Custom value section, enter under:organizations/123456739123.
Answer: B
NEW QUESTION # 109
A company is backing up application logs to a Cloud Storage bucket shared with both analysts and the administrator. Analysts should only have access to logs that do not contain any personally identifiable information (PII). Log files containing PII should be stored in another bucket that is only accessible by the administrator.
What should you do?
- A. On the bucket shared with both the analysts and the administrator, configure Object Lifecycle Management to delete objects that contain any PII.
- B. On the bucket shared with both the analysts and the administrator, configure a Cloud Storage Trigger that is only triggered when PII data is uploaded. Use Cloud Functions to capture the trigger and delete such files.
- C. Upload the logs to both the shared bucket and the bucket only accessible by the administrator. Create a job trigger using the Cloud Data Loss Prevention API. Configure the trigger to delete any files from the shared bucket that contain PII.
- D. Use Cloud Pub/Sub and Cloud Functions to trigger a Data Loss Prevention scan every time a file is uploaded to the shared bucket. If the scan detects PII, have the function move into a Cloud Storage bucket only accessible by the administrator.
Answer: D
Explanation:
To ensure that PII data is separated from non-PII data, using Cloud Pub/Sub and Cloud Functions to trigger a scan by the Data Loss Prevention (DLP) API is an effective approach. This method allows for automated detection and handling of PII.
Steps:
Set Up Cloud Pub/Sub: Configure a Cloud Pub/Sub topic to receive notifications whenever a file is uploaded to the shared Cloud Storage bucket.
Deploy Cloud Functions: Create a Cloud Function that is triggered by the Pub/Sub topic. This function will invoke the DLP API to scan the uploaded file for PII.
Move Detected PII Files: If the scan detects PII, the Cloud Function will move the file to a secure Cloud Storage bucket accessible only by the administrator.
Set Permissions: Ensure that appropriate permissions are set on the Cloud Storage buckets to restrict access to files containing PII.
Reference:
Google Cloud: Data Loss Prevention
Cloud Functions documentation
NEW QUESTION # 110
You are a security administrator at your company and are responsible for managing access controls (identification, authentication, and authorization) on Google Cloud. Which Google-recommended best practices should you follow when configuring authentication and authorization? (Choose two.)
- A. Provision users with basic roles using Google's Identity and Access Management (1AM) service.
- B. Provide granular access with predefined roles.
- C. Manually add users to Google Cloud.
- D. Use Google default encryption.
- E. Use SSO/SAML integration with Cloud Identity for user authentication and user lifecycle management.
Answer: B,E
NEW QUESTION # 111
You are exporting application logs to Cloud Storage. You encounter an error message that the log sinks don't support uniform bucket-level access policies. How should you resolve this error?
- A. Add the roles/logging.logWriter Identity and Access Management (IAM) role to the bucket for the log sink identity.
- B. Add the roles/logging.bucketWriter Identity and Access Management (IAM) role to the bucket for the log sink identity.
- C. Change the access control model for the bucket
- D. Update your sink with the correct bucket destination.
Answer: C
Explanation:
Explanation
https://cloud.google.com/logging/docs/export/troubleshoot#errors_exporting_to_cloud_storage
https://cloud.google.com/logging/docs/export/troubleshoot
Unable to grant correct permissions to the destination: Even if the sink was successfully created with the correct service account permissions, this error message displays if the access control model for the Cloud Storage bucket was set to uniform access when the bucket was created. For existing Cloud Storage buckets, you can change the access control model for the first 90 days after bucket creation by using the Permissions tab. For new buckets, select the Fine-grained access control model during bucket creation. For details, see Creating Cloud Storage buckets.
NEW QUESTION # 112
In an effort for your company messaging app to comply with FIPS 140-2, a decision was made to use GCP compute and network services. The messaging app architecture includes a Managed Instance Group (MIG) that controls a cluster of Compute Engine instances. The instances use Local SSDs for data caching and UDP for instance-to-instance communications. The app development team is willing to make any changes necessary to comply with the standard Which options should you recommend to meet the requirements?
- A. Change the app instance-to-instance communications from UDP to TCP and enable BoringSSL on clients' TLS connections.
- B. Encrypt all cache storage and VM-to-VM communication using the BoringCrypto module.
- C. Set Disk Encryption on the Instance Template used by the MIG to Google-managed Key and use BoringSSL library on all instance-to-instance communications.
- D. Set Disk Encryption on the Instance Template used by the MIG to customer-managed key and use BoringSSL for all data transit between instances.
Answer: B
Explanation:
Explanation
https://cloud.google.com/security/compliance/fips-140-2-validated
Google Cloud Platform uses a FIPS 140-2 validated encryption module called BoringCrypto (certificate 3318) in our production environment. This means that both data in transit to the customer and between data centers, and data at rest are encrypted using FIPS 140-2 validated encryption. The module that achieved FIPS 140-2 validation is part of our BoringSSL library.
NEW QUESTION # 113
Your privacy team uses crypto-shredding (deleting encryption keys) as a strategy to delete personally identifiable information (PII). You need to implement this practice on Google Cloud while still utilizing the majority of the platform's services and minimizing operational overhead.
What should you do?
- A. Use customer-managed encryption keys to delete specific encryption keys.
- B. Use client-side encryption before sending data to Google Cloud, and delete encryption keys on- premises.
- C. Use Cloud External Key Manager to delete specific encryption keys.
- D. Use Google default encryption to delete specific encryption keys.
Answer: A
Explanation:
https://cloud.google.com/sql/docs/mysql/cmek
"You might have situations where you want to permanently destroy data encrypted with CMEK.
To do this, you destroy the customer-managed encryption key version. You can't destroy the keyring or key, but you can destroy key versions of the key."
NEW QUESTION # 114
You are working with a client who plans to migrate their data to Google Cloud. You are responsible for recommending an encryption service to manage their encrypted keys. You have the following requirements:
* The master key must be rotated at least once every 45 days.
* The solution that stores the master key must be FIPS 140-2 Level 3 validated.
* The master key must be stored in multiple regions within the US for redundancy.
Which solution meets these requirements?
- A. Google-managed encryption keys
- B. Customer-supplied encryption keys
- C. Customer-managed encryption keys with Cloud HSM
- D. Customer-managed encryption keys with Cloud Key Management Service
Answer: C
Explanation:
Explanation
https://cloud.google.com/docs/security/key-management-deep-dive https://cloud.google.com/kms/docs/faq
NEW QUESTION # 115
A company migrated their entire data/center to Google Cloud Platform. It is running thousands of instances across multiple projects managed by different departments. You want to have a historical record of what was running in Google Cloud Platform at any point in time.
What should you do?
- A. Use Stackdriver to create a dashboard across all projects.
- B. Use Security Command Center to view all assets across the organization.
- C. Use Resource Manager on the organization level.
- D. Use Forseti Security to automate inventory snapshots.
Answer: D
Explanation:
Explanation
Only Forseti security can have both 'past' and 'present' (i.e. historical) records of the resources.https://forsetisecurity.org/about/
NEW QUESTION # 116
You need to provide a corporate user account in Google Cloud for each of your developers and operational staff who need direct access to GCP resources. Corporate policy requires you to maintain the user identity in a third-party identity management provider and leverage single sign-on. You learn that a significant number of users are using their corporate domain email addresses for personal Google accounts, and you need to follow Google recommended practices to convert existing unmanaged users to managed accounts.
Which two actions should you take? (Choose two.)
- A. Use the Google Admin console to view which managed users are using a personal account for their recovery email.
- B. Use Google Cloud Directory Sync to synchronize your local identity management system to Cloud Identity.
- C. Add users to your managed Google account and force users to change the email addresses associated with their personal accounts.
- D. Send an email to all of your employees and ask those users with corporate email addresses for personal Google accounts to delete the personal accounts immediately.
- E. Use the Transfer Tool for Unmanaged Users (TTUU) to find users with conflicting accounts and ask them to transfer their personal Google accounts.
Answer: B,E
Explanation:
To manage user accounts and ensure they comply with corporate policies, using Google Cloud Directory Sync (GCDS) allows synchronization between your local identity system and Cloud Identity. The Transfer Tool for Unmanaged Users (TTUU) helps identify and manage conflicting accounts by allowing users to transfer their personal accounts to managed accounts.
Steps:
* Synchronize Identities: Use GCDS to sync users from your local identity management system to Cloud Identity, ensuring that all corporate user accounts are managed.
* Identify Conflicting Accounts: Use TTUU to find users who have personal Google accounts using corporate email addresses.
* Manage Conflicting Accounts: Request users to transfer their personal accounts to managed accounts using TTUU, ensuring all accounts are under corporate control.
References:
* Google Cloud Directory Sync
* Transfer Tool for Unmanaged Users
NEW QUESTION # 117
Your organization s record data exists in Cloud Storage. You must retain all record data for at least seven years This policy must be permanent.
What should you do?
- A. * 1 Identify buckets with record data
* 2 Apply a retention policy and set it to retain for seven years
* 3 Enable bucket lock - B. * 1 Identify buckets with record data
* 2 Apply a retention policy and set it to retain for seven years
* 3 Remove any Identity and Access Management (IAM) roles that contain the storage buckets update permission - C. * 1 Identify buckets with record data
* 2 Enable the bucket policy only to ensure that data is retained
* 3 Enable bucket lock - D. * 1 Identify buckets with record data
* 2 Apply a retention policy and set it to retain for seven years
* 3 Monitor the bucket by using log-based alerts to ensure that no modifications to the retention policy occurs
Answer: A
Explanation:
To ensure that your organization's record data is retained for at least seven years in Cloud Storage, you need to apply a retention policy and enable bucket lock. This prevents the policy from being altered or the data from being deleted before the retention period ends.
Identify Buckets: Determine which Cloud Storage buckets contain the record data that needs to be retained.
Apply Retention Policy:
Go to the Google Cloud Console and navigate to "Cloud Storage".
Select the bucket you identified.
Go to the "Retention" tab and set a retention policy to retain objects for seven years.
Enable Bucket Lock:
Once the retention policy is set, you need to lock the bucket to make the retention policy permanent.
This is done by enabling the bucket lock. Go to the "Retention" tab and click "Lock".
Confirm and Monitor:
Confirm that the bucket lock is applied.
Monitor the bucket using log-based alerts to ensure compliance.
Reference:
Cloud Storage Retention Policy
Cloud Storage Bucket Lock
NEW QUESTION # 118
You are implementing communications restrictions for specific services in your Google Cloud organization.
Your data analytics team works in a dedicated folder You need to ensure that access to BigQuery is controlled for that folder and its projects. The data analytics team must be able to control the restrictions only at the folder level What should you do?
- A. Create an organization-level access policy with a service perimeter to restrict BigQuery access. Assign the data analytics team the Access Context Manager Editor role on the access policy to allow the team to configure the access policy.
- B. Create a scoped policy on the folder with a service perimeter to restrict BigQuery access. Assign the data analytics team the Access Context Manager Editor role on the scoped policy to allow the team to configure the scoped policy.
- C. Define a hierarchical firewall policy on the folder to deny BigQuery access. Assign the data analytics team the Compute Organization Firewall Policy Admin role to allow the team to configure rules for the firewall policy.
- D. Enforce the Restrict Resource Service Usage organization policy constraint on the folder to restrict BigQuery access. Assign the data analytics team the Organization Policy Administrator role to allow the team to manage exclusions within the folder.
Answer: B
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
The requirement is to establish a network security boundary around a specific service (BigQuery) for resources in a Folder, while allowing the team to manage that boundary. This is the definition of using VPC Service Controls (VPC SC) with scoped policies.
VPC Service Controls (VPC SC): Used to create a service perimeter (a security boundary) around BigQuery and other Google Cloud services, which restricts API access.
Scoped Policy on the Folder: This enforces the boundary exactly at the required Folder level, as opposed to the organization level.
Access Context Manager Editor Role: Access Context Manager is the service that manages VPC SC policies (Service Perimeters and Access Levels). Granting this role on the scoped policy allows the data analytics team to fulfill the requirement to "control the restrictions." Extracts (Conceptual Basis for VPC SC and Scoped Policies):
"Private Service Connect provides... Explicit authorization. Private Service Connect provides an authorization model that gives consumers and producers granular control, ensuring that only the intended service endpoints and no other resources can connect to a service." (Source 2.4 - VPC SC and PSC share a core architectural concept of explicit, service-oriented boundaries) Option B is the technical implementation that matches the requirements: using a VPC SC service perimeter (for service restriction) applied as a scoped policy on the folder (for resource hierarchy scope) with Access Context Manager Editor (for team management/control).
NEW QUESTION # 119
You want to evaluate GCP for PCI compliance. You need to identify Google's inherent controls.
Which document should you review to find the information?
- A. PCI SSC Cloud Computing Guidelines
- B. Google Cloud Platform: Customer Responsibility Matrix
- C. Product documentation for Compute Engine
- D. PCI DSS Requirements and Security Assessment Procedures
Answer: B
Explanation:
Explanation
https://cloud.google.com/files/PCI_DSS_Shared_Responsibility_GCP_v32.pdf
https://services.google.com/fh/files/misc/gcp_pci_shared_responsibility_matrix_aug_2021.pdf
NEW QUESTION # 120
You are a security administrator at your company and are responsible for managing access controls (identification, authentication, and authorization) on Google Cloud. Which Google-recommended best practices should you follow when configuring authentication and authorization? (Choose two.)
- A. Provision users with basic roles using Google's Identity and Access Management (1AM) service.
- B. Provide granular access with predefined roles.
- C. Manually add users to Google Cloud.
- D. Use Google default encryption.
- E. Use SSO/SAML integration with Cloud Identity for user authentication and user lifecycle management.
Answer: B,E
Explanation:
https://cloud.google.com/iam/docs/using-iam-securely#least_privilege Basic roles include thousands of permissions across all Google Cloud services. In production environments, do not grant basic roles unless there is no alternative. Instead, grant the most limited predefined roles or custom roles that meet your needs.
NEW QUESTION # 121
A customer's company has multiple business units. Each business unit operates independently, and each has their own engineering group. Your team wants visibility into all projects created within the company and wants to organize their Google Cloud Platform (GCP) projects based on different business units. Each business unit also requires separate sets of IAM permissions.
Which strategy should you use to meet these needs?
- A. Assign GCP resources in a VPC for each business unit to separate network access.
- B. Establish standalone projects for each business unit, using gmail.com accounts.
- C. Create an organization node, and assign folders for each business unit.
- D. Assign GCP resources in a project, with a label identifying which business unit owns the resource.
Answer: C
Explanation:
To organize GCP projects based on different business units and manage IAM permissions, you should create an organization node and assign folders for each business unit. This approach allows you to logically separate projects under folders and apply IAM policies at the folder level.
Step-by-Step:
* Create Organization Node: Ensure that your GCP account is linked to an organization.
* Create Folders for Business Units:
* Navigate to the GCP Console > IAM & Admin > Resource Manager.
* Create a folder for each business unit under the organization node.
* Move Projects to Folders:
* Move existing projects into the respective folders according to the business unit.
* Set IAM Policies:
* Assign IAM roles and permissions at the folder level to manage access for each business unit independently.
* Monitor and Manage: Use Cloud Audit Logs and other GCP tools to monitor the activities and ensure compliance with the organization's policies.
References:
* Creating and Managing Folders
* Managing IAM Policies
NEW QUESTION # 122
......
Google Professional-Cloud-Security-Engineer exam consists of multiple-choice and multiple-select questions that must be completed within two hours. To pass the exam, candidates must obtain a minimum score of 75%. Professional-Cloud-Security-Engineer exam fee is $200, and it can be taken online or at a testing center. Upon passing the exam, candidates receive a certificate that demonstrates their expertise in securing GCP solutions.
Verified Professional-Cloud-Security-Engineer dumps Q&As Latest Professional-Cloud-Security-Engineer Download: https://prep4sure.dumpsfree.com/Professional-Cloud-Security-Engineer-valid-exam.html