Updated Dec 19, 2023 Verified Pass Professional-Cloud-Security-Engineer Exam in First Attempt Guaranteed
Free Professional-Cloud-Security-Engineer Sample Questions and 100% Cover Real Exam Questions (Updated 212 Questions)
NEW QUESTION # 25
In order to meet PCI DSS requirements, a customer wants to ensure that all outbound traffic is authorized.
Which two cloud offerings meet this requirement without additional compensating controls? (Choose two.)
- A. Google Kubernetes Engine
- B. App Engine
- C. Cloud Functions
- D. Compute Engine
- E. Cloud Storage
Answer: B,D
Explanation:
Explanation/Reference: https://cloud.google.com/solutions/pci-dss-compliance-in-gcp
NEW QUESTION # 26
Your company requires the security and network engineering teams to identify all network anomalies within and across VPCs, internal traffic from VMs to VMs, traffic between end locations on the internet and VMs, and traffic between VMs to Google Cloud services in production. Which method should you use?
- A. Configure packet mirroring policies.
- B. Define an organization policy constraint.
- C. Monitor and analyze Cloud Audit Logs.
- D. Enable VPC Flow Logs on the subnet.
Answer: A
Explanation:
Explanation
https://cloud.google.com/vpc/docs/packet-mirroring#enterprise_security
Security and network engineering teams must ensure that they are catching all anomalies and threats that might indicate security breaches and intrusions. They mirror all traffic so that they can complete a comprehensive inspection of suspicious flows.
NEW QUESTION # 27
A company is backing up application logs to a Cloud Storage bucket shared with both analysts and the administrator. Analysts should only have access to logs that do not contain any personally identifiable information (PII). Log files containing PII should be stored in another bucket that is only accessible by the administrator.
What should you do?
- A. On the bucket shared with both the analysts and the administrator, configure a Cloud Storage Trigger that is only triggered when PII data is uploaded. Use Cloud Functions to capture the trigger and delete such files.
- B. Upload the logs to both the shared bucket and the bucket only accessible by the administrator. Create a job trigger using the Cloud Data Loss Prevention API. Configure the trigger to delete any files from the shared bucket that contain PII.
- C. Use Cloud Pub/Sub and Cloud Functions to trigger a Data Loss Prevention scan every time a file is uploaded to the shared bucket. If the scan detects PII, have the function move into a Cloud Storage bucket only accessible by the administrator.
- D. On the bucket shared with both the analysts and the administrator, configure Object Lifecycle Management to delete objects that contain any PII.
Answer: D
NEW QUESTION # 28
A customer has an analytics workload running on Compute Engine that should have limited internet access.
Your team created an egress firewall rule to deny (priority 1000) all traffic to the internet.
The Compute Engine instances now need to reach out to the public repository to get security updates. What should your team do?
- A. Create an egress firewall rule to allow traffic to the hostname of the repository with a priority less than 1000.
- B. Create an egress firewall rule to allow traffic to the CIDR range of the repository with a priority less than 1000.
- C. Create an egress firewall rule to allow traffic to the CIDR range of the repository with a priority greater than 1000.
- D. Create an egress firewall rule to allow traffic to the hostname of the repository with a priority greater than 1000.
Answer: B
Explanation:
https://cloud.google.com/vpc/docs/firewalls#priority_order_for_firewall_rules
NEW QUESTION # 29
You are in charge of creating a new Google Cloud organization for your company. Which two actions should you take when creating the super administrator accounts? (Choose two.)
- A. Use a private connection to create the super admin accounts to avoid sending your credentials over the Internet.
- B. Use a physical token to secure the super admin credentials with multi-factor authentication (MFA).
- C. Create an access level in the Google Admin console to prevent super admin from logging in to Google Cloud.
- D. Disable any Identity and Access Management (1AM) roles for super admin at the organization level in the Google Cloud Console.
- E. Provide non-privileged identities to the super admin users for their day-to-day activities.
Answer: B,E
Explanation:
https://cloud.google.com/resource-manager/docs/super-admin-best-practices#discourage_super_admin_account_usage
- Use a security key or other physical authentication device to enforce two-step verification - Give super admins a separate account that requires a separate login
NEW QUESTION # 30
An organization receives an increasing number of phishing emails.
Which method should be used to protect employee credentials in this situation?
- A. Multifactor Authentication
- B. Captcha on login pages
- C. A strict password policy
- D. Encrypted emails
Answer: A
Explanation:
Explanation
https://cloud.google.com/blog/products/g-suite/7-ways-admins-can-help-secure-accounts-against-phishing-g-suit
https://www.duocircle.com/content/email-security-services/email-security-in-cryptography#:~:text=Customer%2
NEW QUESTION # 31
An organization recently began using App Engine to build and host its new web application for its customers. The organization wants to use its existing IAM setup to allow its developer employees to have elevated access to the application remotely. This would allow them to push updates and fixes to the application via an HTTPS connection. Non-developer employees should only get access to the production version without development permissions. Which Google Cloud Platform solution should be used to meet these requirements?
- A. Disable access for non-developer employees by removing their Google Group from the application access control list (ACL).
- B. Set up Virtual Private Cloud (VPC) firewall rules to manage authentication and different authorization levels for employee access.
- C. Synchronize the organization's Active Directory using Cloud Identity for employee access via Cloud VPN.
- D. Set up Cloud Identity-Aware Proxy (Cloud IAP) to manage authentication and different authorization levels for employee access.
Answer: D
Explanation:
A is not correct because synchronizing your users to Google Identity does not grant any differentiated access to an app engine application.
B is not correct because app engine IAM roles only specify different levels of administrative access to app engine applications in a project.
C is correct because Cloud IAP allows the organization to establish different levels of access based on user criteria for app engine apps.
D is not correct because VPC firewall rules do not grant different levels of authorization and only allow/block traffic.
https://cloud.google.com/appengine/docs/standard/python/access-control
https://cloud.google.com/iap/docs/concepts-overview
NEW QUESTION # 32
Applications often require access to "secrets" - small pieces of sensitive data at build or run time. The administrator managing these secrets on GCP wants to keep a track of "who did what, where, and when?" within their GCP projects.
Which two log streams would provide the information that the administrator is looking for? (Choose two.)
- A. Admin Activity logs
- B. Data Access logs
- C. VPC Flow logs
- D. System Event logs
- E. Agent logs
Answer: A,B
Explanation:
Reference:
https://cloud.google.com/kms/docs/secret-management
NEW QUESTION # 33
A customer wants to run a batch processing system on VMs and store the output files in a Cloud Storage bucket. The networking and security teams have decided that no VMs may reach the public internet.
How should this be accomplished?
- A. Provision a NAT Gateway to access the Cloud Storage API endpoint.
- B. Create a firewall rule to block internet traffic from the VM.
- C. Enable Private Google Access on the VPC.
- D. Mount a Cloud Storage bucket as a local filesystem on every VM.
Answer: C
Explanation:
Explanation
https://cloud.google.com/vpc/docs/private-google-access
NEW QUESTION # 34
You need to enforce a security policy in your Google Cloud organization that prevents users from exposing objects in their buckets externally. There are currently no buckets in your organization. Which solution should you implement proactively to achieve this goal with the least operational overhead?
- A. Enable the constraints/storage.uniformBucketLevelAccess constraint at the organization level.
- B. Enable the constraints/storage.publicAccessPrevention constraint at the organization level.
- C. Create an hourly cron job to run a Cloud Function that finds public buckets and makes them private.
- D. Create a VPC Service Controls perimeter that protects the storage.googleapis.com service in your projects that contains buckets. Add any new project that contains a bucket to the perimeter.
Answer: B
Explanation:
Explanation
https://cloud.google.com/storage/docs/public-access-prevention
Public access prevention protects Cloud Storage buckets and objects from being accidentally exposed to the public. If your bucket is contained within an organization, you can enforce public access prevention by using the organization policy constraint storage.publicAccessPrevention at the project, folder, or organization level.
NEW QUESTION # 35
Which type of load balancer should you use to maintain client IP by default while using the standard network tier?
- A. SSL Proxy
- B. TCP Proxy
- C. TCP/UDP Network
- D. Internal TCP/UDP
Answer: D
NEW QUESTION # 36
A company has redundant mail servers in different Google Cloud Platform regions and wants to route customers to the nearest mail server based on location.
How should the company accomplish this?
- A. Create a Network Load Balancer to listen on TCP port 995 with a forwarding rule to forward traffic based on location.
- B. Use Cloud CDN to route the mail traffic to the closest origin mail server based on client IP address.
- C. Use Cross-Region Load Balancing with an HTTP(S) load balancer to route traffic to the nearest region.
- D. Configure TCP Proxy Load Balancing as a global load balancing service listening on port 995.
Answer: D
Explanation:
https://cloud.google.com/load-balancing/docs/tcp
TCP Proxy Load Balancing is implemented on GFEs that are distributed globally. If you choose the Premium Tier of Network Service Tiers, a TCP proxy load balancer is global. In Premium Tier, you can deploy backends in multiple regions, and the load balancer automatically directs user traffic to the closest region that has capacity. If you choose the Standard Tier, a TCP proxy load balancer can only direct traffic among backends in a single region. https://cloud.google.com/load-balancing/docs/load-balancing-overview#tcp-proxy-load-balancing
NEW QUESTION # 37
You are a member of your company's security team. You have been asked to reduce your Linux bastion host external attack surface by removing all public IP addresses. Site Reliability Engineers (SREs) require access to the bastion host from public locations so they can access the internal VPC while off-site. How should you enable this access?
- A. Implement OS Login with 2-step verification for the bastion host.
- B. Implement Cloud VPN for the region where the bastion host lives.
- C. Implement Google Cloud Armor in front of the bastion host.
- D. Implement Identity-Aware Proxy TCP forwarding for the bastion host.
Answer: D
Explanation:
Reference:
https://cloud.google.com/architecture/building-internet-connectivity-for-private-vms#configuring_iap_tunnels_for_interacting_with_instances
NEW QUESTION # 38
A patch for a vulnerability has been released, and a DevOps team needs to update their running containers in Google Kubernetes Engine (GKE).
How should the DevOps team accomplish this?
- A. Verify that auto upgrade is enabled; if so, Google will upgrade the nodes in a GKE cluster.
- B. Use Puppet or Chef to push out the patch to the running container.
- C. Update the application code or apply a patch, build a new image, and redeploy it.
- D. Configure containers to automatically upgrade when the base image is available in Container Registry.
Answer: C
Explanation:
https://cloud.google.com/containers/security
Containers are meant to be immutable, so you deploy a new image in order to make changes. You can simplify patch management by rebuilding your images regularly, so the patch is picked up the next time a container is deployed. Get the full picture of your environment with regular image security reviews.
NEW QUESTION # 39
You want to evaluate GCP for PCI compliance. You need to identify Google's inherent controls.
Which document should you review to find the information?
- A. PCI DSS Requirements and Security Assessment Procedures
- B. PCI SSC Cloud Computing Guidelines
- C. Google Cloud Platform: Customer Responsibility Matrix
- D. Product documentation for Compute Engine
Answer: B
Explanation:
https://cloud.google.com/solutions/pci-dss-compliance-in-gcp
NEW QUESTION # 40
You are designing a new governance model for your organization's secrets that are stored in Secret Manager. Currently, secrets for Production and Non-Production applications are stored and accessed using service accounts. Your proposed solution must:
Provide granular access to secrets
Give you control over the rotation schedules for the encryption keys that wrap your secrets Maintain environment separation Provide ease of management Which approach should you take?
- A. 1. Use separate Google Cloud projects to store Production and Non-Production secrets.
2. Enforce access control to secrets using project-level identity and Access Management (IAM) bindings.
3. Use customer-managed encryption keys to encrypt secrets. - B. 1. Use separate Google Cloud projects to store Production and Non-Production secrets.
2. Enforce access control to secrets using secret-level Identity and Access Management (IAM) bindings.
3. Use Google-managed encryption keys to encrypt secrets. - C. 1. Use a single Google Cloud project to store both Production and Non-Production secrets.
2. Enforce access control to secrets using secret-level Identity and Access Management (IAM) bindings.
3. Use Google-managed encryption keys to encrypt secrets. - D. 1. Use a single Google Cloud project to store both Production and Non-Production secrets.
2. Enforce access control to secrets using project-level Identity and Access Management (IAM) bindings.
3. Use customer-managed encryption keys to encrypt secrets.
Answer: A
Explanation:
Provide granular access to secrets: 2.Enforce access control to secrets using project-level identity and Access Management (IAM) bindings. Give you control over the rotation schedules for the encryption keys that wrap your secrets: 3. Use customer-managed encryption keys to encrypt secrets. Maintain environment separation: 1. Use separate Google Cloud projects to store Production and Non-Production secrets.
NEW QUESTION # 41
Your customer is moving their corporate applications to Google Cloud Platform. The security team wants detailed visibility of all resources in the organization. You use Resource Manager to set yourself up as the org admin. What Cloud Identity and Access Management (Cloud IAM) roles should you give to the security team?
- A. Org viewer, Project owner
- B. Org viewer, Project viewer
- C. Project owner, Network admin
- D. Org admin, Project browser
Answer: B
Explanation:
A is not correct because Project owner is too broad. The security team does not need to be able to make changes to projects.
B is correct because:
- Org viewer grants the security team permissions to view the organization's display name.
- Project viewer grants the security team permissions to see the resources within projects.
C is not correct because Org admin is too broad. The security team does not need to be able to make changes to the organization.
D is not correct because Project owner is too broad. The security team does not need to be able to make changes to projects.
https://cloud.google.com/resource-manager/docs/access-control-org#using_predefined_roles
NEW QUESTION # 42
Your organization acquired a new workload. The Web and Application (App) servers will be running on Compute Engine in a newly created custom VPC. You are responsible for configuring a secure network communication solution that meets the following requirements:
Only allows communication between the Web and App tiers.
Enforces consistent network security when autoscaling the Web and App tiers.
Prevents Compute Engine Instance Admins from altering network traffic.
What should you do?
- A. 1. Re-deploy the Web and App servers with instance templates configured with respective service accounts.
2. Create an allow VPC firewall rule that specifies the target/source with respective service accounts. - B. 1. Configure all running Web and App servers with respective network tags.
2. Create an allow VPC firewall rule that specifies the target/source with respective network tags. - C. 1. Re-deploy the Web and App servers with instance templates configured with respective network tags.
2. Create an allow VPC firewall rule that specifies the target/source with respective network tags. - D. 1. Configure all running Web and App servers with respective service accounts.
2. Create an allow VPC firewall rule that specifies the target/source with respective service accounts.
Answer: B
NEW QUESTION # 43
Your organization has implemented synchronization and SAML federation between Cloud Identity and Microsoft Active Directory. You want to reduce the risk of Google Cloud user accounts being compromised. What should you do?
- A. Create an Active Directory domain password policy with strong password settings, and configure post-SSO (single sign-on) 2-Step Verification with security keys in the Google Admin console.
- B. Create an Active Directory domain password policy with strong password settings, and configure post-SSO (single sign-on) 2-Step Verification with verification codes via text or phone call in the Google Admin console.
- C. Create a Cloud Identity password policy with strong password settings, and configure 2-Step Verification with verification codes via text or phone call in the Google Admin console.
- D. Create a Cloud Identity password policy with strong password settings, and configure 2-Step Verification with security keys in the Google Admin console.
Answer: A
Explanation:
Reference:
"We recommend against using text messages. The National Institute of Standards and Technology (NIST) no longer recommends SMS-based 2SV due to the hijacking risk from state-sponsored entities."
NEW QUESTION # 44
......
Download Real Google Professional-Cloud-Security-Engineer Exam Dumps Test Engine Exam Questions: https://prep4sure.dumpsfree.com/Professional-Cloud-Security-Engineer-valid-exam.html