The Best Practice Test Preparation for the Professional-Cloud-Security-Engineer Certification Exam
Professional-Cloud-Security-Engineer Exam Dumps, Practice Test Questions BUNDLE PACK
The Professional-Cloud-Security-Engineer certification is one of the most prestigious certifications in the cloud security domain. It is a Google Cloud Certified certification, which means it is recognized worldwide as a benchmark for cloud security expertise. Google Cloud Certified - Professional Cloud Security Engineer Exam certification demonstrates that the holder has the knowledge and skills required to design, implement, and manage security solutions in Google Cloud Platform.
What is Google Professional Cloud Security Engineer Exam
The Google Professional Cloud Security Engineer is a private administrator responsible for helping organizations define and enforce a highly secure infrastructure on the Google Cloud Platform (GCP). GCP's professional cloud security Engineer uses an in-depth understanding of security and safety best practices, as well as an in-depth understanding of market security needs.
The cloud security designer brings his knowledge to the design, advancement, and management of the framework through Google security innovations. The GCP Cloud Security Engineer Certification Exam helps validate an individual's proficiency in various skills. Skills and areas of understanding include identifying and tracking access, as well as using Google security technologies to ensure data protection.
The certification exam will no doubt also assess candidates' abilities to configure network security measures and collect and evaluate Google Cloud logs. In addition, the role of a cloud security designer also includes event response management and a broader understanding of regulatory policies.
NEW QUESTION # 85
You want to limit the images that can be used as the source for boot disks. These images will be stored in a dedicated project.
What should you do?
- A. Use the Organization Policy Service to create a compute.trustedimageProjects constraint on the organization level. List the trusted project as the whitelist in an allow operation.
- B. In Resource Manager, edit the project permissions for the trusted project. Add the organization as member with the role: Compute Image User.
- C. In Resource Manager, edit the organization permissions. Add the project ID as member with the role: Compute Image User.
- D. Use the Organization Policy Service to create a compute.trustedimageProjects constraint on the organization level. List the trusted projects as the exceptions in a deny operation.
Answer: D
Explanation:
Reference:
https://cloud.google.com/compute/docs/images/restricting-image-access
NEW QUESTION # 86
You are part of a security team that wants to ensure that a Cloud Storage bucket in Project A can only be readable from Project B. You also want to ensure that data in the Cloud Storage bucket cannot be accessed from or copied to Cloud Storage buckets outside the network, even if the user has the correct credentials.
What should you do?
- A. Enable VPC Peering between Project A and B networks with strict firewall rules to allow communication between the networks.
- B. Enable VPC Service Controls, create a perimeter with Project A and B, and include Cloud Storage service.
- C. Enable Private Access in Project A and B networks with strict firewall rules to allow communication between the networks.
- D. Enable Domain Restricted Sharing Organization Policy and Bucket Policy Only on the Cloud Storage bucket.
Answer: B
Explanation:
Explanation
https://cloud.google.com/vpc-service-controls/docs/overview#isolate
NEW QUESTION # 87
A manager wants to start retaining security event logs for 2 years while minimizing costs. You write a filter to select the appropriate log entries.
Where should you export the logs?
- A. StackDriver logging
- B. BigQuery datasets
- C. Cloud Pub/Sub topics
- D. Cloud Storage buckets
Answer: A
Explanation:
Explanation/Reference: https://cloud.google.com/logging/docs/exclusions
NEW QUESTION # 88
You are a Cloud Identity administrator for your organization. In your Google Cloud environment groups are used to manage user permissions. Each application team has a dedicated group Your team is responsible for creating these groups and the application teams can manage the team members on their own through the Google Cloud console. You must ensure that the application teams can only add users from within your organization to their groups.
What should you do?
- A. Set an Identity and Access Management (1AM) policy that includes a condition that restricts group membership to user principals that belong to your organization.
- B. Export the Cloud Identity logs to BigQuery Configure an alert for external members added to groups Have the alert trigger a Cloud Function instance that removes the external members from the group.
- C. Change the configuration of the relevant groups in the Google Workspace Admin console to prevent external users from being added to the group.
- D. Define an Identity and Access Management (IAM) deny policy that denies the assignment of principals that are outside your organization to the groups in scope.
Answer: A
NEW QUESTION # 89
You are deploying a web application hosted on Compute Engine. A business requirement mandates that application logs are preserved for 12 years and data is kept within European boundaries. You want to implement a storage solution that minimizes overhead and is cost-effective. What should you do?
- A. Configure your Compute Engine instances to use the Google Cloud's operations suite Cloud Logging agent to send application logs to a custom log bucket in the EUROPE-WEST1 region with a custom retention of 12 years.
- B. Use a Pub/Sub topic to forward your application logs to a Cloud Storage bucket in the EUROPE-WEST1 region.
- C. Create a Cloud Storage bucket to store your logs in the EUROPE-WEST1 region. Modify your application code to ship logs directly to your bucket for increased efficiency.
- D. Configure a custom retention policy of 12 years on your Google Cloud's operations suite log bucket in the EUROPE-WEST1 region.
Answer: A
NEW QUESTION # 90
Your Security team believes that a former employee of your company gained unauthorized access to Google Cloud resources some time in the past 2 months by using a service account key. You need to confirm the unauthorized access and determine the user activity. What should you do?
- A. Use the Logs Explorer to search for user activity.
- B. Use the Cloud Monitoring console to filter audit logs by user.
- C. Use the Cloud Data Loss Prevention API to query logs in Cloud Storage.
- D. Use Security Health Analytics to determine user activity.
Answer: B
NEW QUESTION # 91
Your security team wants to reduce the risk of user-managed keys being mismanaged and compromised. To achieve this, you need to prevent developers from creating user-managed service account keys for projects in their organization. How should you enforce this?
- A. Enable an organization policy to disable service accounts from being created.
- B. Enable an organization policy to prevent service account keys from being created.
- C. Remove the iam.serviceAccounts.getAccessToken permission from users.
- D. Configure Secret Manager to manage service account keys.
Answer: B
Explanation:
https://cloud.google.com/iam/docs/best-practices-for-managing-service-account-keys
"To prevent unnecessary usage of service account keys, use organization policy constraints: At the root of your organization's resource hierarchy, apply the Disable service account key creation and Disable service account key upload constraints to establish a default where service account keys are disallowed. When needed, override one of the constraints for selected projects to re-enable service account key creation or upload."
NEW QUESTION # 92
A company allows every employee to use Google Cloud Platform. Each department has a Google Group, with all department members as group members. If a department member creates a new project, all members of that department should automatically have read-only access to all new project resources. Members of any other department should not have access to the project. You need to configure this behavior.
What should you do to meet these requirements?
- A. Create a Project per department under the Organization. For each department's Project, assign the Project Browser role to the Google Group related to that department.
- B. Create a Project per department under the Organization. For each department's Project, assign the Project Viewer role to the Google Group related to that department.
- C. Create a Folder per department under the Organization. For each department's Folder, assign the Project Viewer role to the Google Group related to that department.
- D. Create a Folder per department under the Organization. For each department's Folder, assign the Project Browser role to the Google Group related to that department.
Answer: B
NEW QUESTION # 93
An organization is migrating from their current on-premises productivity software systems to G Suite. Some network security controls were in place that were mandated by a regulatory body in their region for their previous on-premises system. The organization's risk team wants to ensure that network security controls are maintained and effective in G Suite. A security architect supporting this migration has been asked to ensure that network security controls are in place as part of the new shared responsibility model between the organization and Google Cloud.
What solution would help meet the requirements?
- A. Ensure that firewall rules are in place to meet the required controls.
- B. Set up Cloud Armor to ensure that network security controls can be managed for G Suite.
- C. Network security is a built-in solution and Google's Cloud responsibility for SaaS products like G Suite.
- D. Set up an array of Virtual Private Cloud (VPC) networks to control network security as mandated by the relevant regulation.
Answer: C
Explanation:
https://gsuite.google.com/learn-more/security/security-whitepaper/page-1.html
NEW QUESTION # 94
Your organization wants to protect all workloads that run on Compute Engine VM to ensure that the instances weren't compromised by boot-level or kernel-level malware. Also, you need to ensure that data in use on the VM cannot be read by the underlying host system by using a hardware-based solution.
What should you do?
- A. * 1 Use Google Shielded VM including secure boot Virtual Trusted Platform Module (vTPM) and integrity monitoring
* 2 Create a Cloud Run function to check for the VM settings generate metrics and run the function regularly - B. * 1 Use secure hardened images from the Google Cloud Marketplace
* 2 When deploying the images activate the Confidential Computing option
* 3 Enforce the use of the correct images and Confidential Computing by using organization policies - C. * 1 Use Google Shielded VM including secure boot Virtual Trusted Platform Module (vTPM) and integrity monitoring
* 2 Activate Confidential Computing
* 3 Enforce these actions by using organization policies - D. * 1 Activate Virtual Machine Threat Detection in Security Command Center (SCO Premium
* 2 Monitor the findings in SCC
Answer: C
NEW QUESTION # 95
A company is deploying their application on Google Cloud Platform. Company policy requires long-term data to be stored using a solution that can automatically replicate data over at least two geographic places.
Which Storage solution are they allowed to use?
- A. Cloud Bigtable
- B. Cloud BigQuery
- C. Compute Engine SSD Disk
- D. Compute Engine Persistent Disk
Answer: B
Explanation:
https://cloud.google.com/bigquery/docs/locations
NEW QUESTION # 96
Your customer has an on-premises Public Key Infrastructure (PKI) with a certificate authority (CA). You need to issue certificates for many HTTP load balancer frontends. The on-premises PKI should be minimally affected due to many manual processes, and the solution needs to scale.
What should you do?
- A. Use the web applications with PKCS12 certificates issued from subordinate CA based on OpenSSL on-premises Use the gcloud tool for importing. Use the External TCP/UDP Network load balancer instead of an external HTTP Load Balancer.
- B. Use Certificate Manager to import certificates issued from on-premises PKI and for the frontends.
Leverage the gcloud tool for importing - C. Use Certificate Manager to issue Google managed public certificates and configure it at HTTP the load balancers in your infrastructure as code (laC).
- D. Use a subordinate CA in the Google Certificate Authority Service from the on-premises PKI system to issue certificates for the load balancers.
Answer: D
Explanation:
Explanation
This approach allows you to leverage your existing on-premises PKI infrastructure while minimizing its impact and manual processes. By creating a subordinate CA in Google's Certificate Authority Service, you can automate the process of issuing certificates for your HTTP load balancer frontends. This solution scales well as the number of load balancers increases.
NEW QUESTION # 97
Your team needs to obtain a unified log view of all development cloud projects in your SIEM. The development projects are under the NONPROD organization folder with the test and pre-production projects. The development projects share the ABC-BILLING billing account with the rest of the organization.
Which logging export strategy should you use to meet the requirements?
- A. 1. Create a Cloud Storage sink with billingAccounts/ABC-BILLING parent and includeChildren property set to False in a dedicated SIEM project.2. Process Cloud Storage objects in SIEM.
- B. 1. Export logs in each dev project to a Cloud Pub/Sub topic in a dedicated SIEM project.2. Subscribe SIEM to the topic.
- C. 1. Create a Cloud Storage sink with a publicly shared Cloud Storage bucket in each project.2. Process Cloud Storage objects in SIEM.
- D. 1. Export logs to a Cloud Pub/Sub topic with folders/NONPROD parent and includeChildren property set to True in a dedicated SIEM project.2. Subscribe SIEM to the topic.
Answer: A
NEW QUESTION # 98
Your company is storing sensitive data in Cloud Storage. You want a key generated on-premises to be used in the encryption process.
What should you do?
- A. Use customer-supplied encryption keys to manage the data encryption key (DEK).
- B. Use the Cloud Key Management Service to manage a key encryption key (KEK).
- C. Use customer-supplied encryption keys to manage the key encryption key (KEK).
- D. Use the Cloud Key Management Service to manage a data encryption key (DEK).
Answer: A
Explanation:
Explanation
This is a Customer-supplied encryption keys (CSEK). We generate our own encryption key and manage it on-premises. A KEK never leaves Cloud KMS.There is no KEK or KMS on-premises. Encryption at rest by default, with various key management options https://cloud.google.com/security/encryption-at-rest
NEW QUESTION # 99
You are in charge of creating a new Google Cloud organization for your company. Which two actions should you take when creating the super administrator accounts? (Choose two.)
- A. Use a physical token to secure the super admin credentials with multi-factor authentication (MFA).
- B. Disable any Identity and Access Management (1AM) roles for super admin at the organization level in the Google Cloud Console.
- C. Use a private connection to create the super admin accounts to avoid sending your credentials over the Internet.
- D. Provide non-privileged identities to the super admin users for their day-to-day activities.
- E. Create an access level in the Google Admin console to prevent super admin from logging in to Google Cloud.
Answer: A,E
NEW QUESTION # 100
Your security team uses encryption keys to ensure confidentiality of user dat a. You want to establish a process to reduce the impact of a potentially compromised symmetric encryption key in Cloud Key Management Service (Cloud KMS).
Which steps should your team take before an incident occurs? (Choose two.)
- A. Enable automatic key version rotation on a regular schedule.
- B. Disable and revoke access to compromised keys.
- C. Limit the number of messages encrypted with each key version.
- D. Manually rotate key versions on an ad hoc schedule.
- E. Disable the Cloud KMS API.
Answer: A,B
NEW QUESTION # 101
Your privacy team uses crypto-shredding (deleting encryption keys) as a strategy to delete personally identifiable information (PII). You need to implement this practice on Google Cloud while still utilizing the majority of the platform's services and minimizing operational overhead. What should you do?
- A. Use customer-managed encryption keys to delete specific encryption keys.
- B. Use client-side encryption before sending data to Google Cloud, and delete encryption keys on-premises
- C. Use Cloud External Key Manager to delete specific encryption keys.
- D. Use Google default encryption to delete specific encryption keys.
Answer: A
Explanation:
https://cloud.google.com/sql/docs/mysql/cmek
"You might have situations where you want to permanently destroy data encrypted with CMEK. To do this, you destroy the customer-managed encryption key version. You can't destroy the keyring or key, but you can destroy key versions of the key."
NEW QUESTION # 102
A customer has an analytics workload running on Compute Engine that should have limited internet access.
Your team created an egress firewall rule to deny (priority 1000) all traffic to the internet.
The Compute Engine instances now need to reach out to the public repository to get security updates.
What should your team do?
- A. Create an egress firewall rule to allow traffic to the CIDR range of the repository with a priority greater than
1000. - B. Create an egress firewall rule to allow traffic to the CIDR range of the repository with a priority less than
1000. - C. Create an egress firewall rule to allow traffic to the hostname of the repository with a priority greater than
1000. - D. Create an egress firewall rule to allow traffic to the hostname of the repository with a priority less than 1000.
Answer: C
NEW QUESTION # 103
Your organization hosts a financial services application running on Compute Engine instances for a third-party company. The third-party company's servers that will consume the application also run on Compute Engine in a separate Google Cloud organization. You need to configure a secure network connection between the Compute Engine instances. You have the following requirements:
The network connection must be encrypted.
The communication between servers must be over private IP addresses.
What should you do?
- A. Configure an Apigee proxy that exposes your Compute Engine-hosted application as an API, and is encrypted with TLS which allows access only to the third party.
- B. Configure a Cloud VPN connection between your organization's VPC network and the third party's that is controlled by VPC firewall rules.
- C. Configure a VPC Service Controls perimeter around your Compute Engine instances, and provide access to the third party via an access level.
- D. Configure a VPC peering connection between your organization's VPC network and the third party's that is controlled by VPC firewall rules.
Answer: D
Explanation:
Google encrypts and authenticates data in transit at one or more network layers when data moves outside physical boundaries not controlled by Google or on behalf of Google. All VM-to-VM traffic within a VPC network and peered VPC networks is encrypted. https://cloud.google.com/docs/security/encryption-in-transit#cio-level_summary
NEW QUESTION # 104
A customer's internal security team must manage its own encryption keys for encrypting data on Cloud Storage and decides to use customer-supplied encryption keys (CSEK).
How should the team complete this task?
- A. Use the gsutil command line tool to upload the object to Cloud Storage, and specify the location of the encryption key.
- B. Generate an encryption key in the Google Cloud Platform Console, and upload an object to Cloud Storage using the specified key.
- C. Encrypt the object, then use the gsutil command line tool or the Google Cloud Platform Console to upload the object to Cloud Storage.
- D. Upload the encryption key to a Cloud Storage bucket, and then upload the object to the same bucket.
Answer: C
Explanation:
Reference:
https://cloud.google.com/storage/docs/encryption/customer-supplied-keys
NEW QUESTION # 105
An employer wants to track how bonus compensations have changed over time to identify employee outliers and correct earning disparities. This task must be performed without exposing the sensitive compensation data for any individual and must be reversible to identify the outlier.
Which Cloud Data Loss Prevention API technique should you use to accomplish this?
- A. CryptoHashConfig
- B. Redaction
- C. Generalization
- D. CryptoReplaceFfxFpeConfig
Answer: D
Explanation:
Explanation
De-identifying sensitive data Cloud Data Loss Prevention (DLP) can de-identify sensitive data in text content, including text stored in container structures such as tables. De-identification is the process of removing identifying information from data. The API detects sensitive data such as personally identifiable information (PII), and then uses a de-identification transformation to mask, delete, or otherwise obscure the data. For example, de-identification techniques can include any of the following: Masking sensitive data by partially or fully replacing characters with a symbol, such as an asterisk (*) or hash (#). Replacing each instance of sensitive data with a token, or surrogate, string. Encrypting and replacing sensitive data using a randomly generated or pre-determined key. When you de-identify data using the CryptoReplaceFfxFpeConfig or CryptoDeterministicConfig infoType transformations, you can re-identify that data, as long as you have the CryptoKey used to originally de-identify the data. https://cloud.google.com/dlp/docs/deidentify-sensitive-data
NEW QUESTION # 106
......
Prepare for the Actual Google Cloud Certified Professional-Cloud-Security-Engineer Exam Practice Materials Collection: https://www.updatedumps.com/Google/Professional-Cloud-Security-Engineer-updated-exam-dumps.html
Google Cloud Certified Certification Professional-Cloud-Security-Engineer Sample Questions Reliable: https://drive.google.com/open?id=10yC_iIk73US512geOpjzqqAgyc26C-2l