Professional Cloud Security Engineer v1.0 (Professional Cloud Security Engineer)

Page:    1 / 17   
Total 244 questions

A customer wants to deploy a large number of 3-tier web applications on Compute Engine.
How should the customer ensure authenticated network separation between the different tiers of the application?

  • A. Run each tier in its own Project, and segregate using Project labels.
  • B. Run each tier with a different Service Account (SA), and use SA-based firewall rules.
  • C. Run each tier in its own subnet, and use subnet-based firewall rules.
  • D. Run each tier with its own VM tags, and use tag-based firewall rules.


Answer : C

A manager wants to start retaining security event logs for 2 years while minimizing costs. You write a filter to select the appropriate log entries.
Where should you export the logs?

  • A. BigQuery datasets
  • B. Cloud Storage buckets
  • C. StackDriver logging
  • D. Cloud Pub/Sub topics


Answer : C

Reference:
https://cloud.google.com/logging/docs/exclusions

For compliance reasons, an organization needs to ensure that in-scope PCI Kubernetes Pods reside on `in-scope` Nodes only. These Nodes can only contain the
`in-scope` Pods.
How should the organization achieve this objective?

  • A. Add a nodeSelector field to the pod configuration to only use the Nodes labeled inscope: true.
  • B. Create a node pool with the label inscope: true and a Pod Security Policy that only allows the Pods to run on Nodes with that label.
  • C. Place a taint on the Nodes with the label inscope: true and effect NoSchedule and a toleration to match in the Pod configuration.
  • D. Run all in-scope Pods in the namespace ג€in-scope-pciג€.


Answer : C

In an effort for your company messaging app to comply with FIPS 140-2, a decision was made to use GCP compute and network services. The messaging app architecture includes a Managed Instance Group (MIG) that controls a cluster of Compute Engine instances. The instances use Local SSDs for data caching and
UDP for instance-to-instance communications. The app development team is willing to make any changes necessary to comply with the standard
Which options should you recommend to meet the requirements?

  • A. Encrypt all cache storage and VM-to-VM communication using the BoringCrypto module.
  • B. Set Disk Encryption on the Instance Template used by the MIG to customer-managed key and use BoringSSL for all data transit between instances.
  • C. Change the app instance-to-instance communications from UDP to TCP and enable BoringSSL on clients' TLS connections.
  • D. Set Disk Encryption on the Instance Template used by the MIG to Google-managed Key and use BoringSSL library on all instance-to-instance communications.


Answer : D

A customer has an analytics workload running on Compute Engine that should have limited internet access.
Your team created an egress firewall rule to deny (priority 1000) all traffic to the internet.
The Compute Engine instances now need to reach out to the public repository to get security updates.
What should your team do?

  • A. Create an egress firewall rule to allow traffic to the CIDR range of the repository with a priority greater than 1000.
  • B. Create an egress firewall rule to allow traffic to the CIDR range of the repository with a priority less than 1000.
  • C. Create an egress firewall rule to allow traffic to the hostname of the repository with a priority greater than 1000.
  • D. Create an egress firewall rule to allow traffic to the hostname of the repository with a priority less than 1000.


Answer : C

You want data on Compute Engine disks to be encrypted at rest with keys managed by Cloud Key Management Service (KMS). Cloud Identity and Access
Management (IAM) permissions to these keys must be managed in a grouped way because the permissions should be the same for all keys.
What should you do?

  • A. Create a single KeyRing for all persistent disks and all Keys in this KeyRing. Manage the IAM permissions at the Key level.
  • B. Create a single KeyRing for all persistent disks and all Keys in this KeyRing. Manage the IAM permissions at the KeyRing level.
  • C. Create a KeyRing per persistent disk, with each KeyRing containing a single Key. Manage the IAM permissions at the Key level.
  • D. Create a KeyRing per persistent disk, with each KeyRing containing a single Key. Manage the IAM permissions at the KeyRing level.


Answer : C

A company is backing up application logs to a Cloud Storage bucket shared with both analysts and the administrator. Analysts should only have access to logs that do not contain any personally identifiable information (PII). Log files containing PII should be stored in another bucket that is only accessible by the administrator.
What should you do?

  • A. Use Cloud Pub/Sub and Cloud Functions to trigger a Data Loss Prevention scan every time a file is uploaded to the shared bucket. If the scan detects PII, have the function move into a Cloud Storage bucket only accessible by the administrator.
  • B. Upload the logs to both the shared bucket and the bucket only accessible by the administrator. Create a job trigger using the Cloud Data Loss Prevention API. Configure the trigger to delete any files from the shared bucket that contain PII.
  • C. On the bucket shared with both the analysts and the administrator, configure Object Lifecycle Management to delete objects that contain any PII.
  • D. On the bucket shared with both the analysts and the administrator, configure a Cloud Storage Trigger that is only triggered when PII data is uploaded. Use Cloud Functions to capture the trigger and delete such files.


Answer : C

A customer terminates an engineer and needs to make sure the engineer's Google account is automatically deprovisioned.
What should the customer do?

  • A. Use the Cloud SDK with their directory service to remove their IAM permissions in Cloud Identity.
  • B. Use the Cloud SDK with their directory service to provision and deprovision users from Cloud Identity.
  • C. Configure Cloud Directory Sync with their directory service to provision and deprovision users from Cloud Identity.
  • D. Configure Cloud Directory Sync with their directory service to remove their IAM permissions in Cloud Identity.


Answer : C

An organization is evaluating the use of Google Cloud Platform (GCP) for certain IT workloads. A well-established directory service is used to manage user identities and lifecycle management. This directory service must continue for the organization to use as the `source of truth` directory for identities.
Which solution meets the organization's requirements?

  • A. Google Cloud Directory Sync (GCDS)
  • B. Cloud Identity
  • C. Security Assertion Markup Language (SAML)
  • D. Pub/Sub


Answer : B

Reference:
https://cloud.google.com/solutions/federating-gcp-with-active-directory-introduction

Which international compliance standard provides guidelines for information security controls applicable to the provision and use of cloud services?

  • A. ISO 27001
  • B. ISO 27002
  • C. ISO 27017
  • D. ISO 27018


Answer : C

Create a new Service Account that should be able to list the Compute Engine instances in the project. You want to follow Google-recommended practices.

You will create a new Service Account that should be able to list the Compute Engine instances in the project. You want to follow Google-recommended practices.
What should you do?

  • A. Create an Instance Template, and allow the Service Account Read Only access for the Compute Engine Access Scope.
  • B. Create a custom role with the permission compute.instances.list and grant the Service Account this role.
  • C. Give the Service Account the role of Compute Viewer, and use the new Service Account for all instances.
  • D. Give the Service Account the role of Project Viewer, and use the new Service Account for all instances.


Answer : A

In a shared security responsibility model for IaaS, which two layers of the stack does the customer share responsibility for? (Choose two.)

  • A. Hardware
  • B. Network Security
  • C. Storage Encryption
  • D. Access Policies
  • E. Boot


Answer : CD

An organization is starting to move its infrastructure from its on-premises environment to Google Cloud Platform (GCP). The first step the organization wants to take is to migrate its ongoing data backup and disaster recovery solutions to GCP. The organization's on-premises production environment is going to be the next phase for migration to GCP. Stable networking connectivity between the on-premises environment and GCP is also being implemented.
Which GCP solution should the organization use?

  • A. BigQuery using a data pipeline job with continuous updates via Cloud VPN
  • B. Cloud Storage using a scheduled task and gsutil via Cloud Interconnect
  • C. Compute Engines Virtual Machines using Persistent Disk via Cloud Interconnect
  • D. Cloud Datastore using regularly scheduled batch upload jobs via Cloud VPN


Answer : B

Reference:
https://cloud.google.com/solutions/migration-to-google-cloud-building-your-foundation

What are the steps to encrypt data using envelope encryption?
A.
✑ Generate a data encryption key (DEK) locally.
✑ Use a key encryption key (KEK) to wrap the DEK.
✑ Encrypt data with the KEK.
✑ Store the encrypted data and the wrapped KEK.
B.
✑ Generate a key encryption key (KEK) locally.
✑ Use the KEK to generate a data encryption key (DEK).
✑ Encrypt data with the DEK.
✑ Store the encrypted data and the wrapped DEK.
C.
✑ Generate a data encryption key (DEK) locally.
✑ Encrypt data with the DEK.
✑ Use a key encryption key (KEK) to wrap the DEK.
✑ Store the encrypted data and the wrapped DEK.
D.
✑ Generate a key encryption key (KEK) locally.
✑ Generate a data encryption key (DEK) locally.
✑ Encrypt data with the KEK.
Store the encrypted data and the wrapped DEK.



Answer : C

Reference:
https://cloud.google.com/kms/docs/envelope-encryption

A customer wants to make it convenient for their mobile workforce to access a CRM web interface that is hosted on Google Cloud Platform (GCP). The CRM can only be accessed by someone on the corporate network. The customer wants to make it available over the internet. Your team requires an authentication layer in front of the application that supports two-factor authentication
Which GCP product should the customer implement to meet these requirements?

  • A. Cloud Identity-Aware Proxy
  • B. Cloud Armor
  • C. Cloud Endpoints
  • D. Cloud VPN


Answer : D

Page:    1 / 17   
Total 244 questions