[Apr 19, 2024] Pass Google Cloud Certified Professional-Cloud-Security-Engineer Exam With 235 Questions
Ultimate Guide to Prepare Free Google Professional-Cloud-Security-Engineer Exam Questions and Answer
To prepare for the exam, candidates are encouraged to take advantage of the various resources provided by Google Cloud. These resources include online training courses, practice exams, and study guides. In addition, candidates are encouraged to gain practical experience by working on real-world cloud security projects.
NEW QUESTION # 47
A customer wants to move their sensitive workloads to a Compute Engine-based cluster using Managed Instance Groups (MIGs). The jobs are bursty and must be completed quickly. They have a requirement to be able to manage and rotate the encryption keys.
Which boot disk encryption solution should you use on the cluster to meet this customer's requirements?
- A. Pre-encrypting files before transferring to Google Cloud Platform (GCP) for analysis
- B. Encryption by default
- C. Customer-supplied encryption keys (CSEK)
- D. Customer-managed encryption keys (CMEK) using Cloud Key Management Service (KMS)
Answer: D
Explanation:
Reference https://cloud.google.com/kubernetes-engine/docs/how-to/dynamic-provisioning-cmek
NEW QUESTION # 48
Your company's new CEO recently sold two of the company's divisions. Your Director asks you to help migrate the Google Cloud projects associated with those divisions to a new organization node. Which preparation steps are necessary before this migration occurs? (Choose two.)
- A. Remove all project-level custom Identity and Access Management (1AM) roles.
- B. Disallow inheritance of organization policies.
- C. Create a new folder for all projects to be migrated.
- D. Identify inherited Identity and Access Management (1AM) roles on projects to be migrated.
- E. Remove the specific migration projects from any VPC Service Controls perimeters and bridges.
Answer: C,D
Explanation:
Explanation
https://cloud.google.com/resource-manager/docs/project-migration#plan_policy When you migrate your project, it will no longer inherit the policies from its current place in the resource hierarchy, and will be subject to the effective policy evaluation at its destination. We recommend making sure that the effective policies at the project's destination match as much as possible the policies that the project had in its source location.
https://cloud.google.com/resource-manager/docs/project-migration#import_export_folders Policy inheritance can cause unintended effects when you are migrating a project, both in the source and destination organization resources. You can mitigate this risk by creating specific folders to hold only projects for export and import, and ensuring that the same policies are inherited by the folders in both organization resources. You can also set permissions on these folders that will be inherited to the projects moved within them, helping to accelerate the project migration process.
NEW QUESTION # 49
You need to connect your organization's on-premises network with an existing Google Cloud environment that includes one Shared VPC with two subnets named Production and Non-Production. You are required to:
Use a private transport link.
Configure access to Google Cloud APIs through private API endpoints originating from on-premises environments.
Ensure that Google Cloud APIs are only consumed via VPC Service Controls.
What should you do?
- A. 1. Set up a Cloud VPN link between the on-premises environment and Google Cloud.
2. Configure private access using the restricted googleapis.com domains in on-premises DNS configurations. - B. 1. Set up a Dedicated Interconnect link between the on-premises environment and Google Cloud.
2. Configure private access using the restricted.googleapis.com domains in on-premises DNS configurations. - C. 1. Set up a Partner Interconnect link between the on-premises environment and Google Cloud.
2. Configure private access using the private.googleapis.com domains in on-premises DNS configurations. - D. 1. Set up a Direct Peering link between the on-premises environment and Google Cloud.
2. Configure private access for both VPC subnets.
Answer: D
NEW QUESTION # 50
A customer wants to move their sensitive workloads to a Compute Engine-based cluster using Managed Instance Groups (MIGs). The jobs are bursty and must be completed quickly. They have a requirement to be able to manage and rotate the encryption keys.
Which boot disk encryption solution should you use on the cluster to meet this customer's requirements?
- A. Pre-encrypting files before transferring to Google Cloud Platform (GCP) for analysis
- B. Encryption by default
- C. Customer-supplied encryption keys (CSEK)
- D. Customer-managed encryption keys (CMEK) using Cloud Key Management Service (KMS)
Answer: D
Explanation:
Explanation
Reference https://cloud.google.com/kubernetes-engine/docs/how-to/dynamic-provisioning-cmek
NEW QUESTION # 51
You need to create a VPC that enables your security team to control network resources such as firewall rules. How should you configure the network to allow for separation of duties for network resources?
- A. Set up multiple VPC networks, and set up multi-NIC virtual appliances to connect the networks.
- B. Set up VPC Network Peering, and allow developers to peer their network with a Shared VPC.
- C. Set up a VPC in a project. Assign the Compute Network Admin role to the security team, and assign the Compute Admin role to the developers.
- D. Set up a Shared VPC where the security team manages the firewall rules, and share the network with developers via service projects.
Answer: D
NEW QUESTION # 52
Your company has deployed an application on Compute Engine. The application is accessible by clients on port 587. You need to balance the load between the different instances running the application. The connection should be secured using TLS, and terminated by the Load Balancer.
What type of Load Balancing should you use?
- A. SSL Proxy Load Balancing
- B. HTTP(S) Load Balancing
- C. Network Load Balancing
- D. TCP Proxy Load Balancing
Answer: A
Explanation:
https://cloud.google.com/load-balancing/docs/ssl/
NEW QUESTION # 53
A company allows every employee to use Google Cloud Platform. Each department has a Google Group, with all department members as group members. If a department member creates a new project, all members of that department should automatically have read-only access to all new project resources. Members of any other department should not have access to the project. You need to configure this behavior.
What should you do to meet these requirements?
- A. Create a Folder per department under the Organization. For each department's Folder, assign the Project Browser role to the Google Group related to that department.
- B. Create a Folder per department under the Organization. For each department's Folder, assign the Project Viewer role to the Google Group related to that department.
- C. Create a Project per department under the Organization. For each department's Project, assign the Project Viewer role to the Google Group related to that department.
- D. Create a Project per department under the Organization. For each department's Project, assign the Project Browser role to the Google Group related to that department.
Answer: C
NEW QUESTION # 54
You need to set up a Cloud interconnect connection between your company's on-premises data center and VPC host network. You want to make sure that on-premises applications can only access Google APIs over the Cloud Interconnect and not through the public internet. You are required to only use APIs that are supported by VPC Service Controls to mitigate against exfiltration risk to non-supported APIs. How should you configure the network?
- A. Use restricted googleapis.com to access Google APIs using a set of IP addresses only routable from within Google Cloud, which are advertised as routes over the Cloud Interconnect connection.
- B. Set up a Private Service Connect endpoint IP address with the API bundle of "all-apis", which is advertised as a route over the Cloud interconnect connection.
- C. Use private.googleapis.com to access Google APIs using a set of IP addresses only routable from within Google Cloud, which are advertised as routes over the connection.
- D. Enable Private Google Access on the regional subnets and global dynamic routing mode.
Answer: A
Explanation:
https://cloud.google.com/vpc/docs/private-service-connect
An API bundle:
All APIs (all-apis): most Google APIs
(same as private.googleapis.com).
VPC-SC (vpc-sc): APIs that VPC Service Controls supports
(same as restricted.googleapis.com).
VMs in the same VPC network as the endpoint (all regions)
On-premises systems that are connected to the VPC network that contains the endpoint
NEW QUESTION # 55
You perform a security assessment on a customer architecture and discover that multiple VMs have public IP addresses. After providing a recommendation to remove the public IP addresses, you are told those VMs need to communicate to external sites as part of the customer's typical operations. What should you recommend to reduce the need for public IP addresses in your customer's VMs?
- A. Cloud Router
- B. Cloud NAT
- C. Google Cloud Armor
- D. Cloud VPN
Answer: B
Explanation:
Explanation
https://cloud.google.com/nat/docs/overview
NEW QUESTION # 56
You manage a fleet of virtual machines (VMs) in your organization. You have encountered issues with lack of patching in many VMs. You need to automate regular patching in your VMs and view the patch management data across multiple projects.
What should you do?
Choose 2 answers
- A. Deploy patches with VM Manager by using OS patch management
- B. View patch management data in VM Manager by using OS patch management.
- C. View patch management data in a Security Command Center dashboard.
- D. Deploy patches with Security Command Center by using Rapid Vulnerability Detection.
- E. View patch management data in Artifact Registry.
Answer: A,B
Explanation:
https://cloud.google.com/compute/docs/os-patch-management
NEW QUESTION # 57
Your organization hosts a financial services application running on Compute Engine instances for a third-party company. The third-party company's servers that will consume the application also run on Compute Engine in a separate Google Cloud organization. You need to configure a secure network connection between the Compute Engine instances. You have the following requirements:
The network connection must be encrypted.
The communication between servers must be over private IP addresses.
What should you do?
- A. Configure a VPC Service Controls perimeter around your Compute Engine instances, and provide access to the third party via an access level.
- B. Configure a Cloud VPN connection between your organization's VPC network and the third party's that is controlled by VPC firewall rules.
- C. Configure a VPC peering connection between your organization's VPC network and the third party's that is controlled by VPC firewall rules.
- D. Configure an Apigee proxy that exposes your Compute Engine-hosted application as an API, and is encrypted with TLS which allows access only to the third party.
Answer: B
NEW QUESTION # 58
You are asked to recommend a solution to store and retrieve sensitive configuration data from an application that runs on Compute Engine. Which option should you recommend?
- A. Secret Manager
- B. Compute Engine guest attributes
- C. Compute Engine custom metadata
- D. Cloud Key Management Service
Answer: A
Explanation:
Explanation
Secret Manager is a secure and convenient storage system for API keys, passwords, certificates, and other sensitive data. Secret Manager provides a central place and single source of truth to manage, access, and audit secrets across Google Cloud. https://cloud.google.com/secret-manager
NEW QUESTION # 59
You need to audit the network segmentation for your Google Cloud footprint. You currently operate Production and Non-Production infrastructure-as-a-service (IaaS) environments. All your VM instances are deployed without any service account customization.
After observing the traffic in your custom network, you notice that all instances can communicate freely - despite tag-based VPC firewall rules in place to segment traffic properly - with a priority of 1000. What are the most likely reasons for this behavior?
- A. All VM instances are missing the respective network tags.
- B. A VPC firewall rule is allowing traffic between source/targets based on the same service account with priority 999.
- C. All VM instances are configured with the same network route.
- D. All VM instances are residing in the same network subnet.
- E. A VPC firewall rule is allowing traffic between source/targets based on the same service account with priority 1001.
Answer: A,C
NEW QUESTION # 60
A company is using Google Kubernetes Engine (GKE) with container images of a mission-critical application The company wants to scan the images for known security issues and securely share the report with the security team without exposing them outside Google Cloud.
What should you do?
- A. 1. Enable Container Threat Detection in the Security Command Center Premium tier.
* 2. Upgrade all clusters that are not on a supported version of GKE to the latest possible GKE version.
* 3. View and share the results from the Security Command Center - B. * 1. Enable vulnerability scanning in the Artifact Registry settings.
* 2. Use Cloud Build to build the images
* 3. Push the images to the Artifact Registry for automatic scanning.
* 4. View the reports in the Artifact Registry. - C. * 1. Get a GitHub subscription.
* 2. Build the images in Cloud Build and store them in GitHub for automatic scanning
* 3. Download the report from GitHub and share with the Security Team - D. * 1. Use an open source tool in Cloud Build to scan the images.
* 2. Upload reports to publicly accessible buckets in Cloud Storage by using gsutil
* 3. Share the scan report link with your security department.
Answer: B
Explanation:
Explanation
"The service evaluates all changes and remote access attempts to detect runtime attacks in near-real time." :
https://cloud.google.com/security-command-center/docs/concepts-container-threat-detection-overview This has nothing to do with KNOWN security Vulns in images
NEW QUESTION # 61
You need to implement an encryption-at-rest strategy that protects sensitive data and reduces key management complexity for non-sensitive data. Your solution has the following requirements:
* Schedule key rotation for sensitive data.
* Control which region the encryption keys for sensitive data are stored in.
* Minimize the latency to access encryption keys for both sensitive and non-sensitive data.
What should you do?
- A. Encrypt non-sensitive data with Google default encryption, and encrypt sensitive data with Cloud External Key Manager.
- B. Encrypt non-sensitive data and sensitive data with Cloud External Key Manager.
- C. Encrypt non-sensitive data with Google default encryption, and encrypt sensitive data with Cloud Key Management Service.
- D. Encrypt non-sensitive data and sensitive data with Cloud Key Management Service.
Answer: C
Explanation:
Explanation
Google uses a common cryptographic library, Tink, which incorporates our FIPS 140-2 Level 1 validated module, BoringCrypto, to implement encryption consistently across almost all Google Cloud products. To provideflexibility of controlling the key residency and rotation schedule, use google provided key for non-sensitive and encrypt sensitive data with Cloud Key Management Service
NEW QUESTION # 62
You want to use the gcloud command-line tool to authenticate using a third-party single sign-on (SSO) SAML identity provider. Which options are necessary to ensure that authentication is supported by the third-party identity provider (IdP)? (Choose two.)
- A. OpenID Connect
- B. SSO SAML as a third-party IdP
- C. Identity Platform
- D. Identity-Aware Proxy
- E. Cloud Identity
Answer: A,B
NEW QUESTION # 63
......
Ultimately, the Google Professional-Cloud-Security-Engineer certification exam is a rigorous and demanding test of an individual’s security expertise. Those who pass it will have proven themselves as highly skilled security professionals with a deep understanding of Google Cloud Platform security best practices. They will be able to help organizations design, implement, and maintain highly secure cloud-based applications and infrastructure, and will be well-positioned for career advancement and success.
Pass Professional-Cloud-Security-Engineer Tests Engine pdf - All Free Dumps: https://passleader.torrentvalid.com/Professional-Cloud-Security-Engineer-valid-braindumps-torrent.html