Skip to main content

PROFESSIONAL-CLOUD-SECURITY-ENGINEER Real Exam Questions

Professional Cloud Security Engineer

324 questions available · Page 1 of 33

Updated Exam DumpsVerified AnswersPass Guarantee

Get Complete Exam Dumps
Question 1 Single choice

A company has been running their application on Compute Engine. A bug in the application allowed a malicious user to repeatedly execute a script that results in the Compute Engine instance crashing.
Although the bug has been fixed, you want to get notified in case this hack re-occurs.

What should you do?

  1. A

    Create an Alerting Policy in Stackdriver using a Process Health condition, checking that the number of executions of the script remains below the desired threshold. Enable notifications.

  2. B

    Create an Alerting Policy in Stackdriver using the CPU usage metric. Set the threshold to 80% to be notified when the CPU usage goes above this 80%.

  3. C

    Log every execution of the script to Stackdriver Logging. Create a User-defined metric in Stackdriver Logging on the logs, and create a Stackdriver Dashboard displaying the metric.

  4. D

    Log every execution of the script to Stackdriver Logging. Configure BigQuery as a log sink, and create a BigQuery scheduled query to count the number of executions in a specific timeframe.

Show answer and explanation

Correct answer: A

Explanation

References:
https://cloud.google.com/logging/docs/logs-based-metrics/

Question 2 Single choice

You need to centralize your team's logs for production projects. You want your team to be able to search and analyze the logs using Logs Explorer.

What should you do?

  1. A

    Enable Cloud Monitoring workspace, and add the production projects to be monitored.

  2. B

    Use Logs Explorer at the organization level and filter for production project logs.

  3. C

    Create an aggregate org sink at the parent folder of the production projects, and set the destination to a Cloud Storage bucket.

  4. D

    Create an aggregate org sink at the parent folder of the production projects, and set the destination to a logs bucket.

Show answer and explanation

Correct answer: D

Explanation

https://cloud.google.com/logging/docs/export/aggregated_sinks#supported-destinations

You can use aggregated sinks to route logs within or between the same organizations and folders to the following destinations: -Another Cloud Logging bucket: Log entries held in Cloud Logging log buckets.

Question 3 Single choice

An organization is moving applications to Google Cloud while maintaining a few mission-critical applications on-premises. The organization must transfer the data at a bandwidth of at least 50 Gbps.

What should they use to ensure secure continued connectivity between sites?

  1. A

    Dedicated Interconnect

  2. B

    Cloud Router

  3. C

    Cloud VPN

  4. D

    Partner Interconnect

Show answer and explanation

Correct answer: A

Explanation

References:
https://cloud.google.com/architecture/migration-to-google-cloud-transferring-your-large-datasets
https://cloud.google.com/network-connectivity/docs/interconnect/concepts/overview

Question 4 Single choice

Your company's Chief Information Security Officer (CISO) creates a requirement that business data must be stored in specific locations due to regulatory requirements that affect the company's global expansion plans. After working on the details to implement this requirement, you determine the following:

1. The services in scope are included in the Google Cloud Data Residency Terms.
2. The business data remains within specific locations under the same organization.
3. The folder structure can contain multiple data residency locations.

You plan to use the Resource Location Restriction organization policy constraint.
At which level in the resource hierarchy should you set the constraint?

  1. A

    Folder

  2. B

    Resource

  3. C

    Project

  4. D

    Organization

Show answer and explanation

Correct answer: C

Explanation

https://cloud.google.com/resource-manager/docs/organization-policy/defining-locations

Question 5 Single choice

Your organization must follow the Payment Card Industry Data Security Standard (PCI DSS). To prepare for an audit, you must detect deviations on an infrastructure-as-a-service level in your Google Cloud landing zone.

What should you do?

  1. A

    Create a data profile covering all payment relevant data types. Configure Data Discovery and a risk analysis job in Google Cloud Sensitive Data Protection to analyze findings.

  2. B

    Use the Google Cloud Compliance Reports Manager to download the latest version of the PCI DSS report Analyze the report to detect deviations.

  3. C

    Create an Assured Workloads folder in your Google Cloud organization. Migrate existing projects into the folder and monitor for deviations in the PCI DSS.

  4. D

    Activate Security Command Center Premium. Use the Compliance Monitoring product to filter findings that may not be PCI DSS compliant.

Show answer and explanation

Correct answer: D

Question 6 Single choice

A company migrated their entire data/center to Google Cloud Platform. It is running thousands of instances across multiple projects managed by different departments. You want to have a historical record of what was running in Google Cloud Platform at any point in time.

What should you do?

  1. A

    Use Resource Manager on the organization level.

  2. B

    Use Forseti Security to automate inventory snapshots.

  3. C

    Use Stackdriver to create a dashboard across all projects.

  4. D

    Use Security Command Center to view all assets across the organization.

Show answer and explanation

Correct answer: B

Explanation

Only Forseti security can have both 'past' and 'present' (i.e. historical) records of the resources.
https://forsetisecurity.org/about/

Question 7 Single choice

A customer is collaborating with another company to build an application on Compute Engine. The customer is building the application tier in their GCP Organization, and the other company is building the storage tier in a different GCP Organization. This is a 3-tier web application. Communication between portions of the application must not traverse the public internet by any means.

Which connectivity option should be implemented?

  1. A

    VPC peering

  2. B

    Cloud VPN

  3. C

    Cloud Interconnect

  4. D

    Shared VPC

Show answer and explanation

Correct answer: A

Explanation

Peering two VPCs does permit traffic to flow between the two shared networks, but it's only bi-directional.
Peered VPC networks remain administratively separate.

Question 8 Single choice

An organization wants to track how bonus compensations have changed over time to identify employee outliers and correct earning disparities. This task must be performed without exposing the sensitive compensation data for any individual and must be reversible to identify the outlier.

Which Cloud Data Loss Prevention API technique should you use?

  1. A

    Generalization

  2. B

    Redaction

  3. C

    CryptoHashConfig

  4. D

    CryptoReplaceFfxFpeConfig

Show answer and explanation

Correct answer: D

Question 9 Single choice

Your organization's Google Cloud VMs are deployed via an instance template that configures them with a public IP address in order to host web services for external users. The VMs reside in a service project that is attached to a host (VPC) project containing one custom Shared VPC for the VMs. You have been asked to reduce the exposure of the VMs to the internet while continuing to service external users. You have already recreated the instance template without a public IP address configuration to launch the managed instance group (MIG).

What should you do?

  1. A

    Deploy a Cloud NAT Gateway in the service project for the MIG.

  2. B

    Deploy a Cloud NAT Gateway in the host (VPC) project for the MIG.

  3. C

    Deploy an external HTTP(S) load balancer in the service project with the MIG as a backend.

  4. D

    Deploy an external HTTP(S) load balancer in the host (VPC) project with the MIG as a backend.

Show answer and explanation

Correct answer: C

Question 10 Single choice

You are troubleshooting access denied errors between Compute Engine instances connected to a Shared VPC and BigQuery datasets. The datasets reside in a project protected by a VPC Service Controls perimeter.

What should you do?

  1. A

    Add the host project containing the Shared VPC to the service perimeter.

  2. B

    Add the service project where the Compute Engine instances reside to the service perimeter.

  3. C

    Create a service perimeter between the service project where the Compute Engine instances reside and the host project that contains the Shared VPC.

  4. D

    Create a perimeter bridge between the service project where the Compute Engine instances reside and the perimeter that contains the protected BigQuery datasets.

Show answer and explanation

Correct answer: A

Explanation

https://cloud.google.com/vpc-service-controls/docs/service-perimeters#secure-google-managed-resources
If you're using Shared VPC, you must include the host project in a service perimeter along with any projects that belong to the Shared VPC.