Google Google Certifications PROFESSIONAL-CLOUD-SECURITY-ENGINEER Questions & Answers

• Question 91:

  A company is running their webshop on Google Kubernetes Engine and wants to analyze customer transactions in BigQuery. You need to ensure that no credit card numbers are stored in BigQuery What should you do?

  A. Create a BigQuery view with regular expressions matching credit card numbers to query and delete affected rows.

  B. Use the Cloud Data Loss Prevention API to redact related infoTypes before data is ingested into BigQuery.

  C. Leverage Security Command Center to scan for the assets of type Credit Card Number in BigQuery.

  D. Enable Cloud Identity-Aware Proxy to filter out credit card numbers before storing the logs in BigQuery.

  Correct Answer: B

  https://cloud.google.com/bigquery/docs/scan-with-dlp

  Cloud Data Loss Prevention API allows to detect and redact or remove sensitive data before the comments or reviews are published. Cloud DLP will read information from BigQuery, Cloud Storage or Datastore and scan it for sensitive data.

• Question 92:

  Your company's Chief Information Security Officer (CISO) creates a requirement that business data must be stored in specific locations due to regulatory requirements that affect the company's global expansion plans. After working on the details to implement this requirement, you determine the following:

  1.

  The services in scope are included in the Google Cloud Data Residency Terms.

  2.

  The business data remains within specific locations under the same organization.

  3.

  The folder structure can contain multiple data residency locations.

  You plan to use the Resource Location Restriction organization policy constraint. At which level in the resource hierarchy should you set the constraint?

  A. Folder

  B. Resource

  C. Project

  D. Organization

  Correct Answer: C

  https://cloud.google.com/resource-manager/docs/organization-policy/defining-locations

• Question 93:

  Your organization hosts a financial services application running on Compute Engine instances for a third- party company. The third-party company's servers that will consume the application also run on Compute Engine in a separate Google

  Cloud organization. You need to configure a secure network connection between the Compute Engine instances.

  You have the following requirements:

  1.

  The network connection must be encrypted.

  2.

  The communication between servers must be over private IP addresses. What should you do?

  A. Configure a Cloud VPN connection between your organization's VPC network and the third party's that is controlled by VPC firewall rules.

  B. Configure a VPC peering connection between your organization's VPC network and the third party's that is controlled by VPC firewall rules.

  C. Configure a VPC Service Controls perimeter around your Compute Engine instances, and provide access to the third party via an access level.

  D. Configure an Apigee proxy that exposes your Compute Engine-hosted application as an API, and is encrypted with TLS which allows access only to the third party.

  Correct Answer: B

  Google encrypts and authenticates data in transit at one or more network layers when data moves outside physical boundaries not controlled by Google or on behalf of Google. All VM-to-VM traffic within a VPC network and peered VPC networks is encrypted. https://cloud.google.com/docs/security/encryption-in- transit#cio-level_summary

• Question 94:

  As adoption of the Cloud Data Loss Prevention (DLP) API grows within the company, you need to optimize usage to reduce cost. DLP target data is stored in Cloud Storage and BigQuery. The location and region are identified as a suffix in the resource name.

  Which cost reduction options should you recommend?

  A. Set appropriate rowsLimit value on BigQuery data hosted outside the US and set appropriate bytesLimitPerFile value on multiregional Cloud Storage buckets.

  B. Set appropriate rowsLimit value on BigQuery data hosted outside the US, and minimize transformation units on multiregional Cloud Storage buckets.

  C. Use rowsLimit and bytesLimitPerFile to sample data and use CloudStorageRegexFileSet to limit scans.

  D. Use FindingLimits and TimespanContfig to sample data and minimize transformation units.

  Correct Answer: C

  https://cloud.google.com/dlp/docs/inspecting-storage#sampling https://cloud.google.com/dlp/docs/best-practices-costs#limit_scans_of_files_in_to_only_relevant_files Reference: https://cloud.google.com/dlp/docs/reference/rest/v2/ InspectJobConfig

• Question 95:

  You manage one of your organization's Google Cloud projects (Project A). AVPC Service Control (SC) perimeter is blocking API access requests to this project including Pub/Sub. A resource running under a service account in another project (Project B) needs to collect messages from a Pub/Sub topic in your project Project B is not included in a VPC SC perimeter. You need to provide access from Project B to the Pub/Sub topic in Project A using the principle of least Privilege.

  What should you do?

  A. Configure an ingress policy for the perimeter in Project A and allow access for the service account in Project B to collect messages.

  B. Create an access level that allows a developer in Project B to subscribe to the Pub/Sub topic that is located in Project A.

  C. Create a perimeter bridge between Project A and Project B to allow the required communication between both projects.

  D. Remove the Pub/Sub API from the list of restricted services in the perimeter configuration for Project A.

  Correct Answer: A

• Question 96:

  A customer wants to run a batch processing system on VMs and store the output files in a Cloud Storage bucket. The networking and security teams have decided that no VMs may reach the public internet.

  How should this be accomplished?

  A. Create a firewall rule to block internet traffic from the VM.

  B. Provision a NAT Gateway to access the Cloud Storage API endpoint.

  C. Enable Private Google Access on the VPC.

  D. Mount a Cloud Storage bucket as a local filesystem on every VM.

  Correct Answer: C

  https://cloud.google.com/vpc/docs/private-google-access

• Question 97:

  An organization is starting to move its infrastructure from its on-premises environment to Google Cloud Platform (GCP). The first step the organization wants to take is to migrate its ongoing data backup and disaster recovery solutions to GCP. The organization's on-premises production environment is going to be the next phase for migration to GCP. Stable networking connectivity between the on-premises environment and GCP is also being implemented.

  Which GCP solution should the organization use?

  A. BigQuery using a data pipeline job with continuous updates via Cloud VPN

  B. Cloud Storage using a scheduled task and gsutil via Cloud Interconnect

  C. Compute Engines Virtual Machines using Persistent Disk via Cloud Interconnect

  D. Cloud Datastore using regularly scheduled batch upload jobs via Cloud VPN

  Correct Answer: B

  https://cloud.google.com/solutions/dr-scenarios-for-data#production_environment_is_on-premises https://medium.com/@pvergadia/cold-disaster-recovery-on-google-cloud-for-applications-running-on- premises-114b31933d02

• Question 98:

  You are working with protected health information (PHI) for an electronic health record system. The privacy officer is concerned that sensitive data is stored in the analytics system. You are tasked with anonymizing the sensitive data in a way that is not reversible. Also, the anonymized data should not preserve the character set and length. Which Google Cloud solution should you use?

  A. Cloud Data Loss Prevention with deterministic encryption using AES-SIV

  B. Cloud Data Loss Prevention with format-preserving encryption

  C. Cloud Data Loss Prevention with cryptographic hashing

  D. Cloud Data Loss Prevention with Cloud Key Management Service wrapped cryptographic keys

  Correct Answer: C

  Reference: https://cloud.google.com/dlp/docs/pseudonymization https://cloud.google.com/dlp/docs/pseudonymization?hl=JAandskip_cache=true#supported-methods

• Question 99:

  Your company uses Google Cloud and has publicly exposed network assets. You want to discover the assets and perform a security audit on these assets by using a software tool in the least amount of time.

  What should you do?

  A. Run a platform security scanner on all instances in the organization.

  B. Notify Google about the pending audit and wait for confirmation before performing the scan.

  C. Contact a Google approved security vendor to perform the audit.

  D. Identify all external assets by using Cloud Asset Inventory and then run a network security scanner against them.

  Correct Answer: D

• Question 100:

  How should a customer reliably deliver Stackdriver logs from GCP to their on-premises SIEM system?

  A. Send all logs to the SIEM system via an existing protocol such as syslog.

  B. Configure every project to export all their logs to a common BigQuery DataSet, which will be queried by the SIEM system.

  C. Configure Organizational Log Sinks to export logs to a Cloud Pub/Sub Topic, which will be sent to the SIEM via Dataflow.

  D. Build a connector for the SIEM to query for all logs in real time from the GCP RESTful JSON APIs.

  Correct Answer: C

  Scenarios for exporting Cloud Logging data: Splunk This scenario shows how to export selected logs from Cloud Logging to Pub/Sub for ingestion into Splunk. Splunk is a security information and event management (SIEM) solution that supports several ways of ingesting data, such as receiving streaming data out of Google Cloud through Splunk HTTP Event Collector (HEC) or by fetching data from Google Cloud APIs through Splunk Add-on for Google Cloud. Using the Pub/Sub to Splunk Dataflow template, you can natively forward logs and events from a Pub/Sub topic into Splunk HEC. If Splunk HEC is not available in your Splunk deployment, you can use the Add-on to collect the logs and events from the Pub/Sub topic. https://cloud.google.com/solutions/exporting-stackdriver-logging-for-splunk