Google PROFESSIONAL-CLOUD-SECURITY-ENGINEER Online Practice Questions and Exam Preparation

Google PROFESSIONAL-CLOUD-SECURITY-ENGINEER Online Questions & Answers

• Question 101:

  A company's application is deployed with a user-managed Service Account key. You want to use Google- recommended practices to rotate the key.

  What should you do?

  A. Open Cloud Shell and run gcloud iam service-accounts enable-auto-rotate --iam- account=IAM_ACCOUNT.
  B. Open Cloud Shell and run gcloud iam service-accounts keys rotate --iam-account=IAM_ACCOUNT -- key=NEW_KEY.
  C. Create a new key, and use the new key in the application. Delete the old key from the Service Account.
  D. Create a new key, and use the new key in the application. Store the old key on the system as a backup key.
  C. Create a new key, and use the new key in the application. Delete the old key from the Service Account.

  ---

  Explanation/Reference:

  You can rotate a key by creating a new key, updating applications to use the new key, and deleting the old key. Use the serviceAccount.keys.create() method and serviceAccount.keys.delete() method together to automate the rotation. https://cloud.google.com/iam/docs/understanding-service-accounts

• Question 102:

  You manage your organization's Security Operations Center (SOC). You currently monitor and detect network traffic anomalies in your Google Cloud VPCs based on packet header information. However, you want the capability to explore network flows and their payload to aid investigations. Which Google Cloud product should you use?

  A. Marketplace IDS
  B. VPC Flow Logs
  C. VPC Service Controls logs
  D. Packet Mirroring
  E. Google Cloud Armor Deep Packet Inspection
  D. Packet Mirroring

  ---

  Explanation/Reference:

  Reference: https://aws.amazon.com/blogs/aws/new-vpc-traffic-mirroring/ Packet Mirroring clones the traffic of specified instances in your Virtual Private Cloud (VPC) network and forwards it for examination. Packet Mirroring captures all traffic and packet data, including payloads and headers. https://cloud.google.com/vpc/docs/packet-mirroring

• Question 103:

  You need to audit the network segmentation for your Google Cloud footprint. You currently operate Production and Non-Production infrastructure-as-a-service (IaaS) environments. All your VM instances are deployed without any service account customization.

  After observing the traffic in your custom network, you notice that all instances can communicate freely "despite tag-based VPC firewall rules in place to segment traffic properly " with a priority of 1000.

  What are the most likely reasons for this behavior?

  A. All VM instances are missing the respective network tags.
  B. All VM instances are residing in the same network subnet.
  C. All VM instances are configured with the same network route.
  D. A VPC firewall rule is allowing traffic between source/targets based on the same service account with priority 999.
  E. A VPC firewall rule is allowing traffic between source/targets based on the same service account with priority 1001.
  A. All VM instances are missing the respective network tags.
  D. A VPC firewall rule is allowing traffic between source/targets based on the same service account with priority 999.

• Question 104:

  How should a customer reliably deliver Stackdriver logs from GCP to their on-premises SIEM system?

  A. Send all logs to the SIEM system via an existing protocol such as syslog.
  B. Configure every project to export all their logs to a common BigQuery DataSet, which will be queried by the SIEM system.
  C. Configure Organizational Log Sinks to export logs to a Cloud Pub/Sub Topic, which will be sent to the SIEM via Dataflow.
  D. Build a connector for the SIEM to query for all logs in real time from the GCP RESTful JSON APIs.
  C. Configure Organizational Log Sinks to export logs to a Cloud Pub/Sub Topic, which will be sent to the SIEM via Dataflow.

  ---

  Explanation/Reference:

  Scenarios for exporting Cloud Logging data: Splunk This scenario shows how to export selected logs from Cloud Logging to Pub/Sub for ingestion into Splunk. Splunk is a security information and event management (SIEM) solution that supports several ways of ingesting data, such as receiving streaming data out of Google Cloud through Splunk HTTP Event Collector (HEC) or by fetching data from Google Cloud APIs through Splunk Add-on for Google Cloud. Using the Pub/Sub to Splunk Dataflow template, you can natively forward logs and events from a Pub/Sub topic into Splunk HEC. If Splunk HEC is not available in your Splunk deployment, you can use the Add-on to collect the logs and events from the Pub/Sub topic. https://cloud.google.com/solutions/exporting-stackdriver-logging-for-splunk

• Question 105:

  You are setting up a CI/CD pipeline to deploy containerized applications to your production clusters on Google Kubernetes Engine (GKE). You need to prevent containers with known vulnerabilities from being deployed. You have the following requirements for your solution:

  1.

  Must be cloud-native

  2.

  Must be cost-efficient

  3.

  Minimize operational overhead

  How should you accomplish this? (Choose two.)

  A. Create a Cloud Build pipeline that will monitor changes to your container templates in a Cloud Source Repositories repository. Add a step to analyze Container Analysis results before allowing the build to continue.
  B. Use a Cloud Function triggered by log events in Google Cloud's operations suite to automatically scan your container images in Container Registry.
  C. Use a cron job on a Compute Engine instance to scan your existing repositories for known vulnerabilities and raise an alert if a non-compliant container image is found.
  D. Deploy Jenkins on GKE and configure a CI/CD pipeline to deploy your containers to Container Registry. Add a step to validate your container images before deploying your container to the cluster.
  E. In your CI/CD pipeline, add an attestation on your container image when no vulnerabilities have been found. Use a Binary Authorization policy to block deployments of containers with no attestation in your cluster.
  A. Create a Cloud Build pipeline that will monitor changes to your container templates in a Cloud Source Repositories repository. Add a step to analyze Container Analysis results before allowing the build to continue.
  E. In your CI/CD pipeline, add an attestation on your container image when no vulnerabilities have been found. Use a Binary Authorization policy to block deployments of containers with no attestation in your cluster.

  ---

  Explanation/Reference:

  Reference:

  https://cloud.google.com/architecture/prep-kubernetes-engine-for-prod https://cloud.google.com/container-analysis/docs/container-analysis Container Analysis is a service that provides vulnerability scanning and metadata storage for

  containers. The scanning service performs vulnerability scans on images in Container Registry and Artifact Registry, then stores the resulting metadata and makes it available for consumption through an API.

  https://cloud.google.com/binary-authorization/docs/attestations

  After a container image is built, an attestation can be created to affirm that a required activity was performed on the image such as a regression test, vulnerability scan, or other test. The attestation is created by signing the image's unique

  digest.

  During deployment, instead of repeating the activities, Binary Authorization verifies the attestations using an attestor. If all of the attestations for an image are verified, Binary Authorization allows the image to be deployed.

• Question 106:

  Your organization has an application hosted in Cloud Run. You must control access to the application by using Cloud Identity-Aware Proxy (IAP) with these requirements:

  1.

  Only users from the AppDev group may have access.

  2.

  Access must be restricted to internal network IP addresses.

  What should you do?

  A. Deploy a VPN gateway and instruct the AppDev group to connect to the company network before accessing the application.
  B. Create an access level that includes conditions for internal IP address ranges and AppDev groups. Apply this access level to the application's IAP policy.
  C. Configure firewall rules to limit access to IAP based on the AppDev group and source IP addresses.
  D. Configure IAP to enforce multi-factor authentication (MFA) for all users and use network intrusion detection systems (NIDS) to block unauthorized access attempts.
  B. Create an access level that includes conditions for internal IP address ranges and AppDev groups. Apply this access level to the application's IAP policy.

• Question 107:

  Your organization has hired a small, temporary partner team for 18 months. The temporary team will work alongside your DevOps team to develop your organization's application that is hosted on Google Cloud. You must give the temporary partner team access to your application's resources on Google Cloud and ensure that partner employees lose access. If they are removed from their employer's organization. What should you do?

  A. Create a temporary username and password for the temporary partner team members. Auto-clean the usernames and passwords after the work engagement has ended.
  B. Create a workforce identity pool and federate the identity pool with the identity provider (IdP) of the temporary partner team.
  C. Implement just-in-time privileged access to Google Cloud for the temporary partner team.
  D. Add the identities of the temporary partner team members to your identity provider (IdP).
  B. Create a workforce identity pool and federate the identity pool with the identity provider (IdP) of the temporary partner team.

• Question 108:

  You need to enable VPC Service Controls and allow changes to perimeters in existing environments without preventing access to resources. Which VPC Service Controls mode should you use?

  A. Cloud Run
  B. Native
  C. Enforced
  D. Dry run
  D. Dry run

  ---

  Explanation/Reference:

  https://cloud.google.com/vpc-service-controls/docs/service-perimeters https://cloud.google.com/vpc-service-controls/docs/dry-run-mode In dry run mode, requests that violate the perimeter policy are not denied, only logged. Dry run mode is used to test perimeter configuration and to monitor usage of services without preventing access to resources.

• Question 109:

  You work for a banking organization. You are migrating sensitive customer data to Google Cloud that is currently encrypted at rest while on-premises. There are strict regulatory requirements when moving sensitive data to the cloud. Independent of the cloud service provider, you must be able to audit key usage and be able to deny certain types of decrypt requests. You must choose an encryption strategy that will ensure robust security and compliance with the regulations. What should you do?

  A. Utilize Google default encryption and Cloud IAM to keep the keys within your organization's control.
  B. Implement Cloud External Key Manager (Cloud EKM) with Access Approval, to integrate with your existing on-premises key management solution.
  C. Implement Cloud External Key Manager (Cloud EKM) with Key Access Justifications to integrate with your existing one premises key management solution.
  D. Utilize customer-managed encryption keys (CMEK) created in a dedicated Google Compute Engine instance with Confidential Compute encryption, under your organization's control.
  C. Implement Cloud External Key Manager (Cloud EKM) with Key Access Justifications to integrate with your existing one premises key management solution.

• Question 110:

  You perform a security assessment on a customer architecture and discover that multiple VMs have public IP addresses. After providing a recommendation to remove the public IP addresses, you are told those VMs need to communicate to external sites as part of the customer's typical operations. What should you recommend to reduce the need for public IP addresses in your customer's VMs?

  A. Google Cloud Armor
  B. Cloud NAT
  C. Cloud Router
  D. Cloud VPN
  B. Cloud NAT

  ---

  Explanation/Reference:

  https://cloud.google.com/nat/docs/overview