Google Google Certifications PROFESSIONAL-CLOUD-SECURITY-ENGINEER Questions & Answers

• Question 141:

  Your application is deployed as a highly available cross-region solution behind a global external HTTP(S) load balancer. You notice significant spikes in traffic from multiple IP addresses but it is unknown whether the IPs are malicious. You are concerned about your application's availability. You want to limit traffic from these clients over a specified time interval.

  What should you do?

  A. Configure a rate_based_ban action by using Google Cloud Armor and set the ban_duration_sec parameter to the specified time interval.

  B. Configure a deny action by using Google Cloud Armor to deny the clients that issued too many requests over the specified time interval.

  C. Configure a throttle action by using Google Cloud Armor to limit the number of requests per client over a specified time interval.

  D. Configure a firewall rule in your VPC to throttle traffic from the identified IP addresses.

  Correct Answer: C

• Question 142:

  Your company's new CEO recently sold two of the company's divisions. Your Director asks you to help migrate the Google Cloud projects associated with those divisions to a new organization node. Which preparation steps are necessary before this migration occurs? (Choose two.)

  A. Remove all project-level custom Identity and Access Management (1AM) roles.

  B. Disallow inheritance of organization policies.

  C. Identify inherited Identity and Access Management (1AM) roles on projects to be migrated.

  D. Create a new folder for all projects to be migrated.

  E. Remove the specific migration projects from any VPC Service Controls perimeters and bridges.

  Correct Answer: CE

• Question 143:

  An application running on a Compute Engine instance needs to read data from a Cloud Storage bucket. Your team does not allow Cloud Storage buckets to be globally readable and wants to ensure the principle of least privilege.

  Which option meets the requirement of your team?

  A. Create a Cloud Storage ACL that allows read-only access from the Compute Engine instance's IP address and allows the application to read from the bucket without credentials.

  B. Use a service account with read-only access to the Cloud Storage bucket, and store the credentials to the service account in the config of the application on the Compute Engine instance.

  C. Use a service account with read-only access to the Cloud Storage bucket to retrieve the credentials from the instance metadata.

  D. Encrypt the data in the Cloud Storage bucket using Cloud KMS, and allow the application to decrypt the data with the KMS key.

  Correct Answer: C

  If the environment variable GOOGLE_APPLICATION_CREDENTIALS is set, ADC uses the service account key or configuration file that the variable points to. If the environment variable GOOGLE_APPLICATION_CREDENTIALS isn't set, ADC uses the service account that is attached to the resource that is running your code. https://cloud.google.com/docs/authentication/ production#passing_the_path_to_the_service _account_key_in_code

• Question 144:

  Your organization recently activated the Security Command Center {SCO standard tier. There are a few Cloud Storage buckets that were accidentally made accessible to the public. You need to investigate the impact of the incident and remediate it.

  What should you do?

  A. 1 Remove the Identity and Access Management (IAM) granting access to allusers from the buckets 2 Apply the organization policy storage. unifromBucketLevelAccess to prevent regressions 3 Query the data access logs to report on unauthorized access

  B. 1 Change bucket permissions to limit access 2 Query the data access audit logs for any unauthorized access to the buckets 3 After the misconfiguration is corrected mute the finding in the Security Command Center

  C. 1 Change permissions to limit access for authorized users 2 Enforce a VPC Service Controls perimeter around all the production projects to immediately stop any unauthorized access 3 Review the administrator activity audit logs to report on any unauthorized access

  D. 1 Change the bucket permissions to limit access 2 Query the buckets usage logs to report on unauthorized access to the data 3 Enforce the organization policy storage.publicAccessPrevention to avoid regressions

  Correct Answer: D

• Question 145:

  A customer's internal security team must manage its own encryption keys for encrypting data on Cloud Storage and decides to use customer-supplied encryption keys (CSEK).

  How should the team complete this task?

  A. Upload the encryption key to a Cloud Storage bucket, and then upload the object to the same bucket.

  B. Use the gsutil command line tool to upload the object to Cloud Storage, and specify the location of the encryption key.

  C. Generate an encryption key in the Google Cloud Platform Console, and upload an object to Cloud Storage using the specified key.

  D. Encrypt the object, then use the gsutil command line tool or the Google Cloud Platform Console to upload the object to Cloud Storage.

  Correct Answer: B

  https://cloud.google.com/storage/docs/encryption/customer-supplied-keys#gsutil

• Question 146:

  Your team needs to configure their Google Cloud Platform (GCP) environment so they can centralize the control over networking resources like firewall rules, subnets, and routes. They also have an on-premises environment where resources need access back to the GCP resources through a private VPN connection. The networking resources will need to be controlled by the network security team.

  Which type of networking design should your team use to meet these requirements?

  A. Shared VPC Network with a host project and service projects

  B. Grant Compute Admin role to the networking team for each engineering project

  C. VPC peering between all engineering projects using a hub and spoke model

  D. Cloud VPN Gateway between all engineering projects using a hub and spoke model

  Correct Answer: A

  Reference: https://cloud.google.com/docs/enterprise/best-practices-for-enterprise- organizations#centralize_network_control

  Use Shared VPC to connect to a common VPC network. Resources in those projects can communicate with each other securely and efficiently across project boundaries using internal IPs. You can manage shared network resources, such as subnets, routes, and firewalls, from a central host project, enabling you to apply and enforce consistent network policies across the projects.

• Question 147:

  A large financial institution is moving its Big Data analytics to Google Cloud Platform. They want to have maximum control over the encryption process of data stored at rest in BigQuery.

  What technique should the institution use?

  A. Use Cloud Storage as a federated Data Source.

  B. Use a Cloud Hardware Security Module (Cloud HSM).

  C. Customer-managed encryption keys (CMEK).

  D. Customer-supplied encryption keys (CSEK).

  Correct Answer: C

  If you want to manage the key encryption keys used for your data at rest, instead of having Google manage the keys, use Cloud Key Management Service to manage your keys. This scenario is known as customer-managed encryption keys (CMEK). https://cloud.google.com/bigquery/docs/encryption-at-rest

  Reference: https://cloud.google.com/bigquery/docs/encryption-at-rest

• Question 148:

  A customer implements Cloud Identity-Aware Proxy for their ERP system hosted on Compute Engine. Their security team wants to add a security layer so that the ERP systems only accept traffic from Cloud Identity-Aware Proxy. What should the customer do to meet these requirements?

  A. Make sure that the ERP system can validate the JWT assertion in the HTTP requests.

  B. Make sure that the ERP system can validate the identity headers in the HTTP requests.

  C. Make sure that the ERP system can validate the x-forwarded-for headers in the HTTP requests.

  D. Make sure that the ERP system can validate the user's unique identifier headers in the HTTP requests.

  Correct Answer: A

  Use Cryptographic Verification If there is a risk of IAP being turned off or bypassed, your app can check to make sure the identity information it receives is valid. This uses a third web request header added by IAP, called X-Goog-IAP-JWT-Assertion. The value of the header is a cryptographically signed object that also contains the user identity data. Your application can verify the digital signature and use the data provided in this object to be certain that it was provided by IAP without alteration.

• Question 149:

  You will create a new Service Account that should be able to list the Compute Engine instances in the project. You want to follow Google-recommended practices. What should you do?

  A. Create an Instance Template, and allow the Service Account Read Only access for the Compute Engine Access Scope.

  B. Create a custom role with the permission compute.instances.list and grant the Service Account this role.

  C. Give the Service Account the role of Compute Viewer, and use the new Service Account for all instances.

  D. Give the Service Account the role of Project Viewer, and use the new Service Account for all instances.

  Correct Answer: B

  https://cloud.google.com/compute/docs/access/iam

• Question 150:

  You are responsible for managing your company's identities in Google Cloud. Your company enforces 2- Step Verification (2SV) for all users. You need to reset a user's access, but the user lost their second factor for 2SV. You want to minimize risk. What should you do?

  A. On the Google Admin console, select the appropriate user account, and generate a backup code to allow the user to sign in. Ask the user to update their second factor.

  B. On the Google Admin console, temporarily disable the 2SV requirements for all users. Ask the user to log in and add their new second factor to their account. Re-enable the 2SV requirement for all users.

  C. On the Google Admin console, select the appropriate user account, and temporarily disable 2SV for this account Ask the user to update their second factor, and then re-enable 2SV for this account.

  D. On the Google Admin console, use a super administrator account to reset the user account's credentials. Ask the user to update their credentials after their first login.

  Correct Answer: A

  https://support.google.com/a/answer/9176734

  Use backup codes for account recovery If you need to recover an account, use backup codes. Accounts are still protected by 2-Step Verification, and backup codes are easy to generate.