Google Google Certifications PROFESSIONAL-CLOUD-SECURITY-ENGINEER Questions & Answers

• Question 151:

  An engineering team is launching a web application that will be public on the internet. The web application is hosted in multiple GCP regions and will be directed to the respective backend based on the URL request.

  Your team wants to avoid exposing the application directly on the internet and wants to deny traffic from a specific list of malicious IP addresses

  Which solution should your team implement to meet these requirements?

  A. Cloud Armor

  B. Network Load Balancing

  C. SSL Proxy Load Balancing

  D. NAT Gateway

  Correct Answer: A

  https://cloud.google.com/armor/docs/security-policy-overview#edge-security Reference: https://cloud.google.com/armor/docs/security-policy-concepts

• Question 152:

  A company has been running their application on Compute Engine. A bug in the application allowed a malicious user to repeatedly execute a script that results in the Compute Engine instance crashing. Although the bug has been fixed, you want to get notified in case this hack re-occurs.

  What should you do?

  A. Create an Alerting Policy in Stackdriver using a Process Health condition, checking that the number of executions of the script remains below the desired threshold. Enable notifications.

  B. Create an Alerting Policy in Stackdriver using the CPU usage metric. Set the threshold to 80% to be notified when the CPU usage goes above this 80%.

  C. Log every execution of the script to Stackdriver Logging. Create a User-defined metric in Stackdriver Logging on the logs, and create a Stackdriver Dashboard displaying the metric.

  D. Log every execution of the script to Stackdriver Logging. Configure BigQuery as a log sink, and create a BigQuery scheduled query to count the number of executions in a specific timeframe.

  Correct Answer: A

  Reference: https://cloud.google.com/logging/docs/logs-based-metrics/

• Question 153:

  In an effort for your company messaging app to comply with FIPS 140-2, a decision was made to use GCP compute and network services. The messaging app architecture includes a Managed Instance Group (MIG) that controls a cluster of Compute Engine instances. The instances use Local SSDs for data caching and UDP for instance-to-instance communications. The app development team is willing to make any changes necessary to comply with the standard

  Which options should you recommend to meet the requirements?

  A. Encrypt all cache storage and VM-to-VM communication using the BoringCrypto module.

  B. Set Disk Encryption on the Instance Template used by the MIG to customer-managed key and use BoringSSL for all data transit between instances.

  C. Change the app instance-to-instance communications from UDP to TCP and enable BoringSSL on clients' TLS connections.

  D. Set Disk Encryption on the Instance Template used by the MIG to Google-managed Key and use BoringSSL library on all instance-to-instance communications.

  Correct Answer: A

  https://cloud.google.com/security/compliance/fips-140-2-validated Google Cloud Platform uses a FIPS 140-2 validated encryption module called BoringCrypto (certificate 3318) in our production environment. This means that both data in

  transit to the customer and between data centers, and data at rest are encrypted using FIPS 140-2 validated encryption.

  The module that achieved FIPS 140-2 validation is part of our BoringSSL library.

• Question 154:

  You recently joined the networking team supporting your company's Google Cloud implementation. You are tasked with familiarizing yourself with the firewall rules configuration and providing recommendations based on your networking and Google Cloud experience. What product should you recommend to detect firewall rules that are overlapped by attributes from other firewall rules with higher or equal priority?

  A. Security Command Center

  B. Firewall Rules Logging

  C. VPC Flow Logs

  D. Firewall Insights

  Correct Answer: D

  https://cloud.google.com/network-intelligence-center/docs/firewall-insights/concepts/overview#shadowed- firewall-rules Firewall Insights analyzes your firewall rules to detect firewall rules that are shadowed by other rules. A shadowed rule is a firewall rule that has all of its relevant attributes, such as its IP address and port ranges, overlapped by attributes from one or more rules with higher or equal priority, called shadowing rules.

• Question 155:

  You want to evaluate GCP for PCI compliance. You need to identify Google's inherent controls.

  Which document should you review to find the information?

  A. Google Cloud Platform: Customer Responsibility Matrix

  B. PCI DSS Requirements and Security Assessment Procedures

  C. PCI SSC Cloud Computing Guidelines

  D. Product documentation for Compute Engine

  Correct Answer: A

  https://cloud.google.com/files/PCI_DSS_Shared_Responsibility_GCP_v32.pdf https://services.google.com/fh/files/misc/gcp_pci_shared_responsibility_matrix_aug_2021.p df

• Question 156:

  An organization is evaluating the use of Google Cloud Platform (GCP) for certain IT workloads. A well- established directory service is used to manage user identities and lifecycle management. This directory service must continue for the organization to use as the "source of truth" directory for identities.

  Which solution meets the organization's requirements?

  A. Google Cloud Directory Sync (GCDS)

  B. Cloud Identity

  C. Security Assertion Markup Language (SAML)

  D. Pub/Sub

  Correct Answer: A

  With Google Cloud Directory Sync (GCDS), you can synchronize the data in your Google Account with your Microsoft Active Directory or LDAP server. GCDS doesn't migrate any content (such as email messages, calendar events, or files) to your Google Account. You use GCDS to synchronize your Google users, groups, and shared contacts to match the information in your LDAP server. https://support.google.com/a/answer/106368?hl=en

• Question 157:

  Your organization recently deployed a new application on Google Kubernetes Engine. You need to deploy a solution to protect the application. The solution has the following requirements: Scans must run at least once per week Must be able to detect cross-site scripting vulnerabilities Must be able to authenticate using Google accounts Which solution should you use?

  A. Google Cloud Armor

  B. Web Security Scanner

  C. Security Health Analytics

  D. Container Threat Detection

  Correct Answer: B

  Reference: https://cloud.google.com/security-command-center/docs/concepts-web-security-scanner- overview

  Web Security Scanner identifies security vulnerabilities in your App Engine, Google Kubernetes Engine (GKE), and Compute Engine web applications. https://cloud.google.com/security-command-center/docs/concepts-web-security-scanner-overview

• Question 158:

  You are exporting application logs to Cloud Storage. You encounter an error message that the log sinks don't support uniform bucket-level access policies. How should you resolve this error?

  A. Change the access control model for the bucket

  B. Update your sink with the correct bucket destination.

  C. Add the roles/logging.logWriter Identity and Access Management (IAM) role to the bucket for the log sink identity.

  D. Add the roles/logging.bucketWriter Identity and Access Management (IAM) role to the bucket for the log sink identity.

  Correct Answer: A

  https://cloud.google.com/logging/docs/export/troubleshoot#errors_exporting_to_cloud_stor age https://cloud.google.com/logging/docs/export/troubleshoot

  Unable to grant correct permissions to the destination: Even if the sink was successfully created with the correct service account permissions, this error message displays if the access control model for the Cloud Storage bucket was set to

  uniform access when the bucket was created. For existing Cloud Storage buckets, you can change the access control model for the first 90 days after bucket creation by using the Permissions tab. For new buckets, select the Fine-grained

  access control model during bucket creation.

  For details, see Creating Cloud Storage buckets.

• Question 159:

  You define central security controls in your Google Cloud environment for one of the folders in your organization you set an organizational policy to deny the assignment of external IP addresses to VMs. Two days later you receive an alert about a new VM with an external IP address under that folder.

  What could have caused this alert?

  A. The VM was created with a static external IP address that was reserved in the project before the organizational policy rule was set.

  B. The organizational policy constraint wasn't properly enforced and is running in "dry run mode.

  C. At project level, the organizational policy control has been overwritten with an 'allow' value.

  D. The policy constraint on the folder level does not have any effect because of an allow" value for that constraint on the organizational level.

  Correct Answer: C

• Question 160:

  You need to connect your organization's on-premises network with an existing Google Cloud environment that includes one Shared VPC with two subnets named Production and Non-Production. You are required

  to:

  Use a private transport link.

  Configure access to Google Cloud APIs through private API endpoints originating from on-premises environments.

  Ensure that Google Cloud APIs are only consumed via VPC Service Controls.

  What should you do?

  A. 1. Set up a Cloud VPN link between the on-premises environment and Google Cloud.

  2. Configure private access using the restricted googleapis.com domains in on-premises DNS configurations.

  B. 1. Set up a Partner Interconnect link between the on-premises environment and Google Cloud.

  2. Configure private access using the private.googleapis.com domains in on-premises DNS configurations.

  C. 1. Set up a Direct Peering link between the on-premises environment and Google Cloud.

  2. Configure private access for both VPC subnets.

  D. 1. Set up a Dedicated Interconnect link between the on-premises environment and Google Cloud.

  2. Configure private access using the restricted.googleapis.com domains in on-premises DNS configurations.

  Correct Answer: D

  restricted.googleapis.com (199.36.153.4/30) only provides access to Cloud and Developer APIs that support VPC Service Controls. VPC Service Controls are enforced for these services https://cloud.google.com/vpc/docs/configure-privategoogle-access-hybrid