Google PROFESSIONAL-CLOUD-SECURITY-ENGINEER Online Practice Questions and Exam Preparation

Google PROFESSIONAL-CLOUD-SECURITY-ENGINEER Online Questions & Answers

• Question 201:

  Your organization has had a few recent DDoS attacks. You need to authenticate responses to domain name lookups. Which Google Cloud service should you use?

  A. Cloud DNS with DNSSEC
  B. Cloud NAT
  C. HTTP(S) Load Balancing
  D. Google Cloud Armor
  A. Cloud DNS with DNSSEC
  C. HTTP(S) Load Balancing
  D. Google Cloud Armor

• Question 202:

  You are implementing a new web application on Google Cloud that will be accessed from your on-premises network. To provide protection from threats like malware, you must implement transport layer security (TLS) interception for incoming traffic to your application. What should you do?

  A. Configure Secure Web Proxy. Offload the TLS traffic in the load balancer, inspect the traffic, and forward the traffic to the web application.
  B. Configure an internal proxy load balancer. Offload the TLS traffic in the load balancer inspect, the traffic and forward the traffic to the web application.
  C. Configure a hierarchical firewall policy. Enable TLS interception by using Cloud Next Generation Firewall (NGFW) Enterprise.
  D. Configure a VPC firewall rule. Enable TLS interception by using Cloud Next Generation Firewall (NGFW) Enterprise.
  A. Configure Secure Web Proxy. Offload the TLS traffic in the load balancer, inspect the traffic, and forward the traffic to the web application.

• Question 203:

  Your organization is moving virtual machines (VMs) to Google Cloud. You must ensure that operating system images that are used across your projects are trusted and meet your security requirements. What should you do?

  A. Implement an organization policy to enforce that boot disks can only be created from images that come from the trusted image project.
  B. Create a Cloud Function that is automatically triggered when a new virtual machine is created from the trusted image repository Verify that the image is not deprecated.
  C. Implement an organization policy constraint that enables the Shielded VM service on all projects to enforce the trusted image repository usage.
  D. Automate a security scanner that verifies that no common vulnerabilities and exposures (CVEs) are present in your trusted image repository.
  A. Implement an organization policy to enforce that boot disks can only be created from images that come from the trusted image project.

• Question 204:

  You must ensure that the keys used for at-rest encryption of your data are compliant with your organization's security controls. One security control mandates that keys get rotated every 90 days. You must implement an effective detection strategy to validate if keys are rotated as required. What should you do?

  A. Analyze the crypto key versions of the keys by using data from Cloud Asset Inventory. If an active key is older than 90 days, send an alert message through your incident notification channel.
  B. Assess the keys in the Cloud Key Management Service by implementing code in Cloud Run. If a key is not rotated after 90 days, raise a finding in Security Command Center.
  C. Define a metric that checks for timely key updates by using Cloud Logging. If a key is not rotated after 90 days, send an alert message through your incident notification channel.
  D. Identify keys that have not been rotated by using Security Health Analytics. If a key is not rotated after 90 days, a finding in Security Command Center is raised.
  A. Analyze the crypto key versions of the keys by using data from Cloud Asset Inventory. If an active key is older than 90 days, send an alert message through your incident notification channel.

• Question 205:

  You are the security admin of your company. Your development team creates multiple GCP projects under the "implementation" folder for several dev, staging, and production workloads. You want to prevent data exfiltration by malicious insiders or compromised code by setting up a security perimeter. However, you do not want to restrict communication between the projects.

  What should you do?

  A. Use a Shared VPC to enable communication between all projects, and use firewall rules to prevent data exfiltration.
  B. Create access levels in Access Context Manager to prevent data exfiltration, and use a shared VPC for communication between projects.
  C. Use an infrastructure-as-code software tool to set up a single service perimeter and to deploy a Cloud Function that monitors the "implementation" folder via Stackdriver and Cloud Pub/Sub. When the function notices that a new project is added to the folder, it executes Terraform to add the new project to the associated perimeter.
  D. Use an infrastructure-as-code software tool to set up three different service perimeters for dev, staging, and prod and to deploy a Cloud Function that monitors the "implementation" folder via Stackdriver and Cloud Pub/Sub. When the function notices that a new project is added to the folder, it executes Terraform to add the new project to the respective perimeter.
  C. Use an infrastructure-as-code software tool to set up a single service perimeter and to deploy a Cloud Function that monitors the "implementation" folder via Stackdriver and Cloud Pub/Sub. When the function notices that a new project is added to the folder, it executes Terraform to add the new project to the associated perimeter.

  ---

  Explanation/Reference:

  https://cloud.google.com/vpc-service-controls/docs/overview#benefits https://github.com/terraform-google-modules/terraform-google-vpc-service-controls/tree/master/examples/automatic_folder

• Question 206:

  A customer needs to prevent attackers from hijacking their domain/IP and redirecting users to a malicious site through a man-in-the-middle attack.

  Which solution should this customer use?

  A. VPC Flow Logs
  B. Cloud Armor
  C. DNS Security Extensions
  D. Cloud Identity-Aware Proxy
  C. DNS Security Extensions

  ---

  Explanation/Reference:

  Reference: https://cloud.google.com/blog/products/gcp/dnssec-now-available-in-cloud-dns DNSSEC --use a DNS registrar that supports DNSSEC, and enable it. DNSSEC digitally signs DNS communication, making it more difficult (but not impossible) for hackers to intercept and spoof. Domain Name System Security Extensions (DNSSEC) adds security to the Domain Name System (DNS) protocol by enabling DNS responses to be validated. Having a trustworthy Domain Name System (DNS) that translates a domain name like www.example.com into its associated IP address is an increasingly important building block of today's web-based applications. Attackers can hijack this process of domain/IP lookup and redirect users to a malicious site through DNS hijacking and man-in-the-middle attacks. DNSSEC helps mitigate the risk of such attacks by cryptographically signing DNS records. As a result, it prevents attackers from issuing fake DNS responses that may misdirect browsers to nefarious websites. https://cloud.google.com/blog/products/gcp/dnssec-now-available-in-cloud-dns

• Question 207:

  Your DevOps team uses Packer to build Compute Engine images by using this process:

  1 Create an ephemeral Compute Engine VM.

  2 Copy a binary from a Cloud Storage bucket to the VM's file system.

  3 Update the VM's package manager.

  4 Install external packages from the internet onto the VM.

  Your security team just enabled the organizational policy. consrraints/compure.vnExtemallpAccess. to restrict the usage of public IP Addresses on VMs. In response your DevOps team updated their scripts to remove public IP addresses on the Compute Engine VMs however the build pipeline is failing due to connectivity issues.

  What should you do? Choose 2 answers

  A. Provision a Cloud NAT instance in the same VPC and region as the Compute Engine VM
  B. Provision an HTTP load balancer with the VM in an unmanaged instance group to allow inbound connections from the internet to your VM.
  C. Update the VPC routes to allow traffic to and from the internet.
  D. Provision a Cloud VPN tunnel in the same VPC and region as the Compute Engine VM.
  E. Enable Private Google Access on the subnet that the Compute Engine VM is deployed within.
  A. Provision a Cloud NAT instance in the same VPC and region as the Compute Engine VM
  E. Enable Private Google Access on the subnet that the Compute Engine VM is deployed within.

• Question 208:

  Which two implied firewall rules are defined on a VPC network? (Choose two.)

  A. A rule that allows all outbound connections
  B. A rule that denies all inbound connections
  C. A rule that blocks all inbound port 25 connections
  D. A rule that blocks all outbound connections
  E. A rule that allows all inbound port 80 connections
  A. A rule that allows all outbound connections
  B. A rule that denies all inbound connections

  ---

  Explanation/Reference:

  Implied IPv4 allow egress rule. An egress rule whose action is allow, destination is 0.0.0.0/0, and priority is the lowest possible (65535) lets any instance send traffic to any destination

  Implied IPv4 deny ingress rule. An ingress rule whose action is deny, source is 0.0.0.0/0, and priority is the lowest possible (65535) protects all instances by blocking incoming connections to them.

  https://cloud.google.com/vpc/docs/firewalls?hl=en#default_firewall_rules

• Question 209:

  A customer wants to move their sensitive workloads to a Compute Engine-based cluster using Managed Instance Groups (MIGs). The jobs are bursty and must be completed quickly. They have a requirement to be able to manage and rotate the encryption keys.

  Which boot disk encryption solution should you use on the cluster to meet this customer's requirements?

  A. Customer-supplied encryption keys (CSEK)
  B. Customer-managed encryption keys (CMEK) using Cloud Key Management Service (KMS)
  C. Encryption by default
  D. Pre-encrypting files before transferring to Google Cloud Platform (GCP) for analysis
  B. Customer-managed encryption keys (CMEK) using Cloud Key Management Service (KMS)

  ---

  Explanation/Reference:

  Reference https://cloud.google.com/kubernetes-engine/docs/how-to/dynamic-provisioning-cmek

• Question 210:

  Your company is using Cloud Dataproc for its Spark and Hadoop jobs. You want to be able to create, rotate, and destroy symmetric encryption keys used for the persistent disks used by Cloud Dataproc. Keys can be stored in the cloud.

  What should you do?

  A. Use the Cloud Key Management Service to manage the data encryption key (DEK).
  B. Use the Cloud Key Management Service to manage the key encryption key (KEK).
  C. Use customer-supplied encryption keys to manage the data encryption key (DEK).
  D. Use customer-supplied encryption keys to manage the key encryption key (KEK).
  B. Use the Cloud Key Management Service to manage the key encryption key (KEK).

  ---

  Explanation/Reference:

  This PD and bucket data is encrypted using a Google-generated data encryption key (DEK) and key encryption key (KEK). The CMEK feature allows you to create, use, and revoke the key encryption key (KEK). Google still controls the data encryption key (DEK). For more information on Google data encryption keys, see Encryption at Rest.

  https://cloud.google.com/dataproc/docs/concepts/configuring-clusters/customer-managed-encryption https://codelabs.developers.google.com/codelabs/encrypt-and-decrypt-data-with-cloud-kms#0