Google PROFESSIONAL-CLOUD-SECURITY-ENGINEER Online Practice Questions and Exam Preparation

Google PROFESSIONAL-CLOUD-SECURITY-ENGINEER Online Questions & Answers

• Question 211:

  An office manager at your small startup company is responsible for matching payments to invoices and creating billing alerts. For compliance reasons, the office manager is only permitted to have the Identity and Access Management (IAM) permissions necessary for these tasks.

  Which two IAM roles should the office manager have? (Choose two.)

  A. Organization Administrator
  B. Project Creator
  C. Billing Account Viewer
  D. Billing Account Costs Manager
  E. Billing Account User
  C. Billing Account Viewer
  D. Billing Account Costs Manager

  ---

  Explanation/Reference:

  https://cloud.google.com/billing/docs/how-to/billing-access#overview-of-cloud-billing-roles-in-cloud-iam

  Billing Account Costs Manager (roles/billing.costsManager) -Manage budgets and view and export cost information of billing accounts (but not pricing information)

  Billing Account Viewer (roles/billing.viewer)

  -View billing account cost information and transactions.

• Question 212:

  You are migrating an application into the cloud. The application will need to read data from a Cloud Storage bucket. Due to local regulatory requirements, you need to hold the key material used for encryption fully under your control and you require a valid rationale for accessing the key material.

  What should you do?

  A. Encrypt the data in the Cloud Storage bucket by using Customer Managed Encryption Keys. Configure an IAM deny policy for unauthorized groups.
  B. Generate a key in your on-premises environment to encrypt the data before you upload the data to the Cloud Storage bucket. Upload the key to the Cloud Key Management Service (KMS). Activate Key Access Justifications (KAJ) and have the external key system reject unauthorized accesses.
  C. Encrypt the data in the Cloud Storage bucket by using Customer Managed Encryption Keys backed by a Cloud Hardware Security Module (HSM). Enable data access logs.
  D. Generate a key in your on-premises environment and store it in a Hardware Security Module (HSM) that is managed on-premises. Use this key as an external key in the Cloud Key Management Service (KMS). Activate Key Access Justifications (KAJ) and set the external key system to reject unauthorized accesses.
  D. Generate a key in your on-premises environment and store it in a Hardware Security Module (HSM) that is managed on-premises. Use this key as an external key in the Cloud Key Management Service (KMS). Activate Key Access Justifications (KAJ) and set the external key system to reject unauthorized accesses.

  ---

  Explanation/Reference:

  Generate a key in your on-premises environment and store it in a Hardware Security Module (HSM) that is managed on-premises. Use this key as an external key in the Cloud Key Management Service (KMS). Activate Key Access Justifications (KAJ) and set the external key system to reject unauthorized accesses.

  This approach allows you to maintain full control over the key material used for encryption, as the key is generated and stored in an on-premises HSM. By using this key as an external key in Cloud KMS, you can leverage Google Cloud's key management capabilities while still maintaining control over the key material. Activating Key Access Justifications provides a valid rationale for accessing the key material, as it allows you to monitor and justify each attempt to use the key.

• Question 213:

  Your organization must follow the Payment Card Industry Data Security Standard (PCI DSS). To prepare for an audit, you must detect deviations on an infrastructure-as-a-service level in your Google Cloud landing zone. What should you do?

  A. Create a data profile covering all payment relevant data types. Configure Data Discovery and a risk analysis job in Google Cloud Sensitive Data Protection to analyze findings.
  B. Use the Google Cloud Compliance Reports Manager to download the latest version of the PCI DSS report Analyze the report to detect deviations.
  C. Create an Assured Workloads folder in your Google Cloud organization. Migrate existing projects into the folder and monitor for deviations in the PCI DSS.
  D. Activate Security Command Center Premium. Use the Compliance Monitoring product to filter findings that may not be PCI DSS compliant.
  D. Activate Security Command Center Premium. Use the Compliance Monitoring product to filter findings that may not be PCI DSS compliant.

• Question 214:

  Last week, a company deployed a new App Engine application that writes logs to BigQuery. No other workloads are running in the project. You need to validate that all data written to BigQuery was done using the App Engine Default Service Account.

  What should you do?

  A. 1. Use StackDriver Logging and filter on BigQuery Insert Jobs. 2.Click on the email address in line with the App Engine Default Service Account in the authentication field. 3.Click Hide Matching Entries. 4.Make sure the resulting list is empty.
  B. 1. Use StackDriver Logging and filter on BigQuery Insert Jobs. 2.Click on the email address in line with the App Engine Default Service Account in the authentication field. 3.Click Show Matching Entries. 4.Make sure the resulting list is empty.
  C. 1. In BigQuery, select the related dataset. 2. Make sure the App Engine Default Service Account is the only account that can write to the dataset.
  D. 1. Go to the IAM section on the project. 2. Validate that the App Engine Default Service Account is the only account that has a role that can write to BigQuery.
  A. 1. Use StackDriver Logging and filter on BigQuery Insert Jobs. 2.Click on the email address in line with the App Engine Default Service Account in the authentication field. 3.Click Hide Matching Entries. 4.Make sure the resulting list is empty.

• Question 215:

  Your team needs to make sure that their backend database can only be accessed by the frontend application and no other instances on the network.

  How should your team design this network?

  A. Create an ingress firewall rule to allow access only from the application to the database using firewall tags.
  B. Create a different subnet for the frontend application and database to ensure network isolation.
  C. Create two VPC networks, and connect the two networks using Cloud VPN gateways to ensure network isolation.
  D. Create two VPC networks, and connect the two networks using VPC peering to ensure network isolation.
  A. Create an ingress firewall rule to allow access only from the application to the database using firewall tags.

  ---

  Explanation/Reference:

  "However, even though it is possible to uses tags for target filtering in this manner, we recommend that you use service accounts where possible. Target tags are not access-controlled and can be changed by someone with the instanceAdmin role while VMs are in service. Service accounts are access-controlled, meaning that a specific user must be explicitly authorized to use a service account. There can only be one service account per instance, whereas there can be multiple tags. Also, service accounts assigned to a VM can only be changed when the VM is stopped"

• Question 216:

  Your company has deployed an application on Compute Engine. The application is accessible by clients on port 587. You need to balance the load between the different instances running the application. The connection should be secured using TLS, and terminated by the Load Balancer.

  What type of Load Balancing should you use?

  A. Network Load Balancing
  B. HTTP(S) Load Balancing
  C. TCP Proxy Load Balancing
  D. SSL Proxy Load Balancing
  D. SSL Proxy Load Balancing

  ---

  Explanation/Reference:

  https://cloud.google.com/load-balancing/docs/ssl -SSL Proxy Load Balancing is a reverse proxy load balancer that distributes SSL traffic coming from the internet to virtual machine (VM) instances in your Google Cloud VPC network. https://cloud.google.com/load-balancing/docs/ssl/

• Question 217:

  You are migrating an on-premises data warehouse to BigQuery Cloud SQL, and Cloud Storage. You need to configure security services in the data warehouse. Your company compliance policies mandate that the data warehouse must:

  1.

  Protect data at rest with full lifecycle management on cryptographic keys

  2.

  Implement a separate key management provider from data management

  3.

  Provide visibility into all encryption key requests

  What services should be included in the data warehouse implementation? Choose 2 answers

  A. Customer-managed encryption keys
  B. Customer-Supplied Encryption Keys
  C. Key Access Justifications
  D. Access Transparency and Approval
  E. Cloud External Key Manager
  C. Key Access Justifications
  E. Cloud External Key Manager

• Question 218:

  You are responsible for a set of Cloud Functions running on your organization's Google Cloud environment. During the last annual security review, secrets were identified in environment variables of some of these Cloud Functions. You must ensure that secrets are identified in a timely manner. What should you do?

  A. Implement regular peer reviews to assess the environment variables and identify secrets in your Cloud Functions. Raise a security incident if secrets are discovered.
  B. Implement a Cloud Function that scans the environment variables multiple times a day, and creates a finding in Security Command Center if secrets are discovered.
  C. Use Sensitive Data Protection to scan the environment variables multiple times per day, and create a finding in Security Command Center if secrets are discovered.
  D. Integrate dynamic application security testing into the CI/CD pipeline that scans the application code for the Cloud Functions. Fail the build process if secrets are discovered.
  C. Use Sensitive Data Protection to scan the environment variables multiple times per day, and create a finding in Security Command Center if secrets are discovered.

• Question 219:

  You are implementing communications restrictions for specific services in your Google Cloud organization. Your data analytics team works in a dedicated folder. You need to ensure that access to BigQuery is controlled for that folder and its projects. The data analytics team must be able to control the restrictions only at the folder level. What should you do?

  A. Create an organization-level access policy with a service perimeter to restrict BigQuery access. Assign the data analytics team the Access Context Manager Editor role on the access policy to allow the team to configure the access policy.
  B. Create a scoped policy on the folder with a service perimeter to restrict BigQuery access. Assign the data analytics team the Access Context Manager Editor role on the scoped policy to allow the team to configure the scoped policy.
  C. Define a hierarchical firewall policy on the folder to deny BigQuery access. Assign the data analytics team the Compute Organization Firewall Policy Admin role to allow the team to configure rules for the firewall policy.
  D. Enforce the Restrict Resource Service Usage organization policy constraint on the folder to restrict BigQuery access. Assign the data analytics team the Organization Policy Administrator role to allow the team to manage exclusions within the folder.
  B. Create a scoped policy on the folder with a service perimeter to restrict BigQuery access. Assign the data analytics team the Access Context Manager Editor role on the scoped policy to allow the team to configure the scoped policy.

• Question 220:

  An organization is starting to move its infrastructure from its on-premises environment to Google Cloud Platform (GCP). The first step the organization wants to take is to migrate its current data backup and disaster recovery solutions to GCP for later analysis. The organization's production environment will remain on-premises for an indefinite time. The organization wants a scalable and cost-efficient solution.

  Which GCP solution should the organization use?

  A. BigQuery using a data pipeline job with continuous updates
  B. Cloud Storage using a scheduled task and gsutil
  C. Compute Engine Virtual Machines using Persistent Disk
  D. Cloud Datastore using regularly scheduled batch upload jobs
  B. Cloud Storage using a scheduled task and gsutil

  ---

  Explanation/Reference:

  https://cloud.google.com/solutions/dr-scenarios-planning-guide#use-cloud-storage-as-part-of-your-daily-backup-routine