Google Google Certifications PROFESSIONAL-CLOUD-SECURITY-ENGINEER Questions & Answers

• Question 211:

  A customer needs an alternative to storing their plain text secrets in their source-code management (SCM) system.

  How should the customer achieve this using Google Cloud Platform?

  A. Use Cloud Source Repositories, and store secrets in Cloud SQL.

  B. Encrypt the secrets with a Customer-Managed Encryption Key (CMEK), and store them in Cloud Storage.

  C. Run the Cloud Data Loss Prevention API to scan the secrets, and store them in Cloud SQL.

  D. Deploy the SCM to a Compute Engine VM with local SSDs, and enable preemptible VMs.

  Correct Answer: B

• Question 212:

  You are the security admin of your company. Your development team creates multiple GCP projects under the "implementation" folder for several dev, staging, and production workloads. You want to prevent data exfiltration by malicious insiders or compromised code by setting up a security perimeter. However, you do not want to restrict communication between the projects.

  What should you do?

  A. Use a Shared VPC to enable communication between all projects, and use firewall rules to prevent data exfiltration.

  B. Create access levels in Access Context Manager to prevent data exfiltration, and use a shared VPC for communication between projects.

  C. Use an infrastructure-as-code software tool to set up a single service perimeter and to deploy a Cloud Function that monitors the "implementation" folder via Stackdriver and Cloud Pub/Sub. When the function notices that a new project is added to the folder, it executes Terraform to add the new project to the associated perimeter.

  D. Use an infrastructure-as-code software tool to set up three different service perimeters for dev, staging, and prod and to deploy a Cloud Function that monitors the "implementation" folder via Stackdriver and Cloud Pub/Sub. When the function notices that a new project is added to the folder, it executes Terraform to add the new project to the respective perimeter.

  Correct Answer: C

  https://cloud.google.com/vpc-service-controls/docs/overview#benefits https://github.com/terraform-google-modules/terraform-google-vpc-service-controls/tree/master/examples/ automatic_folder

• Question 213:

  Your Google Cloud environment has one organization node, one folder named "Apps", and several projects within that folder. The organizational node enforces the constraints/ iam.allowedPolicyMemberDomains organization policy, which

  allows members from the terramearth.com organization. The "Apps" folder enforces the constraints/iam.allowedPolicyMemberDomains organization policy, which allows members from the flowlogistic.com organization. It also has the

  inheritFromParent:

  false property.

  You attempt to grant access to a project in the "Apps" folder to the user [email protected].

  What is the result of your action and why?

  A. The action succeeds because members from both organizations, terramearth.com or flowlogistic.com, are allowed on projects in the "Apps" folder.

  B. The action succeeds and the new member is successfully added to the project's Identity and Access Management (IAM) policy because all policies are inherited by underlying folders and projects.

  C. The action fails because a constraints/iam.allowedPolicyMemberDomains organization policy must be defined on the current project to deactivate the constraint temporarily.

  D. The action fails because a constraints/iam.allowedPolicyMemberDomains organization policy is in place and only members from the flowlogistic.com organization are allowed.

  Correct Answer: D

  The correct answer is D. The action fails because a constraints/iam.allowedPolicyMemberDomains organization policy is in place and only members from the flowlogistic.com organization are allowed.

  The inheritFromParent: false property on the "Apps" folder means that it does not inherit the organization policy from the organization node. Therefore, only the policy set at the folder level applies, which allows only members from the flowlogistic.com organization. As a result, the attempt to grant access to the user [email protected] fails because this user is not a member of the flowlogistic.com organization.

• Question 214:

  You are developing a new application that uses exclusively Compute Engine VMs. Once a day, this application will execute five different batch jobs. Each of the batch jobs requires a dedicated set of permissions on Google Cloud resources outside of your application. You need to design a secure access concept for the batch jobs that adheres to the least-privilege principle.

  What should you do?

  A. 1. Create a general service account "g-sa" to orchestrate the batch jobs.

  2.

  Create one service account per batch job `b-sa-[1-5]'. Grant only the permissions required to run the individual batch jobs to the service accounts and generate service account keys for each of these service accounts.

  3.

  Store the service account keys in Secret Manager. Grant g-sa access to Secret Manager and run the batch jobs with the permissions of b-sa-[1-5].

  B. 1. Create a general service account "g-sa" to execute the batch jobs.

  2.

  Grant the permissions required to execute the batch jobs to g-sa.

  3.

  Execute the batch jobs with the permissions granted to g-sa.

  C. 1. Create a workload identity pool and configure workload identity pool providers for each batch job.

  2.

  Assign the workload identity user role to each of the identities configured in the providers.

  3.

  Create one service account per batch job "b-sa-[1-5]", and grant only the permissions required to run the individual batch jobs to the service accounts.

  4.

  Generate credential configuration files for each of the providers. Use these files to execute the batch jobs with the permissions of b-sa-[1-5].

  D. 1. Create a general service account "g-sa" to orchestrate the batch jobs.

  2.

  Create one service account per batch job "b-sa-[1-5]", and grant only the permissions required to run the individual batch jobs to the service accounts.

  3.

  Grant the Service Account Token Creator role to g-sa. Use g-sa to obtain short-lived access tokens for b-sa-[1-5] and to execute the batch jobs with the permissions of b-sa-[1-5].

  Correct Answer: D

  The correct answer is D. 1. Create a general service account "g-sa" to orchestrate the batch jobs. 2. Create one service account per batch job "b-sa-[1-5]", and grant only the permissions required to run the individual batch jobs to the service accounts. 3. Grant the Service Account Token Creator role to g-sa. Use g-sa to obtain short-lived access tokens for b-sa-[1-5] and to execute the batch jobs with the permissions of b-sa-[1-5].

  This approach adheres to the principle of least privilege by ensuring that each batch job has only the permissions it needs to run. The general service account "g-sa" is used to orchestrate the batch jobs, and the Service Account Token Creator role allows it to obtain short-lived access tokens for the batch job service accounts "b-sa-[1-5]". This setup allows the batch jobs to be executed with the permissions of the respective service accounts.

• Question 215:

  Your customer has an on-premises Public Key Infrastructure (PKI) with a certificate authority (CA). You need to issue certificates for many HTTP load balancer frontends. The on-premises PKI should be minimally affected due to many manual processes, and the solution needs to scale.

  What should you do?

  A. Use Certificate Manager to issue Google managed public certificates and configure it at HTTP the load balancers in your infrastructure as code (IaC).

  B. Use a subordinate CA in the Google Certificate Authority Service from the on-premises PKI system to issue certificates for the load balancers.

  C. Use Certificate Manager to import certificates issued from on-premises PKI and for the frontends. Leverage the gcloud tool for importing.

  D. Use the web applications with PKCS12 certificates issued from subordinate CA based on OpenSSL on- premises. Use the gcloud tool for importing. Use the External TCP/UDP Network load balancer instead of an external HTTP Load Balancer.

  Correct Answer: B

  The correct answer is B. Use a subordinate CA in the Google Certificate Authority Service from the on- premises PKI system to issue certificates for the load balancers.

  This approach allows you to leverage your existing on-premises PKI infrastructure while minimizing its impact and manual processes. By creating a subordinate CA in Google's Certificate Authority Service, you can automate the process of issuing certificates for your HTTP load balancer frontends. This solution scales well as the number of load balancers increases.

• Question 216:

  You control network traffic for a folder in your Google Cloud environment. Your folder includes multiple projects and Virtual Private Cloud (VPC) networks. You want to enforce on the folder level that egress connections are limited only to IP range 10.58.5.0/24 and only from the VPC network "dev-vpc". You want to minimize implementation and maintenance effort.

  What should you do?

  A. 1. Leave the network configuration of the VMs in scope unchanged.

  2.

  Create a new project including a new VPC network "new-vpc".

  3.

  Deploy a network appliance in "new-vpc" to filter access requests and only allow egress connections from "dev-vpc" to 10.58.5.0/24.

  B. 1. Leave the network configuration of the VMs in scope unchanged.

  2. Enable Cloud NAT for "dev-vpc" and restrict the target range in Cloud NAT to 10.58.5.0/24.

  C. 1. Attach external IP addresses to the VMs in scope.

  2. Define and apply a hierarchical firewall policy on folder level to deny all egress connections and to allow egress to IP range 10.58.5.0/24 from network dev-vpc.

  D. 1. Attach external IP addresses to the VMs in scope.

  2. Configure a VPC Firewall rule in "dev-vpc" that allows egress connectivity to IP range 10.58.5.0/24 for all source addresses in this network.

  Correct Answer: C

  The correct answer is C. 1. Attach external IP addresses to the VMs in scope. 2. Define and apply a hierarchical firewall policy on folder level to deny all egress connections and to allow egress to IP range 10.58.5.0/24 from network dev-vpc.

  This approach allows you to control network traffic at the folder level. By attaching external IP addresses to the VMs in scope, you can ensure that the VMs have a unique, routable IP address for outbound connections. Then, by defining and applying a hierarchical firewall policy at the folder level, you can enforce that egress connections are limited to the specified IP range and only from the specified VPC network.

• Question 217:

  Your company is concerned about unauthorized parties gaining access to the Google Cloud environment by using a fake login page. You must implement a solution to protect against person-in-the-middle attacks. Which security measure should you use?

  A. Security key

  B. Google prompt

  C. Text message or phone call code

  D. Google Authenticator application

  Correct Answer: A

  The correct answer is A. Security key.

  A security key is a physical device that you can use for two-step verification, providing an additional layer of security for your Google Account. Security keys can defend against phishing and man-in-the-middle attacks, making your login process more secure.

• Question 218:

  Your organization wants full control of the keys used to encrypt data at rest in their Google Cloud environments. Keys must be generated and stored outside of Google and integrate with many Google Services including BigQuery. What should you do?

  A. Use customer-supplied encryption keys (CSEK) with keys generated on trusted external systems. Provide the raw CSEK as part of the API call.

  B. Create a KMS key that is stored on a Google managed FIPS 140-2 level 3 Hardware Security Module (HSM). Manage the Identity and Access Management (IAM) permissions settings, and set up the key rotation period.

  C. Use Cloud External Key Management (EKM) that integrates with an external Hardware Security Module (HSM) system from supported vendors.

  D. Create a Cloud Key Management Service (KMS) key with imported key material. Wrap the key for protection during import. Import the key generated on a trusted system in Cloud KMS.

  Correct Answer: C

  The correct answer is C. Use Cloud External Key Management (EKM) that integrates with an external Hardware Security Module (HSM) system from supported vendors.

  Cloud EKM allows you to use encryption keys that are stored and managed in a third-party key management system deployed outside of Google's infrastructure. This gives your organization full control over the keys used to encrypt data at rest in Google Cloud environments, including BigQuery.

• Question 219:

  You are deploying regulated workloads on Google Cloud. The regulation has data residency and data access requirements. It also requires that support is provided from the same geographical location as where the data resides. What should you do?

  A. Enable Access Transparency Logging.

  B. Deploy Assured Workloads.

  C. Deploy resources only to regions permitted by data residency requirements.

  D. Use Data Access logging and Access Transparency logging to confirm that no users are accessing data from another region.

  Correct Answer: B

  The correct answer is B. Deploy Assured Workloads.

  Assured Workloads for Google Cloud allows you to deploy regulated workloads with data residency, access, and support requirements. It helps you configure your environment in a manner that aligns with specific compliance frameworks and standards.

• Question 220:

  You are setting up a new Cloud Storage bucket in your environment that is encrypted with a customer managed encryption key (CMEK). The CMEK is stored in Cloud Key Management Service (KMS), in project "prj-a", and the Cloud Storage bucket will use project "prj-b". The key is backed by a Cloud Hardware Security Module (HSM) and resides in the region europe-west3. Your storage bucket will be located in the region europe-west1. When you create the bucket, you cannot access the key, and you need to troubleshoot why.

  What has caused the access issue?

  A. A firewall rule prevents the key from being accessible.

  B. Cloud HSM does not support Cloud Storage.

  C. The CMEK is in a different project than the Cloud Storage bucket.

  D. The CMEK is in a different region than the Cloud Storage bucket.

  Correct Answer: D

  The correct answer is D. The CMEK is in a different region than the Cloud Storage bucket.

  When you use a customer-managed encryption key (CMEK) to secure a Cloud Storage bucket, the key and the bucket must be located in the same region. In this case, the key is in europe-west3 and the bucket is in europe-west1, which is why you're unable to access the key.