Google PROFESSIONAL-CLOUD-SECURITY-ENGINEER Online Practice Questions and Exam Preparation

Google PROFESSIONAL-CLOUD-SECURITY-ENGINEER Online Questions & Answers

• Question 311:

  A website design company recently migrated all customer sites to App Engine. Some sites are still in progress and should only be visible to customers and company employees from any location. Which solution will restrict access to the in-progress sites?

  A. Upload an .htaccess file containing the customer and employee user accounts to App Engine.
  B. Create an App Engine firewall rule that allows access from the customer and employee networks and denies all other traffic.
  C. Enable Cloud Identity-Aware Proxy (IAP), and allow access to a Google Group that contains the customer and employee user accounts.
  D. Use Cloud VPN to create a VPN connection between the relevant on-premises networks and the company's GCP Virtual Private Cloud (VPC) network.
  C. Enable Cloud Identity-Aware Proxy (IAP), and allow access to a Google Group that contains the customer and employee user accounts.

  ---

  Explanation/Reference:

  https://cloud.google.com/iap/docs/concepts-overview#when_to_use_iap

• Question 312:

  You work for a large organization where each business unit has thousands of users. You need to delegate management of access control permissions to each business unit. You have the following requirements:

  1.

  Each business unit manages access controls for their own projects.

  2.

  Each business unit manages access control permissions at scale.

  3.

  Business units cannot access other business units' projects.

  4.

  Users lose their access if they move to a different business unit or leave the company.

  5.

  Users and access control permissions are managed by the on-premises directory service.

  What should you do? (Choose two.)

  A. Use VPC Service Controls to create perimeters around each business unit's project.
  B. Organize projects in folders, and assign permissions to Google groups at the folder level.
  C. Group business units based on Organization Units (OUs) and manage permissions based on OUs.
  D. Create a project naming convention, and use Google's IAM Conditions to manage access based on the prefix of project names.
  E. Use Google Cloud Directory Sync to synchronize users and group memberships in Cloud Identity.
  B. Organize projects in folders, and assign permissions to Google groups at the folder level.
  E. Use Google Cloud Directory Sync to synchronize users and group memberships in Cloud Identity.

• Question 313:

  Your application development team is releasing a new critical feature. To complete their final testing, they requested 10 thousand real transaction records. The new feature includes format checking on the primary account number (PAN) of a credit card. You must support the request and minimize the risk of unintended personally identifiable information (PII) exposure. What should you do?

  A. Run the new application by using Confidential Computing to ensure PII and card PAN is encrypted in use.
  B. Scan and redact PII from the records by using the Cloud Data Loss Prevention API. Perform format-preserving encryption on the card PAN.
  C. Encrypt the records by using Cloud Key Management Service to protect the PII and card PAN.
  D. Build a tool to replace the card PAN and PII fields with randomly generated values.
  B. Scan and redact PII from the records by using the Cloud Data Loss Prevention API. Perform format-preserving encryption on the card PAN.

• Question 314:

  Your company is using GSuite and has developed an application meant for internal usage on Google App Engine. You need to make sure that an external user cannot gain access to the application even when an employee's password has been compromised.

  What should you do?

  A. Enforce 2-factor authentication in GSuite for all users.
  B. Configure Cloud Identity-Aware Proxy for the App Engine Application.
  C. Provision user passwords using GSuite Password Sync.
  D. Configure Cloud VPN between your private network and GCP.
  A. Enforce 2-factor authentication in GSuite for all users.

  ---

  Explanation/Reference:

  https://docs.google.com/document/d/11o3e14tyhnT7w45Q8-r9ZmTAfj2WUNUpJPZImrxm_F4/edit? usp=sharing https://support.google.com/a/answer/175197?hl=en

• Question 315:

  Your company uses Google Cloud and has publicly exposed network assets. You want to discover the assets and perform a security audit on these assets by using a software tool in the least amount of time.

  What should you do?

  A. Run a platform security scanner on all instances in the organization.
  B. Identify all external assets by using Cloud Asset Inventory, and then run a network security scanner against them.
  C. Contact a Google approved security vendor to perform the audit.
  D. Notify Google about the pending audit, and wait for confirmation before performing the scan.
  B. Identify all external assets by using Cloud Asset Inventory, and then run a network security scanner against them.

  ---

  Explanation/Reference:

  B. Identify all external assets by using Cloud Asset Inventory, and then run a network security scanner against them.

  Cloud Asset Inventory allows you to see all of your Google Cloud assets. By using it, you can quickly identify which assets are externally accessible. Once identified, you can then run a specialized network security scanner against only these assets, making the process efficient. C. Contact a Google approved security vendor to perform the audit.

  While using an external vendor can be beneficial for thoroughness, it may not meet the criteria of accomplishing the task in the "least amount of time."

• Question 316:

  The InfoSec team has mandated that all new Cloud Run jobs and services in production must have Binary Authorization enabled. You need to enforce this requirement. What should you do?

  A. Configure an organization policy to require Binary Authorization enforcement on images deployed to Cloud Run.
  B. Configure a Security Health Analytics (SHA) custom rule that prevents the execution of Cloud Run jobs and services without Binary Authorization.
  C. Ensure the Cloud Run admin role is not assigned to developers.
  D. Configure a Binary Authorization custom policy that is not editable by developers and auto-attaches to all Cloud Run jobs and services.
  A. Configure an organization policy to require Binary Authorization enforcement on images deployed to Cloud Run.

  ---

  Explanation/Reference:

  An organization policy is the best way to enforce company-wide requirements like ensuring Binary Authorization is enabled for all Cloud Run jobs and services in production. By configuring an organization policy, you can centrally enforce the use of Binary Authorization, preventing developers from deploying jobs or services without it.

  Binary Authorization is a security feature that allows you to ensure that only trusted container images, verified by your security policies, are deployed. By setting up an organization policy, you ensure that all Cloud Run deployments across your organization comply with this requirement.

• Question 317:

  You are developing a new application that uses exclusively Compute Engine VMs. Once a day, this application will execute five different batch jobs. Each of the batch jobs requires a dedicated set of permissions on Google Cloud resources outside of your application. You need to design a secure access concept for the batch jobs that adheres to the least-privilege principle.

  What should you do?

  A. 1. Create a general service account "g-sa" to orchestrate the batch jobs. 2. Create one service account per batch job `b-sa-[1-5]'. Grant only the permissions required to run the individual batch jobs to the service accounts and generate service account keys for each of these service accounts. 3. Store the service account keys in Secret Manager. Grant g-sa access to Secret Manager and run the batch jobs with the permissions of b-sa-[1-5].
  B. 1. Create a general service account "g-sa" to execute the batch jobs. 2. Grant the permissions required to execute the batch jobs to g-sa. 3. Execute the batch jobs with the permissions granted to g-sa.
  C. 1. Create a workload identity pool and configure workload identity pool providers for each batch job. 2. Assign the workload identity user role to each of the identities configured in the providers. 3. Create one service account per batch job "b-sa-[1-5]", and grant only the permissions required to run the individual batch jobs to the service accounts. 4. Generate credential configuration files for each of the providers. Use these files to execute the batch jobs with the permissions of b-sa-[1-5].
  D. 1. Create a general service account "g-sa" to orchestrate the batch jobs. 2. Create one service account per batch job "b-sa-[1-5]", and grant only the permissions required to run the individual batch jobs to the service accounts. 3. Grant the Service Account Token Creator role to g-sa. Use g-sa to obtain short-lived access tokens for b-sa-[1-5] and to execute the batch jobs with the permissions of b-sa-[1-5].
  D. 1. Create a general service account "g-sa" to orchestrate the batch jobs. 2. Create one service account per batch job "b-sa-[1-5]", and grant only the permissions required to run the individual batch jobs to the service accounts. 3. Grant the Service Account Token Creator role to g-sa. Use g-sa to obtain short-lived access tokens for b-sa-[1-5] and to execute the batch jobs with the permissions of b-sa-[1-5].

  ---

  Explanation/Reference:

  1.

  Create a general service account "g-sa" to orchestrate the batch jobs.

  2.

  Create one service account per batch job "b-sa-[1-5]", and grant only the permissions required to run the individual batch jobs to the service accounts.

  3.

  Grant the Service Account Token Creator role to g-sa. Use g-sa to obtain short-lived access tokens for b-sa-[1-5] and to execute the batch jobs with the permissions of b-sa-[1-5].

  This approach adheres to the principle of least privilege by ensuring that each batch job has only the permissions it needs to run. The general service account "g-sa" is used to orchestrate the batch jobs, and the Service Account Token Creator role allows it to obtain short-lived access tokens for the batch job service accounts "b-sa-[1-5]". This setup allows the batch jobs to be executed with the permissions of the respective service accounts.

• Question 318:

  A company is running workloads in a dedicated server room. They must only be accessed from within the private company network. You need to connect to these workloads from Compute Engine instances within a Google Cloud Platform project.

  Which two approaches can you take to meet the requirements? (Choose two.)

  A. Configure the project with Cloud VPN.
  B. Configure the project with Shared VPC.
  C. Configure the project with Cloud Interconnect.
  D. Configure the project with VPC peering.
  E. Configure all Compute Engine instances with Private Access.
  A. Configure the project with Cloud VPN.
  C. Configure the project with Cloud Interconnect.

  ---

  Explanation/Reference:

  A) IPsec VPN tunels: https://cloud.google.com/network-connectivity/docs/vpn/concepts/overviewInterconnect https://cloud.google.com/network-connectivity/docs/interconnect/concepts/dedicated-overview https://cloud.google.com/solutions/secure-data-workloads-use-cases

• Question 319:

  You are using Security Command Center (SCC) to protect your workloads and receive alerts for suspected security breaches at your company. You need to detect cryptocurrency mining software. Which SCC service should you use?

  A. Container Threat Detection
  B. Web Security Scanner
  C. Rapid Vulnerability Detection
  D. Virtual Machine Threat Detection
  D. Virtual Machine Threat Detection

• Question 320:

  You need to follow Google-recommended practices to leverage envelope encryption and encrypt data at the application layer. What should you do?

  A. Generate a data encryption key (DEK) locally to encrypt the data, and generate a new key encryption key (KEK) in Cloud KMS to encrypt the DEK. Store both the encrypted data and the encrypted DEK.
  B. Generate a data encryption key (DEK) locally to encrypt the data, and generate a new key encryption key (KEK) in Cloud KMS to encrypt the DEK. Store both the encrypted data and the KEK.
  C. Generate a new data encryption key (DEK) in Cloud KMS to encrypt the data, and generate a key encryption key (KEK) locally to encrypt the key. Store both the encrypted data and the encrypted DEK.
  D. Generate a new data encryption key (DEK) in Cloud KMS to encrypt the data, and generate a key encryption key (KEK) locally to encrypt the key. Store both the encrypted data and the KEK.
  A. Generate a data encryption key (DEK) locally to encrypt the data, and generate a new key encryption key (KEK) in Cloud KMS to encrypt the DEK. Store both the encrypted data and the encrypted DEK.

  ---

  Explanation/Reference:

  Reference: https://cloud.google.com/kms/docs/envelope-encryption Envelope Encryption: https://cloud.google.com/kms/docs/envelope-encryption Here are best practices for managing DEKs:

  1.

  Generate DEKs locally.

  2.

  When stored, always ensure DEKs are encrypted at rest.

  3.

  For easy access, store the DEK near the data that it encrypts.

  The DEK is encrypted (also known as wrapped) by a key encryption key (KEK). The process of encrypting a key with another key is known as envelope encryption.

  Here are best practices for managing KEKs:

  1.

  Store KEKs centrally. (KMS )

  2.

  Set the granularity of the DEKs they encrypt based on their use case.

  For example, consider a workload that requires multiple DEKs to encrypt the workload's data chunks.

  You could use a single KEK to wrap all DEKs that are responsible for that workload's encryption.

  Rotate keys regularly, and also after a suspected incident.