Google PROFESSIONAL-CLOUD-SECURITY-ENGINEER Online Practice Questions and Exam Preparation

Google PROFESSIONAL-CLOUD-SECURITY-ENGINEER Online Questions & Answers

• Question 321:

  Your organization is using Active Directory and wants to configure Security Assertion Markup Language (SAML). You must set up and enforce single sign-on (SSO) for all users.

  What should you do?

  A. 1. Create a new SAML profile. 2. Populate the sign-in and sign-out page URLs. 3. Upload the X.509 certificate. 4. Configure Entity ID and ACS URL in your IdP.
  B. 1. Configure prerequisites for OpenID Connect (OIDC) in your Active Directory (AD) tenant. 2. Verify the AD domain. 3. Decide which users should use SAML. 4. Assign the pre-configured profile to the select organizational units (OUs) and groups.
  C. 1. Create a new SAML profile. 2. Upload the X.509 certificate. 3. Enable the change password URL. 4. Configure Entity ID and ACS URL in your IdP.
  D. 1. Manage SAML profile assignments. 2. Enable OpenID Connect (OIDC) in your Active Directory (AD) tenant. 3. Verify the domain.
  A. 1. Create a new SAML profile. 2. Populate the sign-in and sign-out page URLs. 3. Upload the X.509 certificate. 4. Configure Entity ID and ACS URL in your IdP.

  ---

  Explanation/Reference:

  When configuring SAML-based Single Sign-On (SSO) in an organization that's using Active Directory, the general steps would involve setting up a SAML profile, specifying the necessary URLs for sign-in and sign- out processes, uploading an X.509 certificate for secure communication, and setting up the Entity ID and Assertion Consumer Service (ACS) URL in the Identity Provider (which in this case would be Active Directory).

  A. Create a new SAML profile, populate URLs, upload X.509 certificate, configure Entity ID and ACS URL: This option comprehensively covers the steps necessary for setting up SAML-based SSO.

• Question 322:

  You have been tasked with inspecting IP packet data for invalid or malicious content. What should you do?

  A. Use Packet Mirroring to mirror traffic to and from particular VM instances. Perform inspection using security software that analyzes the mirrored traffic.
  B. Enable VPC Flow Logs for all subnets in the VPC. Perform inspection on the Flow Logs data using Cloud Logging.
  C. Configure the Fluentd agent on each VM Instance within the VPC. Perform inspection on the log data using Cloud Logging.
  D. Configure Google Cloud Armor access logs to perform inspection on the log data.
  A. Use Packet Mirroring to mirror traffic to and from particular VM instances. Perform inspection using security software that analyzes the mirrored traffic.

  ---

  Explanation/Reference:

  https://cloud.google.com/vpc/docs/packet-mirroring

  Packet Mirroring clones the traffic of specified instances in your Virtual Private Cloud (VPC) network and forwards it for examination. Packet Mirroring captures all traffic and packet data, including payloads and headers.

• Question 323:

  Your organization strives to be a market leader in software innovation. You provided a large number of Google Cloud environments so developers can test the integration of Gemini in Vertex AI into their existing applications or create new projects. Your organization has 200 developers and a five-person security team. You must prevent and detect proper security policies across the Google Cloud environments. What should you do? (Choose two.)

  A. Apply organization policy constraints. Detect and monitor drifts by using Security Health Analytics.
  B. Publish internal policies and clear guidelines to securely develop applications.
  C. Use Cloud Logging to create log filters to detect misconfigurations. Trigger Cloud Run functions to remediate misconfigurations.
  D. Apply a predefined AI-recommended security posture template for Gemini in Vertex AI in Security Command Center Enterprise or Premium tiers.
  E. Implement the least privileged access Identity and Access Management roles to prevent misconfigurations.
  A. Apply organization policy constraints. Detect and monitor drifts by using Security Health Analytics.
  C. Use Cloud Logging to create log filters to detect misconfigurations. Trigger Cloud Run functions to remediate misconfigurations.

  ---

  Explanation/Reference:

  In a scenario where you have many developers and a small security team, it's essential to automate as much as possible to prevent and detect security issues across Google Cloud environments. Let's look at both correct choices in detail:

  Apply organization policy constraints. Detect and monitor drifts by using Security Health Analytics:

  1.

  Organization policies allow you to centrally enforce security requirements across all Google Cloud projects. By applying policy constraints, you can restrict what developers can and cannot do, helping to maintain a secure baseline.

  2.

  Security Health Analytics (SHA) continuously scans for security misconfigurations and compliance issues in your cloud environments. Using SHA ensures that policy violations or drifts from security best practices are detected automatically and can be monitored effectively.

  Use Cloud Logging to create log filters to detect misconfigurations. Trigger Cloud Run functions to remediate misconfigurations:

  1.

  Cloud Logging enables the creation of custom log filters that can detect specific misconfigurations or security policy violations. This helps in real-time monitoring of cloud environments.

  2.

  Cloud Run functions can be triggered by log events to automatically remediate misconfigurations, ensuring that any deviations from your security policies are corrected quickly without manual intervention. This approach helps the small security team keep up with the large number of developers.

• Question 324:

  Your organization wants to publish yearly reports of your website usage analytics. You must ensure that no data with personally identifiable information (PII) is published by using the Cloud Data Loss Prevention (Cloud DLP) API. Data integrity must be preserved. What should you do?

  A. Detect all PII in storage by using the Cloud DLP API. Create a cloud function to delete the PII.
  B. Discover and quarantine your PII data in your storage by using the Cloud DLP API.
  C. Discover and transform PII data in your reports by using the Cloud DLP API.
  D. Encrypt the PII from the report by using the Cloud DLP API.
  C. Discover and transform PII data in your reports by using the Cloud DLP API.