[Oct 26, 2022] 100% Real & Accurate Professional-Cloud-Security-Engineer Questions with Free and Fast Updates
Self-Study Guide for Becoming an Google Cloud Certified - Professional Cloud Security Engineer Exam Expert
What is Google Professional Cloud Security Engineer Exam
The Google Professional Cloud Security Engineer is a private administrator responsible for helping organizations define and enforce a highly secure infrastructure on the Google Cloud Platform (GCP). GCP's professional cloud security Engineer uses an in-depth understanding of security and safety best practices, as well as an in-depth understanding of market security needs.
The cloud security designer brings his knowledge to the design, advancement, and management of the framework through Google security innovations. The GCP Cloud Security Engineer Certification Exam helps validate an individual's proficiency in various skills. Skills and areas of understanding include identifying and tracking access, as well as using Google security technologies to ensure data protection.
The certification exam will no doubt also assess candidates' abilities to configure network security measures and collect and evaluate Google Cloud logs. In addition, the role of a cloud security designer also includes event response management and a broader understanding of regulatory policies.
NEW QUESTION 76
As adoption of the Cloud Data Loss Prevention (DLP) API grows within the company, you need to optimize usage to reduce cost. DLP target data is stored in Cloud Storage and BigQuery. The location and region are identified as a suffix in the resource name.
Which cost reduction options should you recommend?
- A. Set appropriate rowsLimit value on BigQuery data hosted outside the US, and minimize transformation units on multiregional Cloud Storage buckets.
- B. Use FindingLimits and TimespanContfig to sample data and minimize transformation units.
- C. Use rowsLimit and bytesLimitPerFile to sample data and use CloudStorageRegexFileSet to limit scans.
- D. Set appropriate rowsLimit value on BigQuery data hosted outside the US and set appropriate bytesLimitPerFile value on multiregional Cloud Storage buckets.
Answer: C
Explanation:
Reference:
https://cloud.google.com/dlp/docs/reference/rest/v2/InspectJobConfig
NEW QUESTION 77
A DevOps team will create a new container to run on Google Kubernetes Engine. As the application will be internet-facing, they want to minimize the attack surface of the container.
What should they do?
- A. Use a Continuous Delivery tool to deploy the application.
- B. Use Cloud Build to build the container images.
- C. Build small containers using small base images.
- D. Delete non-used versions from Container Registry.
Answer: A
Explanation:
Explanation/Reference: https://cloud.google.com/solutions/best-practices-for-building-containers
NEW QUESTION 78
A customer wants to move their sensitive workloads to a Compute Engine-based cluster using Managed Instance Groups (MIGs). The jobs are bursty and must be completed quickly. They have a requirement to be able to manage and rotate the encryption keys.
Which boot disk encryption solution should you use on the cluster to meet this customer's requirements?
- A. Customer-supplied encryption keys (CSEK)
- B. Encryption by default
- C. Customer-managed encryption keys (CMEK) using Cloud Key Management Service (KMS)
- D. Pre-encrypting files before transferring to Google Cloud Platform (GCP) for analysis
Answer: C
Explanation:
Reference:
https://cloud.google.com/kubernetes-engine/docs/how-to/dynamic-provisioning-cmek
NEW QUESTION 79
An application log's data, including customer identifiers such as email addresses, needs to be redacted. However, these logs also include the email addresses of internal developers from company.com, and these should NOT be redacted. Which solution should you use to meet these requirements?
- A. Create a regular expression (regex) custom infoType detector to match on @company.com.
- B. Create a regular custom dictionary detector to match all email addresses listed in Cloud Identity.
- C. Create a regular custom dictionary detector that lists a subset of the developers' email addresses.
- D. Create a custom infoType called COMPANY_EMAIL to match @company.com.
Answer: A
Explanation:
A is not correct because as all company.com email addresses are sensitive and should be filtered, a static list is hard to maintain and can easily miss sensitive data.
B is correct because the regex will detect all company.com email addresses that need to be protected and written to the log file.
C is not correct because as the user base in Cloud Identity might only be a subset of all emails that need to be protected.
D is not correct because you need to specify a detector within the custom infoType and the detector should be a regular expression to match all @company.com email addresses.
https://cloud.google.com/dlp/docs/infotypes-reference
https://cloud.google.com/dlp/docs/creating-custom-infotypes
NEW QUESTION 80
You are a member of the security team at an organization. Your team has a single GCP project with credit card payment processing systems alongside web applications and data processing systems. You want to reduce the scope of systems subject to PCI audit standards.
What should you do?
- A. Use only applications certified compliant with PA-DSS.
- B. Move the cardholder data environment into a separate GCP project.
- C. Use multi-factor authentication for admin access to the web application.
- D. Use VPN for all connections between your office and cloud environments.
Answer: D
Explanation:
Explanation/Reference: https://cloud.google.com/solutions/pci-dss-compliance-in-gcp
NEW QUESTION 81
An organization is moving applications to Google Cloud while maintaining a few mission-critical applications on-premises. The organization must transfer the data at a bandwidth of at least 50 Gbps. What should they use to ensure secure continued connectivity between sites?
- A. Cloud Router
- B. Dedicated Interconnect
- C. Partner Interconnect
- D. Cloud VPN
Answer: B
NEW QUESTION 82
Which type of load balancer should you use to maintain client IP by default while using the standard network tier?
- A. TCP Proxy
- B. TCP/UDP Network
- C. Internal TCP/UDP
- D. SSL Proxy
Answer: C
NEW QUESTION 83
A customer deploys an application to App Engine and needs to check for Open Web Application Security Project (OWASP) vulnerabilities.
Which service should be used to accomplish this?
- A. Cloud Security Scanner
- B. Forseti Security
- C. Cloud Armor
- D. Google Cloud Audit Logs
Answer: A
Explanation:
Reference:
https://cloud.google.com/security-scanner/
NEW QUESTION 84
Your organization recently deployed a new application on Google Kubernetes Engine. You need to deploy a solution to protect the application. The solution has the following requirements:
Scans must run at least once per week
Must be able to detect cross-site scripting vulnerabilities
Must be able to authenticate using Google accounts
Which solution should you use?
- A. Web Security Scanner
- B. Container Threat Detection
- C. Google Cloud Armor
- D. Security Health Analytics
Answer: A
NEW QUESTION 85
A company has been running their application on Compute Engine. A bug in the application allowed a malicious user to repeatedly execute a script that results in the Compute Engine instance crashing. Although the bug has been fixed, you want to get notified in case this hack re-occurs.
What should you do?
- A. Create an Alerting Policy in Stackdriver using the CPU usage metric. Set the threshold to 80% to be notified when the CPU usage goes above this 80%.
- B. Log every execution of the script to Stackdriver Logging. Create a User-defined metric in Stackdriver Logging on the logs, and create a Stackdriver Dashboard displaying the metric.
- C. Log every execution of the script to Stackdriver Logging. Configure BigQuery as a log sink, and create a BigQuery scheduled query to count the number of executions in a specific timeframe.
- D. Create an Alerting Policy in Stackdriver using a Process Health condition, checking that the number of executions of the script remains below the desired threshold. Enable notifications.
Answer: A
NEW QUESTION 86
You are a Security Administrator at your organization. You need to restrict service account creation capability within production environments. You want to accomplish this centrally across the organization. What should you do?
- A. Use organization policy constraints/iam.disableServiceAccountCreation boolean to disable the creation of new service accounts.
- B. Use organization policy constraints/iam.disableServiceAccountKeyCreation boolean to disable the creation of new service accounts.
- C. Use Identity and Access Management (IAM) to restrict access of all users and service accounts that have access to the production environment.
- D. Use organization policy constraints/iam.disableServiceAccountKeyUpload boolean to disable the creation of new service accounts.
Answer: A
NEW QUESTION 87
A manager wants to start retaining security event logs for 2 years while minimizing costs. You write a filter to select the appropriate log entries.
Where should you export the logs?
- A. BigQuery datasets
- B. StackDriver logging
- C. Cloud Pub/Sub topics
- D. Cloud Storage buckets
Answer: B
Explanation:
https://cloud.google.com/logging/docs/exclusions
NEW QUESTION 88
Your company is storing sensitive data in Cloud Storage. You want a key generated on-premises to be used in the encryption process.
What should you do?
- A. Use customer-supplied encryption keys to manage the key encryption key (KEK).
- B. Use the Cloud Key Management Service to manage a key encryption key (KEK).
- C. Use customer-supplied encryption keys to manage the data encryption key (DEK).
- D. Use the Cloud Key Management Service to manage a data encryption key (DEK).
Answer: D
Explanation:
Reference:
https://cloud.google.com/security/encryption-at-rest/default-encryption/
NEW QUESTION 89
You are the security admin of your company. You have 3,000 objects in your Cloud Storage bucket. You do not want to manage access to each object individually. You also do not want the uploader of an object to always have full control of the object. However, you want to use Cloud Audit Logs to manage access to your bucket.
What should you do?
- A. Set up an ACL with OWNER permission to a scope of allUsers.
- B. Set up Uniform bucket-level access on the Cloud Storage bucket and manage access for users using IAM.
- C. Set up a default bucket ACL and manage access for users using IAM.
- D. Set up an ACL with READER permission to a scope of allUsers.
Answer: A
NEW QUESTION 90
You need to follow Google-recommended practices to leverage envelope encryption and encrypt data at the application layer.
What should you do?
- A. Generate a new data encryption key (DEK) in Cloud KMS to encrypt the data, and generate a key encryption key (KEK) locally to encrypt the key. Store both the encrypted data and the KEK.
- B. Generate a new data encryption key (DEK) in Cloud KMS to encrypt the data, and generate a key encryption key (KEK) locally to encrypt the key. Store both the encrypted data and the encrypted DEK.
- C. Generate a data encryption key (DEK) locally to encrypt the data, and generate a new key encryption key (KEK) in Cloud KMS to encrypt the DEK. Store both the encrypted data and the encrypted DEK.
- D. Generate a data encryption key (DEK) locally to encrypt the data, and generate a new key encryption key (KEK) in Cloud KMS to encrypt the DEK. Store both the encrypted data and the KEK.
Answer: C
Explanation:
Explanation/Reference: https://cloud.google.com/kms/docs/envelope-encryption
NEW QUESTION 91
Your team uses a service account to authenticate data transfers from a given Compute Engine virtual machine instance of to a specified Cloud Storage bucket. An engineer accidentally deletes the service account, which breaks application functionality. You want to recover the application as quickly as possible without compromising security.
What should you do?
- A. Update the permissions of another existing service account and supply those credentials to the applications.
- B. Temporarily disable authentication on the Cloud Storage bucket.
- C. Create a new service account with the same name as the deleted service account.
- D. Use the undelete command to recover the deleted service account.
Answer: D
Explanation:
https://cloud.google.com/iam/docs/creating-managing-service-
accounts#undeleting_a_service_account
NEW QUESTION 92
In order to meet PCI DSS requirements, a customer wants to ensure that all outbound traffic is authorized.
Which two cloud offerings meet this requirement without additional compensating controls? (Choose two.)
- A. Cloud Storage
- B. Google Kubernetes Engine
- C. App Engine
- D. Compute Engine
- E. Cloud Functions
Answer: C,D
Explanation:
Reference:
https://cloud.google.com/solutions/pci-dss-compliance-in-gcp
NEW QUESTION 93
A customer wants to move their sensitive workloads to a Compute Engine-based cluster using Managed Instance Groups (MIGs). The jobs are bursty and must be completed quickly. They have a requirement to be able to manage and rotate the encryption keys.
Which boot disk encryption solution should you use on the cluster to meet this customer's requirements?
- A. Customer-supplied encryption keys (CSEK)
- B. Encryption by default
- C. Customer-managed encryption keys (CMEK) using Cloud Key Management Service (KMS)
- D. Pre-encrypting files before transferring to Google Cloud Platform (GCP) for analysis
Answer: C
Explanation:
Explanation/Reference:
Reference https://cloud.google.com/kubernetes-engine/docs/how-to/dynamic-provisioning-cmek
NEW QUESTION 94
Your team creates an ingress firewall rule to allow SSH access from their corporate IP range to a specific bastion host on Compute Engine. Your team wants to make sure that this firewall rule cannot be used by unauthorized engineers who may otherwise have access to manage VMs in the development environment. What should your team do to meet this requirement?
- A. Create the firewall rule with a target of a network tag. Centrally manage access to the tag.
- B. Create the firewall rule with a target of a service account. Centrally manage access to the service account.
- C. Create the firewall rule in a Shared VPC with a target of a network tag.
- D. Create the firewall rule in a Shared VPC with a target of a specific subnet.
Answer: B
Explanation:
A is not correct because the network tag value can be inferred by examining the Firewall Rule or VM metadata.
B is correct because access to the Service Account is required to use a firewall rule with a target of a Service Account.
C is not correct because the target network tag value can be inferred by examining the Firewall Rule or VM metadata.
D is not correct because the target subnet value can be inferred by examining the Firewall Rule or VM metadata.
https://cloud.google.com/vpc/docs/firewalls#service-accounts-vs-tags
NEW QUESTION 95
A customer needs to rely on their existing user directory with the requirements of native authentication against it when developing for Google Cloud Platform (GCP). They want to leverage their existing tooling and functionality to gather insight on user activity from a familiar interface. Which action should you take to meet the customer's requirements?
- A. Configure and enforce 2-Step Verification in Cloud Identity for all Super Admins.
- B. Configure a third-party IdP (Octa or Ping Federate) to manage authentication.
- C. Configure Cloud Identity as a SAML 2.0 Service Provider, using the customer's User Directory as the Identity Provider.
- D. Provision users into Cloud Identity using Just-in-Time SAML 2.0 user provisioning with the customer User Directory as source.
Answer: C
Explanation:
A is not correct because client wants to continue using their existing directory.
B is correct because it lets client use their current user directory as source of truth and to be authenticated against while using Cloud identity as their SAML broker.
C is not correct because it adds a protection to super admin account but doesn't address the use case.
D is not correct because it proposes a non-native solution and doesn't address the use case.
https://cloud.google.com/blog/products/identity-security/using-your-existing-identity-management- system-with-google-cloud-platform
https://support.google.com/a/answer/60224
NEW QUESTION 96
A customer's internal security team must manage its own encryption keys for encrypting data on Cloud Storage and decides to use customer-supplied encryption keys (CSEK).
How should the team complete this task?
- A. Upload the encryption key to a Cloud Storage bucket, and then upload the object to the same bucket.
- B. Use the gsutil command line tool to upload the object to Cloud Storage, and specify the location of the encryption key.
- C. Generate an encryption key in the Google Cloud Platform Console, and upload an object to Cloud Storage using the specified key.
- D. Encrypt the object, then use the gsutil command line tool or the Google Cloud Platform Console to upload the object to Cloud Storage.
Answer: D
Explanation:
https://cloud.google.com/storage/docs/encryption/customer-supplied-keys
NEW QUESTION 97
......
What are the prerequisites for Google Professional Cloud Security Engineer Exam
Prerequisites: None
Recommended Experience: Google recommends that applicants have more than three years of industry experience, including more than one year in designing, managing, and protecting GCP-based solutions.
Professional-Cloud-Security-Engineer Study Guide Realistic Verified Professional-Cloud-Security-Engineer Dumps: https://examcollection.prep4king.com/Professional-Cloud-Security-Engineer-latest-questions.html
