Google Professional-Cloud-Security-Engineer Premium Exam Engine pdf – Download Free Updated 235 Questions [Q120-Q141]

admin January 15, 2024 0 Comments

5/5 - (1 vote)

Google Professional-Cloud-Security-Engineer Premium Exam Engine pdf – Download Free Updated 235 Questions

Verified Professional-Cloud-Security-Engineer Bundle Real Exam Dumps PDF

NEW QUESTION 120
A website design company recently migrated all customer sites to App Engine. Some sites are still in progress and should only be visible to customers and company employees from any location.
Which solution will restrict access to the in-progress sites?

Upload an .htaccess file containing the customer and employee user accounts to App Engine.

Create an App Engine firewall rule that allows access from the customer and employee networks and denies all other traffic.

Enable Cloud Identity-Aware Proxy (IAP), and allow access to a Google Group that contains the customer and employee user accounts.

Use Cloud VPN to create a VPN connection between the relevant on-premises networks and the company’s GCP Virtual Private Cloud (VPC) network.

NEW QUESTION 121
An organization receives an increasing number of phishing emails.
Which method should be used to protect employee credentials in this situation?

Multifactor Authentication

A strict password policy

Captcha on login pages

Encrypted emails

NEW QUESTION 122
For compliance reasons, an organization needs to ensure that in-scope PCI Kubernetes Pods reside on “in- scope” Nodes only. These Nodes can only contain the “in-scope” Pods.
How should the organization achieve this objective?

Add a nodeSelector field to the pod configuration to only use the Nodes labeled inscope: true.

Create a node pool with the label inscope: true and a Pod Security Policy that only allows the Pods to run on Nodes with that label.

Place a taint on the Nodes with the label inscope: true and effect NoSchedule and a toleration to match in the Pod configuration.

Run all in-scope Pods in the namespace “in-scope-pci”.

NEW QUESTION 123
Developers in an organization are prototyping a few applications on Google Cloud Platform (GCP) and are starting to store sensitive information on GCP. The developers are using their personal/consumer Gmail accounts to set up and manage their projects within GCP. A security engineer identifies this practice as a concern to the organization management because of the lack of centralized project management and access to the data being stored in these accounts.
Which solution should be used to resolve this concern?

Enforce the setup of Security Keys as the 2SV method for those Gmail accounts.

Set up Google Cloud Identity and require the developers to use those accounts for GCP work.

Require the developers to log/store their Gmail passwords with the Security team.

Enable logging on all GCP projects to track all developer activities.

NEW QUESTION 124
A customer is running an analytics workload on Google Cloud Platform (GCP) where Compute Engine instances are accessing data stored on Cloud Storage. Your team wants to make sure that this workload will not be able to access, or be accessed from, the internet.
Which two strategies should your team use to meet these requirements? (Choose two.)

Configure Private Google Access on the Compute Engine subnet

Avoid assigning public IP addresses to the Compute Engine cluster.

Make sure that the Compute Engine cluster is running on a separate subnet.

Turn off IP forwarding on the Compute Engine instances in the cluster.

Configure a Cloud NAT gateway.

NEW QUESTION 125
You are part of a security team investigating a compromised service account key. You need to audit which new resources were created by the service account.
What should you do?

Query Data Access logs.

Query Admin Activity logs.

Query Access Transparency logs.

Query Stackdriver Monitoring Workspace.

NEW QUESTION 126
You are routing all your internet facing traffic from Google Cloud through your on-premises internet connection. You want to accomplish this goal securely and with the highest bandwidth possible.
What should you do?

Create an HA VPN connection to Google Cloud Replace the default 0 0 0 0/0 route.

Create a routing VM in Compute Engine Configure the default route with the VM as the next hop.

Configure Cloud Interconnect with HA VPN Replace the default 0 0 0 0/0 route to an on-premises destination.

Configure Cloud Interconnect and route traffic through an on-premises firewall.

NEW QUESTION 127
A DevOps team will create a new container to run on Google Kubernetes Engine. As the application will be internet-facing, they want to minimize the attack surface of the container.
What should they do?

Use Cloud Build to build the container images.

Build small containers using small base images.

Delete non-used versions from Container Registry.

Use a Continuous Delivery tool to deploy the application.

NEW QUESTION 128
A large financial institution is moving its Big Data analytics to Google Cloud Platform. They want to have maximum control over the encryption process of data stored at rest in BigQuery.
What technique should the institution use?

Use Cloud Storage as a federated Data Source.

Use a Cloud Hardware Security Module (Cloud HSM).

Customer-managed encryption keys (CMEK).

Customer-supplied encryption keys (CSEK).

NEW QUESTION 129
How should a customer reliably deliver Stackdriver logs from GCP to their on-premises SIEM system?

Send all logs to the SIEM system via an existing protocol such as syslog.

Configure every project to export all their logs to a common BigQuery DataSet, which will be queried by the SIEM system.

Configure Organizational Log Sinks to export logs to a Cloud Pub/Sub Topic, which will be sent to the SIEM via Dataflow.

Build a connector for the SIEM to query for all logs in real time from the GCP RESTful JSON APIs.

NEW QUESTION 130
Your company’s users access data in a BigQuery table. You want to ensure they can only access the data during working hours.
What should you do?

Assign a BigQuery Data Viewer role along with an 1AM condition that limits the access to specified working hours.

Configure Cloud Scheduler so that it triggers a Cloud Functions instance that modifies the organizational policy constraints for BigQuery during the specified working hours.

Assign a BigQuery Data Viewer role to a service account that adds and removes the users daily during the specified working hours

Run a gsuttl script that assigns a BigQuery Data Viewer role, and remove it only during the specified working hours.

NEW QUESTION 131
A customer deployed an application on Compute Engine that takes advantage of the elastic nature of cloud computing.
How can you work with Infrastructure Operations Engineers to best ensure that Windows Compute Engine VMs are up to date with all the latest OS patches?

Build new base images when patches are available, and use a CI/CD pipeline to rebuild VMs, deploying incrementally.

Federate a Domain Controller into Compute Engine, and roll out weekly patches via Group Policy Object.

Use Deployment Manager to provision updated VMs into new serving Instance Groups (IGs).

Reboot all VMs during the weekly maintenance window and allow the StartUp Script to download the latest patches from the internet.

NEW QUESTION 132
You are a security administrator at your company. Per Google-recommended best practices, you implemented the domain restricted sharing organization policy to allow only required domains to access your projects. An engineering team is now reporting that users at an external partner outside your organization domain cannot be granted access to the resources in a project. How should you make an exception for your partner’s domain while following the stated best practices?

Turn off the domain restriction sharing organization policy. Set the policy value to “Allow All.”

Turn off the domain restricted sharing organization policy. Provide the external partners with the required permissions using Google’s Identity and Access Management (IAM) service.

Turn off the domain restricted sharing organization policy. Add each partner’s Google Workspace customer ID to a Google group, add the Google group as an exception under the organization policy, and then turn the policy back on.

Turn off the domain restricted sharing organization policy. Set the policy value to “Custom.” Add each external partner’s Cloud Identity or Google Workspace customer ID as an exception under the

NEW QUESTION 133
After completing a security vulnerability assessment, you learned that cloud administrators leave Google Cloud CLI sessions open for days. You need to reduce the risk of attackers who might exploit these open sessions by setting these sessions to the minimum duration.
What should you do?

Set the session duration for the Google session control to one hour.

Set the reauthentication frequency (or the Google Cloud Session Control to one hour.

Set the organization policy constraint
constraints/iam.allowServiceAccountCredentialLifetimeExtension to one hour.

Set the organization policy constraint constraints/iam. serviceAccountKeyExpiryHours to one hour and inheritFromParent to false.

NEW QUESTION 134
A company’s application is deployed with a user-managed Service Account key. You want to use Google- recommended practices to rotate the key.
What should you do?

Open Cloud Shell and run gcloud iam service-accounts enable-auto-rotate –iam- account=IAM_ACCOUNT.

Open Cloud Shell and run gcloud iam service-accounts keys rotate –iam- account=IAM_ACCOUNT –key=NEW_KEY.

Create a new key, and use the new key in the application. Delete the old key from the Service Account.

Create a new key, and use the new key in the application. Store the old key on the system as a backup key.

NEW QUESTION 135
Your company is deploying their applications on Google Kubernetes Engine. You want to follow Google-recommended practices. What should you do to ensure that the container images used for new deployments contain the latest security patches?

Use Google-managed base images for all containers.

Use Container Analysis to detect vulnerabilities in images.

Use an update script as part of every container image startup.

Use exclusively private images in Container Registry.

NEW QUESTION 136
Your organization has implemented synchronization and SAML federation between Cloud Identity and Microsoft Active Directory. You want to reduce the risk of Google Cloud user accounts being compromised. What should you do?

Create a Cloud Identity password policy with strong password settings, and configure 2-Step Verification with security keys in the Google Admin console.

Create a Cloud Identity password policy with strong password settings, and configure 2-Step Verification with verification codes via text or phone call in the Google Admin console.

Create an Active Directory domain password policy with strong password settings, and configure post-SSO (single sign-on) 2-Step Verification with security keys in the Google Admin console.

Create an Active Directory domain password policy with strong password settings, and configure post-SSO (single sign-on) 2-Step Verification with verification codes via text or phone call in the Google Admin console.

NEW QUESTION 137
A customer deployed an application on Compute Engine that takes advantage of the elastic nature of cloud computing.
How can you work with Infrastructure Operations Engineers to best ensure that Windows Compute Engine VMs are up to date with all the latest OS patches?

Build new base images when patches are available, and use a CI/CD pipeline to rebuild VMs, deploying incrementally.

Federate a Domain Controller into Compute Engine, and roll out weekly patches via Group Policy Object.

Use Deployment Manager to provision updated VMs into new serving Instance Groups (IGs).

Reboot all VMs during the weekly maintenance window and allow the StartUp Script to download the latest patches from the internet.

NEW QUESTION 138
You need to implement an encryption-at-rest strategy that protects sensitive data and reduces key management complexity for non-sensitive dat a. Your solution has the following requirements:
Schedule key rotation for sensitive data.
Control which region the encryption keys for sensitive data are stored in.
Minimize the latency to access encryption keys for both sensitive and non-sensitive data.
What should you do?

Encrypt non-sensitive data and sensitive data with Cloud External Key Manager.

Encrypt non-sensitive data and sensitive data with Cloud Key Management Service.

Encrypt non-sensitive data with Google default encryption, and encrypt sensitive data with Cloud External Key Manager.

Encrypt non-sensitive data with Google default encryption, and encrypt sensitive data with Cloud Key Management Service.

NEW QUESTION 139
In order to meet PCI DSS requirements, a customer wants to ensure that all outbound traffic is authorized.
Which two cloud offerings meet this requirement without additional compensating controls? (Choose two.)

App Engine

Cloud Functions

Compute Engine

Google Kubernetes Engine

Cloud Storage

NEW QUESTION 140
An organization is moving applications to Google Cloud while maintaining a few mission-critical applications on-premises. The organization must transfer the data at a bandwidth of at least 50 Gbps. What should they use to ensure secure continued connectivity between sites?

Dedicated Interconnect

Cloud Router

Cloud VPN

Partner Interconnect

NEW QUESTION 141
Your team needs to make sure that their backend database can only be accessed by the frontend application and no other instances on the network.
How should your team design this network?

Create an ingress firewall rule to allow access only from the application to the database using firewall tags.

Create a different subnet for the frontend application and database to ensure network isolation.

Create two VPC networks, and connect the two networks using Cloud VPN gateways to ensure network isolation.

Create two VPC networks, and connect the two networks using VPC peering to ensure network isolation.

Pass Your Google Exam with Professional-Cloud-Security-Engineer Exam Dumps: https://www.vcedumps.com/Professional-Cloud-Security-Engineer-examcollection.html

Tags: Professional-Cloud-Security-Engineer latest braindumps questions, Professional-Cloud-Security-Engineer latest test cram sheet, Professional-Cloud-Security-Engineer Real Sheets, Professional-Cloud-Security-Engineer reliable exam collection file, Professional-Cloud-Security-Engineer reliable test sample online, Professional-Cloud-Security-Engineer test dumps demo, Professional-Cloud-Security-Engineer valid exam questions vce

Google Professional-Cloud-Security-Engineer Premium Exam Engine pdf – Download Free Updated 235 Questions [Q120-Q141]

Leave a Reply Cancel reply

Professional-Cloud-Security-Engineer Practice Tests

Related Certifications

Recent Posts

Categories

Archives