Professional-Cloud-Security-Engineer Exam Dumps Pass with Updated 2022 Certified Exam Questions [Q64-Q87]

Rate this post

Professional-Cloud-Security-Engineer Exam Dumps Pass with Updated 2022 Certified Exam Questions

Professional-Cloud-Security-Engineer Exam Questions – Real & Updated Questions PDF

Google Professional-Cloud-Security-Engineer Exam Syllabus Topics:

Topic	Details
Topic 1	Understanding of security best practices and industry security requirements
Topic 2	Manages a secure infrastructure leveraging Google security technologies
Topic 3	Design and Implement a secure infrastructure on Google Cloud Platform
Topic 4	All aspects of Cloud Secur

What is Google Professional Cloud Security Engineer Exam

The Google Professional Cloud Security Engineer is a private administrator responsible for helping organizations define and enforce a highly secure infrastructure on the Google Cloud Platform (GCP). GCP’s professional cloud security Engineer uses an in-depth understanding of security and safety best practices, as well as an in-depth understanding of market security needs.

The cloud security designer brings his knowledge to the design, advancement, and management of the framework through Google security innovations. The GCP Cloud Security Engineer Certification Exam helps validate an individual’s proficiency in various skills. Skills and areas of understanding include identifying and tracking access, as well as using Google security technologies to ensure data protection.

The certification exam will no doubt also assess candidates’ abilities to configure network security measures and collect and evaluate Google Cloud logs. In addition, the role of a cloud security designer also includes event response management and a broader understanding of regulatory policies.

There are 3 study programs available that you can use to prepare for the test. Also, Google provides tons of skill badges that you can complete to verify your competence in implementing cloud security concepts at this level. We will be covering all of them below:

1. Google Cloud Fundamentals: Core Infrastructure

This course will help you build an important foundation for working with popular computing and storage devices in Google Cloud efficiently. These include Google Kubernetes, Cloud SQL, Cloud Storage, BigQuery, App Engine, and Compute Engine. Besides, this training option will also provide important coverage of resource and policy management tools such as Cloud Identity and Access Management and the Resource Manager hierarchy. If you are experienced in working with Azure or AWS and now looking to switch to Google Cloud, this course will be the best tool to ease the transition.

Q64. A customer’s internal security team must manage its own encryption keys for encrypting data on Cloud Storage and decides to use customer-supplied encryption keys (CSEK).
How should the team complete this task?

Upload the encryption key to a Cloud Storage bucket, and then upload the object to the same bucket.

Use the gsutil command line tool to upload the object to Cloud Storage, and specify the location of the encryption key.

Generate an encryption key in the Google Cloud Platform Console, and upload an object to Cloud Storage using the specified key.

Encrypt the object, then use the gsutil command line tool or the Google Cloud Platform Console to upload the object to Cloud Storage.

Q65. A company has been running their application on Compute Engine. A bug in the application allowed a malicious user to repeatedly execute a script that results in the Compute Engine instance crashing. Although the bug has been fixed, you want to get notified in case this hack re-occurs.
What should you do?

Create an Alerting Policy in Stackdriver using a Process Health condition, checking that the number of executions of the script remains below the desired threshold. Enable notifications.

Create an Alerting Policy in Stackdriver using the CPU usage metric. Set the threshold to 80% to be notified when the CPU usage goes above this 80%.

Log every execution of the script to Stackdriver Logging. Create a User-defined metric in Stackdriver Logging on the logs, and create a Stackdriver Dashboard displaying the metric.

Log every execution of the script to Stackdriver Logging. Configure BigQuery as a log sink, and create a BigQuery scheduled query to count the number of executions in a specific timeframe.

Q66. A company has been running their application on Compute Engine. A bug in the application allowed a malicious user to repeatedly execute a script that results in the Compute Engine instance crashing. Although the bug has been fixed, you want to get notified in case this hack re-occurs.
What should you do?

Create an Alerting Policy in Stackdriver using a Process Health condition, checking that the number of executions of the script remains below the desired threshold. Enable notifications.

Create an Alerting Policy in Stackdriver using the CPU usage metric. Set the threshold to 80% to be notified when the CPU usage goes above this 80%.

Log every execution of the script to Stackdriver Logging. Create a User-defined metric in Stackdriver Logging on the logs, and create a Stackdriver Dashboard displaying the metric.

Log every execution of the script to Stackdriver Logging. Configure BigQuery as a log sink, and create a BigQuery scheduled query to count the number of executions in a specific timeframe.

Q67. A patch for a vulnerability has been released, and a DevOps team needs to update their running containers in Google Kubernetes Engine (GKE).
How should the DevOps team accomplish this?

Use Puppet or Chef to push out the patch to the running container.

Verify that auto upgrade is enabled; if so, Google will upgrade the nodes in a GKE cluster.

Update the application code or apply a patch, build a new image, and redeploy it.

Configure containers to automatically upgrade when the base image is available in Container Registry.

Q68. You are a member of the security team at an organization. Your team has a single GCP project with credit card payment processing systems alongside web applications and data processing systems. You want to reduce the scope of systems subject to PCI audit standards.
What should you do?

Use multi-factor authentication for admin access to the web application.

Use only applications certified compliant with PA-DSS.

Move the cardholder data environment into a separate GCP project.

Use VPN for all connections between your office and cloud environments.

Q69. Last week, a company deployed a new App Engine application that writes logs to BigQuery. No other workloads are running in the project. You need to validate that all data written to BigQuery was done using the App Engine Default Service Account.
What should you do?

1. Use StackDriver Logging and filter on BigQuery Insert Jobs.
2. Click on the email address in line with the App Engine Default Service Account in the authentication field.
3. Click Hide Matching Entries.
4. Make sure the resulting list is empty.

1. Use StackDriver Logging and filter on BigQuery Insert Jobs.
2. Click on the email address in line with the App Engine Default Service Account in the authentication field.
3. Click Show Matching Entries.
4. Make sure the resulting list is empty.

1. In BigQuery, select the related dataset.
2. Make sure the App Engine Default Service Account is the only account that can write to the dataset.

1. Go to the IAM section on the project.
2. Validate that the App Engine Default Service Account is the only account that has a role that can write to BigQuery.

Q70. A DevOps team will create a new container to run on Google Kubernetes Engine. As the application will be internet-facing, they want to minimize the attack surface of the container.
What should they do?

Use Cloud Build to build the container images.

Build small containers using small base images.

Delete non-used versions from Container Registry.

Use a Continuous Delivery tool to deploy the application.

Q71. Your team needs to make sure that their backend database can only be accessed by the frontend application and no other instances on the network.
How should your team design this network?

Create an ingress firewall rule to allow access only from the application to the database using firewall tags.

Create a different subnet for the frontend application and database to ensure network isolation.

Create two VPC networks, and connect the two networks using Cloud VPN gateways to ensure network isolation.

Create two VPC networks, and connect the two networks using VPC peering to ensure network isolation.

Q72. You want to prevent users from accidentally deleting a Shared VPC host project. Which organization-level policy constraint should you enable?

compute.restrictSharedVpcHostProjects

compute.restrictXpnProjectLienRemoval

compute.restrictSharedVpcSubnetworks

compute.sharedReservationsOwnerProjects

Q73. A customer’s internal security team must manage its own encryption keys for encrypting data on Cloud Storage and decides to use customer-supplied encryption keys (CSEK).
How should the team complete this task?

Upload the encryption key to a Cloud Storage bucket, and then upload the object to the same bucket.

Use the gsutil command line tool to upload the object to Cloud Storage, and specify the location of the encryption key.

Generate an encryption key in the Google Cloud Platform Console, and upload an object to Cloud Storage using the specified key.

Encrypt the object, then use the gsutil command line tool or the Google Cloud Platform Console to upload the object to Cloud Storage.

Q74. Your team needs to make sure that a Compute Engine instance does not have access to the internet or to any Google APIs or services.
Which two settings must remain disabled to meet these requirements? (Choose two.)

Public IP

IP Forwarding

Private Google Access

Static routes

IAM Network User Role

Q75. You are the Security Admin in your company. You want to synchronize all security groups that have an email address from your LDAP directory in Cloud IAM.
What should you do?

Configure Google Cloud Directory Sync to sync security groups using LDAP search rules that have “user email address” as the attribute to facilitate one-way sync.

Configure Google Cloud Directory Sync to sync security groups using LDAP search rules that have “user email address” as the attribute to facilitate bidirectional sync.

Use a management tool to sync the subset based on the email address attribute. Create a group in the Google domain. A group created in a Google domain will automatically have an explicit Google Cloud Identity and Access Management (IAM) role.

Use a management tool to sync the subset based on group object class attribute. Create a group in the Google domain. A group created in a Google domain will automatically have an explicit Google Cloud Identity and Access Management (IAM) role.

Q76. An organization recently began using App Engine to build and host its new web application for its customers. The organization wants to use its existing IAM setup to allow its developer employees to have elevated access to the application remotely. This would allow them to push updates and fixes to the application via an HTTPS connection. Non-developer employees should only get access to the production version without development permissions. Which Google Cloud Platform solution should be used to meet these requirements?

Synchronize the organization’s Active Directory using Cloud Identity for employee access via Cloud VPN.

Disable access for non-developer employees by removing their Google Group from the application access control list (ACL).

Set up Cloud Identity-Aware Proxy (Cloud IAP) to manage authentication and different authorization levels for employee access.

Set up Virtual Private Cloud (VPC) firewall rules to manage authentication and different authorization levels for employee access.

Q77. Users are reporting an outage on your public-facing application that is hosted on Compute Engine. You suspect that a recent change to your firewall rules is responsible. You need to test whether your firewall rules are working properly. What should you do?

Enable Firewall Rules Logging on the latest rules that were changed. Use Logs Explorer to analyze whether the rules are working correctly.

Connect to a bastion host in your VPC. Use a network traffic analyzer to determine at which point your requests are being blocked.

In a pre-production environment, disable all firewall rules individually to determine which one is blocking user traffic.

Enable VPC Flow Logs in your VPC. Use Logs Explorer to analyze whether the rules are working correctly.

Q78. A customer wants to move their sensitive workloads to a Compute Engine-based cluster using Managed Instance Groups (MIGs). The jobs are bursty and must be completed quickly. They have a requirement to be able to manage and rotate the encryption keys.
Which boot disk encryption solution should you use on the cluster to meet this customer’s requirements?

Customer-supplied encryption keys (CSEK)

Customer-managed encryption keys (CMEK) using Cloud Key Management Service (KMS)

Encryption by default

Pre-encrypting files before transferring to Google Cloud Platform (GCP) for analysis

Q79. A customer wants to run a batch processing system on VMs and store the output files in a Cloud Storage bucket. The networking and security teams have decided that no VMs may reach the public internet.
How should this be accomplished?

Create a firewall rule to block internet traffic from the VM.

Provision a NAT Gateway to access the Cloud Storage API endpoint.

Enable Private Google Access on the VPC.

Mount a Cloud Storage bucket as a local filesystem on every VM.

Q80. A company has redundant mail servers in different Google Cloud Platform regions and wants to route customers to the nearest mail server based on location.
How should the company accomplish this?

Configure TCP Proxy Load Balancing as a global load balancing service listening on port 995.

Create a Network Load Balancer to listen on TCP port 995 with a forwarding rule to forward traffic based on location.

Use Cross-Region Load Balancing with an HTTP(S) load balancer to route traffic to the nearest region.

Use Cloud CDN to route the mail traffic to the closest origin mail server based on client IP address.

Q81. Your company is storing sensitive data in Cloud Storage. You want a key generated on-premises to be used in the encryption process.
What should you do?

Use the Cloud Key Management Service to manage a data encryption key (DEK).

Use the Cloud Key Management Service to manage a key encryption key (KEK).

Use customer-supplied encryption keys to manage the data encryption key (DEK).

Use customer-supplied encryption keys to manage the key encryption key (KEK).

Q82. In order to meet PCI DSS requirements, a customer wants to ensure that all outbound traffic is authorized.
Which two cloud offerings meet this requirement without additional compensating controls? (Choose two.)

App Engine

Cloud Functions

Compute Engine

Google Kubernetes Engine

Cloud Storage

Q83. You want to limit the images that can be used as the source for boot disks. These images will be stored in a dedicated project.
What should you do?

Use the Organization Policy Service to create a compute.trustedimageProjects constraint on the organization level. List the trusted project as the whitelist in an allow operation.

Use the Organization Policy Service to create a compute.trustedimageProjects constraint on the organization level. List the trusted projects as the exceptions in a deny operation.

In Resource Manager, edit the project permissions for the trusted project. Add the organization as member with the role: Compute Image User.

In Resource Manager, edit the organization permissions. Add the project ID as member with the role: Compute Image User.

Q84. When working with agents in a support center via online chat, an organization’s customers often share pictures of their documents with personally identifiable information (PII). The organization that owns the support center is concerned that the PII is being stored in their databases as part of the regular chat logs they retain for review by internal or external analysts for customer service trend analysis.
Which Google Cloud solution should the organization use to help resolve this concern for the customer while still maintaining data utility?

Use Cloud Key Management Service (KMS) to encrypt the PII data shared by customers before storing it for analysis.

Use Object Lifecycle Management to make sure that all chat records with PII in them are discarded and not saved for analysis.

Use the image inspection and redaction actions of the DLP API to redact PII from the images before storing them for analysis.

Use the generalization and bucketing actions of the DLP API solution to redact PII from the texts before storing them for analysis.

Q85. You want to evaluate GCP for PCI compliance. You need to identify Google’s inherent controls.
Which document should you review to find the information?

Google Cloud Platform: Customer Responsibility Matrix

PCI DSS Requirements and Security Assessment Procedures

PCI SSC Cloud Computing Guidelines

Product documentation for Compute Engine

Q86. You are troubleshooting access denied errors between Compute Engine instances connected to a Shared VPC and BigQuery datasets. The datasets reside in a project protected by a VPC Service Controls perimeter. What should you do?

Add the host project containing the Shared VPC to the service perimeter.

Add the service project where the Compute Engine instances reside to the service perimeter.

Create a service perimeter between the service project where the Compute Engine instances reside and the host project that contains the Shared VPC.

Create a perimeter bridge between the service project where the Compute Engine instances reside and the perimeter that contains the protected BigQuery datasets.

Q87. You want to limit the images that can be used as the source for boot disks. These images will be stored in a dedicated project.
What should you do?

Use the Organization Policy Service to create a compute.trustedimageProjects constraint on the organization level. List the trusted project as the whitelist in an allow operation.

Use the Organization Policy Service to create a compute.trustedimageProjects constraint on the organization level. List the trusted projects as the exceptions in a deny operation.

In Resource Manager, edit the project permissions for the trusted project. Add the organization as member with the role: Compute Image User.

In Resource Manager, edit the organization permissions. Add the project ID as member with the role:
Compute Image User.

Pass Guaranteed Quiz 2022 Realistic Verified Free Google: https://www.examdumpsvce.com/Professional-Cloud-Security-Engineer-valid-exam-dumps.html

Exam Dumps VCE