Professional-Cloud-Security-Engineer Exam Dumps – PDF Questions and Testing Engine [Q152-Q171]

5/5 - (2 votes)

Professional-Cloud-Security-Engineer Exam Dumps – PDF Questions and Testing Engine

Professional-Cloud-Security-Engineer Dumps – The Sure Way To Pass Exam

NO.152 In order to meet PCI DSS requirements, a customer wants to ensure that all outbound traffic is authorized.
Which two cloud offerings meet this requirement without additional compensating controls? (Choose two.)

App Engine

Cloud Functions

Compute Engine

Google Kubernetes Engine

Cloud Storage

NO.153 A customer’s internal security team must manage its own encryption keys for encrypting data on Cloud Storage and decides to use customer-supplied encryption keys (CSEK).
How should the team complete this task?

Upload the encryption key to a Cloud Storage bucket, and then upload the object to the same bucket.

Use the gsutil command line tool to upload the object to Cloud Storage, and specify the location of the encryption key.

Generate an encryption key in the Google Cloud Platform Console, and upload an object to Cloud Storage using the specified key.

Encrypt the object, then use the gsutil command line tool or the Google Cloud Platform Console to upload the object to Cloud Storage.

NO.154 You run applications on Cloud Run. You already enabled container analysis for vulnerability scanning. However, you are concerned about the lack of control on the applications that are deployed. You must ensure that only trusted container images are deployed on Cloud Run.
What should you do?
Choose 2 answers

Enable Binary Authorization on the existing Kubernetes cluster.

Set the organization policy constraint constraints/run. allowedBinaryAuthorizationPolicie to the list of allowed Binary Authorization policy names.

Set the organization policy constraint constraints/compute.trustedimageProjects to the list of protects that contain the trusted container images.

Enable Binary Authorization on the existing Cloud Run service.

Use Cloud Run breakglass to deploy an image that meets the Binary Authorization policy by default.

NO.155 You are developing an application that runs on a Compute Engine VM. The application needs to access data stored in Cloud Storage buckets in other Google Cloud projects. The required access to the buckets is variable. You need to provide access to these resources while following Google- recommended practices. What should you do?

Limit the VMs access to the Cloud Storage buckets by setting the relevant access scope of the VM.

Create IAM bindings for the VM’s service account and the required buckets that allow appropriate access to the data stored in the buckets.

Grant the VM’s service account access to the required buckets by using domain-wide delegation.

Create a group and assign IAM bindings to the group for each bucket that the application needs to access. Assign the VM’s service account to the group.

NO.156 Applications often require access to “secrets” – small pieces of sensitive data at build or run time. The administrator managing these secrets on GCP wants to keep a track of “who did what, where, and when?” within their GCP projects.
Which two log streams would provide the information that the administrator is looking for? (Choose two.)

Admin Activity logs

System Event logs

Data Access logs

VPC Flow logs

Agent logs

NO.157 A customer wants to make it convenient for their mobile workforce to access a CRM web interface that is hosted on Google Cloud Platform (GCP). The CRM can only be accessed by someone on the corporate network. The customer wants to make it available over the internet. Your team requires an authentication layer in front of the application that supports two-factor authentication Which GCP product should the customer implement to meet these requirements?

Cloud Identity-Aware Proxy

Cloud Armor

Cloud Endpoints

Cloud VPN

NO.158 An organization’s security and risk management teams are concerned about where their responsibility lies for certain production workloads they are running in Google Cloud Platform (GCP), and where Google’s responsibility lies. They are mostly running workloads using Google Cloud’s Platform-as-a-Service (PaaS) offerings, including App Engine primarily.
Which one of these areas in the technology stack would they need to focus on as their primary responsibility when using App Engine?

Configuring and monitoring VPC Flow Logs

Defending against XSS and SQLi attacks

Manage the latest updates and security patches for the Guest OS

Encrypting all stored data

NO.159 Your team wants to limit users with administrative privileges at the organization level.
Which two roles should your team restrict? (Choose two.)

Organization Administrator

Super Admin

GKE Cluster Admin

Compute Admin

Organization Role Viewer

NO.160 Your organization recently activated the Security Command Center {SCO standard tier. There are a few Cloud Storage buckets that were accidentally made accessible to the public. You need to investigate the impact of the incident and remediate it.
What should you do?

* 1 Remove the Identity and Access Management (IAM) granting access to allusers from the buckets
* 2 Apply the organization policy storage. unifromBucketLevelAccess to prevent regressions
* 3 Query the data access logs to report on unauthorized access

* 1 Change bucket permissions to limit access
* 2 Query the data access audit logs for any unauthorized access to the buckets
* 3 After the misconfiguration is corrected mute the finding in the Security Command Center

* 1 Change permissions to limit access for authorized users
* 2 Enforce a VPC Service Controls perimeter around all the production projects to immediately stop any unauthorized access
* 3 Review the administrator activity audit logs to report on any unauthorized access

* 1 Change the bucket permissions to limit access
* 2 Query the buckets usage logs to report on unauthorized access to the data
* 3 Enforce the organization policy storage.publicAccessPrevention to avoid regressions

NO.161 Your company operates an application instance group that is currently deployed behind a Google Cloud load balancer in us-central-1 and is configured to use the Standard Tier network. The infrastructure team wants to expand to a second Google Cloud region, us-east-2. You need to set up a single external IP address to distribute new requests to the instance groups in both regions.
What should you do?

Change the load balancer backend configuration to use network endpoint groups instead of instance groups.

Change the load balancer frontend configuration to use the Premium Tier network, and add the new instance group.

Create a new load balancer in us-east-2 using the Standard Tier network, and assign a static external IP address.

Create a Cloud VPN connection between the two regions, and enable Google Private Access.

NO.162 A customer implements Cloud Identity-Aware Proxy for their ERP system hosted on Compute Engine. Their security team wants to add a security layer so that the ERP systems only accept traffic from Cloud Identity- Aware Proxy.
What should the customer do to meet these requirements?

Make sure that the ERP system can validate the JWT assertion in the HTTP requests.

Make sure that the ERP system can validate the identity headers in the HTTP requests.

Make sure that the ERP system can validate the x-forwarded-for headers in the HTTP requests.

Make sure that the ERP system can validate the user’s unique identifier headers in the HTTP requests.

NO.163 You have been tasked with configuring Security Command Center for your organization’s Google Cloud environment. Your security team needs to receive alerts of potential crypto mining in the organization’s compute environment and alerts for common Google Cloud misconfigurations that impact security. Which Security Command Center features should you use to configure these alerts? (Choose two.)

Event Threat Detection

Container Threat Detection

Security Health Analytics

Cloud Data Loss Prevention

Google Cloud Armor

NO.164 You are the project owner for a regulated workload that runs in a project you own and manage as an Identity and Access Management (IAM) admin. For an upcoming audit, you need to provide access reviews evidence.
Which tool should you use?

Policy Troubleshooter

Policy Analyzer

IAM Recommender

Policy Simulator

NO.165 Your company wants to determine what products they can build to help customers improve their credit scores depending on their age range. To achieve this, you need tojoin user information in the company’s banking app with customers’ credit score data received from a third party. While using this raw data will allow you to complete this task, it exposes sensitive data, which could be propagated into new systems.
This risk needs to be addressed using de-identification and tokenization with Cloud Data Loss Prevention while maintaining the referential integrity across the database. Which cryptographic token format should you use to meet these requirements?

Deterministic encryption

Secure, key-based hashes

Format-preserving encryption

Cryptographic hashing

NO.166 What are the steps to encrypt data using envelope encryption?

Generate a data encryption key (DEK) locally.
Use a key encryption key (KEK) to wrap the DEK. Encrypt data with the KEK.
Store the encrypted data and the wrapped KEK.

Generate a key encryption key (KEK) locally.
Use the KEK to generate a data encryption key (DEK). Encrypt data with the DEK.
Store the encrypted data and the wrapped DEK.

Generate a data encryption key (DEK) locally.
Encrypt data with the DEK.
Use a key encryption key (KEK) to wrap the DEK. Store the encrypted data and the wrapped DEK.

Generate a key encryption key (KEK) locally.
Generate a data encryption key (DEK) locally. Encrypt data with the KEK.
Store the encrypted data and the wrapped DEK.

NO.167 Your company recently published a security policy to minimize the usage of service account keys.
On-premises Windows-based applications are interacting with Google Cloud APIs. You need to implement Workload Identity Federation (WIF) with your identity provider on-premises.
What should you do?

Set up a workload identity pool with your corporate Active Directory Federation Service (ADFS).
Configure a rule to let principals in the pool impersonate the Google Cloud service account.

Set up a workload identity pool with your corporate Active Directory Federation Service (ADFS).
Let all principals in the pool impersonate the Google Cloud service account.

Set up a workload identity pool with an OpenID Connect (OIDC) service on the same machine.
Configure a rule to let principals in the pool impersonate the Google Cloud service account.

Set up a workload identity pool with an OpenID Connect (OIDC) service on the same machine. Let all principals in the pool impersonate the Google Cloud service account.

NO.168 You plan to deploy your cloud infrastructure using a CI/CD cluster hosted on Compute Engine.
You want to minimize the risk of its credentials being stolen by a third party. What should you do?

Create a dedicated Cloud Identity user account for the cluster. Use a strong self-hosted vault solution to store the user’s temporary credentials.

Create a dedicated Cloud Identity user account for the cluster. Enable the constraints/iam.disableServiceAccountCreation organization policy at the project level.

Create a custom service account for the cluster. Enable the constraints/iam.disableServiceAccountKeyCreation organization policy at the project level

Create a custom service account for the cluster. Enable the constraints/iam.allowServiceAccountCredentialLifetimeExtension organization policy at the project level.

NO.169 You are responsible for managing your company’s identities in Google Cloud. Your company enforces 2-Step Verification (2SV) for all users. You need to reset a user’s access, but the user lost their second factor for
2SV. You want to minimize risk. What should you do?

On the Google Admin console, select the appropriate user account, and generate a backup code to allow the user to sign in. Ask the user to update their second factor.

On the Google Admin console, temporarily disable the 2SV requirements for all users. Ask the user to log in and add their new second factor to their account. Re-enable the 2SV requirement for all users.

On the Google Admin console, select the appropriate user account, and temporarily disable 2SV for this account Ask the user to update their second factor, and then re-enable 2SV for this account.

On the Google Admin console, use a super administrator account to reset the user account’s credentials.Ask the user to update their credentials after their first login.

NO.170 You have an application where the frontend is deployed on a managed instance group in subnet A and the data layer is stored on a mysql Compute Engine virtual machine (VM) in subnet B on the same VPC. Subnet A and Subnet B hold several other Compute Engine VMs. You only want to allow thee application frontend to access the data in the application’s mysql instance on port 3306.
What should you do?

Configure an ingress firewall rule that allows communication from the src IP range of subnet A to the tag “data-tag” that is applied to the mysql Compute Engine VM on port 3306.

Configure an ingress firewall rule that allows communication from the frontend’s unique service account to the unique service account of the mysql Compute Engine VM on port 3306.

Configure a network tag “fe-tag” to be applied to all instances in subnet A and a network tag “data-tag” to be applied to all instances in subnet B. Then configure an egress firewall rule that allows communication from Compute Engine VMs tagged with data-tag to destination Compute Engine VMs tagged fe-tag.

Configure a network tag “fe-tag” to be applied to all instances in subnet A and a network tag “data-tag” to be applied to all instances in subnet B. Then configure an ingress firewall rule that allows communication from Compute Engine VMs tagged with fe-tag to destination Compute Engine VMs tagged with data-tag.

NO.171 You are the Security Admin in your company. You want to synchronize all security groups that have an email address from your LDAP directory in Cloud IAM.
What should you do?

Configure Google Cloud Directory Sync to sync security groups using LDAP search rules that have
“user email address” as the attribute to facilitate one-way sync.

Configure Google Cloud Directory Sync to sync security groups using LDAP search rules that have
“user email address” as the attribute to facilitate bidirectional sync.

Use a management tool to sync the subset based on the email address attribute. Create a group in the Google domain. A group created in a Google domain will automatically have an explicit Google Cloud Identity and Access Management (IAM) role.

Use a management tool to sync the subset based on group object class attribute. Create a group in the Google domain. A group created in a Google domain will automatically have an explicit Google Cloud Identity and Access Management (IAM) role.