Get Latest [Apr-2024] Conduct effective penetration tests using DumpsReview Professional-Cloud-Security-Engineer
Penetration testers simulate Professional-Cloud-Security-Engineer exam PDF
Google Professional-Cloud-Security-Engineer certification exam covers several key topics such as security controls, compliance and regulations, data protection, security management, and incident management. To succeed, candidates are expected to demonstrate their understanding of security principles and best practices in the cloud, and their ability to apply them in real-world scenarios. Candidates will also be tested on their ability to use Google Cloud security tools, services, and features effectively.
To pass the exam, candidates must demonstrate their ability to design, implement, and maintain secure GCP solutions that meet industry best practices and regulatory requirements. They must also be able to analyze and mitigate security threats, as well as monitor and audit GCP security controls. By earning the Google Professional-Cloud-Security-Engineer certification, professionals can demonstrate their expertise in securing GCP and increase their career opportunities in cloud security.
NEW QUESTION # 140
Your organization's Google Cloud VMs are deployed via an instance template that configures them with a public IP address in order to host web services for external users. The VMs reside in a service project that is attached to a host (VPC) project containing one custom Shared VPC for the VMs. You have been asked to reduce the exposure of the VMs to the internet while continuing to service external users. You have already recreated the instance template without a public IP address configuration to launch the managed instance group (MIG). What should you do?
- A. Deploy a Cloud NAT Gateway in the service project for the MIG.
- B. Deploy an external HTTP(S) load balancer in the host (VPC) project with the MIG as a backend.
- C. Deploy an external HTTP(S) load balancer in the service project with the MIG as a backend.
- D. Deploy a Cloud NAT Gateway in the host (VPC) project for the MIG.
Answer: B
Explanation:
https://cloud.google.com/load-balancing/docs/https#shared-vpc
While you can create all the load balancing components and backends in the Shared VPC host project, this model does not separate network administration and service development responsibilities.
NEW QUESTION # 141
You need to provide a corporate user account in Google Cloud for each of your developers and operational staff who need direct access to GCP resources. Corporate policy requires you to maintain the user identity in a third-party identity management provider and leverage single sign-on. You learn that a significant number of users are using their corporate domain email addresses for personal Google accounts, and you need to follow Google recommended practices to convert existing unmanaged users to managed accounts.
Which two actions should you take? (Choose two.)
- A. Send an email to all of your employees and ask those users with corporate email addresses for personal Google accounts to delete the personal accounts immediately.
- B. Use the Transfer Tool for Unmanaged Users (TTUU) to find users with conflicting accounts and ask them to transfer their personal Google accounts.
- C. Use the Google Admin console to view which managed users are using a personal account for their recovery email.
- D. Add users to your managed Google account and force users to change the email addresses associated with their personal accounts.
- E. Use Google Cloud Directory Sync to synchronize your local identity management system to Cloud Identity.
Answer: A,C
Explanation:
Explanation/Reference:
NEW QUESTION # 142
A security team at an e-commerce company wants to define an automatic incident response process for fraudulent credit card usage attempts. The team targets a 10-minute or faster response time for such incidents. The fraudulent card list is updated every 60 seconds. The e- commerce servers log the transaction details in near-real time. Which option should you recommend to the security team?
- A. Maintain a log ingestion exclusion filter based on the fraudulent credit card lists.
- B. Use AutoML to automatically build models based on the fraudulent credit card lists.
- C. Create a new logging export with a filter to match the transaction and a sink pointing to a Cloud Pub/Sub topic.
- D. Define a log-based metric for each fraudulent credit card, and set a Stackdriver alert for these metrics.
Answer: C
Explanation:
A is not correct because creating a metric for every credit card will not scale well.
B is not correct because it will exclude the transactions that are relevant to the security team.
C is not correct because while we could use AutoML to build models, this solution is incomplete without deploying and running the model, as well as wiring them up with some consumer service.
D is correct because this will capture the important events and pass them to Pub/Sub which in turn can send the message to a consumer service like a chat notification webhook.
https://cloud.google.com/logging/docs/export/configure_export_v2
NEW QUESTION # 143
Your organization wants to be compliant with the General Data Protection Regulation (GDPR) on Google Cloud You must implement data residency and operational sovereignty in the EU.
What should you do?
Choose 2 answers
- A. Use Cloud IDS to get east-west and north-south traffic visibility in the EU to monitor intra-VPC and mter-VPC communication.
- B. Use identity federation to limit access to Google Cloud resources from non-EU entities.
- C. Limit Google personnel access based on predefined attributes such as their citizenship or geographic location by using Key Access Justifications
- D. Use VPC Flow Logs to monitor intra-VPC and inter-VPC traffic in the EU.
- E. Limit the physical location of a new resource with the Organization Policy Service resource locations constraint."
Answer: C,E
Explanation:
https://cloud.google.com/architecture/framework/security/data-residency-sovereignty#manage_your_operational_sovereignty
NEW QUESTION # 144
You need to connect your organization's on-premises network with an existing Google Cloud environment that includes one Shared VPC with two subnets named Production and Non-Production. You are required to:
Use a private transport link.
Configure access to Google Cloud APIs through private API endpoints originating from on-premises environments.
Ensure that Google Cloud APIs are only consumed via VPC Service Controls.
What should you do?
- A. 1. Set up a Dedicated Interconnect link between the on-premises environment and Google Cloud.
2. Configure private access using the restricted.googleapis.com domains in on-premises DNS configurations. - B. 1. Set up a Direct Peering link between the on-premises environment and Google Cloud.
2. Configure private access for both VPC subnets. - C. 1. Set up a Partner Interconnect link between the on-premises environment and Google Cloud.
2. Configure private access using the private.googleapis.com domains in on-premises DNS configurations. - D. 1. Set up a Cloud VPN link between the on-premises environment and Google Cloud.
2. Configure private access using the restricted googleapis.com domains in on-premises DNS configurations.
Answer: A
Explanation:
Explanation
restricted.googleapis.com (199.36.153.4/30) only provides access to Cloud and Developer APIs that support VPC Service Controls. VPC Service Controls are enforced for these serviceshttps://cloud.google.com/vpc/docs/configure-private-google-access-hybrid
NEW QUESTION # 145
You are in charge of migrating a legacy application from your company datacenters to GCP before the current maintenance contract expires. You do not know what ports the application is using and no documentation is available for you to check. You want to complete the migration without putting your environment at risk.
What should you do?
- A. Migrate the application into an isolated project using a "Lift & Shift" approach in a custom network. Disable all traffic within the VPC and look at the Firewall logs to determine what traffic should be allowed for the application to work properly.
- B. Refactor the application into a micro-services architecture hosted in Cloud Functions in an isolated project.Disable all traffic from outside your project using Firewall Rules. Use VPC Flow logs to determine what traffic should be allowed for the application to work properly.
- C. Refactor the application into a micro-services architecture in a GKE cluster. Disable all traffic from outside the cluster using Firewall Rules. Use VPC Flow logs to determine what traffic should be allowed for the application to work properly.
- D. Migrate the application into an isolated project using a "Lift & Shift" approach. Enable all internal TCP traffic using VPC Firewall rules. Use VPC Flow logs to determine what traffic should be allowed for the application to work properly.
Answer: D
Explanation:
Migrate the application into an isolated project using a "Lift & Shift" approach. Enable all internal TCP traffic using VPC Firewall rules. Use VPC Flow logs to determine what traffic should be allowed for the application to work properly.
NEW QUESTION # 146
An organization is starting to move its infrastructure from its on-premises environment to Google Cloud Platform (GCP). The first step the organization wants to take is to migrate its ongoing data backup and disaster recovery solutions to GCP. The organization's on-premises production environment is going to be the next phase for migration to GCP. Stable networking connectivity between the on-premises environment and GCP is also being implemented.
Which GCP solution should the organization use?
- A. Cloud Storage using a scheduled task and gsutil via Cloud Interconnect
- B. Compute Engines Virtual Machines using Persistent Disk via Cloud Interconnect
- C. Cloud Datastore using regularly scheduled batch upload jobs via Cloud VPN
- D. BigQuery using a data pipeline job with continuous updates via Cloud VPN
Answer: A
Explanation:
Explanation/Reference: https://cloud.google.com/solutions/migration-to-google-cloud-building-your-foundation
NEW QUESTION # 147
An organization adopts Google Cloud Platform (GCP) for application hosting services and needs guidance on setting up password requirements for their Cloud Identity account. The organization has a password policy requirement that corporate employee passwords must have a minimum number of characters.
Which Cloud Identity password guidelines can the organization use to inform their new requirements?
- A. Set the minimum length for passwords to be 12 characters.
- B. Set the minimum length for passwords to be 8 characters.
- C. Set the minimum length for passwords to be 6 characters.
- D. Set the minimum length for passwords to be 10 characters.
Answer: B
Explanation:
Default password length is 8 characters. https://support.google.com/cloudidentity/answer/33319?hl=en
https://support.google.com/cloudidentity/answer/139399?hl=en#:~:text=It%20can%20be%20between%208,decide%20to%20change%20their%20password.
NEW QUESTION # 148
Your company has been creating users manually in Cloud Identity to provide access to Google Cloud resources. Due to continued growth of the environment, you want to authorize the Google Cloud Directory Sync (GCDS) instance and integrate it with your on-premises LDAP server to onboard hundreds of users. You are required to:
Replicate user and group lifecycle changes from the on-premises LDAP server in Cloud Identity.
Disable any manually created users in Cloud Identity.
You have already configured the LDAP search attributes to include the users and security groups in scope for Google Cloud. What should you do next to complete this solution?
- A. 1. Configure the LDAP search attributes to exclude manually created Cloud identity users not found in LDAP.
2. Run GCDS after user and group lifecycle changes. - B. 1. Configure the option to delete domain users not found in LDAP.
2. Run GCDS after user and group lifecycle changes. - C. 1. Configure the option to suspend domain users not found in LDAP.
2. Set up a recurring GCDS task. - D. 1. Configure the LDAP search attributes to exclude manually created Cloud Identity users not found in LDAP.
2. Set up a recurring GCDS task.
Answer: C
Explanation:
To achieve the requirement "Disable any manually created users in Cloud Identity", configure GCDS to suspend rather than delete accounts if user accounts are not found in the LDAP directory in GCDS. Ref: https://support.google.com/a/answer/7177267
NEW QUESTION # 149
Your company is storing sensitive data in Cloud Storage. You want a key generated on-premises to be used in the encryption process.
What should you do?
- A. Use the Cloud Key Management Service to manage a key encryption key (KEK).
- B. Use customer-supplied encryption keys to manage the data encryption key (DEK).
- C. Use customer-supplied encryption keys to manage the key encryption key (KEK).
- D. Use the Cloud Key Management Service to manage a data encryption key (DEK).
Answer: D
Explanation:
https://cloud.google.com/security/encryption-at-rest/default-encryption/
NEW QUESTION # 150
You need to implement an encryption-at-rest strategy that protects sensitive data and reduces key management complexity for non-sensitive dat a. Your solution has the following requirements:
Schedule key rotation for sensitive data.
Control which region the encryption keys for sensitive data are stored in.
Minimize the latency to access encryption keys for both sensitive and non-sensitive data.
What should you do?
- A. Encrypt non-sensitive data and sensitive data with Cloud Key Management Service.
- B. Encrypt non-sensitive data with Google default encryption, and encrypt sensitive data with Cloud External Key Manager.
- C. Encrypt non-sensitive data with Google default encryption, and encrypt sensitive data with Cloud Key Management Service.
- D. Encrypt non-sensitive data and sensitive data with Cloud External Key Manager.
Answer: C
Explanation:
Google uses a common cryptographic library, Tink, which incorporates our FIPS 140-2 Level 1 validated module, BoringCrypto, to implement encryption consistently across almost all Google Cloud products. To provideflexibility of controlling the key residency and rotation schedule, use google provided key for non-sensitive and encrypt sensitive data with Cloud Key Management Service
NEW QUESTION # 151
You need to follow Google-recommended practices to leverage envelope encryption and encrypt data at the application layer.
What should you do?
- A. Generate a new data encryption key (DEK) in Cloud KMS to encrypt the data, and generate a key encryption key (KEK) locally to encrypt the key. Store both the encrypted data and the KEK.
- B. Generate a data encryption key (DEK) locally to encrypt the data, and generate a new key encryption key (KEK) in Cloud KMS to encrypt the DEK. Store both the encrypted data and the encrypted DEK.
- C. Generate a new data encryption key (DEK) in Cloud KMS to encrypt the data, and generate a key encryption key (KEK) locally to encrypt the key. Store both the encrypted data and the encrypted DEK.
- D. Generate a data encryption key (DEK) locally to encrypt the data, and generate a new key encryption key (KEK) in Cloud KMS to encrypt the DEK. Store both the encrypted data and the KEK.
Answer: B
Explanation:
Reference:
https://cloud.google.com/kms/docs/envelope-encryption
NEW QUESTION # 152
You want to use the gcloud command-line tool to authenticate using a third-party single sign-on (SSO) SAML identity provider. Which options are necessary to ensure that authentication is supported by the third-party identity provider (IdP)? (Choose two.)
- A. SSO SAML as a third-party IdP
- B. Identity-Aware Proxy
- C. Identity Platform
- D. OpenID Connect
- E. Cloud Identity
Answer: A,D
Explanation:
Explanation
To provide users with SSO-based access to selected cloud apps, Cloud Identity as your IdP supports the OpenID Connect (OIDC) and Security Assertion Markup Language 2.0 (SAML) protocols.
https://cloud.google.com/identity/solutions/enable-sso
NEW QUESTION # 153
Your team creates an ingress firewall rule to allow SSH access from their corporate IP range to a specific bastion host on Compute Engine. Your team wants to make sure that this firewall rule cannot be used by unauthorized engineers who may otherwise have access to manage VMs in the development environment. What should your team do to meet this requirement?
- A. Create the firewall rule with a target of a service account. Centrally manage access to the service account.
- B. Create the firewall rule with a target of a network tag. Centrally manage access to the tag.
- C. Create the firewall rule in a Shared VPC with a target of a network tag.
- D. Create the firewall rule in a Shared VPC with a target of a specific subnet.
Answer: A
Explanation:
A is not correct because the network tag value can be inferred by examining the Firewall Rule or VM metadata.
B is correct because access to the Service Account is required to use a firewall rule with a target of a Service Account.
C is not correct because the target network tag value can be inferred by examining the Firewall Rule or VM metadata.
D is not correct because the target subnet value can be inferred by examining the Firewall Rule or VM metadata.
https://cloud.google.com/vpc/docs/firewalls#service-accounts-vs-tags
NEW QUESTION # 154
A customer has 300 engineers. The company wants to grant different levels of access and efficiently manage IAM permissions between users in the development and production environment projects.
Which two steps should the company take to meet these requirements? (Choose two.)
- A. Create an Organizational Policy constraint for each folder environment.
- B. Create projects for each environment, and grant IAM rights to each engineering user.
- C. Create a Google Group for the Engineering team, and assign permissions at the folder level.
- D. Create a project with multiple VPC networks for each environment.
- E. Create a folder for each development and production environment.
Answer: C,E
NEW QUESTION # 155
A customer has an analytics workload running on Compute Engine that should have limited internet access.
Your team created an egress firewall rule to deny (priority 1000) all traffic to the internet.
The Compute Engine instances now need to reach out to the public repository to get security updates. What should your team do?
- A. Create an egress firewall rule to allow traffic to the CIDR range of the repository with a priority greater than 1000.
- B. Create an egress firewall rule to allow traffic to the hostname of the repository with a priority greater than 1000.
- C. Create an egress firewall rule to allow traffic to the CIDR range of the repository with a priority less than 1000.
- D. Create an egress firewall rule to allow traffic to the hostname of the repository with a priority less than
1000.
Answer: C
Explanation:
Explanation
https://cloud.google.com/vpc/docs/firewalls#priority_order_for_firewall_rules
NEW QUESTION # 156
A company migrated their entire data/center to Google Cloud Platform. It is running thousands of instances across multiple projects managed by different departments. You want to have a historical record of what was running in Google Cloud Platform at any point in time.
What should you do?
- A. Use Stackdriver to create a dashboard across all projects.
- B. Use Security Command Center to view all assets across the organization.
- C. Use Forseti Security to automate inventory snapshots.
- D. Use Resource Manager on the organization level.
Answer: C
Explanation:
Explanation
Only Forseti security can have both 'past' and 'present' (i.e. historical) records of the resources.https://forsetisecurity.org/about/
NEW QUESTION # 157
You are responsible for managing your company's identities in Google Cloud. Your company enforces 2-Step Verification (2SV) for all users. You need to reset a user's access, but the user lost their second factor for 2SV.
You want to minimize risk. What should you do?
- A. On the Google Admin console, use a super administrator account to reset the user account's credentials.
Ask the user to update their credentials after their first login. - B. On the Google Admin console, select the appropriate user account, and temporarily disable 2SV for this account Ask the user to update their second factor, and then re-enable 2SV for this account.
- C. On the Google Admin console, select the appropriate user account, and generate a backup code to allow the user to sign in. Ask the user to update their second factor.
- D. On the Google Admin console, temporarily disable the 2SV requirements for all users. Ask the user to log in and add their new second factor to their account. Re-enable the 2SV requirement for all users.
Answer: C
Explanation:
Explanation
https://support.google.com/a/answer/9176734
Use backup codes for account recovery If you need to recover an account, use backup codes. Accounts are still protected by 2-Step Verification, and backup codes are easy to generate.
NEW QUESTION # 158
A company is backing up application logs to a Cloud Storage bucket shared with both analysts and the administrator. Analysts should only have access to logs that do not contain any personally identifiable information (PII). Log files containing PII should be stored in another bucket that is only accessible by the administrator.
What should you do?
- A. On the bucket shared with both the analysts and the administrator, configure Object Lifecycle Management to delete objects that contain any PII.
- B. Upload the logs to both the shared bucket and the bucket only accessible by the administrator. Create a job trigger using the Cloud Data Loss Prevention API. Configure the trigger to delete any files from the shared bucket that contain PII.
- C. Use Cloud Pub/Sub and Cloud Functions to trigger a Data Loss Prevention scan every time a file is uploaded to the shared bucket. If the scan detects PII, have the function move into a Cloud Storage bucket only accessible by the administrator.
- D. On the bucket shared with both the analysts and the administrator, configure a Cloud Storage Trigger that is only triggered when PII data is uploaded. Use Cloud Functions to capture the trigger and delete such files.
Answer: C
Explanation:
Explanation
https://codelabs.developers.google.com/codelabs/cloud-storage-dlp-functions#0
https://www.youtube.com/watch?v=0TmO1f-Ox40
NEW QUESTION # 159
A customer is running an analytics workload on Google Cloud Platform (GCP) where Compute Engine instances are accessing data stored on Cloud Storage. Your team wants to make sure that this workload will not be able to access, or be accessed from, the internet.
Which two strategies should your team use to meet these requirements? (Choose two.)
- A. Configure Private Google Access on the Compute Engine subnet
- B. Make sure that the Compute Engine cluster is running on a separate subnet.
- C. Avoid assigning public IP addresses to the Compute Engine cluster.
- D. Configure a Cloud NAT gateway.
- E. Turn off IP forwarding on the Compute Engine instances in the cluster.
Answer: C,D
NEW QUESTION # 160
You are migrating an application into the cloud The application will need to read data from a Cloud Storage bucket. Due to local regulatory requirements, you need to hold the key material used for encryption fully under your control and you require a valid rationale for accessing the key material.
What should you do?
- A. Encrypt the data in the Cloud Storage bucket by using Customer Managed Encryption Keys backed by a Cloud Hardware Security Module (HSM). Enable data access logs.
- B. Generate a key in your on-premises environment to encrypt the data before you upload the data to the Cloud Storage bucket Upload the key to the Cloud Key Management Service (KMS). Activate Key Access Justifications (KAJ) and have the external key system reject unauthorized accesses.
- C. Encrypt the data in the Cloud Storage bucket by using Customer Managed Encryption Keys. Configure an 1AM deny policy for unauthorized groups
- D. Generate a key in your on-premises environment and store it in a Hardware Security Module (HSM) that is managed on-premises Use this key as an external key in the Cloud Key Management Service (KMS). Activate Key Access Justifications (KAJ) and set the external key system to reject unauthorized accesses.
Answer: D
Explanation:
By generating a key in your on-premises environment and storing it in an HSM that you manage, you're ensuring that the key material is fully under your control. Using the key as an external key in Cloud KMS allows you to use the key with Google Cloud services without having the key stored on Google Cloud. Activating Key Access Justifications (KAJ) provides a reason every time the key is accessed, and you can configure the external key system to reject unauthorized access attempts.
NEW QUESTION # 161
A company is deploying their application on Google Cloud Platform. Company policy requires long-term data to be stored using a solution that can automatically replicate data over at least two geographic places.
Which Storage solution are they allowed to use?
- A. Cloud Bigtable
- B. Compute Engine Persistent Disk
- C. Cloud BigQuery
- D. Compute Engine SSD Disk
Answer: C
Explanation:
https://cloud.google.com/bigquery#:~:text=BigQuery%20transparently%20and%20automatically%20provides,charge%20and%20no%20additional%20setup.&text=BigQuery%20also%20provides%20ODBC%20and,interact%20with%20its%20powerful%20engine.
NEW QUESTION # 162
......
Candidates for the Google Professional-Cloud-Security-Engineer certification must have a strong understanding of cloud security fundamentals, including threat modeling, risk management, encryption, and access controls. They must also be familiar with the Google Cloud Platform and its various services, such as Google Kubernetes Engine, Google Cloud Storage, and Google Cloud SQL.
Tested Material Used To Professional-Cloud-Security-Engineer Test Engine: https://quizmaterials.dumpsreview.com/Professional-Cloud-Security-Engineer-exam-dumps-review.html
