Tested & Approved Professional-Cloud-Security-Engineer Study Materials Download Free Updated 320 Questions
Regular Free Updates Professional-Cloud-Security-Engineer Dumps Real Exam Questions Test Engine
NEW QUESTION # 14
Your organization acquired a new workload. The Web and Application (App) servers will be running on Compute Engine in a newly created custom VPC. You are responsible for configuring a secure network communication solution that meets the following requirements:
Only allows communication between the Web and App tiers.
Enforces consistent network security when autoscaling the Web and App tiers.
Prevents Compute Engine Instance Admins from altering network traffic.
What should you do?
- A. 1. Re-deploy the Web and App servers with instance templates configured with respective network tags.
2. Create an allow VPC firewall rule that specifies the target/source with respective network tags. - B. 1. Configure all running Web and App servers with respective service accounts.2. Create an allow VPC firewall rule that specifies the target/source with respective service accounts.
- C. 1. Configure all running Web and App servers with respective network tags.2. Create an allow VPC firewall rule that specifies the target/source with respective network tags.
- D. 1. Re-deploy the Web and App servers with instance templates configured with respective service accounts.2. Create an allow VPC firewall rule that specifies the target/source with respective service accounts.
Answer: D
Explanation:
https://cloud.google.com/vpc/docs/firewalls#service-accounts-vs-tags
https://cloud.google.com/vpc/docs/firewalls#service-accounts-vs-tags
A service account represents an identity associated with an instance. Only one service account can be associated with an instance. You control access to the service account by controlling the grant of the Service Account User role for other IAM principals. For an IAM principal to start an instance by using a service account, that principal must have the Service Account User role to at least use that service account and appropriate permissions to create instances (for example, having the Compute Engine Instance Admin role to the project).
NEW QUESTION # 15
There is a threat actor that is targeting organizations like yours. Attacks are always initiated from a known IP address range. You want to deny-list those IPs for your website, which is exposed to the internet through an Application Load Balancer. What should you do?
- A. Activate Identity-Aware Proxy for the backend of the Application Load Balancer. Create a firewall rule that only allows traffic from the proxy to the application.
- B. Create a log sink with a filter containing the known IP address range. Trigger an alert that detects when the Application Load Balancer is accessed from those IPs.
- C. Create a Cloud Armor policy with a deny-rule for the known IP address range. Attach the policy to the backend of the Application Load Balancer.
- D. Create a Cloud Firewall policy with a deny-rule for the known IP address range. Associate the firewall policy to the Virtual Private Cloud with the application backend.
Answer: C
Explanation:
Cloud Armor: Cloud Armor is a web application firewall (WAF) that provides DDoS protection and advanced security features. Creating a deny-rule for the known IP address range will effectively block traffic from those IPs, preventing them from reaching your website.
Application Load Balancer Integration: Attaching the Cloud Armor policy to the backend of the Application Load Balancer ensures that the policy is applied to all traffic entering your website, regardless of the specific backend instance.
NEW QUESTION # 16
You want to evaluate GCP for PCI compliance. You need to identify Google's inherent controls.
Which document should you review to find the information?
- A. PCI SSC Cloud Computing Guidelines
- B. Google Cloud Platform: Customer Responsibility Matrix
- C. PCI DSS Requirements and Security Assessment Procedures
- D. Product documentation for Compute Engine
Answer: A
NEW QUESTION # 17
Your company must follow industry specific regulations. Therefore, you need to enforce customer-managed encryption keys (CMEK) for all new Cloud Storage resources in the organization called org1.
What command should you execute?
- A. * organization policy:constraints/gcp.restrictStorageNonCraekServices
* binding at: orgl
* policy type: allow
* policy value: all supported services - B. * organization policy: constraints/gcp.restrictStorageNonCraekServices
* binding at: orgl
* policy type: deny
* policy value: storage.gcogleapis.com - C. * organization policy: constramts/gcp.restrictNonCmekServices
* binding at: orgl
* policy type: allow
* policy value: storage.googleapis.com - D. * organization policy: constraints/gcp.restrictHonCmekServices
* binding at: orgl
* policy type: deny
* policy value: storage.googleapis.com
Answer: C
Explanation:
* Requirement:
* Enforce the use of Customer-Managed Encryption Keys (CMEK) for all new Cloud Storage resources in the organization.
* Policy Constraint:
* Use the constraints/gcp.restrictNonCmekServices constraint to enforce CMEK usage.
* Policy Type and Value:
* Set the policy type to allow to specify which services must use CMEK.
* In this case, the policy value should be storage.googleapis.com to target Cloud Storage.
* Command:
* Applying the organization policy with the appropriate binding ensures that all new Cloud Storage resources under the organization will require CMEK.
* Steps:
* Step 1: Go to the Google Cloud Console.
* Step 2: Navigate to the Organization Policies page.
* Step 3: Apply the policy constraint constraints/gcp.restrictNonCmekServices with the allow policy type and storage.googleapis.com as the policy value.
References:
* Organization Policy Constraints
* Customer-Managed Encryption Keys (CMEK)
NEW QUESTION # 18
You are exporting application logs to Cloud Storage. You encounter an error message that the log sinks don't support uniform bucket-level access policies. How should you resolve this error?
- A. Update your sink with the correct bucket destination.
- B. Change the access control model for the bucket
- C. Add the roles/logging.bucketWriter Identity and Access Management (IAM) role to the bucket for the log sink identity.
- D. Add the roles/logging.logWriter Identity and Access Management (IAM) role to the bucket for the log sink identity.
Answer: B
Explanation:
https://cloud.google.com/logging/docs/export/troubleshoot
Unable to grant correct permissions to the destination:
Even if the sink was successfully created with the correct service account permissions, this error message displays if the access control model for the Cloud Storage bucket was set to uniform access when the bucket was created.
For existing Cloud Storage buckets, you can change the access control model for the first 90 days after bucket creation by using the Permissions tab. For new buckets, select the Fine-grained access control model during bucket creation. For details, see Creating Cloud Storage buckets.
NEW QUESTION # 19
A customer has an analytics workload running on Compute Engine that should have limited internet access.
Your team created an egress firewall rule to deny (priority 1000) all traffic to the internet.
The Compute Engine instances now need to reach out to the public repository to get security updates. What should your team do?
- A. Create an egress firewall rule to allow traffic to the CIDR range of the repository with a priority less than 1000.
- B. Create an egress firewall rule to allow traffic to the CIDR range of the repository with a priority greater than 1000.
- C. Create an egress firewall rule to allow traffic to the hostname of the repository with a priority less than
1000. - D. Create an egress firewall rule to allow traffic to the hostname of the repository with a priority greater than 1000.
Answer: A
Explanation:
Explanation
https://cloud.google.com/vpc/docs/firewalls#priority_order_for_firewall_rules
NEW QUESTION # 20
In order to meet PCI DSS requirements, a customer wants to ensure that all outbound traffic is authorized.
Which two cloud offerings meet this requirement without additional compensating controls? (Choose two.)
- A. Google Kubernetes Engine
- B. Cloud Storage
- C. Cloud Functions
- D. Compute Engine
- E. App Engine
Answer: A,D
Explanation:
App Engine ingress firewall rules are available, but egress rules are not currently available. Per requirements 1.2.1 and 1.3.4, you must ensure that all outbound traffic is authorized. SAQ A-EP and SAQ D-type merchants must provide compensating controls or use a different Google Cloud product. Compute Engine and GKE are the preferred alternatives. https://cloud.google.com/solutions/pci-dss-compliance-in-gcp
NEW QUESTION # 21
A customer is running an analytics workload on Google Cloud Platform (GCP) where Compute Engine instances are accessing data stored on Cloud Storage. Your team wants to make sure that this workload will not be able to access, or be accessed from, the internet.
Which two strategies should your team use to meet these requirements? (Choose two.)
- A. Avoid assigning public IP addresses to the Compute Engine cluster.
- B. Turn off IP forwarding on the Compute Engine instances in the cluster.
- C. Configure Private Google Access on the Compute Engine subnet
- D. Make sure that the Compute Engine cluster is running on a separate subnet.
- E. Configure a Cloud NAT gateway.
Answer: A,C
NEW QUESTION # 22
You have been tasked with inspecting IP packet data for invalid or malicious content. What should you do?
- A. Configure Google Cloud Armor access logs to perform inspection on the log data.
- B. Configure the Fluentd agent on each VM Instance within the VPC. Perform inspection on the log data using Cloud Logging.
- C. Enable VPC Flow Logs for all subnets in the VPC. Perform inspection on the Flow Logs data using Cloud Logging.
- D. Use Packet Mirroring to mirror traffic to and from particular VM instances. Perform inspection using security software that analyzes the mirrored traffic.
Answer: D
Explanation:
Packet Mirroring Setup: Configure Packet Mirroring in your Google Cloud VPC to capture traffic to and from specific VM instances. This allows you to analyze the traffic for security and compliance purposes.
Security Software: Use specialized security software to inspect the mirrored traffic. This software can detect invalid or malicious content in the IP packets.
Mirroring Configuration: Specify the instances, network, and traffic direction (ingress, egress, or both) to be mirrored. Ensure that the mirrored traffic is directed to an appropriate analysis destination.
Traffic Analysis: Continuously monitor and analyze the mirrored traffic for any signs of malicious activity or anomalies. Use the findings to enhance your security posture and respond to potential threats. Reference::
Google Cloud - Packet Mirroring
Google Cloud - Packet Mirroring Best Practices
NEW QUESTION # 23
Your company's users access data in a BigQuery table. You want to ensure they can only access the data during working hours.
What should you do?
- A. Configure Cloud Scheduler so that it triggers a Cloud Functions instance that modifies the organizational policy constraints for BigQuery during the specified working hours.
- B. Run a gsuttl script that assigns a BigQuery Data Viewer role, and remove it only during the specified working hours.
- C. Assign a BigQuery Data Viewer role to a service account that adds and removes the users daily during the specified working hours
- D. Assign a BigQuery Data Viewer role along with an 1AM condition that limits the access to specified working hours.
Answer: D
Explanation:
o ensure that users can only access the data in a BigQuery table during working hours, you can assign the BigQuery Data Viewer role with an IAM condition that specifies the allowed access times. This method leverages IAM Conditions, which allow you to define and enforce time-based access policies. Here's how to do it:
* Identify the BigQuery Table: Determine which BigQuery table(s) require restricted access.
* Create an IAM Policy with Conditions: Define an IAM policy that includes a condition for time- based access. You can do this using the Google Cloud Console, gcloud command-line tool, or directly editing the IAM policy JSON.
* Specify Working Hours: In the IAM condition, specify the time frame during which access is allowed.
For example, you can set access to be allowed from 9 AM to 5 PM on weekdays.
* Assign the Role with Conditions: Apply the policy to the users or groups who need access. Ensure that the condition is correctly attached to the BigQuery Data Viewer role.
Example using gcloud:
gcloud projects add-iam-policy-binding [PROJECT_ID] \
--member=user:[USER_EMAIL] \
--role=roles/bigquery.dataViewer \
--condition=expression="(request.time.getFullYear() == 2024) && (request.time.getDayOfWeek() in [1, 2, 3,
4, 5]) && (request.time.getHours() >= 9) && (request.time.getHours() < 17)",title="Working hours condition",description="Access limited to working hours" References
* Google Cloud IAM Conditions
* Google Cloud BigQuery IAM Roles
NEW QUESTION # 24
Your company is developing a new application for your organization. The application consists of two Cloud Run services, service A and service B. Service A provides a web-based user front-end. Service B provides back-end services that are called by service A. You need to set up identity and access management for the application. Your solution should follow the principle of least privilege. What should you do?
- A. Use the Compute Engine default service account to run service A and service B. Require authentication for service B. Permit only the default service account to call the backend.
- B. Create a new service account with the permissions to run service A and service B. Require authentication for service B. Permit only the new service account to call the backend.
- C. Create two separate service accounts. Grant one service account the permissions to execute service A, and grant the other service account the permissions to execute service B. Require authentication for service B. Permit only the service account for service A to call the back-end.
- D. Create three separate service accounts. Grant one service account the permissions to execute service A.Grant the second service account the permissions to run service B. Grant the third service account the permissions to communicate between both services A and B. Require authentication for service B. Call the back-end by authenticating with a service account key for the third service account.
Answer: C
Explanation:
The problem describes an application with two Cloud Run services (Service A - frontend, Service B - backend) and requires setting up IAM with the principle of least privilege. Service A calls Service B.
Principle of Least Privilege: This principle dictates that each entity (in this case, a Cloud Run service) should only have the minimum permissions necessary to perform its function.
Separate Service Accounts for Separate Services: To adhere to the principle of least privilege, it's best practice to assign a unique service account to each distinct service or component. This ensures that a compromise of one service account does not grant excessive permissions across other services. Service A needs permissions to run itself and to invoke Service B. Service B only needs permissions to run itself.Extract Reference:
"Assign a service account to a Cloud Run service. The service account acts as the identity for your service and determines what permissions your revisions have when executing requests. It is a best practice to grant each service account only the permissions that are required to run the specific service (principle of least privilege)." (Google Cloud documentation: https://cloud.google.com/run/docs/configuring/service-accounts) Authentication for Cloud Run Services: When one Cloud Run service (caller) needs to invoke another Cloud Run service (callee), the caller must be authorized to do so. This is typically achieved by assigning the roles
/run.invoker role on the callee service to the caller's service account.Extract Reference: "To allow a service to invoke another service, grant the roles/run.invoker role on the called service to the caller's service account." (Google Cloud documentation: https://cloud.google.com/run/docs/securing/service-to-service) Let's evaluate the options:
A). Create a new service account with the permissions to run service A and service B. Require authentication for service B. Permit only the new service account to call the backend. This violates the principle of least privilege by giving a single service account permissions for both services. If that service account were compromised, both services would be affected.
B). Create two separate service accounts. Grant one service account the permissions to execute service A, and grant the other service account the permissions to execute service B. Require authentication for service B.
Permit only the service account for service A to call the back-end. This aligns perfectly with least privilege.
Service A gets its own identity, Service B gets its own identity. Service A's service account is then granted run.invoker permissions on Service B, allowing it to call the backend while Service B requires authentication.
This is the recommended approach.
C). Use the Compute Engine default service account to run service A and service B. Require authentication for service B. Permit only the default service account to call the backend. The Compute Engine default service account often has broad permissions (e.g., editor role in its project). Using it violates the principle of least privilege and is generally discouraged for production applications due to the potential for excessive permissions.
D). Create three separate service accounts. Grant one service account the permissions to execute service A.
Grant the second service account the permissions to run service B. Grant the third service account the permissions to communicate between both services A and B. Require authentication for service B. Call the back-end by authenticating with a service account key for the third service account. This introduces unnecessary complexity with a third service account just for communication. More critically, using a service account key for authentication is generally discouraged in Cloud Run environments where ADC (Application Default Credentials) can be used, as managing keys securely becomes an operational overhead and security risk. Cloud Run services automatically use their attached service accounts for authentication when making calls to other Google Cloud services, including other Cloud Run services.
Therefore, option B is the best solution, adhering to the principle of least privilege and Google Cloud best practices for Cloud Run service-to-service authentication.
NEW QUESTION # 25
You run applications on Cloud Run. You already enabled container analysis for vulnerability scanning.
However, you are concerned about the lack of control on the applications that are deployed. You must ensure that only trusted container images are deployed on Cloud Run.
What should you do?
Choose 2 answers
- A. Set the organization policy constraint constraints/run. allowedBinaryAuthorizationPolicie tothe list of allowed Binary Authorization policy names.
- B. Enable Binary Authorization on the existing Cloud Run service.
- C. Enable Binary Authorization on the existing Kubernetes cluster.
- D. Use Cloud Run breakglass to deploy an image that meets the Binary Authorization policy by default.
- E. Set the organization policy constraint constraints/compute.trustedimageProjects to the list ofprotects that contain the trusted container images.
Answer: A,B
Explanation:
To ensure that only trusted container images are deployed on Cloud Run, you can implement Binary Authorization, which is a deploy-time security control that ensures only trusted images are used.
* Set Up Binary Authorization:
* Navigate to the Google Cloud Console.
* Go to Security > Binary Authorization.
* Configure the policy to include attestors that verify your trusted images.
* Enable Binary Authorization on Cloud Run:
* Go to the Cloud Run service.
* Enable Binary Authorization on your existing Cloud Run services by selecting the appropriate Binary Authorization policy.
* Set Organization Policy:
* Go to the Organization Policies page in the Google Cloud Console.
* Add a constraint for constraints/run.allowedBinaryAuthorizationPolicies.
* Specify the list of allowed Binary Authorization policy names to enforce across your organization.
These steps ensure that any container image deployed on Cloud Run is validated against the specified Binary Authorization policies, preventing untrusted images from being deployed.
Binary Authorization Documentation
Enabling Binary Authorization on Cloud Run
NEW QUESTION # 26
Last week, a company deployed a new App Engine application that writes logs to BigQuery. No other workloads are running in the project. You need to validate that all data written to BigQuery was done using the App Engine Default Service Account.
What should you do?
- A. 1. In BigQuery, select the related dataset.
2. Make sure the App Engine Default Service Account is the only account that can write to the dataset. - B. 1. Use StackDriver Logging and filter on BigQuery Insert Jobs.
2.Click on the email address in line with the App Engine Default Service Account in the authentication field.
3.Click Show Matching Entries.
4.Make sure the resulting list is empty. - C. 1. Go to the IAM section on the project.
2. Validate that the App Engine Default Service Account is the only account that has a role that can write to BigQuery. - D. 1. Use StackDriver Logging and filter on BigQuery Insert Jobs.
2.Click on the email address in line with the App Engine Default Service Account in the authentication field.
3.Click Hide Matching Entries.
4.Make sure the resulting list is empty.
Answer: D
NEW QUESTION # 27
You are a Cloud Identity administrator for your organization. In your Google Cloud environment groups are used to manage user permissions. Each application team has a dedicated group Your team is responsible for creating these groups and the application teams can manage the team members on their own through the Google Cloud console. You must ensure that the application teams can only add users from within your organization to their groups.
What should you do?
- A. Change the configuration of the relevant groups in the Google Workspace Admin console to prevent external users from being added to the group.
- B. Export the Cloud Identity logs to BigQuery Configure an alert for external members added to groups Have the alert trigger a Cloud Function instance that removes the external members from the group.
- C. Define an Identity and Access Management (IAM) deny policy that denies the assignment of principals that are outside your organization to the groups in scope.
- D. Set an Identity and Access Management (1AM) policy that includes a condition that restricts group membership to user principals that belong to your organization.
Answer: A
Explanation:
To ensure that application teams can only add users from within your organization to their groups, you need to configure the group settings in the Google Workspace Admin console. Here are the steps:
Access Google Workspace Admin Console:
Go to the Google Workspace Admin console.
Navigate to the Groups section.
Configure Group Settings:
Select the relevant groups used by the application teams.
Go to the group settings and set the group to only allow members from your domain.
This prevents external users from being added to these groups.
Apply and Save Changes:
Apply the changes to ensure that only users from within your organization can be added to these groups.
Verify Configuration:
Test the configuration by attempting to add an external user to the group and verifying that it is not allowed.
Benefits:
Security: Prevents unauthorized access by ensuring that only internal users can be added to groups.
Compliance: Helps in adhering to organizational policies regarding user access and management.
Reference:
Google Workspace Admin Help: Groups
NEW QUESTION # 28
Your organization's application is being integrated with a partner application that requires read access to customer data to process customer orders. The customer data is stored in one of your Cloud Storage buckets.
You have evaluated different options and determined that this activity requires the use of service account keys. You must advise the partner on how to minimize the risk of a compromised service account key causing a loss of data. What should you advise the partner to do?
- A. Implement a secret management service. Configure the service to frequently rotate the service account key. Configure proper access control to the key, and restrict who can create service account keys.
- B. Ensure that all data for the application that is accessed through the relevant service accounts is encrypted at rest by using customer-managed encryption keys (CMEK).
- C. Scan the Cloud Storage bucket with Sensitive Data Protection when new data is added, and automatically mask all customer data.
- D. Define a VPC Service Controls perimeter, and restrict the Cloud Storage API. Add an ingress rule to the perimeter to allow access to the Cloud Storage API for the service account from outside of the perimeter.
Answer: A
Explanation:
When integrating applications that require access to sensitive data stored in Cloud Storage, managing service account keys securely is crucial to prevent unauthorized access or data loss.
* Option A: Defining a VPC Service Controls perimeter enhances security by restricting access to Google Cloud services. However, configuring ingress rules to allow external access for the service account may introduce complexities and potential security gaps, especially if the partner's infrastructure is outside the defined perimeter.
* Option B: Scanning and masking customer data addresses data sensitivity but does not mitigate risks associated with compromised service account keys. This approach focuses on data content rather than access control mechanisms.
* Option C: Encrypting data at rest using customer-managed encryption keys (CMEK) ensures data confidentiality but does not directly address the security of service account keys or access controls.
* Option D: Implementing a secret management service to handle service account keys is a best practice.
By configuring the service to frequently rotate keys, you reduce the window of opportunity for malicious actors to exploit compromised keys. Additionally, enforcing strict access controls ensures that only authorized personnel can create or manage service account keys, minimizing the risk of unauthorized access. This approach directly addresses the security concerns related to service account key management.
Therefore, Option D is the most appropriate recommendation, as it focuses on securely managing service account keys through rotation and access controls, thereby minimizing the risk of data loss due to compromised keys.
References:
* Best Practices for Managing Service Account Keys
* Secret Manager Documentation
NEW QUESTION # 29
You are working with a client who plans to migrate their data to Google Cloud. You are responsible for recommending an encryption service to manage their encrypted keys. You have the following requirements:
The master key must be rotated at least once every 45 days.
The solution that stores the master key must be FIPS 140-2 Level 3 validated.
The master key must be stored in multiple regions within the US for redundancy.
Which solution meets these requirements?
- A. Customer-supplied encryption keys
- B. Customer-managed encryption keys with Cloud HSM
- C. Google-managed encryption keys
- D. Customer-managed encryption keys with Cloud Key Management Service
Answer: C
NEW QUESTION # 30
......
Pass Google Professional-Cloud-Security-Engineer Exam in First Attempt Easily: https://www.prep4away.com/Google-certification/braindumps.Professional-Cloud-Security-Engineer.ete.file.html
Practice Test Questions Verified Answers As Experienced in the Actual Test!: https://drive.google.com/open?id=1YcDO9ffK8zMvZZy1_NcOv5xurYYUl6Id