Pass Google Professional-Cloud-Security-Engineer exam Dumps 100 Pass Guarantee With Latest Demo
The Professional-Cloud-Security-Engineer PDF Dumps Greatest for the Google Exam Study Guide!
Data Protection Ensuring
To answer the questions related to this module, the learners need to have the skills in managing encryption at rest. This comprises their comprehension of use cases for default encryption, customer-supplied encryption keys (CSEK), and customer-managed encryption keys (CMEK). The candidates should also be capable of creating & managing encryption keys for CSEK and CMEK as well as managing application secrets. They should have an understanding of enclave computing, envelope encryption, and object lifecycle policies for Cloud Storage. Moreover, this area requires your competency in preventing data loss using DLP API. This involves the ability to configure tokenization, restrict access to DLP datasets, determine and redact PII, as well as configure the format-preserving substitution.
NEW QUESTION 44
You need to connect your organization's on-premises network with an existing Google Cloud environment that includes one Shared VPC with two subnets named Production and Non-Production. You are required to:
Use a private transport link.
Configure access to Google Cloud APIs through private API endpoints originating from on-premises environments.
Ensure that Google Cloud APIs are only consumed via VPC Service Controls.
What should you do?
- A. 1. Set up a Partner Interconnect link between the on-premises environment and Google Cloud.
2. Configure private access using the private.googleapis.com domains in on-premises DNS configurations. - B. 1. Set up a Direct Peering link between the on-premises environment and Google Cloud.
2. Configure private access for both VPC subnets. - C. 1. Set up a Cloud VPN link between the on-premises environment and Google Cloud.
2. Configure private access using the restricted googleapis.com domains in on-premises DNS configurations. - D. 1. Set up a Dedicated Interconnect link between the on-premises environment and Google Cloud.
2. Configure private access using the restricted.googleapis.com domains in on-premises DNS configurations.
Answer: B
NEW QUESTION 45
Which type of load balancer should you use to maintain client IP by default while using the standard network tier?
- A. TCP/UDP Network
- B. TCP Proxy
- C. Internal TCP/UDP
- D. SSL Proxy
Answer: C
NEW QUESTION 46
You are part of a security team investigating a compromised service account key. You need to audit which new resources were created by the service account.
What should you do?
- A. Query Data Access logs.
- B. Query Admin Activity logs.
- C. Query Stackdriver Monitoring Workspace.
- D. Query Access Transparency logs.
Answer: A
Explanation:
https://cloud.google.com/iam/docs/audit-logging/examples-service-accounts
NEW QUESTION 47
An organization recently began using App Engine to build and host its new web application for its customers. The organization wants to use its existing IAM setup to allow its developer employees to have elevated access to the application remotely. This would allow them to push updates and fixes to the application via an HTTPS connection. Non-developer employees should only get access to the production version without development permissions. Which Google Cloud Platform solution should be used to meet these requirements?
- A. Set up Cloud Identity-Aware Proxy (Cloud IAP) to manage authentication and different authorization levels for employee access.
- B. Disable access for non-developer employees by removing their Google Group from the application access control list (ACL).
- C. Set up Virtual Private Cloud (VPC) firewall rules to manage authentication and different authorization levels for employee access.
- D. Synchronize the organization's Active Directory using Cloud Identity for employee access via Cloud VPN.
Answer: A
Explanation:
A is not correct because synchronizing your users to Google Identity does not grant any differentiated access to an app engine application.
B is not correct because app engine IAM roles only specify different levels of administrative access to app engine applications in a project.
C is correct because Cloud IAP allows the organization to establish different levels of access based on user criteria for app engine apps.
D is not correct because VPC firewall rules do not grant different levels of authorization and only allow/block traffic.
https://cloud.google.com/appengine/docs/standard/python/access-control
https://cloud.google.com/iap/docs/concepts-overview
NEW QUESTION 48
A DevOps team will create a new container to run on Google Kubernetes Engine. As the application will be internet-facing, they want to minimize the attack surface of the container.
What should they do?
- A. Build small containers using small base images.
- B. Use a Continuous Delivery tool to deploy the application.
- C. Use Cloud Build to build the container images.
- D. Delete non-used versions from Container Registry.
Answer: B
NEW QUESTION 49
An organization adopts Google Cloud Platform (GCP) for application hosting services and needs guidance on setting up password requirements for their Cloud Identity account. The organization has a password policy requirement that corporate employee passwords must have a minimum number of characters.
Which Cloud Identity password guidelines can the organization use to inform their new requirements?
- A. Set the minimum length for passwords to be 6 characters.
- B. Set the minimum length for passwords to be 12 characters.
- C. Set the minimum length for passwords to be 8 characters.
- D. Set the minimum length for passwords to be 10 characters.
Answer: C
Explanation:
Default password length is 8 characters. https://support.google.com/cloudidentity/answer/33319?hl=en
NEW QUESTION 50
Your team creates an ingress firewall rule to allow SSH access from their corporate IP range to a specific bastion host on Compute Engine. Your team wants to make sure that this firewall rule cannot be used by unauthorized engineers who may otherwise have access to manage VMs in the development environment. What should your team do to meet this requirement?
- A. Create the firewall rule with a target of a service account. Centrally manage access to the service account.
- B. Create the firewall rule in a Shared VPC with a target of a network tag.
- C. Create the firewall rule with a target of a network tag. Centrally manage access to the tag.
- D. Create the firewall rule in a Shared VPC with a target of a specific subnet.
Answer: A
Explanation:
A is not correct because the network tag value can be inferred by examining the Firewall Rule or VM metadata.
B is correct because access to the Service Account is required to use a firewall rule with a target of a Service Account.
C is not correct because the target network tag value can be inferred by examining the Firewall Rule or VM metadata.
D is not correct because the target subnet value can be inferred by examining the Firewall Rule or VM metadata.
https://cloud.google.com/vpc/docs/firewalls#service-accounts-vs-tags
NEW QUESTION 51
A customer has 300 engineers. The company wants to grant different levels of access and efficiently manage IAM permissions between users in the development and production environment projects.
Which two steps should the company take to meet these requirements? (Choose two.)
- A. Create a folder for each development and production environment.
- B. Create a project with multiple VPC networks for each environment.
- C. Create a Google Group for the Engineering team, and assign permissions at the folder level.
- D. Create an Organizational Policy constraint for each folder environment.
- E. Create projects for each environment, and grant IAM rights to each engineering user.
Answer: A,D
NEW QUESTION 52
You recently joined the networking team supporting your company's Google Cloud implementation. You are tasked with familiarizing yourself with the firewall rules configuration and providing recommendations based on your networking and Google Cloud experience. What product should you recommend to detect firewall rules that are overlapped by attributes from other firewall rules with higher or equal priority?
- A. Firewall Rules Logging
- B. VPC Flow Logs
- C. Security Command Center
- D. Firewall Insights
Answer: D
NEW QUESTION 53
You have been tasked with implementing external web application protection against common web application attacks for a public application on Google Cloud. You want to validate these policy changes before they are enforced. What service should you use?
- A. Prepopulated VPC firewall rules in monitor mode
- B. The inherent protections of Google Front End (GFE)
- C. Google Cloud Armor's preconfigured rules in preview mode
- D. VPC Service Controls in dry run mode
- E. Cloud Load Balancing firewall rules
Answer: C
NEW QUESTION 54
An employer wants to track how bonus compensations have changed over time to identify employee outliers and correct earning disparities. This task must be performed without exposing the sensitive compensation data for any individual and must be reversible to identify the outlier.
Which Cloud Data Loss Prevention API technique should you use to accomplish this?
- A. CryptoHashConfig
- B. CryptoReplaceFfxFpeConfig
- C. Generalization
- D. Redaction
Answer: C
Explanation:
By bucketing or generalizing, we achieve a reversible pseudonymised data that can still yield the required analysis. https://cloud.google.com/dlp/docs/concepts-bucketing
NEW QUESTION 55
Your company has been creating users manually in Cloud Identity to provide access to Google Cloud resources. Due to continued growth of the environment, you want to authorize the Google Cloud Directory Sync (GCDS) instance and integrate it with your on-premises LDAP server to onboard hundreds of users. You are required to:
Replicate user and group lifecycle changes from the on-premises LDAP server in Cloud Identity.
Disable any manually created users in Cloud Identity.
You have already configured the LDAP search attributes to include the users and security groups in scope for Google Cloud. What should you do next to complete this solution?
- A. 1. Configure the option to suspend domain users not found in LDAP.
2. Set up a recurring GCDS task. - B. 1. Configure the LDAP search attributes to exclude manually created Cloud Identity users not found in LDAP.
2. Set up a recurring GCDS task. - C. 1. Configure the option to delete domain users not found in LDAP.
2. Run GCDS after user and group lifecycle changes. - D. 1. Configure the LDAP search attributes to exclude manually created Cloud identity users not found in LDAP.
2. Run GCDS after user and group lifecycle changes.
Answer: D
NEW QUESTION 56
An engineering team is launching a web application that will be public on the internet. The web application is hosted in multiple GCP regions and will be directed to the respective backend based on the URL request.
Your team wants to avoid exposing the application directly on the internet and wants to deny traffic from a specific list of malicious IP addresses Which solution should your team implement to meet these requirements?
- A. SSL Proxy Load Balancing
- B. Network Load Balancing
- C. NAT Gateway
- D. Cloud Armor
Answer: D
Explanation:
https://cloud.google.com/armor/docs/security-policy-concepts
NEW QUESTION 57
You are creating an internal App Engine application that needs to access a user's Google Drive on the user's behalf. Your company does not want to rely on the current user's credentials. It also wants to follow Google-recommended practices.
What should you do?
- A. Create a new Service account, and give all application users the role of Service Account User.
- B. Create a new Service account, and add all application users to a Google Group. Give this group the role of Service Account User.
- C. Use a dedicated G Suite Admin account, and authenticate the application's operations with these G Suite credentials.
- D. Create a new service account, and grant it G Suite domain-wide delegation. Have the application use it to impersonate the user.
Answer: A
NEW QUESTION 58
An organization is moving applications to Google Cloud while maintaining a few mission-critical applications on-premises. The organization must transfer the data at a bandwidth of at least 50 Gbps. What should they use to ensure secure continued connectivity between sites?
- A. Dedicated Interconnect
- B. Cloud VPN
- C. Partner Interconnect
- D. Cloud Router
Answer: A
NEW QUESTION 59
......
Read Online Professional-Cloud-Security-Engineer Test Practice Test Questions Exam Dumps: https://examcollection.actualcollection.com/Professional-Cloud-Security-Engineer-exam-questions.html