Free 365 Days Exam Updates Professional-Cloud-Security-Engineer dumps with test Engine Practice
Updated Verified Professional-Cloud-Security-Engineer dumps Q&As - 100% Pass Guaranteed
NEW QUESTION # 129
You are a member of the security team at an organization. Your team has a single GCP project with credit card payment processing systems alongside web applications and data processing systems. You want to reduce the scope of systems subject to PCI audit standards.
What should you do?
- A. Move the cardholder data environment into a separate GCP project.
- B. Use only applications certified compliant with PA-DSS.
- C. Use VPN for all connections between your office and cloud environments.
- D. Use multi-factor authentication for admin access to the web application.
Answer: C
Explanation:
Reference:
https://cloud.google.com/solutions/pci-dss-compliance-in-gcp
NEW QUESTION # 130
Your Google Cloud environment has one organization node, one folder named Apps." and several projects within that folder The organizational node enforces the constraints/iam.allowedPolicyMemberDomains organization policy, which allows members from the terramearth.com organization The "Apps" folder enforces the constraints/iam.allowedPolicyMemberDomains organization policy, which allows members from the flowlogistic.com organization. It also has the inheritFromParent: false property.
You attempt to grant access to a project in the Apps folder to the user [email protected].
What is the result of your action and why?
- A. The action succeeds because members from both organizations, terramearth. com or flowlogistic.com, are allowed on projects in the "Apps" folder
- B. The action succeeds and the new member is successfully added to the project's Identity and Access Management (1AM) policy because all policies are inherited by underlying folders and projects.
- C. The action fails because a constraints/iam.allowedPolicyMemberDomains organization policy must be defined on the current project to deactivate the constraint temporarily.
- D. The action fails because a constraints/iam.allowedPolicyMemberDomains organization policy is in place and only members from the flowlogistic.com organization are allowed.
Answer: D
Explanation:
The action fails because a constraints/iam.allowedPolicyMemberDomains organization policy is in place and only members from the flowlogistic.com organization are allowed. The inheritFromParent: false property on the "Apps" folder means that it does not inherit the organization policy from the organization node. Therefore, only the policy set at the folder level applies, which allows only members from the flowlogistic.com organization. As a result, the attempt to grant access to the user [email protected] fails because this user is not a member of the flowlogistic.com organization.
NEW QUESTION # 131
A retail customer allows users to upload comments and product reviews. The customer needs to make sure the text does not include sensitive data before the comments or reviews are published.
Which Google Cloud Service should be used to achieve this?
- A. BigQuery
- B. Cloud Security Scanner
- C. Cloud Data Loss Prevention API
- D. Cloud Key Management Service
Answer: C
NEW QUESTION # 132
A customer deploys an application to App Engine and needs to check for Open Web Application Security Project (OWASP) vulnerabilities.
Which service should be used to accomplish this?
- A. Cloud Armor
- B. Cloud Security Scanner
- C. Forseti Security
- D. Google Cloud Audit Logs
Answer: B
NEW QUESTION # 133
Your team needs to make sure that a Compute Engine instance does not have access to the internet or to any Google APIs or services.
Which two settings must remain disabled to meet these requirements? (Choose two.)
- A. Static routes
- B. Private Google Access
- C. Public IP
- D. IP Forwarding
- E. IAM Network User Role
Answer: A,B
Explanation:
https://cloud.google.com/vpc/docs/configure-private-google-access
NEW QUESTION # 134
A company is deploying their application on Google Cloud Platform. Company policy requires long-term data to be stored using a solution that can automatically replicate data over at least two geographic places.
Which Storage solution are they allowed to use?
- A. Compute Engine Persistent Disk
- B. Compute Engine SSD Disk
- C. Cloud BigQuery
- D. Cloud Bigtable
Answer: C
Explanation:
https://cloud.google.com/bigquery/docs/locations
NEW QUESTION # 135
You are in charge of migrating a legacy application from your company datacenters to GCP before the current maintenance contract expires. You do not know what ports the application is using and no documentation is available for you to check. You want to complete the migration without putting your environment at risk.
What should you do?
- A. Migrate the application into an isolated project using a "Lift & Shift" approach in a custom network.
Disable all traffic within the VPC and look at the Firewall logs to determine what traffic should be allowed for the application to work properly. - B. Refactor the application into a micro-services architecture in a GKE cluster. Disable all traffic from outside the cluster using Firewall Rules. Use VPC Flow logs to determine what traffic should be allowed for the application to work properly.
- C. Refactor the application into a micro-services architecture hosted in Cloud Functions in an isolated project. Disable all traffic from outside your project using Firewall Rules. Use VPC Flow logs to determine what traffic should be allowed for the application to work properly.
- D. Migrate the application into an isolated project using a "Lift & Shift" approach. Enable all internal TCP traffic using VPC Firewall rules. Use VPC Flow logs to determine what traffic should be allowed for the application to work properly.
Answer: D
Explanation:
Explanation
Migrate the application into an isolated project using a "Lift & Shift" approach. Enable all internal TCP traffic using VPC Firewall rules. Use VPC Flow logs to determine what traffic should be allowed for the application to work properly.
NEW QUESTION # 136
You need to implement an encryption at-rest strategy that reduces key management complexity for non-sensitive data and protects sensitive data while providing the flexibility of controlling the key residency and rotation schedule. FIPS 140-2 L1 compliance is required for all data types. What should you do?
- A. Encrypt non-sensitive data with Google default encryption, and encrypt sensitive data with Cloud Key Management Service.
- B. Encrypt non-sensitive data and sensitive data with Cloud External Key Manager.
- C. Encrypt non-sensitive data with Google default encryption, and encrypt sensitive data with Cloud External Key Manager.
- D. Encrypt non-sensitive data and sensitive data with Cloud Key Management Service
Answer: A
Explanation:
Explanation
Google uses a common cryptographic library, Tink, which incorporates our FIPS 140-2 Level 1 validated module, BoringCrypto, to implement encryption consistently across almost all Google Cloud products. To provideflexibility of controlling the key residency and rotation schedule, use google provided key for non-sensitive and encrypt sensitive data with Cloud Key Management Service
NEW QUESTION # 137
You will create a new Service Account that should be able to list the Compute Engine instances in the project.
You want to follow Google-recommended practices.
What should you do?
- A. Give the Service Account the role of Compute Viewer, and use the new Service Account for all instances.
- B. Create a custom role with the permission compute.instances.list and grant the Service Account this role.
- C. Give the Service Account the role of Project Viewer, and use the new Service Account for all instances.
- D. Create an Instance Template, and allow the Service Account Read Only access for the Compute Engine Access Scope.
Answer: B
Explanation:
Explanation
https://cloud.google.com/compute/docs/access/iam
NEW QUESTION # 138
Your company uses Google Cloud and has publicly exposed network assets. You want to discover the assets and perform a security audit on these assets by using a software tool in the least amount of time.
What should you do?
- A. Contact a Google approved security vendor to perform the audit.
- B. Run a platform security scanner on all instances in the organization.
- C. Notify Google about the pending audit and wait for confirmation before performing the scan.
- D. Identify all external assets by using Cloud Asset Inventory and then run a network security scanner against them.
Answer: D
NEW QUESTION # 139
Your team wants to centrally manage GCP IAM permissions from their on-premises Active Directory Service. Your team wants to manage permissions by AD group membership.
What should your team do to meet these requirements?
- A. Set up SAML 2.0 Single Sign-On (SSO), and assign IAM permissions to the groups.
- B. Set up Cloud Directory Sync to sync groups, and set IAM permissions on the groups.
- C. Use the Cloud Identity and Access Management API to create groups and IAM permissions from Active Directory.
- D. Use the Admin SDK to create groups and assign IAM permissions from Active Directory.
Answer: B
Explanation:
"In order to be able to keep using the existing identity management system, identities need to be synchronized between AD and GCP IAM. To do so google provides a tool called Cloud Directory Sync. This tool will read all identities in AD and replicate those within GCP. Once the identities have been replicated then it's possible to apply IAM permissions on the groups. After that you will configure SAML so google can act as a service provider and either you ADFS or other third party tools like Ping or Okta will act as the identity provider. This way you effectively delegate the authentication from Google to something that is under your control."
NEW QUESTION # 140
You are implementing data protection by design and in accordance with GDPR requirements. As part of design reviews, you are told that you need to manage the encryption key for a solution that includes workloads for Compute Engine, Google Kubernetes Engine, Cloud Storage, BigQuery, and Pub/Sub. Which option should you choose for this implementation?
- A. Cloud External Key Manager
- B. Customer-managed encryption keys
- C. Customer-supplied encryption keys
- D. Google default encryption
Answer: B
NEW QUESTION # 141
Your organization's Google Cloud VMs are deployed via an instance template that configures them with a public IP address in order to host web services for external users. The VMs reside in a service project that is attached to a host (VPC) project containing one custom Shared VPC for the VMs. You have been asked to reduce the exposure of the VMs to the internet while continuing to service external users. You have already recreated the instance template without a public IP address configuration to launch the managed instance group (MIG). What should you do?
- A. Deploy a Cloud NAT Gateway in the host (VPC) project for the MIG.
- B. Deploy an external HTTP(S) load balancer in the host (VPC) project with the MIG as a backend.
- C. Deploy an external HTTP(S) load balancer in the service project with the MIG as a backend.
- D. Deploy a Cloud NAT Gateway in the service project for the MIG.
Answer: B
Explanation:
https://cloud.google.com/load-balancing/docs/https#shared-vpc
While you can create all the load balancing components and backends in the Shared VPC host project, this model does not separate network administration and service development responsibilities.
NEW QUESTION # 142
Your company's cloud security policy dictates that VM instances should not have an external IP address. You need to identify the Google Cloud service that will allow VM instances without external IP addresses to connect to the internet to update the VMs. Which service should you use?
- A. Cloud NAT
- B. Identity Aware-Proxy
- C. Cloud DNS
- D. TCP/UDP Load Balancing
Answer: A
NEW QUESTION # 143
You are a Security Administrator at your organization. You need to restrict service account creation capability within production environments. You want to accomplish this centrally across the organization. What should you do?
- A. Use organization policy constraints/iam.disableServiceAccountKeyCreation boolean to disable the creation of new service accounts.
- B. Use organization policy constraints/iam.disableServiceAccountCreation boolean to disable the creation of new service accounts.
- C. Use organization policy constraints/iam.disableServiceAccountKeyUpload boolean to disable the creation of new service accounts.
- D. Use Identity and Access Management (IAM) to restrict access of all users and service accounts that have access to the production environment.
Answer: B
Explanation:
Reference:
You can use the iam.disableServiceAccountCreation boolean constraint to disable the creation of new service accounts. This allows you to centralize management of service accounts while not restricting the other permissions your developers have on projects. https://cloud.google.com/resource-manager/docs/organization-policy/restricting-service-accounts#disable_service_account_creation
NEW QUESTION # 144
Your company's chief information security officer (CISO) is requiring business data to be stored in specific locations due to regulatory requirements that affect the company's global expansion plans. After working on a plan to implement this requirement, you determine the following:
* The services in scope are included in the Google Cloud data residency requirements.
* The business data remains within specific locations under the same organization.
* The folder structure can contain multiple data residency locations.
* The projects are aligned to specific locations.
You plan to use the Resource Location Restriction organization policy constraint with very granular control.
At which level in the hierarchy should you set the constraint?
- A. Resource
- B. Organization
- C. Project
- D. Folder
Answer: C
NEW QUESTION # 145
A DevOps team will create a new container to run on Google Kubernetes Engine. As the application will be internet-facing, they want to minimize the attack surface of the container.
What should they do?
- A. Use a Continuous Delivery tool to deploy the application.
- B. Use Cloud Build to build the container images.
- C. Delete non-used versions from Container Registry.
- D. Build small containers using small base images.
Answer: A
Explanation:
Section: (none)
Explanation
NEW QUESTION # 146
......
Provide Valid Dumps To Help You Prepare For Google Cloud Certified - Professional Cloud Security Engineer Exam Exam: https://www.actual4cert.com/Professional-Cloud-Security-Engineer-real-questions.html
Professional-Cloud-Security-Engineer Dumps Questions [2024] Pass for Exam: https://drive.google.com/open?id=1n0gfT5nQW5YEGvvOcrFkJUWm3kj1t__g