[May-2023] Professional-Cloud-Security-Engineer Dumps PDF - Professional-Cloud-Security-Engineer Real Exam Questions Answers
Professional-Cloud-Security-Engineer Dumps 100% Pass Guarantee With Latest Demo
Skills Measured
This certification exam measures the ability of the professionals to perform a range of technical tasks. Therefore, you need to know the details of the subject areas covered in the test to be able to master the overall content. All in all, the exam contains the following objectives:
Configure Access in a Cloud Solution Environment
- Service Accounts Management: The questions from this domain cover service keys and accounts auditing and automation of rotations of the user-managed service account service and keys. It also measures the understanding of securely managed API access management as well as creation, securing, and authorization of service accounts;
- Authentication Management: This subtopic validates the individuals’ skills in establishing Security Assertion Mark-up Language, creating password policies for user accounts, as well as configuring and enforcing two-factor authentication;
- User Accounts Management: This part evaluates the test takers' ability to design identity roles at organizational and project levels, automate the lifecycle management process of a user, and API usage;
- Resource Hierarchy Definition: This topic estimates the applicants’ skills in the creation and management of the organization. It measures their understanding of resource structures, security & trust boundaries in Google Cloud projects, as well as usage of resource hierarchy for permission inheritance and access control. Additionally, they have to be able to define and manage organization constraints.
NEW QUESTION 34
You want to evaluate GCP for PCI compliance. You need to identify Google's inherent controls.
Which document should you review to find the information?
- A. Product documentation for Compute Engine
- B. PCI DSS Requirements and Security Assessment Procedures
- C. PCI SSC Cloud Computing Guidelines
- D. Google Cloud Platform: Customer Responsibility Matrix
Answer: C
NEW QUESTION 35
Your company operates an application instance group that is currently deployed behind a Google Cloud load balancer in us-central-1 and is configured to use the Standard Tier network. The infrastructure team wants to expand to a second Google Cloud region, us-east-2. You need to set up a single external IP address to distribute new requests to the instance groups in both regions.
What should you do?
- A. Change the load balancer frontend configuration to use the Premium Tier network, and add the new instance group.
- B. Create a Cloud VPN connection between the two regions, and enable Google Private Access.
- C. Change the load balancer backend configuration to use network endpoint groups instead of instance groups.
- D. Create a new load balancer in us-east-2 using the Standard Tier network, and assign a static external IP address.
Answer: A
Explanation:
Explanation
https://cloud.google.com/load-balancing/docs/choosing-load-balancer#global-regional
NEW QUESTION 36
An application log's data, including customer identifiers such as email addresses, needs to be redacted. However, these logs also include the email addresses of internal developers from company.com, and these should NOT be redacted. Which solution should you use to meet these requirements?
- A. Create a regular custom dictionary detector to match all email addresses listed in Cloud Identity.
- B. Create a regular custom dictionary detector that lists a subset of the developers' email addresses.
- C. Create a regular expression (regex) custom infoType detector to match on @company.com.
- D. Create a custom infoType called COMPANY_EMAIL to match @company.com.
Answer: C
Explanation:
A is not correct because as all company.com email addresses are sensitive and should be filtered, a static list is hard to maintain and can easily miss sensitive data.
B is correct because the regex will detect all company.com email addresses that need to be protected and written to the log file.
C is not correct because as the user base in Cloud Identity might only be a subset of all emails that need to be protected.
D is not correct because you need to specify a detector within the custom infoType and the detector should be a regular expression to match all @company.com email addresses.
https://cloud.google.com/dlp/docs/infotypes-reference
https://cloud.google.com/dlp/docs/creating-custom-infotypes
NEW QUESTION 37
You are on your company's development team. You noticed that your web application hosted in staging on GKE dynamically includes user data in web pages without first properly validating the inputted dat a. This could allow an attacker to execute gibberish commands and display arbitrary content in a victim user's browser in a production environment.
How should you prevent and fix this vulnerability?
- A. Use Web Security Scanner in staging to simulate an XSS injection attack, and then use a templating system that supports contextual auto-escaping.
- B. Use Web Security Scanner to validate the usage of an outdated library in the code, and then use a secured version of the included library.
- C. Set up an HTTPS load balancer, and then use Cloud Armor for the production environment to prevent the potential XSS attack.
- D. Use Cloud IAP based on IP address or end-user device attributes to prevent and fix the vulnerability.
Answer: A
Explanation:
Reference:
https://cloud.google.com/security-scanner/docs/remediate-findings
NEW QUESTION 38
Applications often require access to "secrets" - small pieces of sensitive data at build or run time. The administrator managing these secrets on GCP wants to keep a track of "who did what, where, and when?" within their GCP projects.
Which two log streams would provide the information that the administrator is looking for? (Choose two.)
- A. VPC Flow logs
- B. Data Access logs
- C. Agent logs
- D. System Event logs
- E. Admin Activity logs
Answer: B,E
Explanation:
Explanation/Reference: https://cloud.google.com/kms/docs/secret-management
NEW QUESTION 39
You are in charge of migrating a legacy application from your company datacenters to GCP before the current maintenance contract expires. You do not know what ports the application is using and no documentation is available for you to check. You want to complete the migration without putting your environment at risk.
What should you do?
- A. Migrate the application into an isolated project using a "Lift & Shift" approach in a custom network. Disable all traffic within the VPC and look at the Firewall logs to determine what traffic should be allowed for the application to work properly.
- B. Refactor the application into a micro-services architecture in a GKE cluster. Disable all traffic from outside the cluster using Firewall Rules. Use VPC Flow logs to determine what traffic should be allowed for the application to work properly.
- C. Refactor the application into a micro-services architecture hosted in Cloud Functions in an isolated project.
Disable all traffic from outside your project using Firewall Rules. Use VPC Flow logs to determine what traffic should be allowed for the application to work properly. - D. Migrate the application into an isolated project using a "Lift & Shift" approach. Enable all internal TCP traffic using VPC Firewall rules. Use VPC Flow logs to determine what traffic should be allowed for the application to work properly.
Answer: B
NEW QUESTION 40
Your company is storing sensitive data in Cloud Storage. You want a key generated on-premises to be used in the encryption process.
What should you do?
- A. Use the Cloud Key Management Service to manage a data encryption key (DEK).
- B. Use the Cloud Key Management Service to manage a key encryption key (KEK).
- C. Use customer-supplied encryption keys to manage the data encryption key (DEK).
- D. Use customer-supplied encryption keys to manage the key encryption key (KEK).
Answer: A
Explanation:
https://cloud.google.com/security/encryption-at-rest/default-encryption/
NEW QUESTION 41
You have an application where the frontend is deployed on a managed instance group in subnet A and the data layer is stored on a mysql Compute Engine virtual machine (VM) in subnet B on the same VPC. Subnet A and Subnet B hold several other Compute Engine VMs. You only want to allow thee application frontend to access the data in the application's mysql instance on port
3306.
What should you do?
- A. Configure a network tag "fe-tag" to be applied to all instances in subnet A and a network tag "data-tag" to be applied to all instances in subnet B. Then configure an ingress firewall rule that allows communication from Compute Engine VMs tagged with fe-tag to destination Compute Engine VMs tagged with data-tag.
- B. Configure an ingress firewall rule that allows communication from the frontend's unique service account to the unique service account of the mysql Compute Engine VM on port 3306.
- C. Configure a network tag "fe-tag" to be applied to all instances in subnet A and a network tag "data-tag" to be applied to all instances in subnet B. Then configure an egress firewall rule that allows communication from Compute Engine VMs tagged with data-tag to destination Compute Engine VMs tagged fe-tag.
- D. Configure an ingress firewall rule that allows communication from the src IP range of subnet A to the tag "data-tag" that is applied to the mysql Compute Engine VM on port 3306.
Answer: B
NEW QUESTION 42
You are in charge of migrating a legacy application from your company datacenters to GCP before the current maintenance contract expires. You do not know what ports the application is using and no documentation is available for you to check. You want to complete the migration without putting your environment at risk.
What should you do?
- A. Refactor the application into a micro-services architecture in a GKE cluster. Disable all traffic from outside the cluster using Firewall Rules. Use VPC Flow logs to determine what traffic should be allowed for the application to work properly.
- B. Migrate the application into an isolated project using a "Lift & Shift" approach in a custom network.
Disable all traffic within the VPC and look at the Firewall logs to determine what traffic should be allowed for the application to work properly. - C. Migrate the application into an isolated project using a "Lift & Shift" approach. Enable all internal TCP traffic using VPC Firewall rules. Use VPC Flow logs to determine what traffic should be allowed for the application to work properly.
- D. Refactor the application into a micro-services architecture hosted in Cloud Functions in an isolated project. Disable all traffic from outside your project using Firewall Rules. Use VPC Flow logs to determine what traffic should be allowed for the application to work properly.
Answer: A
NEW QUESTION 43
You manage your organization's Security Operations Center (SOC). You currently monitor and detect network traffic anomalies in your Google Cloud VPCs based on packet header information. However, you want the capability to explore network flows and their payload to aid investigations. Which Google Cloud product should you use?
- A. VPC Flow Logs
- B. Packet Mirroring
- C. Google Cloud Armor Deep Packet Inspection
- D. VPC Service Controls logs
- E. Marketplace IDS
Answer: B
NEW QUESTION 44
You are the security admin of your company. Your development team creates multiple GCP projects under the
"implementation" folder for several dev, staging, and production workloads. You want to prevent data exfiltration by malicious insiders or compromised code by setting up a security perimeter. However, you do not want to restrict communication between the projects.
What should you do?
- A. Use a Shared VPC to enable communication between all projects, and use firewall rules to prevent data exfiltration.
- B. Use an infrastructure-as-code software tool to set up three different service perimeters for dev, staging, and prod and to deploy a Cloud Function that monitors the "implementation" folder via Stackdriver and Cloud Pub/Sub. When the function notices that a new project is added to the folder, it executes Terraform to add the new project to the respective perimeter.
- C. Create access levels in Access Context Manager to prevent data exfiltration, and use a shared VPC for communication between projects.
- D. Use an infrastructure-as-code software tool to set up a single service perimeter and to deploy a Cloud Function that monitors the "implementation" folder via Stackdriver and Cloud Pub/Sub. When the function notices that a new project is added to the folder, it executes Terraform to add the new project to the associated perimeter.
Answer: D
Explanation:
Explanation
https://cloud.google.com/vpc-service-controls/docs/overview#benefits
https://github.com/terraform-google-modules/terraform-google-vpc-service-controls/tree/master/examples/autom
NEW QUESTION 45
A patch for a vulnerability has been released, and a DevOps team needs to update their running containers in Google Kubernetes Engine (GKE) How should the DevOps team accomplish this?
- A. Verify that auto upgrade is enabled; if so, Google will upgrade the nodes in a GKE cluster.
- B. Use Puppet or Chef to push out the patch to the running container.
- C. Update the application code or apply a patch, build a new image, and redeploy it.
- D. Configure containers to automatically upgrade when the base image is available in Container Registry.
Answer: A
Explanation:
Explanation/Reference: https://cloud.google.com/kubernetes-engine/docs/security-bulletins
NEW QUESTION 46
Your team wants to limit users with administrative privileges at the organization level.
Which two roles should your team restrict? (Choose two.)
- A. Organization Role Viewer
- B. Organization Administrator
- C. GKE Cluster Admin
- D. Compute Admin
- E. Super Admin
Answer: B,E
Explanation:
Reference:
https://cloud.google.com/resource-manager/docs/creating-managing-organization
NEW QUESTION 47
You are a consultant for an organization that is considering migrating their data from its private cloud to Google Cloud. The organization's compliance team is not familiar with Google Cloud and needs guidance on how compliance requirements will be met on Google Cloud. One specific compliance requirement is for customer data at rest to reside within specific geographic boundaries. Which option should you recommend for the organization to meet their data residency requirements on Google Cloud?
- A. Shielded VM instances
- B. Organization Policy Service constraints
- C. Google Cloud Armor
- D. Access control lists
- E. Geolocation access controls
Answer: B
Explanation:
Explanation
https://cloud.google.com/resource-manager/docs/organization-policy/using-constraints#list-constraint
NEW QUESTION 48
Your team sets up a Shared VPC Network where project co-vpc-prod is the host project. Your team has configured the firewall rules, subnets, and VPN gateway on the host project. They need to enable Engineering Group A to attach a Compute Engine instance to only the 10.1.1.0/24 subnet.
What should your team grant to Engineering Group A to meet this requirement?
- A. Compute Network User Role at the subnet level.
- B. Compute Network User Role at the host project level.
- C. Compute Shared VPC Admin Role at the service project level.
- D. Compute Shared VPC Admin Role at the host project level.
Answer: D
Explanation:
https://cloud.google.com/vpc/docs/shared-vpc
NEW QUESTION 49
......
Dumps Real Google Professional-Cloud-Security-Engineer Exam Questions [Updated 2023]: https://passleader.passsureexam.com/Professional-Cloud-Security-Engineer-pass4sure-exam-dumps.html