[2023] Pass Key features of Professional-Cloud-Security-Engineer Course with Updated 178 Questions [Q53-Q68]

Rate this post

[2023] Pass Key features of Professional-Cloud-Security-Engineer Course with Updated 178 Questions

Professional-Cloud-Security-Engineer Sample Practice Exam Questions 2023 Updated Verified

Preparation Options

Preparing for the certification exam, you do not have to make a long search for the right study materials as everything you need is located on the official website. The most effective way to study for the Google Professional Cloud Security Engineer test is to follow the learning path available on the vendor’s platform. The Security Engineer learning path consists of a number of courses and hands-on labs covering each aspect of the exam. You will learn the best practices in Cloud security and how the Google Cloud security model can help you protect your technology stack.

The official platform also provides the learners with a variety of additional resources such as Google Cloud documentation and Google Cloud solutions. At the end of your preparation, use the sample questions to evaluate your readiness for the upcoming exam.

Available Skill Badges

The Google skill badges are a form of training that allows candidates to demonstrate their understanding of Google concepts at this level. For the Google Professional Cloud Security Engineer exam, the most popular badges include the following:

Create and Manage Cloud Resources
Secure Workloads in Google Kubernetes Engine
Ensure Access and Identity in Google Cloud
Build and Secure Networks in Google Cloud

NO.53 A company has been running their application on Compute Engine. A bug in the application allowed a malicious user to repeatedly execute a script that results in the Compute Engine instance crashing. Although the bug has been fixed, you want to get notified in case this hack re-occurs.
What should you do?

Create an Alerting Policy in Stackdriver using a Process Health condition, checking that the number of executions of the script remains below the desired threshold. Enable notifications.

Create an Alerting Policy in Stackdriver using the CPU usage metric. Set the threshold to 80% to be notified when the CPU usage goes above this 80%.

Log every execution of the script to Stackdriver Logging. Create a User-defined metric in Stackdriver Logging on the logs, and create a Stackdriver Dashboard displaying the metric.

Log every execution of the script to Stackdriver Logging. Configure BigQuery as a log sink, and create a BigQuery scheduled query to count the number of executions in a specific timeframe.

NO.54 You are the security admin of your company. You have 3,000 objects in your Cloud Storage bucket. You do not want to manage access to each object individually. You also do not want the uploader of an object to always have full control of the object. However, you want to use Cloud Audit Logs to manage access to your bucket.
What should you do?

Set up an ACL with OWNER permission to a scope of allUsers.

Set up an ACL with READER permission to a scope of allUsers.

Set up a default bucket ACL and manage access for users using IAM.

Set up Uniform bucket-level access on the Cloud Storage bucket and manage access for users using IAM.

NO.55 In order to meet PCI DSS requirements, a customer wants to ensure that all outbound traffic is authorized.
Which two cloud offerings meet this requirement without additional compensating controls? (Choose two.)

App Engine

Cloud Functions

Compute Engine

Google Kubernetes Engine

Cloud Storage

NO.56 Your team wants to centrally manage GCP IAM permissions from their on-premises Active Directory Service. Your team wants to manage permissions by AD group membership.
What should your team do to meet these requirements?

Set up Cloud Directory Sync to sync groups, and set IAM permissions on the groups.

Set up SAML 2.0 Single Sign-On (SSO), and assign IAM permissions to the groups.

Use the Cloud Identity and Access Management API to create groups and IAM permissions from Active Directory.

Use the Admin SDK to create groups and assign IAM permissions from Active Directory.

NO.57 What are the steps to encrypt data using envelope encryption?
* A. Generate a data encryption key (DEK) locally.
* Use a key encryption key (KEK) to wrap the DEK.
* Encrypt data with the KEK.
* Store the encrypted data and the wrapped KEK.
* B. Generate a key encryption key (KEK) locally.
* Use the KEK to generate a data encryption key (DEK).
* Encrypt data with the DEK.
* Store the encrypted data and the wrapped DEK.
* C. Generate a data encryption key (DEK) locally.
* Encrypt data with the DEK.
* Use a key encryption key (KEK) to wrap the DEK.
* Store the encrypted data and the wrapped DEK.
* D. Generate a key encryption key (KEK) locally.
* Generate a data encryption key (DEK) locally.
* Encrypt data with the KEK

NO.58 You want to use the gcloud command-line tool to authenticate using a third-party single sign-on (SSO) SAML identity provider. Which options are necessary to ensure that authentication is supported by the third-party identity provider (IdP)? (Choose two.)

SSO SAML as a third-party IdP

Identity Platform

OpenID Connect

Identity-Aware Proxy

Cloud Identity

NO.59 A company allows every employee to use Google Cloud Platform. Each department has a Google Group, with all department members as group members. If a department member creates a new project, all members of that department should automatically have read-only access to all new project resources. Members of any other department should not have access to the project. You need to configure this behavior.
What should you do to meet these requirements?

Create a Folder per department under the Organization. For each department’s Folder, assign the Project Viewer role to the Google Group related to that department.

Create a Folder per department under the Organization. For each department’s Folder, assign the Project Browser role to the Google Group related to that department.

Create a Project per department under the Organization. For each department’s Project, assign the Project Viewer role to the Google Group related to that department.

Create a Project per department under the Organization. For each department’s Project, assign the Project Browser role to the Google Group related to that department.

NO.60 Your privacy team uses crypto-shredding (deleting encryption keys) as a strategy to delete personally identifiable information (PII). You need to implement this practice on Google Cloud while still utilizing the majority of the platform’s services and minimizing operational overhead. What should you do?

Use client-side encryption before sending data to Google Cloud, and delete encryption keys on-premises

Use Cloud External Key Manager to delete specific encryption keys.

Use customer-managed encryption keys to delete specific encryption keys.

Use Google default encryption to delete specific encryption keys.

NO.61 A customer is running an analytics workload on Google Cloud Platform (GCP) where Compute Engine instances are accessing data stored on Cloud Storage. Your team wants to make sure that this workload will not be able to access, or be accessed from, the internet.
Which two strategies should your team use to meet these requirements? (Choose two.)

Configure Private Google Access on the Compute Engine subnet

Avoid assigning public IP addresses to the Compute Engine cluster.

Make sure that the Compute Engine cluster is running on a separate subnet.

Turn off IP forwarding on the Compute Engine instances in the cluster.

Configure a Cloud NAT gateway.

NO.62 You want to evaluate GCP for PCI compliance. You need to identify Google’s inherent controls.
Which document should you review to find the information?

Google Cloud Platform: Customer Responsibility Matrix

PCI DSS Requirements and Security Assessment Procedures

PCI SSC Cloud Computing Guidelines

Product documentation for Compute Engine

NO.63 You are on your company’s development team. You noticed that your web application hosted in staging on GKE dynamically includes user data in web pages without first properly validating the inputted dat a. This could allow an attacker to execute gibberish commands and display arbitrary content in a victim user’s browser in a production environment.
How should you prevent and fix this vulnerability?

Use Cloud IAP based on IP address or end-user device attributes to prevent and fix the vulnerability.

Set up an HTTPS load balancer, and then use Cloud Armor for the production environment to prevent the potential XSS attack.

Use Web Security Scanner to validate the usage of an outdated library in the code, and then use a secured version of the included library.

Use Web Security Scanner in staging to simulate an XSS injection attack, and then use a templating system that supports contextual auto-escaping.

NO.64 A company has redundant mail servers in different Google Cloud Platform regions and wants to route customers to the nearest mail server based on location.
How should the company accomplish this?

Configure TCP Proxy Load Balancing as a global load balancing service listening on port 995.

Create a Network Load Balancer to listen on TCP port 995 with a forwarding rule to forward traffic based on location.

Use Cross-Region Load Balancing with an HTTP(S) load balancer to route traffic to the nearest region.

Use Cloud CDN to route the mail traffic to the closest origin mail server based on client IP address.

NO.65 You are exporting application logs to Cloud Storage. You encounter an error message that the log sinks don’t support uniform bucket-level access policies. How should you resolve this error?

Change the access control model for the bucket

Update your sink with the correct bucket destination.

Add the roles/logging.logWriter Identity and Access Management (IAM) role to the bucket for the log sink identity.

Add the roles/logging.bucketWriter Identity and Access Management (IAM) role to the bucket for the log sink identity.

NO.66 Your organization acquired a new workload. The Web and Application (App) servers will be running on Compute Engine in a newly created custom VPC. You are responsible for configuring a secure network communication solution that meets the following requirements:
Only allows communication between the Web and App tiers.
Enforces consistent network security when autoscaling the Web and App tiers.
Prevents Compute Engine Instance Admins from altering network traffic.
What should you do?

1. Configure all running Web and App servers with respective network tags.
2. Create an allow VPC firewall rule that specifies the target/source with respective network tags.

1. Configure all running Web and App servers with respective service accounts.
2. Create an allow VPC firewall rule that specifies the target/source with respective service accounts.

1. Re-deploy the Web and App servers with instance templates configured with respective network tags.
2. Create an allow VPC firewall rule that specifies the target/source with respective network tags.

1. Re-deploy the Web and App servers with instance templates configured with respective service accounts.
2. Create an allow VPC firewall rule that specifies the target/source with respective service accounts.

NO.67 Your team needs to configure their Google Cloud Platform (GCP) environment so they can centralize the control over networking resources like firewall rules, subnets, and routes. They also have an on-premises environment where resources need access back to the GCP resources through a private VPN connection. The networking resources will need to be controlled by the network security team.
Which type of networking design should your team use to meet these requirements?

Shared VPC Network with a host project and service projects

Grant Compute Admin role to the networking team for each engineering project

VPC peering between all engineering projects using a hub and spoke model

Cloud VPN Gateway between all engineering projects using a hub and spoke model

NO.68 You are on your company’s development team. You noticed that your web application hosted in staging on GKE dynamically includes user data in web pages without first properly validating the inputted data. This could allow an attacker to execute gibberish commands and display arbitrary content in a victim user’s browser in a production environment.
How should you prevent and fix this vulnerability?

Use Cloud IAP based on IP address or end-user device attributes to prevent and fix the vulnerability.

Set up an HTTPS load balancer, and then use Cloud Armor for the production environment to prevent the potential XSS attack.

Use Web Security Scanner to validate the usage of an outdated library in the code, and then use a secured version of the included library.

Use Web Security Scanner in staging to simulate an XSS injection attack, and then use a templating system that supports contextual auto-escaping.

The New Professional-Cloud-Security-Engineer 2023 Updated Verified Study Guides & Best Courses: https://www.trainingquiz.com/Professional-Cloud-Security-Engineer-practice-quiz.html

Quiz Training Materials

[2023] Pass Key features of Professional-Cloud-Security-Engineer Course with Updated 178 Questions [Q53-Q68]

Preparation Options

Available Skill Badges

Real Professional-Data-Engineer are Uploaded by TrainingQuiz provide 2026 Latest Professional-Data-Engineer Practice Tests Dumps [Q86-Q106]

Leave a Reply Cancel reply

Quiz Training Materials

[2023] Pass Key features of Professional-Cloud-Security-Engineer Course with Updated 178 Questions [Q53-Q68]

Preparation Options

Available Skill Badges

You May Also Like...

Pass Guaranteed Quiz 2022 Realistic Verified Free Cloud-Digital-Leader Exam Dumps [Q22-Q46]

Real Professional-Data-Engineer are Uploaded by TrainingQuiz provide 2026 Latest Professional-Data-Engineer Practice Tests Dumps [Q86-Q106]

Leave a Reply Cancel reply