Professional-Cloud-Security-Engineer by Google Actual Free Exam Questions And Answers [UPDATED 2025]
Professional-Cloud-Security-Engineer Questions Truly Valid For Your Google Exam!
NEW QUESTION # 87
You will create a new Service Account that should be able to list the Compute Engine instances in the project.
You want to follow Google-recommended practices.
What should you do?
- A. Give the Service Account the role of Compute Viewer, and use the new Service Account for all instances.
- B. Create a custom role with the permission compute.instances.listand grant the Service Account this role.
- C. Give the Service Account the role of Project Viewer, and use the new Service Account for all instances.
- D. Create an Instance Template, and allow the Service Account Read Only access for the Compute Engine Access Scope.
Answer: D
NEW QUESTION # 88
Which two implied firewall rules are defined on a VPC network? (Choose two.)
- A. A rule that allows all inbound port 80 connections
- B. A rule that allows all outbound connections
- C. A rule that blocks all inbound port 25 connections
- D. A rule that denies all inbound connections
- E. A rule that blocks all outbound connections
Answer: B,D
Explanation:
Explanation/Reference: https://cloud.google.com/vpc/docs/firewalls
NEW QUESTION # 89
A large financial institution is moving its Big Data analytics to Google Cloud Platform. They want to have maximum control over the encryption process of data stored at rest in BigQuery.
What technique should the institution use?
- A. Customer-managed encryption keys (CMEK).
- B. Customer-supplied encryption keys (CSEK).
- C. Use a Cloud Hardware Security Module (Cloud HSM).
- D. Use Cloud Storage as a federated Data Source.
Answer: A
Explanation:
Explanation/Reference: https://cloud.google.com/bigquery/docs/encryption-at-rest
NEW QUESTION # 90
You need to implement an encryption at-rest strategy that reduces key management complexity for non-sensitive data and protects sensitive data while providing the flexibility of controlling the key residency and rotation schedule. FIPS 140-2 L1 compliance is required for all data types.
What should you do?
- A. Encrypt non-sensitive data and sensitive data with Cloud Key Management Service
- B. Encrypt non-sensitive data with Google default encryption, and encrypt sensitive data with Cloud External Key Manager.
- C. Encrypt non-sensitive data with Google default encryption, and encrypt sensitive data with Cloud Key Management Service.
- D. Encrypt non-sensitive data and sensitive data with Cloud External Key Manager.
Answer: C
Explanation:
Google uses a common cryptographic library, Tink, which incorporates our FIPS 140-2 Level 1 validated module, BoringCrypto, to implement encryption consistently across almost all Google Cloud products. To provideflexibility of controlling the key residency and rotation schedule, use google provided key for non-sensitive and encrypt sensitive data with Cloud Key Management Service.
NEW QUESTION # 91
Your team uses a service account to authenticate data transfers from a given Compute Engine virtual machine instance of to a specified Cloud Storage bucket. An engineer accidentally deletes the service account, which breaks application functionality. You want to recover the application as quickly as possible without compromising security.
What should you do?
- A. Use the undelete command to recover the deleted service account.
- B. Update the permissions of another existing service account and supply those credentials to the applications.
- C. Temporarily disable authentication on the Cloud Storage bucket.
- D. Create a new service account with the same name as the deleted service account.
Answer: A
Explanation:
Reference:
https://cloud.google.com/iam/docs/creating-managing-service- accounts#undeleting_a_service_account
NEW QUESTION # 92
You are in charge of migrating a legacy application from your company datacenters to GCP before the current maintenance contract expires. You do not know what ports the application is using and no documentation is available for you to check. You want to complete the migration without putting your environment at risk.
What should you do?
- A. Migrate the application into an isolated project using a "Lift & Shift" approach. Enable all internal TCP traffic using VPC Firewall rules. Use VPC Flow logs to determine what traffic should be allowed for the application to work properly.
- B. Refactor the application into a micro-services architecture in a GKE cluster. Disable all traffic from outside the cluster using Firewall Rules. Use VPC Flow logs to determine what traffic should be allowed for the application to work properly.
- C. Refactor the application into a micro-services architecture hosted in Cloud Functions in an isolated project. Disable all traffic from outside your project using Firewall Rules. Use VPC Flow logs to determine what traffic should be allowed for the application to work properly.
- D. Migrate the application into an isolated project using a "Lift & Shift" approach in a custom network.
Disable all traffic within the VPC and look at the Firewall logs to determine what traffic should be allowed for the application to work properly.
Answer: A
Explanation:
You have a deadline you cannot develop a new app so you have to lift and shift.
NEW QUESTION # 93
An application running on a Compute Engine instance needs to read data from a Cloud Storage bucket. Your team does not allow Cloud Storage buckets to be globally readable and wants to ensure the principle of least privilege.
Which option meets the requirement of your team?
- A. Encrypt the data in the Cloud Storage bucket using Cloud KMS, and allow the application to decrypt the data with the KMS key.
- B. Create a Cloud Storage ACL that allows read-only access from the Compute Engine instance's IP address and allows the application to read from the bucket without credentials.
- C. Use a service account with read-only access to the Cloud Storage bucket to retrieve the credentials from the instance metadata.
- D. Use a service account with read-only access to the Cloud Storage bucket, and store the credentials to the service account in the config of the application on the Compute Engine instance.
Answer: C
Explanation:
If the environment variable GOOGLE_APPLICATION_CREDENTIALS is set, ADC uses the service account key or configuration file that the variable points to. If the environment variable GOOGLE_APPLICATION_CREDENTIALS isn't set, ADC uses the service account that is attached to the resource that is running your code. https://cloud.google.com/docs/authentication
/production#passing_the_path_to_the_service_account_key_in_code
NEW QUESTION # 94
An organization is migrating from their current on-premises productivity software systems to G Suite. Some network security controls were in place that were mandated by a regulatory body in their region for their previous on-premises system. The organization's risk team wants to ensure that network security controls are maintained and effective in G Suite. A security architect supporting this migration has been asked to ensure that network security controls are in place as part of the new shared responsibility model between the organization and Google Cloud.
What solution would help meet the requirements?
- A. Set up Cloud Armor to ensure that network security controls can be managed for G Suite.
- B. Network security is a built-in solution and Google's Cloud responsibility for SaaS products like G Suite.
- C. Set up an array of Virtual Private Cloud (VPC) networks to control network security as mandated by the relevant regulation.
- D. Ensure that firewall rules are in place to meet the required controls.
Answer: B
Explanation:
https://gsuite.google.com/learn-more/security/security-whitepaper/page-1.html Shared responsibility "Security of the Cloud" - GCP is responsible for protecting the infrastructure that runs all of the services offered in the GCP Cloud. This infrastructure is composed of the hardware, software, networking, and facilities that run GCP Cloud services.
NEW QUESTION # 95
You will create a new Service Account that should be able to list the Compute Engine instances in the project.
You want to follow Google-recommended practices.
What should you do?
- A. Create a custom role with the permission compute.instances.list and grant the Service Account this role.
- B. Create an Instance Template, and allow the Service Account Read Only access for the Compute Engine Access Scope.
- C. Give the Service Account the role of Compute Viewer, and use the new Service Account for all instances.
- D. Give the Service Account the role of Project Viewer, and use the new Service Account for all instances.
Answer: A
Explanation:
* Objective: Create a Service Account that can list Compute Engine instances in the project following Google-recommended practices.
* Solution: Create a custom role and assign it to the Service Account.
* Steps:
* Step 1: Open the Google Cloud Console.
* Step 2: Navigate to the IAM & Admin page and select "Roles".
* Step 3: Click on "Create Role" and define a new role with a suitable name and description.
* Step 4: Add the permission compute.instances.list to the custom role.
* Step 5: Save the custom role.
* Step 6: Go to the "Service Accounts" section.
* Step 7: Create a new Service Account or select an existing one.
* Step 8: Assign the newly created custom role to the Service Account.
By creating a custom role with the specific permission to list Compute Engine instances, you follow the principle of least privilege, which is a recommended security practice.
References:
* Creating and Managing Custom Roles
* Best Practices for IAM
NEW QUESTION # 96
Your organization develops software involved in many open source projects and is concerned about software supply chain threats You need to deliver provenance for the build to demonstrate the software is untampered.
What should you do?
- A. * 1. Review the software process.
* 2. Generate private and public key pairs and use Pretty Good Privacy (PGP) protocols to sign the output software artifacts together with a file containing the address of your enterprise and point of contact.
* 3. Publish the PGP signed attestation to your public web page. - B. * 1. Hire an external auditor to review and provide provenance
* 2. Define the scope and conditions.
* 3. Get support from the Security department or representative.
* 4. Publish the attestation to your public web page. - C. * 1- Generate Supply Chain Levels for Software Artifacts (SLSA) level 3 assurance by using Cloud Build.
* 2. View the build provenance in the Security insights side panel within the Google Cloud console. - D. * 1, Publish the software code on GitHub as open source.
* 2. Establish a bug bounty program, and encourage the open source community to review, report, and fix the vulnerabilities.
Answer: C
Explanation:
Explanation
https://cloud.google.com/build/docs/securing-builds/view-build-provenance
NEW QUESTION # 97
A large financial institution is moving its Big Data analytics to Google Cloud Platform. They want to have maximum control over the encryption process of data stored at rest in BigQuery.
What technique should the institution use?
- A. Customer-managed encryption keys (CMEK).
- B. Customer-supplied encryption keys (CSEK).
- C. Use a Cloud Hardware Security Module (Cloud HSM).
- D. Use Cloud Storage as a federated Data Source.
Answer: A
Explanation:
If you want to manage the key encryption keys used for your data at rest, instead of having Google manage the keys, use Cloud Key Management Service to manage your keys. This scenario is known as customer-managed encryption keys (CMEK).
https://cloud.google.com/bigquery/docs/encryption-at-rest
NEW QUESTION # 98
Your organization develops software involved in many open source projects and is concerned about software supply chain threats. You need to deliver provenance for the build to demonstrate the software is untampered.
What should you do?
- A. 1. Publish the software code on GitHub as open source.
2. Establish a bug bounty program, and encourage the open source community to review, report, and fix the vulnerabilities. - B. 1. Generate Supply Chain Levels for Software Artifacts (SLSA) level 3 assurance by using Cloud Build.
2. View the build provenance in the Security insights side panel within the Google Cloud console. - C. 1. Hire an external auditor to review and provide provenance.
2. Define the scope and conditions.
3. Get support from the Security department or representative.
4. Publish the attestation to your public web page. - D. 1. Review the software process.
2. Generate private and public key pairs and use Pretty Good Privacy (PGP) protocols to sign the output software artifacts together with a file containing the address of your enterprise and point of contact.
3. Publish the PGP signed attestation to your public web page.
Answer: B
Explanation:
https://cloud.google.com/build/docs/securing-builds/view-build-provenance
NEW QUESTION # 99
Your organization operates in a highly regulated industry and uses multiple Google Cloud services. You need to identify potential risks to regulatory compliance. Which situation introduces the greatest risk?
- A. The audit team needs access to Cloud Audit Logs related to managed services like BigQuery.
- B. Sensitive data is stored in a Cloud Storage bucket with the uniform bucket-level access setting enabled.
- C. Principals have broad IAM roles allowing the creation and management of Compute Engine VMs without a pre-defined hardening process.
- D. The security team mandates the use of customer-managed encryption keys (CMEK) for all data classified as sensitive.
Answer: C
Explanation:
Lack of Control: This situation grants individuals broad permissions to create and manage VMs without ensuring that they adhere to necessary security standards. This lack of control can lead to the creation of vulnerable or non-compliant systems.
Regulatory Implications: Depending on your industry and specific regulations, having unhardened systems can expose your organization to significant risks, such as data breaches, unauthorized access, or non-compliance with security requirements.
NEW QUESTION # 100
You are working with protected health information (PHI) for an electronic health record system. The privacy officer is concerned that sensitive data is stored in the analytics system. You are tasked with anonymizing the sensitive data in a way that is not reversible. Also, the anonymized data should not preserve the character set and length. Which Google Cloud solution should you use?
- A. Cloud Data Loss Prevention with deterministic encryption using AES-SIV
- B. Cloud Data Loss Prevention with Cloud Key Management Service wrapped cryptographic keys
- C. Cloud Data Loss Prevention with cryptographic hashing
- D. Cloud Data Loss Prevention with format-preserving encryption
Answer: C
Explanation:
Reference:
https://cloud.google.com/dlp/docs/pseudonymization?hl=JA&skip_cache=true#supported-methods
NEW QUESTION # 101
You are responsible for managing your company's identities in Google Cloud. Your company enforces 2-Step Verification (2SV) for all users. You need to reset a user's access, but the user lost their second factor for
2SV. You want to minimize risk. What should you do?
- A. On the Google Admin console, use a super administrator account to reset the user account's credentials.Ask the user to update their credentials after their first login.
- B. On the Google Admin console, select the appropriate user account, and generate a backup code to allow the user to sign in. Ask the user to update their second factor.
- C. On the Google Admin console, temporarily disable the 2SV requirements for all users. Ask the user to log in and add their new second factor to their account. Re-enable the 2SV requirement for all users.
- D. On the Google Admin console, select the appropriate user account, and temporarily disable 2SV for this account Ask the user to update their second factor, and then re-enable 2SV for this account.
Answer: B
Explanation:
If a user loses their second factor for 2-Step Verification (2SV), you can help them regain access with minimal risk by generating a backup code.
* Generate a Backup Code (A):
* In the Google Admin console, navigate to the user's account settings.
* Generate a backup code for the user. This code allows them to sign in despite not having access to their usual second factor.
* Instruct the user to log in using the backup code and then update their second factor in their account settings.
This method ensures that only the affected user's access is temporarily adjusted, minimizing risk while maintaining overall security policies.
References
* Google Admin console 2-Step Verification documentation
NEW QUESTION # 102
Your organization previously stored files in Cloud Storage by using Google Managed Encryption Keys (GMEK), but has recently updated the internal policy to require Customer Managed Encryption Keys (CMEK). You need to re-encrypt the files quickly and efficiently with minimal cost.
What should you do?
- A. Change the encryption type on the bucket to CMEK, and rewrite the objects.
- B. Encrypt the files locally, and then use gsutil to upload the files to a new bucket.
- C. Copy the files to a new bucket with CMEK enabled in a secondary region.
- D. Reupload the files to the same Cloud Storage bucket specifying a key file by using gsutil.
Answer: A
Explanation:
https://cloud.google.com/storage/docs/encryption/using-customer-managed-keys
NEW QUESTION # 103
A customer has an analytics workload running on Compute Engine that should have limited internet access.
Your team created an egress firewall rule to deny (priority 1000) all traffic to the internet.
The Compute Engine instances now need to reach out to the public repository to get security updates. What should your team do?
- A. Create an egress firewall rule to allow traffic to the CIDR range of the repository with a priority greater than 1000.
- B. Create an egress firewall rule to allow traffic to the hostname of the repository with a priority less than
1000. - C. Create an egress firewall rule to allow traffic to the hostname of the repository with a priority greater than 1000.
- D. Create an egress firewall rule to allow traffic to the CIDR range of the repository with a priority less than 1000.
Answer: D
Explanation:
To allow Compute Engine instances to access public repositories for security updates while an egress firewall rule is in place to deny all internet traffic, you need to create a more specific egress rule that permits traffic to the CIDR range of the repository. The priority of this rule should be lower (i.e., a higher priority number) than the deny rule.
Steps:
* Identify the CIDR Range: Determine the CIDR range of the public repository from which the security updates will be fetched.
* Create Egress Firewall Rule: Create a new egress firewall rule allowing traffic to the identified CIDR range with a priority less than 1000.
* Apply Firewall Rule: Use the Google Cloud Console or gcloud command-line tool to apply the new firewall rule.
References:
* Google Cloud: Firewall rules
* Creating firewall rules
NEW QUESTION # 104
Your organization uses the top-tier folder to separate application environments (prod and dev). The developers need to see all application development audit logs but they are not permitted to review production logs. Your security team can review all logs in production and development environments. You must grant Identity and Access Management (1AM) roles at the right resource level tor the developers and security team while you ensure least privilege.
What should you do?
- A. * 1 Grant logging.admin role to the security team at the organization resource level.
* 2 Grant logging. viewer rote to the developer team at the folder resource level that contains all the dev projects. - B. * 1 Grant logging. viewer rote to the security team at the organization resource level.
* 2 Grant logging. admin role to the developer team at the organization resource level. - C. * 1 Grant logging, viewer rote to the security team at the organization resource level.
* 2 Grant logging, viewer rote to the developer team at the folder resource level that contains all the dev projects. - D. * 1 Grant logging.admin role to the security team at the organization resource level.
* 2 Grant logging.admin role to the developer team at the organization resource level.
Answer: C
NEW QUESTION # 105
......
Get instant access of 100% real exam questions with verified answers: https://www.itexamsimulator.com/Professional-Cloud-Security-Engineer-brain-dumps.html
Professional-Cloud-Security-Engineer Actual Questions - Instant Download Tests Free Updated Today!: https://drive.google.com/open?id=1wDPFMXd66F4aSosIo1Ck1Sln9G2_HPW_
