Valid Professional-Cloud-Security-Engineer Exam Q&A PDF Professional-Cloud-Security-Engineer Dump is Ready (Updated 235 Questions)
Exam Questions and Answers for Professional-Cloud-Security-Engineer Study Guide
NEW QUESTION # 24
A company allows every employee to use Google Cloud Platform. Each department has a Google Group, with all department members as group members. If a department member creates a new project, all members of that department should automatically have read-only access to all new project resources. Members of any other department should not have access to the project. You need to configure this behavior.
What should you do to meet these requirements?
- A. Create a Folder per department under the Organization. For each department's Folder, assign the Project Viewer role to the Google Group related to that department.
- B. Create a Project per department under the Organization. For each department's Project, assign the Project Viewer role to the Google Group related to that department.
- C. Create a Project per department under the Organization. For each department's Project, assign the Project Browser role to the Google Group related to that department.
- D. Create a Folder per department under the Organization. For each department's Folder, assign the Project Browser role to the Google Group related to that department.
Answer: A
NEW QUESTION # 25
A manager wants to start retaining security event logs for 2 years while minimizing costs. You write a filter to select the appropriate log entries.
Where should you export the logs?
- A. Cloud Pub/Sub topics
- B. Cloud Storage buckets
- C. BigQuery datasets
- D. StackDriver logging
Answer: D
Explanation:
Explanation/Reference: https://cloud.google.com/logging/docs/exclusions
NEW QUESTION # 26
You have been tasked with configuring Security Command Center for your organization's Google Cloud environment. Your security team needs to receive alerts of potential crypto mining in the organization's compute environment and alerts for common Google Cloud misconfigurations that impact security. Which Security Command Center features should you use to configure these alerts? (Choose two.)
- A. Event Threat Detection
- B. Security Health Analytics
- C. Container Threat Detection
- D. Google Cloud Armor
- E. Cloud Data Loss Prevention
Answer: A,D
NEW QUESTION # 27
Which two implied firewall rules are defined on a VPC network? (Choose two.)
- A. A rule that allows all inbound port 80 connections
- B. A rule that blocks all outbound connections
- C. A rule that allows all outbound connections
- D. A rule that denies all inbound connections
- E. A rule that blocks all inbound port 25 connections
Answer: C,D
Explanation:
Explanation/Reference: https://cloud.google.com/vpc/docs/firewalls
NEW QUESTION # 28
For compliance reasons, an organization needs to ensure that in-scope PCI Kubernetes Pods reside on "in- scope" Nodes only. These Nodes can only contain the "in-scope" Pods.
How should the organization achieve this objective?
- A. Run all in-scope Pods in the namespace "in-scope-pci".
- B. Place a taint on the Nodes with the label inscope: true and effect NoSchedule and a toleration to match in the Pod configuration.
- C. Add a nodeSelector field to the pod configuration to only use the Nodes labeled inscope: true.
- D. Create a node pool with the label inscope: true and a Pod Security Policy that only allows the Pods to run on Nodes with that label.
Answer: C
Explanation:
Explanation
nodeSelector is the simplest recommended form of node selection constraint. You can add the nodeSelector field to your Pod specification and specify the node labels you wantthe target node to have. Kubernetes only schedules the Pod onto nodes that have each of the labels you specify. =>
https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#nodeselector Tolerations are applied to pods. Tolerations allow the scheduler to schedule pods with matching taints. Tolerations allow scheduling but don't guarantee scheduling: the scheduler also evaluates other parameters as part of its function.
=>https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/
NEW QUESTION # 29
You are asked to recommend a solution to store and retrieve sensitive configuration data from an application that runs on Compute Engine. Which option should you recommend?
- A. Secret Manager
- B. Compute Engine guest attributes
- C. Cloud Key Management Service
- D. Compute Engine custom metadata
Answer: C
NEW QUESTION # 30
Which Google Cloud service should you use to enforce access control policies for applications and resources?
- A. Cloud NAT
- B. Identity-Aware Proxy
- C. Google Cloud Armor
- D. Shielded VMs
Answer: B
Explanation:
Explanation
https://cloud.google.com/iap/docs/concepts-overview "Use IAP when you want to enforce access control policies for applications and resources."
NEW QUESTION # 31
A company is running workloads in a dedicated server room. They must only be accessed from within the private company network. You need to connect to these workloads from Compute Engine instances within a Google Cloud Platform project.
Which two approaches can you take to meet the requirements? (Choose two.)
- A. Configure all Compute Engine instances with Private Access.
- B. Configure the project with Cloud Interconnect.
- C. Configure the project with VPC peering.
- D. Configure the project with Cloud VPN.
- E. Configure the project with Shared VPC.
Answer: A,C
NEW QUESTION # 32
A customer implements Cloud Identity-Aware Proxy for their ERP system hosted on Compute Engine. Their security team wants to add a security layer so that the ERP systems only accept traffic from Cloud Identity- Aware Proxy.
What should the customer do to meet these requirements?
- A. Make sure that the ERP system can validate the JWT assertion in the HTTP requests.
- B. Make sure that the ERP system can validate the identity headers in the HTTP requests.
- C. Make sure that the ERP system can validate the user's unique identifier headers in the HTTP requests.
- D. Make sure that the ERP system can validate the x-forwarded-for headers in the HTTP requests.
Answer: A
Explanation:
Use Cryptographic Verification If there is a risk of IAP being turned off or bypassed, your app can check to make sure the identity information it receives is valid. This uses a third web request header added by IAP, called X-Goog-IAP-JWT-Assertion. The value of the header is a cryptographically signed object that also contains the user identity data. Your application can verify the digital signature and use the data provided in this object to be certain that it was provided by IAP without alteration.
NEW QUESTION # 33
You are a member of your company's security team. You have been asked to reduce your Linux bastion host external attack surface by removing all public IP addresses. Site Reliability Engineers (SREs) require access to the bastion host from public locations so they can access the internal VPC while off-site. How should you enable this access?
- A. Implement Cloud VPN for the region where the bastion host lives.
- B. Implement Identity-Aware Proxy TCP forwarding for the bastion host.
- C. Implement Google Cloud Armor in front of the bastion host.
- D. Implement OS Login with 2-step verification for the bastion host.
Answer: B
Explanation:
Reference:
https://cloud.google.com/architecture/building-internet-connectivity-for-private-vms#configuring_iap_tunnels_for_interacting_with_instances
NEW QUESTION # 34
Users are reporting an outage on your public-facing application that is hosted on Compute Engine. You suspect that a recent change to your firewall rules is responsible. You need to test whether your firewall rules are working properly. What should you do?
- A. In a pre-production environment, disable all firewall rules individually to determine which one is blocking user traffic.
- B. Connect to a bastion host in your VPC. Use a network traffic analyzer to determine at which point your requests are being blocked.
- C. Enable Firewall Rules Logging on the latest rules that were changed. Use Logs Explorer to analyze whether the rules are working correctly.
- D. Enable VPC Flow Logs in your VPC. Use Logs Explorer to analyze whether the rules are working correctly.
Answer: C
Explanation:
Reference:
https://cloud.google.com/vpc/docs/firewall-rules-logging
NEW QUESTION # 35
Your team needs to obtain a unified log view of all development cloud projects in your SIEM. The development projects are under the NONPROD organization folder with the test and pre-production projects. The development projects share the ABC-BILLING billing account with the rest of the organization.
Which logging export strategy should you use to meet the requirements?
- A. 1. Create a Cloud Storage sink with a publicly shared Cloud Storage bucket in each project.
2. Process Cloud Storage objects in SIEM. - B. 1. Create a Cloud Storage sink with billingAccounts/ABC-BILLING parent and includeChildren property set to False in a dedicated SIEM project.
2. Process Cloud Storage objects in SIEM. - C. 1. Export logs in each dev project to a Cloud Pub/Sub topic in a dedicated SIEM project.
2. Subscribe SIEM to the topic. - D. 1. Export logs to a Cloud Pub/Sub topic with folders/NONPROD parent and includeChildren property set to True in a dedicated SIEM project.
2. Subscribe SIEM to the topic.
Answer: B
NEW QUESTION # 36
How should a customer reliably deliver Stackdriver logs from GCP to their on-premises SIEM system?
- A. Send all logs to the SIEM system via an existing protocol such as syslog.
- B. Configure every project to export all their logs to a common BigQuery DataSet, which will be queried by the SIEM system.
- C. Configure Organizational Log Sinks to export logs to a Cloud Pub/Sub Topic, which will be sent to the SIEM via Dataflow.
- D. Build a connector for the SIEM to query for all logs in real time from the GCP RESTful JSON APIs.
Answer: C
Explanation:
Explanation
Scenarios for exporting Cloud Logging data: Splunk This scenario shows how to export selected logs from Cloud Logging to Pub/Sub for ingestion into Splunk. Splunk is a security information and event management (SIEM) solution that supports several ways of ingesting data, such as receiving streaming data out of Google Cloud through Splunk HTTP Event Collector (HEC) or by fetching data from Google Cloud APIs through Splunk Add-on for Google Cloud. Using the Pub/Sub to Splunk Dataflow template, you can natively forward logs and events from a Pub/Sub topic into Splunk HEC. If Splunk HEC is not available in your Splunk deployment, you can use the Add-on to collect the logs and events from the Pub/Sub topic.
https://cloud.google.com/solutions/exporting-stackdriver-logging-for-splunk
NEW QUESTION # 37
You are the project owner for a regulated workload that runs in a project you own and manage as an Identity and Access Management (IAM) admin. For an upcoming audit, you need to provide access reviews evidence. Which tool should you use?
- A. Policy Simulator
- B. Policy Analyzer
- C. IAM Recommender
- D. Policy Troubleshooter
Answer: B
Explanation:
https://cloud.google.com/policy-intelligence/docs/policy-analyzer-overview Policy Analyzer lets you find out which principals (for example, users, service accounts, groups, and domains) have what access to which Google Cloud resources based on your IAM allow policies.
NEW QUESTION # 38
You recently joined the networking team supporting your company's Google Cloud implementation. You are tasked with familiarizing yourself with the firewall rules configuration and providing recommendations based on your networking and Google Cloud experience. What product should you recommend to detect firewall rules that are overlapped by attributes from other firewall rules with higher or equal priority?
- A. Firewall Insights
- B. Security Command Center
- C. Firewall Rules Logging
- D. VPC Flow Logs
Answer: A
NEW QUESTION # 39
......
Certification dumps - Google Cloud Certified Professional-Cloud-Security-Engineer guides - 100% valid: https://www.itexamsimulator.com/Professional-Cloud-Security-Engineer-brain-dumps.html
100% Pass Your Professional-Cloud-Security-Engineer Google Cloud Certified - Professional Cloud Security Engineer Exam at First Attempt with ITExamSimulator: https://drive.google.com/open?id=1C1gf8woG_JrCv0HvOhQB6dtgPjtSF0xj
