[Feb-2023] Professional-Cloud-Security-Engineer PDF Dumps Extremely Quick Way Of Preparation
Download Professional-Cloud-Security-Engineer Dumps (2023) - Free PDF Exam Demo
NEW QUESTION 61
Your company operates an application instance group that is currently deployed behind a Google Cloud load balancer in us-central-1 and is configured to use the Standard Tier network. The infrastructure team wants to expand to a second Google Cloud region, us-east-2. You need to set up a single external IP address to distribute new requests to the instance groups in both regions.
What should you do?
- A. Change the load balancer frontend configuration to use the Premium Tier network, and add the new instance group.
- B. Change the load balancer backend configuration to use network endpoint groups instead of instance groups.
- C. Create a new load balancer in us-east-2 using the Standard Tier network, and assign a static external IP address.
- D. Create a Cloud VPN connection between the two regions, and enable Google Private Access.
Answer: B
NEW QUESTION 62
Your company plans to move most of its IT infrastructure to Google Cloud. They want to leverage their existing on-premises Active Directory as an identity provider for Google Cloud. Which two steps should you take to integrate the company's on-premises Active Directory with Google Cloud and configure access management? (Choose two.)
- A. Use Cloud Identity SAML integration to provision users and groups to Google Cloud.
- B. Create Identity and Access Management (1AM) roles with permissions corresponding to each Active Directory group.
- C. Install Google Cloud Directory Sync and connect it to Active Directory and Cloud Identity.
- D. Use Identity Platform to provision users and groups to Google Cloud.
- E. Create Identity and Access Management (1AM) groups with permissions corresponding to each Active Directory group.
Answer: A,C
NEW QUESTION 63
Your team needs to make sure that a Compute Engine instance does not have access to the internet or to any Google APIs or services.
Which two settings must remain disabled to meet these requirements? (Choose two.)
- A. Private Google Access
- B. Static routes
- C. Public IP
- D. IP Forwarding
- E. IAM Network User Role
Answer: A,B
Explanation:
Explanation/Reference: https://cloud.google.com/vpc/docs/configure-private-google-access
NEW QUESTION 64
You have the following resource hierarchy. There is an organization policy at each node in the hierarchy as shown. Which load balancer types are denied in VPC A?
- A. EXTERNAL_TCP_PROXY, EXTERNAL_SSL_PROXY, INTERNAL_TCP_UDP, and INTERNAL_HTTP_HTTPS are denied in accordance with the folder and project's policies.
- B. All load balancer types are denied in accordance with the global node's policy.
- C. EXTERNAL_TCP_PROXY, EXTERNAL_SSL_PROXY are denied in accordance with the project's policy.
- D. INTERNAL_TCP_UDP, INTERNAL_HTTP_HTTPS is denied in accordance with the folder's policy.
Answer: A
NEW QUESTION 65
A customer's data science group wants to use Google Cloud Platform (GCP) for their analytics workloads.
Company policy dictates that all data must be company-owned and all user authentications must go through their own Security Assertion Markup Language (SAML) 2.0 Identity Provider (IdP). The Infrastructure Operations Systems Engineer was trying to set up Cloud Identity for the customer and realized that their domain was already being used by G Suite.
How should you best advise the Systems Engineer to proceed with the least disruption?
- A. Contact Google Support and initiate the Domain Contestation Process to use the domain name in your new Cloud Identity domain.
- B. Ask customer's management to discover any other uses of Google managed services, and work with the existing Super Administrator.
- C. Ask Google to provision the data science manager's account as a Super Administrator in the existing domain.
- D. Register a new domain name, and use that for the new Cloud Identity domain.
Answer: B
Explanation:
Explanation
https://support.google.com/cloudidentity/answer/7389973
NEW QUESTION 66
Your security team wants to implement a defense-in-depth approach to protect sensitive data stored in a Cloud Storage bucket. Your team has the following requirements:
The Cloud Storage bucket in Project A can only be readable from Project B.
The Cloud Storage bucket in Project A cannot be accessed from outside the network.
Data in the Cloud Storage bucket cannot be copied to an external Cloud Storage bucket.
What should the security team do?
- A. Enable domain restricted sharing in an organization policy, and enable uniform bucket-level access on the Cloud Storage bucket.
- B. Enable VPC Peering between Project A and B's networks with strict firewall rules that allow communication between the networks.
- C. Enable VPC Service Controls, create a perimeter around Projects A and B. and include the Cloud Storage API in the Service Perimeter configuration.
- D. Enable Private Access in both Project A and B's networks with strict firewall rules that allow communication between the networks.
Answer: B
NEW QUESTION 67
You need to perform a vulnerability scan for an App Engine app using Cloud Security Scanner.
Upon completion of the scan, the report is not producing the expected number of webpage results. The pages in the app with mouseover menus are missing from the report. Which action should you take to make sure the scan completes and captures the menu?
- A. Verify the Excluded URLs.
- B. Modify the scan schedule to return new results.
- C. Change the scan to include additional Starting URLs.
- D. Adjust the Google account on which the scan is running.
Answer: C
Explanation:
A is not correct because the missing webpages in mouseover menu are unlikely to be explicitly excluded since they're expected to be scanned.
B is not correct because changing the scan schedule will not result in scanning of more webpages.
C is correct because Cloud Security Scanner may not be able to navigate through complex JavaScript such as a mouseover-driven multilevel menu. Specifying additional starting URLs can increase scan coverage in this scenario.
D is not correct because changing the Google account will not result in scanning of more webpages.
https://cloud.google.com/security-scanner/docs/scanning
NEW QUESTION 68
You perform a security assessment on a customer architecture and discover that multiple VMs have public IP addresses. After providing a recommendation to remove the public IP addresses, you are told those VMs need to communicate to external sites as part of the customer's typical operations. What should you recommend to reduce the need for public IP addresses in your customer's VMs?
- A. Cloud Router
- B. Cloud VPN
- C. Google Cloud Armor
- D. Cloud NAT
Answer: D
Explanation:
Explanation
https://cloud.google.com/nat/docs/overview
NEW QUESTION 69
While migrating your organization's infrastructure to GCP, a large number of users will need to access GCP Console. The Identity Management team already has a well-established way to manage your users and want to keep using your existing Active Directory or LDAP server along with the existing SSO password.
What should you do?
- A. Use Google Cloud Directory Sync to synchronize the data in Google domain with your existing Active Directory or LDAP server.
- B. Users sign in using OpenID (OIDC) compatible IdP, receive an authentication token, then use that token to log in to the GCP Console.
- C. Users sign in directly to the GCP Console using the credentials from your on-premises Kerberos compliant identity provider.
- D. Manually synchronize the data in Google domain with your existing Active Directory or LDAP server.
Answer: A
Explanation:
Explanation/Reference: https://cloud.google.com/blog/products/identity-security/using-your-existing-identity-management- system-with-google-cloud-platform
NEW QUESTION 70
Your company requires the security and network engineering teams to identify all network anomalies and be able to capture payloads within VPCs. Which method should you use?
- A. Configure packet mirroring policies.
- B. Enable VPC Flow Logs on the subnet.
- C. Monitor and analyze Cloud Audit Logs.
- D. Define an organization policy constraint.
Answer: A
Explanation:
Explanation
https://cloud.google.com/vpc/docs/packet-mirroring
Packet Mirroring clones the traffic of specified instances in your Virtual Private Cloud (VPC) network and forwards it for examination. Packet Mirroring captures all traffic and packet data, including payloads and headers.
NEW QUESTION 71
When creating a secure container image, which two items should you incorporate into the build if possible? (Choose two.)
- A. Package a single app as a container.
- B. Remove any unnecessary tools not needed by the app.
- C. Ensure that the app does not run as PID 1.
- D. Use public container images as a base image for the app.
- E. Use many container image layers to hide sensitive information.
Answer: A,B
Explanation:
https://cloud.google.com/solutions/best-practices-for-building-containers
NEW QUESTION 72
While migrating your organization's infrastructure to GCP, a large number of users will need to access GCP Console. The Identity Management team already has a well-established way to manage your users and want to keep using your existing Active Directory or LDAP server along with the existing SSO password.
What should you do?
- A. Use Google Cloud Directory Sync to synchronize the data in Google domain with your existing Active Directory or LDAP server.
- B. Users sign in using OpenID (OIDC) compatible IdP, receive an authentication token, then use that token to log in to the GCP Console.
- C. Users sign in directly to the GCP Console using the credentials from your on-premises Kerberos compliant identity provider.
- D. Manually synchronize the data in Google domain with your existing Active Directory or LDAP server.
Answer: A
Explanation:
Explanation
https://cloud.google.com/architecture/identity/federating-gcp-with-active-directory-configuring-single-sign-on
NEW QUESTION 73
A retail customer allows users to upload comments and product reviews. The customer needs to make sure the text does not include sensitive data before the comments or reviews are published.
Which Google Cloud Service should be used to achieve this?
- A. BigQuery
- B. Cloud Security Scanner
- C. Cloud Data Loss Prevention API
- D. Cloud Key Management Service
Answer: C
NEW QUESTION 74
Your security team uses encryption keys to ensure confidentiality of user dat a. You want to establish a process to reduce the impact of a potentially compromised symmetric encryption key in Cloud Key Management Service (Cloud KMS).
Which steps should your team take before an incident occurs? (Choose two.)
- A. Disable and revoke access to compromised keys.
- B. Limit the number of messages encrypted with each key version.
- C. Manually rotate key versions on an ad hoc schedule.
- D. Disable the Cloud KMS API.
- E. Enable automatic key version rotation on a regular schedule.
Answer: A,E
NEW QUESTION 75
When working with agents in a support center via online chat, an organization's customers often share pictures of their documents with personally identifiable information (PII). The organization that owns the support center is concerned that the PII is being stored in their databases as part of the regular chat logs they retain for review by internal or external analysts for customer service trend analysis.
Which Google Cloud solution should the organization use to help resolve this concern for the customer while still maintaining data utility?
- A. Use the image inspection and redaction actions of the DLP API to redact PII from the images before storing them for analysis.
- B. Use Cloud Key Management Service (KMS) to encrypt the PII data shared by customers before storing it for analysis.
- C. Use Object Lifecycle Management to make sure that all chat records with PII in them are discarded and not saved for analysis.
- D. Use the generalization and bucketing actions of the DLP API solution to redact PII from the texts before storing them for analysis.
Answer: A
Explanation:
https://cloud.google.com/dlp/docs/concepts-image-redaction
NEW QUESTION 76
Your team needs to configure their Google Cloud Platform (GCP) environment so they can centralize the control over networking resources like firewall rules, subnets, and routes. They also have an on-premises environment where resources need access back to the GCP resources through a private VPN connection. The networking resources will need to be controlled by the network security team.
Which type of networking design should your team use to meet these requirements?
- A. Cloud VPN Gateway between all engineering projects using a hub and spoke model
- B. VPC peering between all engineering projects using a hub and spoke model
- C. Grant Compute Admin role to the networking team for each engineering project
- D. Shared VPC Network with a host project and service projects
Answer: D
Explanation:
https://cloud.google.com/docs/enterprise/best-practices-for-enterprise- organizations#centralize_network_control
NEW QUESTION 77
Your team uses a service account to authenticate data transfers from a given Compute Engine virtual machine instance of to a specified Cloud Storage bucket. An engineer accidentally deletes the service account, which breaks application functionality. You want to recover the application as quickly as possible without compromising security.
What should you do?
- A. Create a new service account with the same name as the deleted service account.
- B. Update the permissions of another existing service account and supply those credentials to the applications.
- C. Use the undelete command to recover the deleted service account.
- D. Temporarily disable authentication on the Cloud Storage bucket.
Answer: C
Explanation:
Reference:
https://cloud.google.com/iam/docs/creating-managing-service- accounts#undeleting_a_service_account
NEW QUESTION 78
You are the Security Admin in your company. You want to synchronize all security groups that have an email address from your LDAP directory in Cloud IAM.
What should you do?
- A. Configure Google Cloud Directory Sync to sync security groups using LDAP search rules that have
"user email address" as the attribute to facilitate bidirectional sync. - B. Use a management tool to sync the subset based on group object class attribute. Create a group in the Google domain. A group created in a Google domain will automatically have an explicit Google Cloud Identity and Access Management (IAM) role.
- C. Use a management tool to sync the subset based on the email address attribute. Create a group in the Google domain. A group created in a Google domain will automatically have an explicit Google Cloud Identity and Access Management (IAM) role.
- D. Configure Google Cloud Directory Sync to sync security groups using LDAP search rules that have
"user email address" as the attribute to facilitate one-way sync.
Answer: D
Explanation:
Explanation
search rules that have "user email address" as the attribute to facilitate one-way sync. Reference Links:
https://support.google.com/a/answer/6126589?hl=en
NEW QUESTION 79
Your company is using GSuite and has developed an application meant for internal usage on Google App Engine. You need to make sure that an external user cannot gain access to the application even when an employee's password has been compromised.
What should you do?
- A. Provision user passwords using GSuite Password Sync.
- B. Configure Cloud Identity-Aware Proxy for the App Engine Application.
- C. Configure Cloud VPN between your private network and GCP.
- D. Enforce 2-factor authentication in GSuite for all users.
Answer: D
Explanation:
Explanation
https://docs.google.com/document/d/11o3e14tyhnT7w45Q8-r9ZmTAfj2WUNUpJPZImrxm_F4/edit?usp=sharin
https://support.google.com/a/answer/175197?hl=en
NEW QUESTION 80
You are exporting application logs to Cloud Storage. You encounter an error message that the log sinks don't support uniform bucket-level access policies. How should you resolve this error?
- A. Add the roles/logging.bucketWriter Identity and Access Management (IAM) role to the bucket for the log sink identity.
- B. Add the roles/logging.logWriter Identity and Access Management (IAM) role to the bucket for the log sink identity.
- C. Update your sink with the correct bucket destination.
- D. Change the access control model for the bucket
Answer: D
Explanation:
Explanation
https://cloud.google.com/logging/docs/export/troubleshoot#errors_exporting_to_cloud_storage
https://cloud.google.com/logging/docs/export/troubleshoot
Unable to grant correct permissions to the destination: Even if the sink was successfully created with the correct service account permissions, this error message displays if the access control model for the Cloud Storage bucket was set to uniform access when the bucket was created. For existing Cloud Storage buckets, you can change the access control model for the first 90 days after bucket creation by using the Permissions tab. For new buckets, select the Fine-grained access control model during bucket creation. For details, see Creating Cloud Storage buckets.
NEW QUESTION 81
Which two implied firewall rules are defined on a VPC network? (Choose two.)
- A. A rule that blocks all outbound connections
- B. A rule that allows all inbound port 80 connections
- C. A rule that denies all inbound connections
- D. A rule that allows all outbound connections
- E. A rule that blocks all inbound port 25 connections
Answer: C,D
Explanation:
Explanation/Reference: https://cloud.google.com/vpc/docs/firewalls
NEW QUESTION 82
As adoption of the Cloud Data Loss Prevention (DLP) API grows within the company, you need to optimize usage to reduce cost. DLP target data is stored in Cloud Storage and BigQuery. The location and region are identified as a suffix in the resource name.
Which cost reduction options should you recommend?
- A. Use FindingLimits and TimespanContfig to sample data and minimize transformation units.
- B. Set appropriate rowsLimit value on BigQuery data hosted outside the US and set appropriate bytesLimitPerFile value on multiregional Cloud Storage buckets.
- C. Set appropriate rowsLimit value on BigQuery data hosted outside the US, and minimize transformation units on multiregional Cloud Storage buckets.
- D. Use rowsLimit and bytesLimitPerFile to sample data and use CloudStorageRegexFileSet to limit scans.
Answer: D
NEW QUESTION 83
What are the steps to encrypt data using envelope encryption?
- A. Generate a key encryption key (KEK) locally.
Use the KEK to generate a data encryption key (DEK). Encrypt data with the DEK.
Store the encrypted data and the wrapped DEK. - B. Generate a key encryption key (KEK) locally.
Generate a data encryption key (DEK) locally. Encrypt data with the KEK.
Store the encrypted data and the wrapped DEK. - C. Generate a data encryption key (DEK) locally.
Use a key encryption key (KEK) to wrap the DEK. Encrypt data with the KEK.
Store the encrypted data and the wrapped KEK. - D. Generate a data encryption key (DEK) locally.
Encrypt data with the DEK.
Use a key encryption key (KEK) to wrap the DEK. Store the encrypted data and the wrapped DEK.
Answer: D
Explanation:
Reference:
https://cloud.google.com/kms/docs/envelope-encryption
NEW QUESTION 84
......
Enhance your career with Professional-Cloud-Security-Engineer PDF Dumps - True Google Exam Questions: https://torrentpdf.practicedump.com/Professional-Cloud-Security-Engineer-exam-questions.html