Google Professional Cloud Security Engineer356 questions across 36 pages are complete and free, with no account or card.
356 questions in this bank
Free access · progress saved on this device
You need to follow Google-recommended practices to leverage envelope encryption and encrypt data at the application layer. What should you do?
Answer: A
Yes, A is correct The process of encrypting data is to generate a DEK locally, encrypt data with the DEK, use a KEK to wrap the DEK, and then store the encrypted data and the wrapped DEK. The KEK never leaves Cloud KMS.
Source: Adapted from community discussion — Sheeda
Your organization is using Active Directory and wants to configure Security Assertion Markup Language (SAML). You must set up and enforce single sign-on (SSO) for all users. What should you do?
Answer: A
When configuring SAML-based Single Sign-On (SSO) in an organization that's using Active Directory, the general steps would involve setting up a SAML profile, specifying the necessary URLs for sign-in and sign-out processes, uploading an X.509 certificate for secure communication, and setting up the Entity ID and Assertion Consumer Service (ACS) URL in the Identity Provider (which in this case would be Active Directory). A. Create a new SAML profile, populate URLs, upload X.509 certificate, configure Entity ID and ACS URL: This option comprehensively covers the steps necessary for setting up SAML-based SSO.
Source: Adapted from community discussion — ArizonaClassics
Employees at your company use their personal computers to access your organization's Google Cloud console. You need to ensure that users can only access the Google Cloud console from their corporate-issued devices and verify that they have a valid enterprise certificate. What should you do?
Answer: A
A. Implement an Access Policy in BeyondCorp Enterprise to verify the device certificate. Create an access binding with the access policy just created. This approach is designed to enforce zero-trust access policies, making it a strong fit for the stated needs of only allowing access from corporate-issued devices with valid enterprise certificates.
Source: Adapted from community discussion — ArizonaClassics
Your organization is rolling out a new continuous integration and delivery (CI/CD) process to deploy infrastructure and applications in Google Cloud. Many teams will use their own instances of the CI/CD workflow. It will run on Google Kubernetes Engine (GKE). The CI/CD pipelines must be designed to securely access Google Cloud APIs. What should you do?
Answer: A
Your organization's Customers must scan and upload the contract and their driver license into a web portal in Cloud Storage. You must remove all personally identifiable information (PII) from files that are older than 12 months. Also, you must archive the anonymized files for retention purposes. What should you do?
Answer: B
You plan to synchronize identities to Cloud Identity from a third-party identity provider (IdP). You discovered that some employees used their corporate email address to set up consumer accounts to access Google services. You need to ensure that the organization has control over the configuration, security, and lifecycle of these consumer accounts. What should you do? (Choose two.)
Answer: B
B & E, To ensure control over the configuration, security, and lifecycle of consumer accounts created with corporate email addresses, you should reconcile accounts that exist in Cloud Identity but not in the third-party IdP (B). This helps to align accounts and ensure consistent management. Additionally, you can use the transfer tool to invite employees to transfer their unmanaged consumer accounts to the corporate domain (E), which allows you to bring these accounts under the organization's control in Cloud Identity.
Source: Adapted from community discussion — akg001
You are auditing all your Google Cloud resources in the production project. You want to identify all principals who can change firewall rules. What should you do?
Answer: D
D. You can use the Policy Analyzer to check which resources within your organization a principal has a certain roles or permissions on. To get this information, create a query that includes the principal whose access you want to analyze and one or more permissions or roles that you want to check for. https://cloud.google.com/policy-intelligence/docs/analyze-iam-policies#:~:text=You%20can%20use%20the%20Policy%20Analyzer%20to%20check%20which%20resources,you%20want%20to%20check%20for.
Source: Adapted from community discussion — alkaloid
Your organization previously stored files in Cloud Storage by using Google Managed Encryption Keys (GMEK), but has recently updated the internal policy to require Customer Managed Encryption Keys (CMEK). You need to re-encrypt the files quickly and efficiently with minimal cost. What should you do?
Answer: D
re-writing the objects is not quick and efficient. Option D is incorrect. C. Copy the files to a new bucket with CMEK enabled in a secondary region.Option C is the most efficient and cost-effective solution. It would create a new bucket with CMEK enabled in a secondary region. The files would be copied to the new bucket, and the encryption type would be changed to CMEK. This would allow the files to be accessed using CMEK, while minimizing the impact on performance and availability.
Source: Adapted from community discussion — arpgaur
You run applications on Cloud Run. You already enabled container analysis for vulnerability scanning. However, you are concerned about the lack of control on the applications that are deployed. You must ensure that only trusted container images are deployed on Cloud Run. What should you do? (Choose two.)
Answer: AB
Your organization has on-premises hosts that need to access Google Cloud APIs. You must enforce private connectivity between these hosts, minimize costs, and optimize for operational efficiency. What should you do?
Answer: B
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
PCSE practice, question 101. 356 questions available.
Version 1.0.0. How we source questions