PCSE practice questions 111–120

1. Question 111 · 356 in bank

   As part of your organization's zero trust strategy, you use Identity-Aware Proxy (IAP) to protect multiple applications. You need to ingest logs into a Security Information and Event Management (SIEM) system so that you are alerted to possible intrusions. Which logs should you analyze?

   • AData Access audit logs
   • BPolicy Denied audit logs
   • CCloud Identity user log events
   • DAdmin Activity audit logs

   Show answer

   Answer: A

   Explanation

   The data_access log name only appears if there was traffic to your resource after you enabled Cloud Audit Logs for IAP. Click to expand the date and time of the access you want to review. Authorized access has a blue i icon. Unauthorized access has an orange !! icon. " https://cloud.google.com/iap/docs/audit-log-howto

   Source: Adapted from community discussion — gcp4test

   References

   • Google Cloud documentation

   Next question

2. Question 112 · 356 in bank

   Select 2

   Which two implied firewall rules are defined on a VPC network? (Choose two.)

   • AA rule that allows all outbound connections
   • BA rule that denies all inbound connections
   • CA rule that blocks all inbound port 25 connections
   • DA rule that blocks all outbound connections
   • EA rule that allows all inbound port 80 connections

   Show answer

   Answer: AB

   References

   • Google Cloud documentation

   Next question

3. Question 113 · 356 in bank

   How should a customer reliably deliver Stackdriver logs from GCP to their on-premises SIEM system?

   • ASend all logs to the SIEM system via an existing protocol such as syslog.
   • BConfigure every project to export all their logs to a common BigQuery DataSet, which will be queried by the SIEM system.
   • CConfigure Organizational Log Sinks to export logs to a Cloud Pub/Sub Topic, which will be sent to the SIEM via Dataflow.
   • DBuild a connector for the SIEM to query for all logs in real time from the GCP RESTful JSON APIs.

   Show answer

   Answer: C

   Explanation

   Correct answer is (C): Scenarios for exporting Cloud Logging data: Splunk This scenario shows how to export selected logs from Cloud Logging to Pub/Sub for ingestion into Splunk. Splunk is a security information and event management (SIEM) solution that supports several ways of ingesting data, such as receiving streaming data out of Google Cloud through Splunk HTTP Event Collector (HEC) or by fetching data from Google Cloud APIs through Splunk Add-on for Google Cloud. Using the Pub/Sub to Splunk Dataflow template, you can natively forward logs and events from a Pub/Sub topic into Splunk HEC. If Splunk HEC is not available in your Splunk deployment, you can use the Add-on to collect the logs and events from the Pub/Sub topic. https://cloud.google.com/solutions/exporting-stackdriver-logging-for-splunk

   Source: Adapted from community discussion — ESP_SAP

   References

   • Google Cloud documentation

   Next question

4. Question 114 · 356 in bank

   Your company must follow industry specific regulations. Therefore, you need to enforce customer-managed encryption keys (CMEK) for all new Cloud Storage resources in the organization called org1. What command should you execute?

   • A• organization poli-cy:constraints/gcp.restrictStorageNonCmekServices • binding at: org1 • policy type: allow • policy value: all supported services
   • B• organization policy: con-straints/gcp.restrictNonCmekServices • binding at: org1 • policy type: deny • policy value: storage.googleapis.com
   • C• organization policy: con-straints/gcp.restrictStorageNonCmekServices • binding at: org1 • policy type: deny • policy value: storage.googleapis.com
   • D• organization policy: con-straints/gcp.restrictNonCmekServices • binding at: org1 • policy type: allow • policy value: storage.googleapis.com

   Show answer

   Answer: B

   References

   • Google Cloud documentation

   Next question

5. Question 115 · 356 in bank

   Your company's Google Cloud organization has about 200 projects and 1,500 virtual machines. There is no uniform strategy for logs and events management, which reduces visibility for your security operations team. You need to design a logs management solution that provides visibility and allows the security team to view the environment's configuration. What should you do?

   • A1. Create a dedicated log sink for each project that is in scope. 2. Use a BigQuery dataset with time partitioning enabled as a destination of the log sinks. 3. Deploy alerts based on log metrics in every project. 4. Grant the role "Monitoring Viewer" to the security operations team in each project.
   • B1. Create one log sink at the organization level that includes all the child resources. 2. Use as destination a Pub/Sub topic to ingest the logs into the security information and event. management (SIEM) on-premises, and ensure that the right team can access the SIEM. 3. Grant the Viewer role at organization level to the security operations team.
   • C1. Enable network logs and data access logs for all resources in the "Production" folder. 2. Do not create log sinks to avoid unnecessary costs and latency. 3. Grant the roles "Logs Viewer" and "Browser" at project level to the security operations team.
   • D1. Create one sink for the "Production" folder that includes child resources and one sink for the logs ingested at the organization level that excludes child resources. 2. As destination, use a log bucket with a minimum retention period of 90 days in a project that can be accessed by the security team. 3. Grant the security operations team the role of Security Reviewer at organization level.

   Show answer

   Answer: B

   Explanation

   B. 1. Create one log sink at the organization level that includes all the child resources. 2. Use as destination a Pub/Sub topic to ingest the logs into the security information and event management (SIEM) on-premises, and ensure that the right team can access the SIEM.

   Source: Adapted from community discussion — ArizonaClassics

   Next question

6. Question 116 · 356 in bank

   Your Google Cloud organization allows for administrative capabilities to be distributed to each team through provision of a Google Cloud project with Owner role (roles/owner). The organization contains thousands of Google Cloud projects. Security Command Center Premium has surfaced multiple OPEN_MYSQL_PORT findings. You are enforcing the guardrails and need to prevent these types of common misconfigurations. What should you do?

   • ACreate a hierarchical firewall policy configured at the organization to deny all connections from 0.0.0.0/0.
   • BCreate a hierarchical firewall policy configured at the organization to allow connections only from internal IP ranges.
   • CCreate a Google Cloud Armor security policy to deny traffic from 0.0.0.0/0.
   • DCreate a firewall rule for each virtual private cloud (VPC) to deny traffic from 0.0.0.0/0 with priority 0.

   Show answer

   Answer: B

   Explanation

   Your Google Cloud organization allows for administrative capabilities to be distributed to each team through provision of a Google Cloud project with Owner role (roles/owner). The organization contains thousands of Google Cloud projects. Security Command Center Premium has surfaced multiple OPEN_MYSQL_PORT findings. You are enforcing the guardrails and need to prevent these types of common misconfigurations. What should you do? A. Create a hierarchical firewall policy configured at the organization to deny all connections from 0.0.0.0/0. B. Create a hierarchical firewall policy configured at the organization to allow connections only from internal IP ranges. C. Create a Google Cloud Armor security policy to deny traffic from 0.0.0.0/0. D. Create a firewall rule for each virtual private cloud (VPC) to deny traffic from 0.0.0.0/0 with priority 0.

   Source: Adapted from community discussion — Xoxoo

   References

   • Google Cloud documentation
   • Google Cloud documentation

   Next question

7. Question 117 · 356 in bank

   Your organization must comply with the regulation to keep instance logging data within Europe. Your workloads will be hosted in the Netherlands in region europe-west4 in a new project. You must configure Cloud Logging to keep your data in the country. What should you do?

   • AConfigure the organization policy constraint gcp.resourceLocations to europe-west4.
   • BConfigure log sink to export all logs into a Cloud Storage bucket in europe-west4.
   • CCreate a new log bucket in europe-west4, and redirect the _Default bucket to the new bucket.
   • DSet the logging storage region to europe-west4 by using the gcloud CLI logging settings update.

   Show answer

   Answer: C

   Explanation

   Answer is C: https://cloud.google.com/logging/docs/regionalized-logs This guide walks through this process using the example of redirecting all logs to the europe-west1 region. This process involves the following steps: Create a log bucket in the designated region for storing the logs. Redirect the _Default sink to route the logs to the new log bucket. Search for logs in the Logs Explorer. (Optional) Update the log retention period.

   Source: Adapted from community discussion — desertlotus1211

   References

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   Next question

8. Question 118 · 356 in bank

   You are using Security Command Center (SCC) to protect your workloads and receive alerts for suspected security breaches at your company. You need to detect cryptocurrency mining software. Which SCC service should you use?

   • AVirtual Machine Threat Detection
   • BContainer Threat Detection
   • CRapid Vulnerability Detection
   • DWeb Security Scanner

   Show answer

   Answer: A

   References

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   Next question

9. Question 119 · 356 in bank

   Select 2

   You are running applications outside Google Cloud that need access to Google Cloud resources. You are using workload identity federation to grant external identities Identity and Access Management (IAM) roles to eliminate the maintenance and security burden associated with service account keys. You must protect against attempts to spoof another user's identity and gain unauthorized access to Google Cloud resources. What should you do? (Choose two.)

   • AEnable data access logs for IAM APIs.
   • BLimit the number of external identities that can impersonate a service account.
   • CUse a dedicated project to manage workload identity pools and providers.
   • DUse immutable attributes in attribute mappings.
   • ELimit the resources that a service account can access.

   Show answer

   Answer: CD

   Explanation

   Best practices for protecting against spoofing threats: Use a dedicated project to manage workload identity pools and providers. Use organizational policy constraints to disable the creation of workload identity pool providers in other projects. Use a single provider per workload identity pool to avoid subject collisions. Avoid federating with the same identity provider twice. Protect the OIDC metadata endpoint of your identity provider. Use the URL of the workload identity pool provider as audience. Use immutable attributes in attribute mappings. Use non-reusable attributes in attribute mappings. Don't allow attribute mappings to be modified. Don't rely on attributes that aren't stable or authoritative. Therefore, Option C and D are correct

   Source: Adapted from community discussion — Xoxoo

   References

   • Google Cloud documentation

   Next question

10. Question 120 · 356 in bank

    Select 2

    You manage a BigQuery analytical data warehouse in your organization. You want to keep data for all your customers in a common table while you also restrict query access based on rows and columns permissions. Non-query operations should not be supported. What should you do? (Choose two.)

    • ACreate row-level access policies to restrict the result data when you run queries with the filter expression set to TRUE.
    • BConfigure column-level encryption by using Authenticated Encryption with Associated Data (AEAD) functions with Cloud Key Management Service (KMS) to control access to columns at query runtime.
    • CCreate row-level access policies to restrict the result data when you run queries with the filter expression set to FALSE.
    • DConfigure dynamic data masking rules to control access to columns at query runtime.
    • ECreate column-level policy tags to control access to columns at query runtime.

    Show answer

    Answer: CE

    Explanation

    Bumping this up (credit to pfilourenco): C - Non-query operations should >>>not<<< be supported so it has to be FALSE: https://cloud.google.com/bigquery/docs/using-row-level-security-with-features#the_true_filter E - https://cloud.google.com/bigquery/docs/column-level-security-intro#column-level_security_workflow

    Source: Adapted from community discussion — Xoxoo

    References

    • Google Cloud documentation
    • Google Cloud documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

PCSE practice, question 111. 356 questions available.