PCSE practice questions 131–140

1. Question 131 · 356 in bank

   Your organization wants to be continuously evaluated against CIS Google Cloud Computing Foundations Benchmark v1.3.0 (CIS Google Cloud Foundation 1.3). Some of the controls are irrelevant to your organization and must be disregarded in evaluation. You need to create an automated system or process to ensure that only the relevant controls are evaluated. What should you do?

   • AMark all security findings that are irrelevant with a tag and a value that indicates a security exception. Select all marked findings, and mute them on the console every time they appear. Activate Security Command Center (SCC) Premium.
   • BActivate Security Command Center (SCC) Premium. Create a rule to mute the security findings in SCC so they are not evaluated.
   • CDownload all findings from Security Command Center (SCC) to a CSV file. Mark the findings that are part of CIS Google Cloud Foundation 1.3 in the file. Ignore the entries that are irrelevant and out of scope for the company.
   • DAsk an external audit company to provide independent reports including needed CIS benchmarks. In the scope of the audit, clarify that some of the controls are not needed and must be disregarded.

   Show answer

   Answer: B

   Explanation

   Option A is a reasonable approach, but it involves ongoing manual intervention to mute security findings and may not be the most efficient method, especially when dealing with a large number of findings. Option B, activating Security Command Center (SCC) Premium and creating rules to mute security findings, is a more automated and scalable approach. SCC Premium allows you to create custom security rules to automatically filter or mute findings based on your organization's requirements. This can help reduce the noise and ensure that irrelevant findings are not evaluated.

   Source: Adapted from community discussion — Xoxoo

   References

   • Google Cloud documentation

   Next question

2. Question 132 · 356 in bank

   You are routing all your internet facing traffic from Google Cloud through your on-premises internet connection. You want to accomplish this goal securely and with the highest bandwidth possible. What should you do?

   • ACreate an HA VPN connection to Google Cloud. Replace the default 0.0.0.0/0 route.
   • BCreate a routing VM in Compute Engine. Configure the default route with the VM as the next hop.
   • CConfigure Cloud Interconnect with HA VPN. Replace the default 0.0.0.0/0 route to an on-premises destination.
   • DConfigure Cloud Interconnect and route traffic through an on-premises firewall.

   Show answer

   Answer: D

   Explanation

   Here's why option D is the recommended choice: Cloud Interconnect: Google Cloud Interconnect is designed to provide dedicated and high-bandwidth connections between your on-premises network and Google Cloud. It offers higher bandwidth and lower latency compared to typical VPN connections. On-Premises Firewall: By configuring Cloud Interconnect to route traffic through an on-premises firewall, you can ensure that all traffic between Google Cloud and the internet passes through your organization's firewall for security inspection and enforcement of security policies.

   Source: Adapted from community discussion — Xoxoo

   References

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   Next question

3. Question 133 · 356 in bank

   Your organization uses Google Workspace Enterprise Edition for authentication. You are concerned about employees leaving their laptops unattended for extended periods of time after authenticating into Google Cloud. You must prevent malicious people from using an employee's unattended laptop to modify their environment. What should you do?

   • ACreate a policy that requires employees to not leave their sessions open for long durations.
   • BReview and disable unnecessary Google Cloud APIs.
   • CRequire strong passwords and 2SV through a security token or Google authenticator.
   • DSet the session length timeout for Google Cloud services to a shorter duration.

   Show answer

   Answer: D

   Next question

4. Question 134 · 356 in bank

   Select 2

   You are migrating an on-premises data warehouse to BigQuery, Cloud SQL, and Cloud Storage. You need to configure security services in the data warehouse. Your company compliance policies mandate that the data warehouse must: • Protect data at rest with full lifecycle management on cryptographic keys. • Implement a separate key management provider from data management. • Provide visibility into all encryption key requests. What services should be included in the data warehouse implementation? (Choose two.)

   • ACustomer-managed encryption keys
   • BCustomer-Supplied Encryption Keys
   • CKey Access Justifications
   • DAccess Transparency and Approval
   • ECloud External Key Manager

   Show answer

   Answer: CE

   Explanation

   C. Key Access Justifications Key Access Justifications can provide visibility into all encryption key requests, satisfying your third condition. This feature enables you to get justification for every request to use a decryption key, giving you the information you need to decide whether to approve or deny the request in real-time. E. Cloud External Key Manager The Cloud External Key Manager allows you to use and manage encryption keys stored outside of Google's infrastructure, thereby providing a separate key management provider from data management. This meets your first and second conditions because it enables you to fully manage the lifecycle of your cryptographic keys while storing them outside Google Cloud.

   Source: Adapted from community discussion — ArizonaClassics

   References

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   Next question

5. Question 135 · 356 in bank

   A website design company recently migrated all customer sites to App Engine. Some sites are still in progress and should only be visible to customers and company employees from any location. Which solution will restrict access to the in-progress sites?

   • AUpload an .htaccess file containing the customer and employee user accounts to App Engine.
   • BCreate an App Engine firewall rule that allows access from the customer and employee networks and denies all other traffic.
   • CEnable Cloud Identity-Aware Proxy (IAP), and allow access to a Google Group that contains the customer and employee user accounts.
   • DUse Cloud VPN to create a VPN connection between the relevant on-premises networks and the company's GCP Virtual Private Cloud (VPC) network.

   Show answer

   Answer: C

   References

   • Google Cloud documentation

   Next question

6. Question 136 · 356 in bank

   You manage one of your organization's Google Cloud projects (Project A). A VPC Service Control (SC) perimeter is blocking API access requests to this project, including Pub/Sub. A resource running under a service account in another project (Project B) needs to collect messages from a Pub/Sub topic in your project. Project B is not included in a VPC SC perimeter. You need to provide access from Project B to the Pub/Sub topic in Project A using the principle of least privilege. What should you do?

   • AConfigure an ingress policy for the perimeter in Project A, and allow access for the service account in Project B to collect messages.
   • BCreate an access level that allows a developer in Project B to subscribe to the Pub/Sub topic that is located in Project A.
   • CCreate a perimeter bridge between Project A and Project B to allow the required communication between both projects.
   • DRemove the Pub/Sub API from the list of restricted services in the perimeter configuration for Project A.

   Show answer

   Answer: A

   Explanation

   Can't be B: You can only use public IP address ranges in the access levels for IP-based allowlists. You cannot include an internal IP address in these allowlists. Internal IP addresses are associated with a VPC network, and VPC networks must be referenced by their containing project using an ingress or egress rule, or a service perimeter. https://cloud.google.com/vpc-service-controls/docs/use-access-levels#create_an_access_level:~:text=You%20can%20only,service%20perimeter.

   Source: Adapted from community discussion — Nachtwaker

   References

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   Next question

7. Question 137 · 356 in bank

   You define central security controls in your Google Cloud environment. For one of the folders in your organization, you set an organizational policy to deny the assignment of external IP addresses to VMs. Two days later, you receive an alert about a new VM with an external IP address under that folder. What could have caused this alert?

   • AThe VM was created with a static external IP address that was reserved in the project before the organizational policy rule was set.
   • BThe organizational policy constraint wasn't properly enforced and is running in "dry run" mode.
   • CA project level, the organizational policy control has been overwritten with an "allow" value.
   • DThe policy constraint on the folder level does not have any effect because of an "allow" value for that constraint on the organizational level.

   Show answer

   Answer: A

   Explanation

   When you define an organizational policy in Google Cloud, it applies to future actions and configurations, not to resources that already exist or were configured before the policy was set. If a static external IP address had been reserved in the project prior to the policy being applied, it could be assigned to a new VM after the policy enforcement starts. This would result in a VM with an external IP address, despite the organizational policy. C. A project-level organizational policy control has been overwritten with an "allow" value. Organizational policies propagate from the top (organization) to the bottom (project), unless specifically overridden. However, the question specifies the policy was applied at the folder level, which would affect all projects under that folder. This is less likely unless explicitly overridden at the project level, which the question does not suggest.

   Source: Adapted from community discussion — BPzen

   References

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   Next question

8. Question 138 · 356 in bank

   Your company recently published a security policy to minimize the usage of service account keys. On-premises Windows-based applications are interacting with Google Cloud APIs. You need to implement Workload Identity Federation (WIF) with your identity provider on-premises. What should you do?

   • ASet up a workload identity pool with your corporate Active Directory Federation Service (ADFS). Configure a rule to let principals in the pool impersonate the Google Cloud service account.
   • BSet up a workload identity pool with your corporate Active Directory Federation Service (ADFS). Let all principals in the pool impersonate the Google Cloud service account.
   • CSet up a workload identity pool with an OpenID Connect (OIDC) service on the same machine. Configure a rule to let principals in the pool impersonate the Google Cloud service account.
   • DSet up a workload identity pool with an OpenID Connect (OIDC) service on the same machine. Let all principals in the pool impersonate the Google Cloud service account.

   Show answer

   Answer: A

   Explanation

   Here's why option A is the preferred choice: Workload Identity Pool: Using your corporate ADFS for identity federation is a common and secure way to manage identities and access to Google Cloud resources. Configure a Rule: Configuring a rule in the workload identity pool allows you to specify which principals (users or entities) in your corporate ADFS can impersonate the Google Cloud service account. This approach adheres to the principle of least privilege by allowing only specific users or entities to impersonate the service account.

   Source: Adapted from community discussion — Xoxoo

   Next question

9. Question 139 · 356 in bank

   After completing a security vulnerability assessment, you learned that cloud administrators leave Google Cloud CLI sessions open for days. You need to reduce the risk of attackers who might exploit these open sessions by setting these sessions to the minimum duration. What should you do?

   • ASet the session duration for the Google session control to one hour.
   • BSet the reauthentication frequency for the Google Cloud Session Control to one hour.
   • CSet the organization policy constraint constraints/iam.allowServiceAccountCredentialLifetimeExtension to one hour.
   • DSet the organization policy constraint constraints/iam.serviceAccountKeyExpiryHours to one hour and inheritFromParent to false.

   Show answer

   Answer: B

   Explanation

   The session-length control settings affect sessions with all Google web properties that a user accesses while signed in. I think B is the most appropriated: " for Google Cloud tools, and how these controls interact with the parent session control on this page, see Set session length for Google Cloud services." https://support.google.com/a/answer/7576830?hl=en https://support.google.com/a/answer/9368756?hl=en

   Source: Adapted from community discussion — pfilourenco

   References

   • support.google.com documentation
   • support.google.com documentation
   • Google Cloud documentation
   • support.google.com documentation
   • support.google.com documentation

   Next question

10. Question 140 · 356 in bank

    You have numerous private virtual machines on Google Cloud. You occasionally need to manage the servers through Secure Socket Shell (SSH) from a remote location. You want to configure remote access to the servers in a manner that optimizes security and cost efficiency. What should you do?

    • ACreate a site-to-site VPN from your corporate network to Google Cloud.
    • BConfigure server instances with public IP addresses. Create a firewall rule to only allow traffic from your corporate IPs.
    • CCreate a firewall rule to allow access from the Identity-Aware Proxy (IAP) IP range. Grant the role of an IAP-secured Tunnel User to the administrators.
    • DCreate a jump host instance with public IP. Manage the instances by connecting through the jump host.

    Show answer

    Answer: C

    Explanation

    C - correct. With TCP forwarding, IAP can protect SSH and RDP access to your VMs hosted on Google Cloud. Your VM instances don't even need public IP addresses. https://cloud.google.com/iap#section-2

    Source: Adapted from community discussion — alkaloid

    References

    • Google Cloud documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

PCSE practice, question 131. 356 questions available.