Question 141 · 356 in bank
Your organization's record data exists in Cloud Storage. You must retain all record data for at least seven years. This policy must be permanent. What should you do?
Show answer
Answer: D
Google Professional Cloud Security Engineer356 questions across 36 pages are complete and free, with no account or card.
356 questions in this bank
Free access · progress saved on this device
Your organization's record data exists in Cloud Storage. You must retain all record data for at least seven years. This policy must be permanent. What should you do?
Answer: D
Your organization wants to protect all workloads that run on Compute Engine VM to ensure that the instances weren't compromised by boot-level or kernel-level malware. Also, you need to ensure that data in use on the VM cannot be read by the underlying host system by using a hardware-based solution. What should you do?
Answer: C
You are migrating your users to Google Cloud. There are cookie replay attacks with Google web and Google Cloud CLI SDK sessions on endpoint devices. You need to reduce the risk of these threats. What should you do? (Choose two.)
Answer: A
Correct anwers are A & E. A. Configuring Google session control to a shorter duration reduces the time window in which an attacker can use a replayed cookie to gain unauthorized access, thereby enhancing security. E. Enforcing Security Key Authentication with 2-Step Verification (2SV) adds an additional layer of security by requiring users to verify their identity using a physical security key, making it more difficult for attackers to gain unauthorized access even if they have a replayed cookie.
Source: Adapted from community discussion — i_am_robot
You manage a mission-critical workload for your organization, which is in a highly regulated industry. The workload uses Compute Engine VMs to analyze and process the sensitive data after it is uploaded to Cloud Storage from the endpoint computers. Your compliance team has detected that this workload does not meet the data protection requirements for sensitive data. You need to meet these requirements: • Manage the data encryption key (DEK) outside the Google Cloud boundary. • Maintain full control of encryption keys through a third-party provider. • Encrypt the sensitive data before uploading it to Cloud Storage. • Decrypt the sensitive data during processing in the Compute Engine VMs. • Encrypt the sensitive data in memory while in use in the Compute Engine VMs. What should you do? (Choose two.)
Answer: BC
B,C is the answer. Confidential VM does not support live migration. You can only enable Confidential Computing on a VM when you first create the instance. https://cloud.google.com/confidential-computing/confidential-vm/docs/creating-cvm-instance
Source: Adapted from community discussion — ymkk
Your organization wants to be General Data Protection Regulation (GDPR) compliant. You want to ensure that your DevOps teams can only create Google Cloud resources in the Europe regions. What should you do?
Answer: B
B. Use the org policy constraint 'Google Cloud Platform – Resource Location Restriction' on your Google Cloud organization node: This policy constraint allows you to restrict the regions where Google Cloud resources can be created within your organization. By setting this constraint, you can ensure that resources are only deployed in the Europe regions, aligning with GDPR requirements for data processing and storage.
Source: Adapted from community discussion — ppandher
When working with agents in the support center via online chat, your organization's customers often share pictures of their documents with personally identifiable information (PII). Your leadership team is concerned that this PII is being stored as part of the regular chat logs, which are reviewed by internal or external analysts for customer service trends. You want to resolve this concern while still maintaining data utility. What should you do?
Answer: C
For data residency requirements, you want your secrets in Google Clouds Secret Manager to only have payloads in europe-west1 and europe-west4. Your secrets must be highly available in both regions. What should you do?
Answer: A
from ChatGPT-4: The correct answer is A. Create your secret with a user-managed replication policy, and choose only compliant locations. In Google Cloud's Secret Manager, secrets with a user-managed replication policy are replicated only in the user-specified locations. This can be used to ensure data residency requirements are met, as the secret data (payloads) will not be stored or replicated outside of the regions selected in the policy. The automatic replication policy option (B and D) would not work because it replicates data across all regions in Google Cloud, which may violate the data residency requirements. Creating two secrets using Terraform (C) in different regions could work from a data residency standpoint, but it could lead to management issues as you would have two separate secrets to manage instead of one.
Source: Adapted from community discussion — kapara
You are migrating an application into the cloud. The application will need to read data from a Cloud Storage bucket. Due to local regulatory requirements, you need to hold the key material used for encryption fully under your control and you require a valid rationale for accessing the key material. What should you do?
Answer: D
The correct answer is D. Generate a key in your on-premises environment and store it in a Hardware Security Module (HSM) that is managed on-premises. Use this key as an external key in the Cloud Key Management Service (KMS). Activate Key Access Justifications (KAJ) and set the external key system to reject unauthorized accesses. This approach allows you to maintain full control over the key material used for encryption, as the key is generated and stored in an on-premises HSM. By using this key as an external key in Cloud KMS, you can leverage Google Cloud’s key management capabilities while still maintaining control over the key material. Activating Key Access Justifications provides a valid rationale for accessing the key material, as it allows you to monitor and justify each attempt to use the key.
Source: Adapted from community discussion — MisterHairy
Your organization uses the top-tier folder to separate application environments (prod and dev). The developers need to see all application development audit logs, but they are not permitted to review production logs. Your security team can review all logs in production and development environments. You must grant Identity and Access Management (IAM) roles at the right resource level for the developers and security team while you ensure least privilege. What should you do?
Answer: A
You manage a fleet of virtual machines (VMs) in your organization. You have encountered issues with lack of patching in many VMs. You need to automate regular patching in your VMs and view the patch management data across multiple projects. What should you do? (Choose two.)
Answer: AE
A. View patch management data in VM Manager by using OS patch management. VM Manager’s OS patch management feature allows you to view patch compliance and deployment data across multiple projects. E. Deploy patches with VM Manager by using OS patch management. VM Manager’s OS patch management feature also allows you to automate the deployment of patches to your VMs.
Source: Adapted from community discussion — MisterHairy
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
PCSE practice, question 141. 356 questions available.
Version 1.0.0. How we source questions