PCSE practice questions 161–170

1. Question 161 · 356 in bank

   An administrative application is running on a virtual machine (VM) in a managed group at port 5601 inside a Virtual Private Cloud (VPC) instance without access to the internet currently. You want to expose the web interface at port 5601 to users and enforce authentication and authorization Google credentials. What should you do?

   • AConfigure the bastion host with OS Login enabled and allow connection to port 5601 at VPC firewall. Log in to the bastion host from the Google Cloud console by using SSH-in-browser and then to the web application.
   • BModify the VPC routing with the default route point to the default internet gateway. Modify the VPC Firewall rule to allow access from the internet 0.0.0.0/0 to port 5601 on the application instance.
   • CConfigure Secure Shell Access (SSH) bastion host in a public network, and allow only the bastion host to connect to the application on port 5601. Use a bastion host as a jump host to connect to the application.
   • DConfigure an HTTP Load Balancing instance that points to the managed group with Identity-Aware Proxy (IAP) protection with Google credentials. Modify the VPC firewall to allow access from IAP network range.

   Show answer

   Answer: D

   Explanation

   D. Configuring an HTTP Load Balancing instance with Identity-Aware Proxy (IAP) protection ensures that access to the web interface at port 5601 is authenticated and authorized using Google credentials. IAP verifies user identity before allowing access to the backend service.

   Source: Adapted from community discussion — glb2

   Next question

2. Question 162 · 356 in bank

   Your company’s users access data in a BigQuery table. You want to ensure they can only access the data during working hours. What should you do?

   • AAssign a BigQuery Data Viewer role along with an IAM condition that limits the access to specified working hours.
   • BRun a gsutil script that assigns a BigQuery Data Viewer role, and remove it only during the specified working hours.
   • CAssign a BigQuery Data Viewer role to a service account that adds and removes the users daily during the specified working hours.
   • DConfigure Cloud Scheduler so that it triggers a Cloud Functions instance that modifies the organizational policy constraint for BigQuery during the specified working hours.

   Show answer

   Answer: A

   Explanation

   The correct answer is A. Assign a BigQuery Data Viewer role along with an IAM condition that limits the access to specified working hours. IAM conditions in Google Cloud can be used to fine-tune access control according to attributes like time, date, and IP address. In this case, you can create an IAM condition that allows access only during working hours. This condition can be attached to the BigQuery Data Viewer role, ensuring that users can only access the data in the BigQuery table during the specified times.

   Source: Adapted from community discussion — MisterHairy

   References

   • Google Cloud documentation
   • Google Cloud documentation

   Next question

3. Question 163 · 356 in bank

   You have placed several Compute Engine instances in a private subnet. You want to allow these instances to access Google Cloud services, like Cloud Storage, without traversing the internet. What should you do?

   • AEnable Private Google Access for the private subnet.
   • BConfigure Private Service Connect for the private subnet's Virtual Private Cloud (VPC) and allocate an IP range for the Compute Engine instances.
   • CReserve and assign static external IP addresses for the Compute Engine instances.
   • DCreate a Cloud NAT gateway for the region where the private subnet is configured.

   Show answer

   Answer: A

   Explanation

   The correct answer is: A. Enable Private Google Access for the private subnet. Reasoning: Private Google Access: This feature allows instances in a private subnet to reach Google APIs and services without using their public IP addresses. This is the most direct and recommended way to achieve your goal.

   Source: Adapted from community discussion — Mr_MIXER007

   Next question

4. Question 164 · 356 in bank

   Your organization relies heavily on Cloud Run for its containerized applications. You utilize Cloud Build for image creation, Artifact Registry for image storage, and Cloud Run for deployment. You must ensure that containers with vulnerabilities rated above a common vulnerability scoring system (CVSS) score of "medium" are not deployed to production. What should you do?

   • AImplement vulnerability scanning as part of the Cloud Build process. If any medium or higher vulnerabilities are detected, manually rebuild the image with updated components.
   • BPerform manual vulnerability checks post-build, but before Cloud Run deployment. Implement a manual security-engineer-driven remediation process.
   • CConfigure Binary Authorization on Cloud Run to enforce image signatures. Create policies to allow deployment only for images passing a defined vulnerability threshold.
   • DUtilize a vulnerability scanner during the Cloud Build stage and set Artifact Registry permissions to block images containing vulnerabilities above "medium."

   Show answer

   Answer: C

   Explanation

   The best solution is C. Configure Binary Authorization on Cloud Run to enforce image signatures. Create policies to allow deployment only for images passing a defined vulnerability threshold. Here's why this is the preferred approach: Binary Authorization: Provides a strong, policy-based control mechanism for deploying containers. It ensures only trusted and verified images can be deployed to Cloud Run. Vulnerability Threshold: By setting a policy within Binary Authorization, you can explicitly block the deployment of any container images that have vulnerabilities exceeding a CVSS score of "medium". Automation: This approach enables automated enforcement of security standards at the deployment stage, preventing vulnerable images from reaching production.

   Source: Adapted from community discussion — Mr_MIXER007

   References

   • Google Cloud documentation

   Next question

5. Question 165 · 356 in bank

   You run a web application on top of Cloud Run that is exposed to the internet with an Application Load Balancer. You want to ensure that only privileged users from your organization can access the application. The proposed solution must support browser access with single sign-on. What should you do?

   • AChange Cloud Run configuration to require authentication. Assign the role of Cloud Run Invoker to the group of privileged users.
   • BCreate a group of privileged users in Cloud Identity. Assign the role of Cloud Run User to the group directly on the Cloud Run service.
   • CChange the Ingress Control configuration of Cloud Run to internal and create firewall rules to allow only access from known IP addresses.
   • DActivate Identity-Aware Proxy (IAP) on the Application Load Balancer backend. Assign the role of IAP-secured Web App User to the group of privileged users.

   Show answer

   Answer: D

   Explanation

   The correct answer is D. Activate Identity-Aware Proxy (IAP) on the Application Load Balancer backend. Assign the role of IAP-secured Web App User to the group of privileged users. Here's why: IAP for Authentication and Authorization: IAP provides a centralized way to control access to your Cloud Run service, ensuring that only authenticated users can reach it. It integrates seamlessly with Cloud Identity for user management and supports single sign-on (SSO) for a smooth user experience. Role-Based Access Control: By assigning the IAP-secured Web App User role to the group of privileged users, you can precisely control who has access to the application.

   Source: Adapted from community discussion — Mr_MIXER007

   Next question

6. Question 166 · 356 in bank

   During a routine security review, your team discovered a suspicious login attempt to impersonate a highly privileged but regularly used service account by an unknown IP address. You need to effectively investigate in order to respond to this potential security incident. What should you do?

   • AEnable Cloud Audit Logs for the resources that the service account interacts with. Review the logs for further evidence of unauthorized activity.
   • BReview Cloud Audit Logs for activity related to the service account. Focus on the time period of the suspicious login attempt.
   • CRun a vulnerability scan to identify potentially exploitable weaknesses in systems that use the service account.
   • DCheck Event Threat Detection in Security Command Center for any related alerts. Cross-reference your findings with Cloud Audit Logs.

   Show answer

   Answer: D

   Explanation

   D. Check Event Threat Detection in Security Command Center for any related alerts. Cross-reference your findings with Cloud Audit Logs. Explanation: Security Command Center (SCC) is Google Cloud's security and risk management platform. Event Threat Detection within SCC is specifically designed to detect suspicious activity, such as unauthorized logins, and generates alerts based on predefined threat patterns. This tool would help you quickly identify if the suspicious login attempt is part of a known threat pattern. After checking for alerts in Event Threat Detection, cross-referencing with Cloud Audit Logs will give you detailed insights into the actions performed by the service account, allowing you to investigate the extent of any potential breach.

   Source: Adapted from community discussion — 1e22522

   Next question

7. Question 167 · 356 in bank

   Your organization has an operational image classification model running on a managed AI service on Google Cloud. You are in a configuration review with stakeholders and must describe the security responsibilities for the image classification model. What should you do?

   • AExplain that using platform-as-a-service (PaaS) transfers security concerns to Google. Describe the need for strict API usage limits to protect against unexpected usage and billing spikes.
   • BExplain the security aspects of the code that transforms user-uploaded images using Google's service. Define Cloud IAM for fine-grained access control within the development team.
   • CExplain Google's shared responsibility model. Focus the configuration review on Identity and Access Management (IAM) permissions, secure data upload/download procedures, and monitoring logs for any potential malicious activity.
   • DExplain the development of custom network firewalls around the image classification service for deep intrusion detection and prevention. Describe vulnerability scanning tools for known vulnerabilities.

   Show answer

   Answer: C

   References

   • Google Cloud documentation

   Next question

8. Question 168 · 356 in bank

   Your team needs to configure their Google Cloud Platform (GCP) environment so they can centralize the control over networking resources like firewall rules, subnets, and routes. They also have an on-premises environment where resources need access back to the GCP resources through a private VPN connection. The networking resources will need to be controlled by the network security team. Which type of networking design should your team use to meet these requirements?

   • AShared VPC Network with a host project and service projects
   • BGrant Compute Admin role to the networking team for each engineering project
   • CVPC peering between all engineering projects using a hub and spoke model
   • DCloud VPN Gateway between all engineering projects using a hub and spoke model

   Show answer

   Answer: A

   Explanation

   Reference: https://cloud.google.com/docs/enterprise/best-practices-for-enterprise-organizations#centralize_network_control

   Source: Adapted from community discussion — ArizonaClassics

   References

   • Google Cloud documentation
   • Google Cloud documentation

   Next question

9. Question 169 · 356 in bank

   You are managing data in your organization's Cloud Storage buckets and are required to retain objects. To reduce storage costs, you must automatically downgrade the storage class of objects older than 365 days to Coldline storage. What should you do?

   • AUse Cloud Asset Inventory to generate a report of the configuration of all storage buckets. Examine the Lifecycle management policy settings and ensure that they are set correctly.
   • BSet up a CloudRun Job with Cloud Scheduler to execute a script that searches for and removes flies older than 365 days from your Cloud Storage.
   • CEnable the Autoclass feature to manage all aspects of bucket storage classes.
   • DDefine a lifecycle policy JSON with an action on SetStorageClass to COLDLINE with an age condition of 365 and matchStorageClass STANDARD.

   Show answer

   Answer: D

   Next question

10. Question 170 · 356 in bank

    Your organization has a centralized identity provider that is used to manage human and machine access. You want to leverage this existing identity management system to enable on-premises applications to access Google Cloud without hard coded credentials. What should you do?

    • AEnable Secure Web Proxy. Create a proxy subnet for each region that Secure Web Proxy will be deployed. Deploy an SSL certificate to Certificate Manager. Create a Secure Web Proxy policy and rules that allow access to Google Cloud services.
    • BEnable Workforce Identity Federation. Create a workforce identity pool and specify the on-premises identity provider as a workforce identity pool provider. Create an attribute mapping to map the on-premises identity provider token to a Google STS token. Create an IAM binding that binds the required role(s) to the external identity by specifying the project ID, workload identity pool, and attribute that should be matched.
    • CEnable Identity-Aware Proxy (IAP). Configure IAP by specifying the groups and service accounts that should have access to the application. Grant these identities the IAP-secured web app user role.
    • DEnable Workload Identity Federation. Create a workload identity pool and specify the on-premises identity provider as a workload identity pool provider. Create an attribute mapping to map the on-premises identity provider token to a Google STS token. Create a service account with the necessary permissions for the workload. Grant the external identity the Workload Identity user role on the service account.

    Show answer

    Answer: D

    Explanation

    It's D "You want to leverage this existing identity management system to enable on-premises applications to access Google Cloud without hard coded credentials" Workload Identity Federation is used for applications when Workforce Identity Federation is used for humans

    Source: Adapted from community discussion — Art

    References

    • Google Cloud documentation
    • Google Cloud documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

PCSE practice, question 161. 356 questions available.