PCSE practice questions 11–20

1. Question 11 · 356 in bank

   An organization is moving applications to Google Cloud while maintaining a few mission-critical applications on-premises. The organization must transfer the data at a bandwidth of at least 50 Gbps. What should they use to ensure secure continued connectivity between sites?

   • ADedicated Interconnect
   • BCloud Router
   • CCloud VPN
   • DPartner Interconnect

   Show answer

   Answer: A

   Explanation

   "A" I think the keyword here is "at least" 50 Gbps. Partner interconnect seems to max go up to 50 Gbps but Dedicated Interconnect can guarantee that throughput https://cloud.google.com/network-connectivity/docs/interconnect/concepts/overview

   Source: Adapted from community discussion — [Removed]

   References

   • Google Cloud documentation

   Next question

2. Question 12 · 356 in bank

   Your organization has had a few recent DDoS attacks. You need to authenticate responses to domain name lookups. Which Google Cloud service should you use?

   • ACloud DNS with DNSSEC
   • BCloud NAT
   • CHTTP(S) Load Balancing
   • DGoogle Cloud Armor

   Show answer

   Answer: A

   Explanation

   Answer is (A). The Domain Name System Security Extensions (DNSSEC) is a feature of the Domain Name System (DNS) that authenticates responses to domain name lookups. It does not provide privacy protections for those lookups, but prevents attackers from manipulating or poisoning the responses to DNS requests. https://cloud.google.com/dns/docs/dnssec

   Source: Adapted from community discussion — Tabayashi

   References

   • Google Cloud documentation

   Next question

3. Question 13 · 356 in bank

   A customer needs to prevent attackers from hijacking their domain/IP and redirecting users to a malicious site through a man-in-the-middle attack. Which solution should this customer use?

   • AVPC Flow Logs
   • BCloud Armor
   • CDNS Security Extensions
   • DCloud Identity-Aware Proxy

   Show answer

   Answer: C

   Explanation

   Correct Answer is (C): DNSSEC — use a DNS registrar that supports DNSSEC, and enable it. DNSSEC digitally signs DNS communication, making it more difficult (but not impossible) for hackers to intercept and spoof. Domain Name System Security Extensions (DNSSEC) adds security to the Domain Name System (DNS) protocol by enabling DNS responses to be validated. Having a trustworthy Domain Name System (DNS) that translates a domain name like www.example.com into its associated IP address is an increasingly important building block of today’s web-based applications. Attackers can hijack this process of domain/IP lookup and redirect users to a malicious site through DNS hijacking and man-in-the-middle attacks. DNSSEC helps mitigate the risk of such attacks by cryptographically signing DNS records. As a result, it prevents attackers from issuing fake DNS responses that may misdirect browsers to nefarious websites. https://cloud.google.com/blog/products/gcp/dnssec-now-available-in-cloud-dns

   Source: Adapted from community discussion — ESP_SAP

   References

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   Next question

4. Question 14 · 356 in bank

   Your Security team believes that a former employee of your company gained unauthorized access to Google Cloud resources some time in the past 2 months by using a service account key. You need to confirm the unauthorized access and determine the user activity. What should you do?

   • AUse Security Health Analytics to determine user activity.
   • BUse the Cloud Monitoring console to filter audit logs by user.
   • CUse the Cloud Data Loss Prevention API to query logs in Cloud Storage.
   • DUse the Logs Explorer to search for user activity.

   Show answer

   Answer: D

   Explanation

   "D" A- Health Analytics - Managed Vulnerability Assessment. Not related. B- DLP - Filtering/Masing Sensitive Data. Not Related C- Cloud Monitoring - Perf metrics (e.g. availability). Not related D- Log Explorer - Log analysis. Related. Great for investigations. References: https://cloud.google.com/monitoring https://cloud.google.com/docs/security/compromised-credentials#look_for_unauthorized_access_and_resources

   Source: Adapted from community discussion — [Removed]

   References

   • Google Cloud documentation
   • Google Cloud documentation

   Next question

5. Question 15 · 356 in bank

   Your company requires the security and network engineering teams to identify all network anomalies within and across VPCs, internal traffic from VMs to VMs, traffic between end locations on the internet and VMs, and traffic between VMs to Google Cloud services in production. Which method should you use?

   • ADefine an organization policy constraint.
   • BConfigure packet mirroring policies.
   • CEnable VPC Flow Logs on the subnet.
   • DMonitor and analyze Cloud Audit Logs.

   Show answer

   Answer: B

   Explanation

   I think the answer is (C). VPC Flow Logs samples each VM's TCP, UDP, ICMP, ESP, and GRE flows. Both inbound and outbound flows are sampled. These flows can be between the VM and another VM, a host in your on-premises data center, a Google service, or a host on the internet. https://cloud.google.com/vpc/docs/flow-logs

   Source: Adapted from community discussion — Tabayashi

   References

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   Next question

6. Question 16 · 356 in bank

   Your company has been creating users manually in Cloud Identity to provide access to Google Cloud resources. Due to continued growth of the environment, you want to authorize the Google Cloud Directory Sync (GCDS) instance and integrate it with your on-premises LDAP server to onboard hundreds of users. You are required to: ✑ Replicate user and group lifecycle changes from the on-premises LDAP server in Cloud Identity. ✑ Disable any manually created users in Cloud Identity. You have already configured the LDAP search attributes to include the users and security groups in scope for Google Cloud. What should you do next to complete this solution?

   • A1. Configure the option to suspend domain users not found in LDAP. 2. Set up a recurring GCDS task.
   • B1. Configure the option to delete domain users not found in LDAP. 2. Run GCDS after user and group lifecycle changes.
   • C1. Configure the LDAP search attributes to exclude manually created Cloud Identity users not found in LDAP. 2. Set up a recurring GCDS task.
   • D1. Configure the LDAP search attributes to exclude manually created Cloud Identity users not found in LDAP. 2. Run GCDS after user and group lifecycle changes.

   Show answer

   Answer: A

   Explanation

   Answer is (A). To achieve the requirement "Disable any manually created users in Cloud Identity", configure GCDS to suspend rather than delete accounts if user accounts are not found in the LDAP directory in GCDS. Ref: https://support.google.com/a/answer/7177267

   Source: Adapted from community discussion — mT3

   References

   • support.google.com documentation
   • Google Cloud documentation
   • Google Cloud documentation

   Next question

7. Question 17 · 356 in bank

   You are troubleshooting access denied errors between Compute Engine instances connected to a Shared VPC and BigQuery datasets. The datasets reside in a project protected by a VPC Service Controls perimeter. What should you do?

   • AAdd the host project containing the Shared VPC to the service perimeter.
   • BAdd the service project where the Compute Engine instances reside to the service perimeter.
   • CCreate a service perimeter between the service project where the Compute Engine instances reside and the host project that contains the Shared VPC.
   • DCreate a perimeter bridge between the service project where the Compute Engine instances reside and the perimeter that contains the protected BigQuery datasets.

   Show answer

   Answer: A

   Explanation

   (A) For VMs inside shared VPC, the host project needs to be added to the perimeter as well. I had real-life experience with this. However, this creates new security issues as all other VMs in other projects which are attached to shared subnets in the same host project then are also able to access the perimeter. Google recommends setting up Private Service Connect Endpoints to achieve subnet segregation for VPC-SC usage with Host projects.

   Source: Adapted from community discussion — risc

   References

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   Next question

8. Question 18 · 356 in bank

   You recently joined the networking team supporting your company's Google Cloud implementation. You are tasked with familiarizing yourself with the firewall rules configuration and providing recommendations based on your networking and Google Cloud experience. What product should you recommend to detect firewall rules that are overlapped by attributes from other firewall rules with higher or equal priority?

   • ASecurity Command Center
   • BFirewall Rules Logging
   • CVPC Flow Logs
   • DFirewall Insights

   Show answer

   Answer: D

   Explanation

   D is the answer. https://cloud.google.com/network-intelligence-center/docs/firewall-insights/concepts/overview#shadowed-firewall-rules Firewall Insights analyzes your firewall rules to detect firewall rules that are shadowed by other rules. A shadowed rule is a firewall rule that has all of its relevant attributes, such as its IP address and port ranges, overlapped by attributes from one or more rules with higher or equal priority, called shadowing rules.

   Source: Adapted from community discussion — zellck

   References

   • Google Cloud documentation

   Next question

9. Question 19 · 356 in bank

   The security operations team needs access to the security-related logs for all projects in their organization. They have the following requirements: ✑ Follow the least privilege model by having only view access to logs. ✑ Have access to Admin Activity logs. ✑ Have access to Data Access logs. ✑ Have access to Access Transparency logs. Which Identity and Access Management (IAM) role should the security operations team be granted?

   • Aroles/logging.privateLogViewer
   • Broles/logging.admin
   • Croles/viewer
   • Droles/logging.viewer

   Show answer

   Answer: A

   Explanation

   Answer = A roles/logging.privateLogViewer (Private Logs Viewer) includes all the permissions contained by roles/logging.viewer, plus the ability to read Data Access audit logs in the _Default bucket.

   Source: Adapted from community discussion — mouchu

   References

   • Google Cloud documentation
   • Google Cloud documentation
   • Google developer documentation
   • Google Cloud documentation

   Next question

10. Question 20 · 356 in bank

    You are exporting application logs to Cloud Storage. You encounter an error message that the log sinks don't support uniform bucket-level access policies. How should you resolve this error?

    • AChange the access control model for the bucket
    • BUpdate your sink with the correct bucket destination.
    • CAdd the roles/logging.logWriter Identity and Access Management (IAM) role to the bucket for the log sink identity.
    • DAdd the roles/logging.bucketWriter Identity and Access Management (IAM) role to the bucket for the log sink identity.

    Show answer

    Answer: A

    Explanation

    https://cloud.google.com/logging/docs/export/troubleshoot Unable to grant correct permissions to the destination: Even if the sink was successfully created with the correct service account permissions, this error message displays if the access control model for the Cloud Storage bucket was set to uniform access when the bucket was created. For existing Cloud Storage buckets, you can change the access control model for the first 90 days after bucket creation by using the Permissions tab. For new buckets, select the Fine-grained access control model during bucket creation. For details, see Creating Cloud Storage buckets.

    Source: Adapted from community discussion — mikesp

    References

    • Google Cloud documentation
    • Google Cloud documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

PCSE practice, question 11. 356 questions available.