PCSE practice questions 201–210

1. Question 201 · 356 in bank

   A company has redundant mail servers in different Google Cloud Platform regions and wants to route customers to the nearest mail server based on location. How should the company accomplish this?

   • AConfigure TCP Proxy Load Balancing as a global load balancing service listening on port 995.
   • BCreate a Network Load Balancer to listen on TCP port 995 with a forwarding rule to forward traffic based on location.
   • CUse Cross-Region Load Balancing with an HTTP(S) load balancer to route traffic to the nearest region.
   • DUse Cloud CDN to route the mail traffic to the closest origin mail server based on client IP address.

   Show answer

   Answer: A

   Explanation

   Corrrect Answer is (A): TCP Proxy Load Balancing is implemented on GFEs that are distributed globally. If you choose the Premium Tier of Network Service Tiers, a TCP proxy load balancer is global. In Premium Tier, you can deploy backends in multiple regions, and the load balancer automatically directs user traffic to the closest region that has capacity. If you choose the Standard Tier, a TCP proxy load balancer can only direct traffic among backends in a single region. https://cloud.google.com/load-balancing/docs/load-balancing-overview#tcp-proxy-load-balancing

   Source: Adapted from community discussion — ESP_SAP

   References

   • Google Cloud documentation
   • Google Cloud documentation

   Next question

2. Question 202 · 356 in bank

   Your organization has an application hosted in Cloud Run. You must control access to the application by using Cloud Identity-Aware Proxy (IAP) with these requirements: • Only users from the AppDev group may have access. • Access must be restricted to internal network IP addresses. What should you do?

   • ADeploy a VPN gateway and instruct the AppDev group to connect to the company network before accessing the application.
   • BCreate an access level that includes conditions for internal IP address ranges and AppDev groups. Apply this access level to the application's IAP policy.
   • CConfigure firewall rules to limit access to IAP based on the AppDev group and source IP addresses.
   • DConfigure IAP to enforce multi-factor authentication (MFA) for all users and use network intrusion detection systems (NIDS) to block unauthorized access attempts.

   Show answer

   Answer: B

   References

   • Google Cloud documentation

   Next question

3. Question 203 · 356 in bank

   You just implemented a Secure Web Proxy instance on Google Cloud for your organization. You were able to reach the internet when you tested this configuration on your test instance. However, developers cannot access the allowed URLs on the Secure Web Proxy instance from their Linux instance on Google Cloud. You want to solve this problem with developers. What should you do?

   • AConfigure a Cloud NAT gateway to enable internet access from the developer instance subnet.
   • BEnsure that the developers have restarted their instance and HTTP service is enabled.
   • CEnsure that the developers have explicitly configured the proxy address on their instance.
   • DConfigure a firewall rule to allow HTTP/S from the developer instance.

   Show answer

   Answer: C

   References

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   Next question

4. Question 204 · 356 in bank

   You have just created a new log bucket to replace the _Default log bucket. You want to route all log entries that are currently routed to the _Default log bucket to this new log bucket, in the most efficient manner. What should you do?

   • ACreate exclusion filters for the _Default sink to prevent it from receiving new logs. Create a user-defined sink, and select the new log bucket as the sink destination.
   • BDisable the _Default sink. Create a user-defined sink and select the new log bucket as the sink destination.
   • CCreate a user-defined sink with inclusion filters copied from the _Default sink. Select the new log bucket as the sink destination.
   • DEdit the _Default sink, and select the new log bucket as the sink destination.

   Show answer

   Answer: D

   Explanation

   D is most efficient and is possible to do. I just checked in GCP b/c people using AI as their source in this forum is a major red flag

   Source: Adapted from community discussion — nah99

   References

   • Google Cloud documentation

   Next question

5. Question 205 · 356 in bank

   Your organization's use of the Google Cloud has grown substantially and there are many different groups using different cloud resources independently. You must identify common misconfigurations and compliance violations across the organization and track findings for remedial action in a dashboard. What should you do?

   • ACreate a filter set in Cloud Asset Inventory to identify service accounts with high privileges and IAM principals with Gmail domains.
   • BScan and alert vulnerabilities and misconfigurations by using Secure Health Analytics detectors in Security Command Center Premium.
   • CSet up filters on Cloud Audit Logs to flag log entries for specific, risky API calls, and display the calls in a Cloud Log Analytics dashboard.
   • DAlert and track emerging attacks detected in your environment by using Event Threat Detection detectors.

   Show answer

   Answer: B

   References

   • Google Cloud documentation

   Next question

6. Question 206 · 356 in bank

   You are responsible for a set of Cloud Functions running on your organization's Google Cloud environment. During the last annual security review, secrets were identified in environment variables of some of these Cloud Functions. You must ensure that secrets are identified in a timely manner. What should you do?

   • AImplement regular peer reviews to assess the environment variables and identify secrets in your Cloud Functions. Raise a security incident if secrets are discovered.
   • BImplement a Cloud Function that scans the environment variables multiple times a day, and creates a finding in Security Command Center if secrets are discovered.
   • CUse Sensitive Data Protection to scan the environment variables multiple times per day, and create a finding in Security Command Center if secrets are discovered.
   • DIntegrate dynamic application security testing into the CI/CD pipeline that scans the application code for the Cloud Functions. Fail the build process if secrets are discovered.

   Show answer

   Answer: C

   Explanation

   I think C: To perform secrets discovery, you create a discovery scan configuration at the organization or project level. Within your selected scope, Sensitive Data Protection periodically scans Cloud Run functions for secrets in build and runtime environment variables. If a secret is present in an environment variable, Sensitive Data Protection sends a Secrets in environment variables vulnerability finding to Security Command Center. No data profiles are generated. Any findings are only available through Security Command Center. Sensitive Data Protection generates a maximum of one finding per function. For example, if secrets are found in two environment variables in the same function, only one finding is generated in Security Command Center.

   Source: Adapted from community discussion — dat987

   References

   • Google Cloud documentation

   Next question

7. Question 207 · 356 in bank

   Your organization 1s developing a new SaaS application on Google Cloud. Stringent compliance standards require visibility into privileged account activity, and potentially unauthorized changes and misconfigurations to the application's infrastructure. You need to monitor administrative actions, log changes to IAM roles and permissions, and be able to trace potentially unauthorized configuration changes. What should you do?

   • ACreate log sinks to Cloud Storage for long-term retention. Set up log-based alerts in Cloud Logging based on relevant log types. Enable VPC Flow Logs for network visibility.
   • BDeploy Cloud IDS and activate Firewall Rules Logging. Create a custom dashboard in Security Command Center to visualize potential intrusion attempts.
   • CDetect sensitive administrative actions by using Cloud Logging with custom filters. Enable VPC Flow Logs with BigQuery exports for rapid analysis of network traffic patterns.
   • DEnable Event Threat Detection and Security Health Analytics in Security Command Center. Set up detailed logging for IAM-related activity and relevant project resources by deploying Cloud Audit Logs.

   Show answer

   Answer: D

   References

   • Google Cloud documentation

   Next question

8. Question 208 · 356 in bank

   Your application development team is releasing a new critical feature. To complete their final testing, they requested 10 thousand real transaction records. The new feature includes format checking on the primary account number (PAN) of a credit card. You must support the request and minimize the risk of unintended personally identifiable information (PII) exposure. What should you do?

   • ARun the new application by using Confidential Computing to ensure PII and card PAN is encrypted in use.
   • BScan and redact PII from the records by using the Cloud Data Loss Prevention API. Perform format-preserving encryption on the card PAN.
   • CEncrypt the records by using Cloud Key Management Service to protect the PII and card PAN.
   • DBuild a tool to replace the card PAN and PII fields with randomly generated values.

   Show answer

   Answer: B

   Explanation

   Answer B is correct. A - is missing this requirement - The new feature includes format checking on the primary account number (PAN) of a credit card. By encrypting you will not preserve the format.

   Source: Adapted from community discussion — brpjp

   References

   • Google Cloud documentation
   • Google Cloud documentation

   Next question

9. Question 209 · 356 in bank

   You work for a banking organization. You are migrating sensitive customer data to Google Cloud that is currently encrypted at rest while on-premises. There are strict regulatory requirements when moving sensitive data to the cloud. Independent of the cloud service provider, you must be able to audit key usage and be able to deny certain types of decrypt requests. You must choose an encryption strategy that will ensure robust security and compliance with the regulations. What should you do?

   • AUtilize Google default encryption and Cloud IAM to keep the keys within your organization's control.
   • BImplement Cloud External Key Manager (Cloud EKM) with Access Approval, to integrate with your existing on-premises key management solution.
   • CImplement Cloud External Key Manager (Cloud EKM) with Key Access Justifications to integrate with your existing one premises key management solution.
   • DUtilize customer-managed encryption keys (CMEK) created in a dedicated Google Compute Engine instance with Confidential Compute encryption, under your organization's control.

   Show answer

   Answer: C

   Explanation

   Answer is C. - Access Approval : This lets you control access to your organization's data by Google personnel. - Key Access Justifications : This provides a justification for every request to access keys stored in an external key manager.

   Source: Adapted from community discussion — json4u

   References

   • Google Cloud documentation
   • Google Cloud documentation

   Next question

10. Question 210 · 356 in bank

    Your organization is developing an application that will have both corporate and public end-users. You want to centrally manage those customers' identities and authorizations. Corporate end users must access the application by using their corporate user and domain name. What should you do?

    • AAdd the corporate and public end-user domains to domain restricted sharing on the organization.
    • BFederate the customers' identity provider (IdP) with Workforce Identity Federation in your application's project.
    • CDo nothing. Google Workspace identities will allow you to filter personal accounts and disable their access.
    • DUse a customer identity and access management tool (CIAM) like Identity Platform.

    Show answer

    Answer: D

    Explanation

    Obviously it's D. - Identity Platform : A customer identity and access management (CIAM) platform that lets users sign in to your applications and services. This is ideal for users who want to be their own identity provider, or who need the enterprise-ready functionality Identity Platform provides. - Workforce Identity Federation : This is an IAM feature that lets you configure and secure granular access for your workforce—employees and partners—by federating identities from an external identity provider (IdP).

    Source: Adapted from community discussion — json4u

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

PCSE practice, question 201. 356 questions available.