PCSE practice questions 231–240

1. Question 231 · 356 in bank

   You must ensure that the keys used for at-rest encryption of your data are compliant with your organization's security controls. One security control mandates that keys get rotated every 90 days. You must implement an effective detection strategy to validate if keys are rotated as required. What should you do?

   • AAnalyze the crypto key versions of the keys by using data from Cloud Asset Inventory. If an active key is older than 90 days, send an alert message through your incident notification channel.
   • BAssess the keys in the Cloud Key Management Service by implementing code in Cloud Run. If a key is not rotated after 90 days, raise a finding in Security Command Center.
   • CDefine a metric that checks for timely key updates by using Cloud Logging. If a key is not rotated after 90 days, send an alert message through your incident notification channel.
   • DIdentify keys that have not been rotated by using Security Health Analytics. If a key is not rotated after 90 days, a finding in Security Command Center is raised.

   Show answer

   Answer: D

   Explanation

   D - Security Health Analytics: Security Health Analytics is a specialized tool designed to assess the security posture of your Google Cloud environment. It can effectively identify keys that have not been rotated within the specified timeframe. Finding in Security Command Center: Raising a finding in Security Command Center ensures that the non-compliance issue is clearly documented and can be addressed promptly. Efficiency: Security Health Analytics provides a streamlined and efficient way to monitor key rotation compliance without requiring custom code or manual analysis.

   Source: Adapted from community discussion — abdelrahman89

   References

   • Google Cloud documentation

   Next question

2. Question 232 · 356 in bank

   Your organization is developing a sophisticated machine learning (ML) model to predict customer behavior for targeted marketing campaigns. The BigQuery dataset used for training includes sensitive personal information. You must design the security controls around the AI/ML pipeline. Data privacy must be maintained throughout the model’s lifecycle and you must ensure that personal data is not used in the training process. Additionally, you must restrict access to the dataset to an authorized subset of people only. What should you do?

   • ADe-identify sensitive data before model training by using Cloud Data Loss Prevention (DLP)APIs. and implement strict Identity and Access Management (IAM) policies to control access to BigQuery.
   • BImplement Identity-Aware Proxy to enforce context-aware access to BigQuery and models based on user identity and device.
   • CImplement at-rest encryption by using customer-managed encryption keys (CMEK) for the pipeline. Implement strict Identity and Access Management (IAM) policies to control access to BigQuery.
   • DDeploy the model on Confidential VMs for enhanced protection of data and code while in use. Implement strict Identity and Access Management (IAM) policies to control access to BigQuery.

   Show answer

   Answer: A

   Next question

3. Question 233 · 356 in bank

   Your organization wants to publish yearly reports of your website usage analytics. You must ensure that no data with personally identifiable information (PII) is published by using the Cloud Data Loss Prevention (Cloud DLP) API. Data integrity must be preserved. What should you do?

   • ADetect all PII in storage by using the Cloud DLP API. Create a cloud function to delete the PII.
   • BDiscover and quarantine your PII data in your storage by using the Cloud DLP API.
   • CDiscover and transform PII data in your reports by using the Cloud DLP API.
   • DEncrypt the PII from the report by using the Cloud DLP API.

   Show answer

   Answer: C

   Explanation

   C - Data Discovery: Cloud DLP API can effectively discover PII within your reports, identifying sensitive information that needs to be protected. Data Transformation: Once PII is detected, Cloud DLP can transform it into a format that removes personally identifiable elements, such as anonymization or generalization. This ensures that the data remains usable for analytics purposes while protecting privacy. Data Integrity: By transforming PII rather than deleting it, you preserve the overall structure and context of the data, maintaining its integrity for analysis.

   Source: Adapted from community discussion — abdelrahman89

   Next question

4. Question 234 · 356 in bank

   Your development team is launching a new application. The new application has a microservices architecture on Compute Engine instances and serverless components, including Cloud Functions. This application will process financial transactions that require temporary, highly sensitive data in memory. You need to secure data in use during computations with a focus on minimizing the risk of unauthorized access to memory for this financial application. What should you do?

   • AEnable Confidential VM instances for Compute Engine, and ensure that relevant Cloud Functions can leverage hardware-based memory isolation.
   • BUse data masking and tokenization techniques on sensitive financial data fields throughout the application and the application's data processing workflows.
   • CUse the Cloud Data Loss Prevention (Cloud DLP) API to scan and mask sensitive data before feeding the data into any compute environment.
   • DStore all sensitive data during processing in Cloud Storage by using customer-managed encryption keys (CMEK), and set strict bucket-level permissions.

   Show answer

   Answer: A

   Explanation

   A - Confidential VMs: Using Confidential VMs provides a strong security boundary around the memory of the VM instances, protecting sensitive data from unauthorized access, even if the VM is compromised. Hardware-Based Memory Isolation: Leveraging hardware-based memory isolation ensures that the data within the VM's memory is protected by hardware-enforced mechanisms, making it significantly more difficult for attackers to access. Comprehensive Protection: This approach provides a comprehensive solution for securing data in use, as it combines both software-based (Confidential VMs) and hardware-based (memory isolation) protections.

   Source: Adapted from community discussion — abdelrahman89

   Next question

5. Question 235 · 356 in bank

   An organization is starting to move its infrastructure from its on-premises environment to Google Cloud Platform (GCP). The first step the organization wants to take is to migrate its current data backup and disaster recovery solutions to GCP for later analysis. The organization's production environment will remain on- premises for an indefinite time. The organization wants a scalable and cost-efficient solution. Which GCP solution should the organization use?

   • ABigQuery using a data pipeline job with continuous updates
   • BCloud Storage using a scheduled task and gsutil
   • CCompute Engine Virtual Machines using Persistent Disk
   • DCloud Datastore using regularly scheduled batch upload jobs

   Show answer

   Answer: B

   Explanation

   The keyword in the question here is "cost-effective". Out of the 3 Disaster Recovery patterns (Cold, Warm, Hot HA), Cold is the most cost-effective which utilizes cloud storage. References: https://cloud.google.com/architecture/dr-scenarios-for-applications#cold-pattern-recovery-to-gcp https://cloud.google.com/architecture/dr-scenarios-planning-guide#use-cloud-storage-as-part-of-your-daily-backup-routine

   Source: Adapted from community discussion — [Removed]

   References

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   Next question

6. Question 236 · 356 in bank

   You work for a financial organization in a highly regulated industry that is subject to active regulatory compliance. To meet compliance requirements, you need to continuously maintain a specific set of configurations, data residency, organizational policies, and personnel data access controls. What should you do?

   • AApply an organizational policy constraint at the organization level to limit the location of new resource creation.
   • BCreate an Assured Workloads folder for your required compliance program to apply defined controls and requirements.
   • CGo to the Compliance page in Security Command Center. View the report for your status against the required compliance standard. Triage violations to maintain compliance on a regular basis.
   • DCreate a posture.yaml file with the required security compliance posture. Apply the posture with the gcloud scc postures create POSTURE_NAME --posture-from-file=posture.yaml command in Security Command Center Premium.

   Show answer

   Answer: B

   References

   • Google Cloud documentation
   • Google Cloud documentation

   Next question

7. Question 237 · 356 in bank

   Your organization is worried about recent news headlines regarding application vulnerabilities in production applications that have led to security breaches. You want to automatically scan your deployment pipeline for vulnerabilities and ensure only scanned and verified containers can run in the environment. What should you do?

   • AUse Kubernetes role-based access control (RBAC) as the source of truth for cluster access by granting “container.clusters.get” to limited users. Restrict deployment access by allowing these users to generate a kubeconfig file containing the configuration access to the GKE cluster.
   • BUse gcloud artifacts docker images describe LOCATION-docker.pkg.dev/PROJECT_ID/REPOSITORY/IMAGE_ID@sha256:HASH --show-package-vulnerability in your CI/CD pipeline, and trigger a pipeline failure for critical vulnerabilities.
   • CEnforce the use of Cloud Code for development so users receive real-time security feedback on vulnerable libraries and dependencies before they check in their code.
   • DEnable Binary Authorization and create attestations of scans.

   Show answer

   Answer: D

   References

   • Google Cloud documentation
   • Google Cloud documentation

   Next question

8. Question 238 · 356 in bank

   A team at your organization collects logs in an on-premises security information and event management system (SIEM). You must provide a subset of Google Cloud logs for the SIEM, and minimize the risk of data exposure in your cloud environment. What should you do?

   • ACreate a new BigQuery dataset. Stream all logs to this dataset. Provide the on-premises SIEM system access to the data in BigQuery by using workload identity federation and let the SIEM team filter for the relevant log data.
   • BDefine a log view for the relevant logs. Provide access to the log view to a principal from your on-premises identity provider by using workforce identity federation.
   • CCreate a log sink for the relevant logs. Send the logs to Pub/Sub. Retrieve the logs from Pub/Sub and push the logs to the SIEM by using Dataflow.
   • DFilter for the relevant logs. Store the logs in a Cloud Storage bucket. Grant the service account access to the bucket. Provide the service account key to the SIEM team.

   Show answer

   Answer: C

   Explanation

   Why C is Correct: Log Sink for Filtering: A log sink allows you to filter and export only the relevant logs, ensuring unnecessary data is not sent, which reduces the risk of data exposure. Pub/Sub for Delivery: Exporting logs to Pub/Sub enables real-time streaming of filtered logs to external systems. This ensures the SIEM receives logs promptly and securely. Dataflow for Transformation and Transfer: Use Dataflow to process and transform logs as needed before pushing them to the on-premises SIEM.

   Source: Adapted from community discussion — BPzen

   Next question

9. Question 239 · 356 in bank

   Your Google Cloud organization is subdivided into three folders: production, development, and networking, Networking resources for the organization are centrally managed in the networking folder. You discovered that projects in the production folder are attaching to Shared VPCs that are outside of the networking folder which could become a data exfiltration risk. You must resolve the production folder issue without impacting the development folder. You need to use the most efficient and least disruptive approach. What should you do?

   • AEnable the Restrict Shared VPC Host Projects organization policy on the production folder. Create a custom rule and configure the policy type to Allow. In the Custom value section, enter under:folders/networking.
   • BEnable the Restrict Shared VPC Host Projects organization policy on the networking folder only. Create a new custom rule and configure the policy type to Allow. In the Custom value section, enter under:organizations/123456739123.
   • CEnable the Restrict Shared VPC Host Projects organization policy at the project level for each of the production projects. Create a custom rule and configure the policy type to Allow. In the Custom value section, enter under:folders/networking.
   • DEnable the Restrict Shared VPC Host Projects organization policy at the organization level. Create a custom rule and configure the policy type to Allow. In the Custom value section, enter under:folders/networking.

   Show answer

   Answer: A

   Next question

10. Question 240 · 356 in bank

    Your organization operates in a highly regulated environment and has a stringent set of compliance requirements for protecting customer data. You must encrypt data while in use to meet regulations. What should you do?

    • AEnable the use of customer-supplied encryption keys (CSEK) keys in the Google Compute Engine VMs to give your organization maximum control over their VM disk encryption.
    • BEstablish a trusted execution environment with a Confidential VM.
    • CUse a Shielded VM to ensure a secure boot with integrity monitoring for the application environment.
    • DUse customer-managed encryption keys (CMEK) and Cloud KSM to enable your organization to control their keys for data encryption in Cloud SQL.

    Show answer

    Answer: B

    References

    • Google Cloud documentation
    • Google Cloud documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

PCSE practice, question 231. 356 questions available.