PCSE practice questions 251–260

1. Question 251 · 356 in bank

   You are a member of the security team at an organization. Your team has a single GCP project with credit card payment processing systems alongside web applications and data processing systems. You want to reduce the scope of systems subject to PCI audit standards. What should you do?

   • AUse multi-factor authentication for admin access to the web application.
   • BUse only applications certified compliant with PA-DSS.
   • CMove the cardholder data environment into a separate GCP project.
   • DUse VPN for all connections between your office and cloud environments.

   Show answer

   Answer: C

   Explanation

   The Answer is C. Check "Setting up your payment-processing environment" section in https://cloud.google.com/solutions/pci-dss-compliance-in-gcp. In the question, it is mentioned that it is the same environment for card processing as the Web App and Data processing and that is not recommended.

   Source: Adapted from community discussion — smart123

   References

   • Google Cloud documentation
   • Google Cloud documentation

   Next question

2. Question 252 · 356 in bank

   A retail customer allows users to upload comments and product reviews. The customer needs to make sure the text does not include sensitive data before the comments or reviews are published. Which Google Cloud Service should be used to achieve this?

   • ACloud Key Management Service
   • BCloud Data Loss Prevention API
   • CBigQuery
   • DWeb Security Scanner

   Show answer

   Answer: B

   Next question

3. Question 253 · 356 in bank

   A company allows every employee to use Google Cloud Platform. Each department has a Google Group, with all department members as group members. If a department member creates a new project, all members of that department should automatically have read-only access to all new project resources. Members of any other department should not have access to the project. You need to configure this behavior. What should you do to meet these requirements?

   • ACreate a Folder per department under the Organization. For each department's Folder, assign the Project Viewer role to the Google Group related to that department.
   • BCreate a Folder per department under the Organization. For each department's Folder, assign the Project Browser role to the Google Group related to that department.
   • CCreate a Project per department under the Organization. For each department's Project, assign the Project Viewer role to the Google Group related to that department.
   • DCreate a Project per department under the Organization. For each department's Project, assign the Project Browser role to the Google Group related to that department.

   Show answer

   Answer: A

   Explanation

   Shouldn't it be A? Project Browser has least permissions comparing to Project Viewer. The question is about have read-access to all new project resources. roles/browser - Read access to browse the hierarchy for a project, including the folder, organization, and IAM policy. This role doesn't include permission to view resources in the project. https://cloud.google.com/iam/docs/understanding-roles#project-roles

   Source: Adapted from community discussion — ownez

   References

   • Google Cloud documentation
   • Google Cloud documentation

   Next question

4. Question 254 · 356 in bank

   A customer's internal security team must manage its own encryption keys for encrypting data on Cloud Storage and decides to use customer-supplied encryption keys (CSEK). How should the team complete this task?

   • AUpload the encryption key to a Cloud Storage bucket, and then upload the object to the same bucket.
   • BUse the gsutil command line tool to upload the object to Cloud Storage, and specify the location of the encryption key.
   • CGenerate an encryption key in the Google Cloud Platform Console, and upload an object to Cloud Storage using the specified key.
   • DEncrypt the object, then use the gsutil command line tool or the Google Cloud Platform Console to upload the object to Cloud Storage.

   Show answer

   Answer: B

   Explanation

   The fact is, both B & D would work. I lean towards B because it allows you to manage the file using GCP tools later as long as you keep that key around. B is definitely incomplete though, as the boto file does need to be updated.

   Source: Adapted from community discussion — FatCharlie

   References

   • Google Cloud documentation
   • Google Cloud documentation

   Next question

5. Question 255 · 356 in bank

   Select 2

   A customer has 300 engineers. The company wants to grant different levels of access and efficiently manage IAM permissions between users in the development and production environment projects. Which two steps should the company take to meet these requirements? (Choose two.)

   • ACreate a project with multiple VPC networks for each environment.
   • BCreate a folder for each development and production environment.
   • CCreate a Google Group for the Engineering team, and assign permissions at the folder level.
   • DCreate an Organizational Policy constraint for each folder environment.
   • ECreate projects for each environment, and grant IAM rights to each engineering user.

   Show answer

   Answer: BC

   Explanation

   B is correct But, if you make 1 group (by choosing option C) how you manage the permission for dev environment ? since you have only 1 group, you will offer the same access for all 300 engineers (that are in that group) to dev and prod environment, so this will not answer the question: efficiently manage IAM permissions between users in the development and production environment projects

   Source: Adapted from community discussion — danielklein09

   References

   • Google Cloud documentation

   Next question

6. Question 256 · 356 in bank

   Your team wants to centrally manage GCP IAM permissions from their on-premises Active Directory Service. Your team wants to manage permissions by AD group membership. What should your team do to meet these requirements?

   • ASet up Cloud Directory Sync to sync groups, and set IAM permissions on the groups.
   • BSet up SAML 2.0 Single Sign-On (SSO), and assign IAM permissions to the groups.
   • CUse the Cloud Identity and Access Management API to create groups and IAM permissions from Active Directory.
   • DUse the Admin SDK to create groups and assign IAM permissions from Active Directory.

   Show answer

   Answer: A

   Explanation

   Correct Answer is A as explained here https://www.udemy.com/course/google-security-engineer-certification/?referralCode=E90E3FF49D9DE15E2855 "In order to be able to keep using the existing identity management system, identities need to be synchronized between AD and GCP IAM. To do so google provides a tool called Cloud Directory Sync. This tool will read all identities in AD and replicate those within GCP. Once the identities have been replicated then it's possible to apply IAM permissions on the groups. After that you will configure SAML so google can act as a service provider and either you ADFS or other third party tools like Ping or Okta will act as the identity provider. This way you effectively delegate the authentication from Google to something that is under your control."

   Source: Adapted from community discussion — johnsm

   References

   • Google Cloud documentation

   Next question

7. Question 257 · 356 in bank

   You want to evaluate your organization's Google Cloud instance for PCI compliance. You need to identify Google's inherent controls. Which document should you review to find the information?

   • AGoogle Cloud Platform: Customer Responsibility Matrix
   • BPCI DSS Requirements and Security Assessment Procedures
   • CPCI SSC Cloud Computing Guidelines
   • DProduct documentation for Compute Engine

   Show answer

   Answer: A

   Explanation

   The answer is A. Google Cloud Platform: Customer Responsibility Matrix. This document outlines the responsibilities of both the customer and Google for securing the cloud environment and is an important resource for understanding Google's inherent controls for PCI compliance. The PCI DSS Requirements and Security Assessment Procedures and the PCI SSC Cloud Computing Guidelines are both helpful resources for understanding the PCI compliance requirements, but they do not provide information on Google's specific inherent controls. The product documentation for Compute Engine is focused on the technical aspects of using that service and is unlikely to provide a comprehensive overview of Google's inherent controls.

   Source: Adapted from community discussion — aashissh

   References

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   Next question

8. Question 258 · 356 in bank

   Your company runs a website that will store PII on Google Cloud Platform. To comply with data privacy regulations, this data can only be stored for a specific amount of time and must be fully deleted after this specific period. Data that has not yet reached the time period should not be deleted. You want to automate the process of complying with this regulation. What should you do?

   • AStore the data in a single Persistent Disk, and delete the disk at expiration time.
   • BStore the data in a single BigQuery table and set the appropriate table expiration time.
   • CStore the data in a single Cloud Storage bucket and configure the bucket's Time to Live.
   • DStore the data in a single BigTable table and set an expiration time on the column families.

   Show answer

   Answer: C

   Explanation

   I believe the Answer is C not B. This isn't data which needs to be analyzed, so I don't understand why would it be stored in BQ when having data stored in GCS seems much more reasonable. I think the only thing about answer C which throws me off is the fact that they don't mention object life cycle management

   Source: Adapted from community discussion — KILLMAD

   References

   • Google Cloud documentation
   • Google Cloud documentation

   Next question

9. Question 259 · 356 in bank

   A DevOps team will create a new container to run on Google Kubernetes Engine. As the application will be internet-facing, they want to minimize the attack surface of the container. What should they do?

   • AUse Cloud Build to build the container images.
   • BBuild small containers using small base images.
   • CDelete non-used versions from Container Registry.
   • DUse a Continuous Delivery tool to deploy the application.

   Show answer

   Answer: B

   Explanation

   Ans is B Small containers usually have a smaller attack surface as compared to containers that use large base images. https://cloud.google.com/blog/products/gcp/kubernetes-best-practices-how-and-why-to-build-small-container-images

   Source: Adapted from community discussion — xhova

   References

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   Next question

10. Question 260 · 356 in bank

    While migrating your organization's infrastructure to GCP, a large number of users will need to access GCP Console. The Identity Management team already has a well-established way to manage your users and want to keep using your existing Active Directory or LDAP server along with the existing SSO password. What should you do?

    • AManually synchronize the data in Google domain with your existing Active Directory or LDAP server.
    • BUse Google Cloud Directory Sync to synchronize the data in Google domain with your existing Active Directory or LDAP server.
    • CUsers sign in directly to the GCP Console using the credentials from your on-premises Kerberos compliant identity provider.
    • DUsers sign in using OpenID (OIDC) compatible IdP, receive an authentication token, then use that token to log in to the GCP Console.

    Show answer

    Answer: B

    Explanation

    D sounds nice, but the user doesn't "use" the token.... that's used in the integration with Cloud Identity. So answer must be B, GCDS

    Source: Adapted from community discussion — rr4444

    References

    • Google Cloud documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

PCSE practice, question 251. 356 questions available.