PCSE practice questions 261–270

1. Question 261 · 356 in bank

   Your company is using GSuite and has developed an application meant for internal usage on Google App Engine. You need to make sure that an external user cannot gain access to the application even when an employee's password has been compromised. What should you do?

   • AEnforce 2-factor authentication in GSuite for all users.
   • BConfigure Cloud Identity-Aware Proxy for the App Engine Application.
   • CProvision user passwords using GSuite Password Sync.
   • DConfigure Cloud VPN between your private network and GCP.

   Show answer

   Answer: A

   Explanation

   I was thinking the same thing. Turns out IAP ensures security by enforcing 2FA. So at the end of the day, 2FA is the real solution. 2FA without IAP would still address the risk. IAP without 2FA might not. https://cloud.google.com/iap/docs/configuring-reauth#supported_reauthentication_methods

   Source: Adapted from community discussion — [Removed]

   References

   • support.google.com documentation
   • Google Cloud documentation

   Next question

2. Question 262 · 356 in bank

   A large financial institution is moving its Big Data analytics to Google Cloud Platform. They want to have maximum control over the encryption process of data stored at rest in BigQuery. What technique should the institution use?

   • AUse Cloud Storage as a federated Data Source.
   • BUse a Cloud Hardware Security Module (Cloud HSM).
   • CCustomer-managed encryption keys (CMEK).
   • DCustomer-supplied encryption keys (CSEK).

   Show answer

   Answer: C

   Explanation

   CSEK is only supported in Google Cloud Storage and Compute Engine, therefore D cannot be the right answer. Ideally, it would be client-side encryption, with BigQuery providing another round of encryption of the encrypted data - https://cloud.google.com/bigquery/docs/encryption-at-rest#client_side_encryption, but since that is not one of the options, we can go with C as the next best option.

   Source: Adapted from community discussion — Ganshank

   References

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   Next question

3. Question 263 · 356 in bank

   A company is deploying their application on Google Cloud Platform. Company policy requires long-term data to be stored using a solution that can automatically replicate data over at least two geographic places. Which Storage solution are they allowed to use?

   • ACloud Bigtable
   • BCloud BigQuery
   • CCompute Engine SSD Disk
   • DCompute Engine Persistent Disk

   Show answer

   Answer: B

   Explanation

   https://cloud.google.com/bigquery#:~:text=BigQuery%20transparently%20and%20automatically%20provides,charge%20and%20no%20additional%20setup.&text=BigQuery%20also%20provides%20ODBC%20and,interact%20with%20its%20powerful%20engine. Answer is B. BigQuery transparently and automatically provides highly durable, replicated storage in multiple locations and high availability with no extra charge and no additional setup. @xhova: https://cloud.google.com/bigquery-transfer/docs/locations What it mentions here is once you create a replication. YOu cannot change a location. Here the question is about high availability. synchronous replication.

   Source: Adapted from community discussion — ronron89

   References

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   Next question

4. Question 264 · 356 in bank

   A large e-retailer is moving to Google Cloud Platform with its ecommerce website. The company wants to ensure payment information is encrypted between the customer's browser and GCP when the customers checkout online. What should they do?

   • AConfigure an SSL Certificate on an L7 Load Balancer and require encryption.
   • BConfigure an SSL Certificate on a Network TCP Load Balancer and require encryption.
   • CConfigure the firewall to allow inbound traffic on port 443, and block all other inbound traffic.
   • DConfigure the firewall to allow outbound traffic on port 443, and block all other outbound traffic.

   Show answer

   Answer: A

   Explanation

   Correct Answer is (A): he type of traffic that you need your load balancer to handle is another factor in determining which load balancer to use: For HTTP and HTTPS traffic, use: External HTTP(S) Load Balancing https://cloud.google.com/load-balancing/docs/load-balancing-overview#external_versus_internal_load_balancing

   Source: Adapted from community discussion — ESP_SAP

   References

   • Google Cloud documentation

   Next question

5. Question 265 · 356 in bank

   Select 2

   Applications often require access to `secrets` - small pieces of sensitive data at build or run time. The administrator managing these secrets on GCP wants to keep a track of `who did what, where, and when?` within their GCP projects. Which two log streams would provide the information that the administrator is looking for? (Choose two.)

   • AAdmin Activity logs
   • BSystem Event logs
   • CData Access logs
   • DVPC Flow logs
   • EAgent logs

   Show answer

   Answer: AC

   References

   • Google Cloud documentation
   • Google Cloud documentation

   Next question

6. Question 266 · 356 in bank

   You are in charge of migrating a legacy application from your company datacenters to GCP before the current maintenance contract expires. You do not know what ports the application is using and no documentation is available for you to check. You want to complete the migration without putting your environment at risk. What should you do?

   • AMigrate the application into an isolated project using a ג€Lift & Shiftג€ approach. Enable all internal TCP traffic using VPC Firewall rules. Use VPC Flow logs to determine what traffic should be allowed for the application to work properly.
   • BMigrate the application into an isolated project using a ג€Lift & Shiftג€ approach in a custom network. Disable all traffic within the VPC and look at the Firewall logs to determine what traffic should be allowed for the application to work properly.
   • CRefactor the application into a micro-services architecture in a GKE cluster. Disable all traffic from outside the cluster using Firewall Rules. Use VPC Flow logs to determine what traffic should be allowed for the application to work properly.
   • DRefactor the application into a micro-services architecture hosted in Cloud Functions in an isolated project. Disable all traffic from outside your project using Firewall Rules. Use VPC Flow logs to determine what traffic should be allowed for the application to work properly.

   Show answer

   Answer: A

   Explanation

   Agree "Disable all traffic within the VPC and look at the Firewall logs to determine what traffic should be allowed for the application to work properly." if you disable all the VPC traffic there will be nothing to look into firewall logs.

   Source: Adapted from community discussion — mynk29

   Next question

7. Question 267 · 356 in bank

   Select 2

   When creating a secure container image, which two items should you incorporate into the build if possible? (Choose two.)

   • AEnsure that the app does not run as PID 1.
   • BPackage a single app as a container.
   • CRemove any unnecessary tools not needed by the app.
   • DUse public container images as a base image for the app.
   • EUse many container image layers to hide sensitive information.

   Show answer

   Answer: BC

   Explanation

   You don't usually want your container to get killed instantly - you want to see the SIGINT or SIGTERM command and respond. For example, in a webserver you may stop accepting connections, and respond to the remaining open ones, before calling exit()

   Source: Adapted from community discussion — lollo1234

   References

   • Google Cloud documentation

   Next question

8. Question 268 · 356 in bank

   Your company has deployed an application on Compute Engine. The application is accessible by clients on port 587. You need to balance the load between the different instances running the application. The connection should be secured using TLS, and terminated by the Load Balancer. What type of Load Balancing should you use?

   • ANetwork Load Balancing
   • BHTTP(S) Load Balancing
   • CTCP Proxy Load Balancing
   • DSSL Proxy Load Balancing

   Show answer

   Answer: D

   Explanation

   Although both TCP Proxy LB and SSL Proxy LB support port 587 but only SSL Proxy LB support TLS. Hence 'D' is the right answer.

   Source: Adapted from community discussion — smart123

   References

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   Next question

9. Question 269 · 356 in bank

   You want to limit the images that can be used as the source for boot disks. These images will be stored in a dedicated project. What should you do?

   • AUse the Organization Policy Service to create a compute.trustedimageProjects constraint on the organization level. List the trusted project as the whitelist in an allow operation.
   • BUse the Organization Policy Service to create a compute.trustedimageProjects constraint on the organization level. List the trusted projects as the exceptions in a deny operation.
   • CIn Resource Manager, edit the project permissions for the trusted project. Add the organization as member with the role: Compute Image User.
   • DIn Resource Manager, edit the organization permissions. Add the project ID as member with the role: Compute Image User.

   Show answer

   Answer: A

   Explanation

   To limit the images that can be used as the source for boot disks and store these images in a dedicated project, you should use option A: A. Use the Organization Policy Service to create a compute.trustedimageProjects constraint on the organization level. List the trusted project as the whitelist in an allow operation. Here's why this option is appropriate: Organization-Wide Control: Creating an organization-level constraint allows you to enforce the policy organization-wide, ensuring consistent image usage across all projects within the organization. Whitelist Approach: By listing the trusted project as a whitelist in an "allow" operation, you explicitly specify which project can be trusted as the source for boot disks. This is a more secure approach because it only allows specific trusted projects. Dedicated Project: You mentioned that the images are stored in a dedicated project, and this option aligns with that requirement.

   Source: Adapted from community discussion — Xoxoo

   References

   • Google Cloud documentation

   Next question

10. Question 270 · 356 in bank

    Select 2

    Your team needs to prevent users from creating projects in the organization. Only the DevOps team should be allowed to create projects on behalf of the requester. Which two tasks should your team perform to handle this request? (Choose two.)

    • ARemove all users from the Project Creator role at the organizational level.
    • BCreate an Organization Policy constraint, and apply it at the organizational level.
    • CGrant the Project Editor role at the organizational level to a designated group of users.
    • DAdd a designated group of users to the Project Creator role at the organizational level.
    • EGrant the billing account creator role to the designated DevOps team.

    Show answer

    Answer: AD

    Explanation

    I think Ans is AD Because we need to stop the users can create project first (A), and allow devops team to create project (D)

    Source: Adapted from community discussion — mlyu

    References

    • Google Cloud documentation
    • Google Cloud documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

PCSE practice, question 261. 356 questions available.