Question 281 · 356 in bank
A manager wants to start retaining security event logs for 2 years while minimizing costs. You write a filter to select the appropriate log entries. Where should you export the logs?
Show answer
Answer: B
Google Professional Cloud Security Engineer356 questions across 36 pages are complete and free, with no account or card.
356 questions in this bank
Free access · progress saved on this device
A manager wants to start retaining security event logs for 2 years while minimizing costs. You write a filter to select the appropriate log entries. Where should you export the logs?
Answer: B
For compliance reasons, an organization needs to ensure that in-scope PCI Kubernetes Pods reside on `in-scope` Nodes only. These Nodes can only contain the `in-scope` Pods. How should the organization achieve this objective?
Answer: C
[A] Correct answer. This is a typical use case for node selector. https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#nodeselector [B] The Pod Security Policy is designed to block the creation of misconfigured pods on certain clusters. This does not meet the requirements. [C] Taint will no longer place pods without the "inscope" label on that node, but it does not guarantee that pods with the "inscope" label will be placed on that node. [D] Placing the "in scope" node in the namespace "in-scope-pci" may meet the requirement, but [A] takes precedence.
Source: Adapted from community discussion — Tabayashi
In an effort for your company messaging app to comply with FIPS 140-2, a decision was made to use GCP compute and network services. The messaging app architecture includes a Managed Instance Group (MIG) that controls a cluster of Compute Engine instances. The instances use Local SSDs for data caching and UDP for instance-to-instance communications. The app development team is willing to make any changes necessary to comply with the standard Which options should you recommend to meet the requirements?
Answer: A
when I revisited this, Now I think A is correct. In A - We will use an approved encryption method for encrypting Local SSD and VM to VM communication. In B and D, we are still using GCP's encryption algorithms and are not FIPS 140-2 approved. Moreover only the BoringCrypto is FIPS 140-2 approved and not the Boring SSL. I see A as evidently correct. ownez, genesis3k, MohitA has explained this and provided the right links too.
Source: Adapted from community discussion — subhala
A customer has an analytics workload running on Compute Engine that should have limited internet access. Your team created an egress firewall rule to deny (priority 1000) all traffic to the internet. The Compute Engine instances now need to reach out to the public repository to get security updates. What should your team do?
Answer: B
Answer: B https://cloud.google.com/vpc/docs/firewalls#rule_assignment The priority of the second rule determines whether TCP traffic to port 80 is allowed for the webserver targets: If the priority of the second rule is set to a number greater than 1000, it has a lower priority, so the first rule denying all traffic applies. If the priority of the second rule is set to 1000, the two rules have identical priorities, so the first rule denying all traffic applies. If the priority of the second rule is set to a number less than 1000, it has a higher priority, thus allowing traffic on TCP 80 for the webserver targets. Absent other rules, the first rule would still deny other types of traffic to the webserver targets, and it would also deny all traffic, including TCP 80, to instances without the webserver tag.
Source: Adapted from community discussion — ronron89
You want data on Compute Engine disks to be encrypted at rest with keys managed by Cloud Key Management Service (KMS). Cloud Identity and Access Management (IAM) permissions to these keys must be managed in a grouped way because the permissions should be the same for all keys. What should you do?
Answer: B
B. Create a single KeyRing for all persistent disks and all Keys in this KeyRing. Manage the IAM permissions at the KeyRing level.
Source: Adapted from community discussion — AwesomeGCP
A company is backing up application logs to a Cloud Storage bucket shared with both analysts and the administrator. Analysts should only have access to logs that do not contain any personally identifiable information (PII). Log files containing PII should be stored in another bucket that is only accessible by the administrator. What should you do?
Answer: A
A. Use Cloud Pub/Sub and Cloud Functions to trigger a Data Loss Prevention scan every time a file is uploaded to the shared bucket. If the scan detects PII, have the function move into a Cloud Storage bucket only accessible by theadministrator.
Source: Adapted from community discussion — AwesomeGCP
A customer terminates an engineer and needs to make sure the engineer's Google account is automatically deprovisioned. What should the customer do?
Answer: C
Agree with C. "https://cloud.google.com/identity/solutions/automate-user-provisioning#cloud_identity_automated_provisioning" "Cloud Identity has a catalog of automated provisioning connectors, which act as a bridge between Cloud Identity and third-party cloud apps."
Source: Adapted from community discussion — ownez
An organization is evaluating the use of Google Cloud Platform (GCP) for certain IT workloads. A well-established directory service is used to manage user identities and lifecycle management. This directory service must continue for the organization to use as the `source of truth` directory for identities. Which solution meets the organization's requirements?
Answer: A
The answer is A: With Google Cloud Directory Sync (GCDS), you can synchronize the data in your Google Account with your Microsoft Active Directory or LDAP server. GCDS doesn't migrate any content (such as email messages, calendar events, or files) to your Google Account. You use GCDS to synchronize your Google users, groups, and shared contacts to match the information in your LDAP server. The questions says the well established directory service is the 'source of truth' not GCP... So LDAP or AD is the source... GCDS will sync that to match those, not replace them...
Source: Adapted from community discussion — desertlotus1211
A company is running workloads in a dedicated server room. They must only be accessed from within the private company network. You need to connect to these workloads from Compute Engine instances within a Google Cloud Platform project. Which two approaches can you take to meet the requirements? (Choose two.)
Answer: AC
To connect to the workloads in the dedicated server room from Compute Engine instances within a Google Cloud Platform project while ensuring access is only from within the private company network, you can use Cloud VPN and Cloud Interconnect: A. Cloud VPN: This allows you to set up a secure, encrypted connection between your Google Cloud project and your on-premises network. With Cloud VPN, you can establish a VPN tunnel to the dedicated server room, ensuring private network connectivity. C. Cloud Interconnect: If you require a more dedicated and high-performance connection, you can set up Cloud Interconnect, which provides direct, low-latency connectivity between your Google Cloud project and your on-premises data center. It's suitable for scenarios where high bandwidth and reliability are crucial.
Source: Adapted from community discussion — Xoxoo
Which international compliance standard provides guidelines for information security controls applicable to the provision and use of cloud services?
Answer: C
Yes, My answer also goes to C and my last compliance related project is also working on ISO27017 in order to extend the scope to Cloud service user/provider.
Source: Adapted from community discussion — asee
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
PCSE practice, question 281. 356 questions available.
Version 1.0.0. How we source questions