PCSE practice questions 21–30

1. Question 21 · 356 in bank

   You plan to deploy your cloud infrastructure using a CI/CD cluster hosted on Compute Engine. You want to minimize the risk of its credentials being stolen by a third party. What should you do?

   • ACreate a dedicated Cloud Identity user account for the cluster. Use a strong self-hosted vault solution to store the user's temporary credentials.
   • BCreate a dedicated Cloud Identity user account for the cluster. Enable the constraints/iam.disableServiceAccountCreation organization policy at the project level.
   • CCreate a custom service account for the cluster. Enable the constraints/iam.disableServiceAccountKeyCreation organization policy at the project level
   • DCreate a custom service account for the cluster. Enable the constraints/iam.allowServiceAccountCredentialLifetimeExtension organization policy at the project level.

   Show answer

   Answer: C

   Explanation

   Disable service account key creation You can use the iam.disableServiceAccountKeyCreation boolean constraint to disable the creation of new external service account keys. This allows you to control the use of unmanaged long-term credentials for service accounts. When this constraint is set, user-managed credentials cannot be created for service accounts in projects affected by the constraint. https://cloud.google.com/resource-manager/docs/organization-policy/restricting-service-accounts#example_policy_boolean_constraint

   Source: Adapted from community discussion — ExamQnA

   References

   • Google Cloud documentation

   Next question

2. Question 22 · 356 in bank

   You need to set up two network segments: one with an untrusted subnet and the other with a trusted subnet. You want to configure a virtual appliance such as a next-generation firewall (NGFW) to inspect all traffic between the two network segments. How should you design the network to inspect the traffic?

   • A1. Set up one VPC with two subnets: one trusted and the other untrusted. 2. Configure a custom route for all traffic (0.0.0.0/0) pointed to the virtual appliance.
   • B1. Set up one VPC with two subnets: one trusted and the other untrusted. 2. Configure a custom route for all RFC1918 subnets pointed to the virtual appliance.
   • C1. Set up two VPC networks: one trusted and the other untrusted, and peer them together. 2. Configure a custom route on each network pointed to the virtual appliance.
   • D1. Set up two VPC networks: one trusted and the other untrusted. 2. Configure a virtual appliance using multiple network interfaces, with each interface connected to one of the VPC networks.

   Show answer

   Answer: D

   Explanation

   Answer = D Multiple network interfaces. The simplest way to connect multiple VPC networks through a virtual appliance is by using multiple network interfaces, with each interface connecting to one of the VPC networks. Internet and on-premises connectivity is provided over one or two separate network interfaces. With many NGFW products, internet connectivity is connected through an interface marked as untrusted in the NGFW software.

   Source: Adapted from community discussion — mouchu

   References

   • Cisco documentation
   • Google Cloud documentation
   • Google Cloud documentation

   Next question

3. Question 23 · 356 in bank

   You are a member of your company's security team. You have been asked to reduce your Linux bastion host external attack surface by removing all public IP addresses. Site Reliability Engineers (SREs) require access to the bastion host from public locations so they can access the internal VPC while off-site. How should you enable this access?

   • AImplement Cloud VPN for the region where the bastion host lives.
   • BImplement OS Login with 2-step verification for the bastion host.
   • CImplement Identity-Aware Proxy TCP forwarding for the bastion host.
   • DImplement Google Cloud Armor in front of the bastion host.

   Show answer

   Answer: C

   Explanation

   To enable access to the bastion host from public locations while reducing the Linux bastion host external attack surface by removing all public IP addresses, you should implement Identity-Aware Proxy TCP forwarding for the bastion host. This will allow Site Reliability Engineers (SREs) to access the internal VPC while off-site. Identity-Aware Proxy TCP forwarding allows you to securely access TCP-based applications such as SSH and RDP without exposing them to the internet. It provides a secure way to access your applications by verifying user identity and context of the request before granting access. By implementing Identity-Aware Proxy TCP forwarding for the bastion host, you can ensure that only authorized users can access the internal VPC while off-site, reducing the risk of unauthorized access and data breaches.

   Source: Adapted from community discussion — Xoxoo

   References

   • Google Cloud documentation

   Next question

4. Question 24 · 356 in bank

   A customer deploys an application to App Engine and needs to check for Open Web Application Security Project (OWASP) vulnerabilities. Which service should be used to accomplish this?

   • ACloud Armor
   • BGoogle Cloud Audit Logs
   • CWeb Security Scanner
   • DAnomaly Detection

   Show answer

   Answer: C

   Explanation

   Answer is (C). Web Security Scanner supports categories in the OWASP Top Ten, a document that ranks and provides remediation guidance for the top 10 most critical web application security risks, as determined by the Open Web Application Security Project (OWASP). https://cloud.google.com/security-command-center/docs/concepts-web-security-scanner-overview#detectors_and_compliance

   Source: Adapted from community discussion — Tabayashi

   References

   • Google Cloud documentation

   Next question

5. Question 25 · 356 in bank

   You need to enable VPC Service Controls and allow changes to perimeters in existing environments without preventing access to resources. Which VPC Service Controls mode should you use?

   • ACloud Run
   • BNative
   • CEnforced
   • DDry run

   Show answer

   Answer: D

   Explanation

   Answer is (D). In dry run mode, requests that violate the perimeter policy are not denied, only logged. Dry run mode is used to test perimeter configuration and to monitor usage of services without preventing access to resources. https://cloud.google.com/vpc-service-controls/docs/dry-run-mode

   Source: Adapted from community discussion — Tabayashi

   References

   • Google Cloud documentation
   • Google Cloud documentation

   Next question

6. Question 26 · 356 in bank

   You manage your organization's Security Operations Center (SOC). You currently monitor and detect network traffic anomalies in your Google Cloud VPCs based on packet header information. However, you want the capability to explore network flows and their payload to aid investigations. Which Google Cloud product should you use?

   • AMarketplace IDS
   • BVPC Flow Logs
   • CVPC Service Controls logs
   • DPacket Mirroring
   • EGoogle Cloud Armor Deep Packet Inspection

   Show answer

   Answer: D

   Explanation

   Answer is (D). Packet Mirroring clones the traffic of specified instances in your Virtual Private Cloud (VPC) network and forwards it for examination. Packet Mirroring captures all traffic and packet data, including payloads and headers. https://cloud.google.com/vpc/docs/packet-mirroring

   Source: Adapted from community discussion — Tabayashi

   References

   • Google Cloud documentation

   Next question

7. Question 27 · 356 in bank

   Your organization acquired a new workload. The Web and Application (App) servers will be running on Compute Engine in a newly created custom VPC. You are responsible for configuring a secure network communication solution that meets the following requirements: ✑ Only allows communication between the Web and App tiers. ✑ Enforces consistent network security when autoscaling the Web and App tiers. ✑ Prevents Compute Engine Instance Admins from altering network traffic. What should you do?

   • A1. Configure all running Web and App servers with respective network tags. 2. Create an allow VPC firewall rule that specifies the target/source with respective network tags.
   • B1. Configure all running Web and App servers with respective service accounts. 2. Create an allow VPC firewall rule that specifies the target/source with respective service accounts.
   • C1. Re-deploy the Web and App servers with instance templates configured with respective network tags. 2. Create an allow VPC firewall rule that specifies the target/source with respective network tags.
   • D1. Re-deploy the Web and App servers with instance templates configured with respective service accounts. 2. Create an allow VPC firewall rule that specifies the target/source with respective service accounts.

   Show answer

   Answer: D

   Explanation

   The requirement can be fulfilled by both network tags and service accounts. To update both compute instances will have to be stopped. That means options A and B are out. Option C is out because Compute Engine Instance Admins can change network tags and avoid firewall rules. Deployment has to be done based on the instance template so that no configuration can be changed to divert the traffic.

   Source: Adapted from community discussion — csrazdan

   References

   • Google Cloud documentation
   • Google Cloud documentation

   Next question

8. Question 28 · 356 in bank

   You need to connect your organization's on-premises network with an existing Google Cloud environment that includes one Shared VPC with two subnets named Production and Non-Production. You are required to: ✑ Use a private transport link. ✑ Configure access to Google Cloud APIs through private API endpoints originating from on-premises environments. ✑ Ensure that Google Cloud APIs are only consumed via VPC Service Controls. What should you do?

   • A1. Set up a Cloud VPN link between the on-premises environment and Google Cloud. 2. Configure private access using the restricted.googleapis.com domains in on-premises DNS configurations.
   • B1. Set up a Partner Interconnect link between the on-premises environment and Google Cloud. 2. Configure private access using the private.googleapis.com domains in on-premises DNS configurations.
   • C1. Set up a Direct Peering link between the on-premises environment and Google Cloud. 2. Configure private access for both VPC subnets.
   • D1. Set up a Dedicated Interconnect link between the on-premises environment and Google Cloud. 2. Configure private access using the restricted.googleapis.com domains in on-premises DNS configurations.

   Show answer

   Answer: D

   Explanation

   Ans: D restricted.googleapis.com (199.36.153.4/30) only provides access to Cloud and Developer APIs that support VPC Service Controls. VPC Service Controls are enforced for these services https://cloud.google.com/vpc/docs/configure-private-google-access-hybrid

   Source: Adapted from community discussion — ExamQnA

   References

   • Google Cloud documentation

   Next question

9. Question 29 · 356 in bank

   You are working with protected health information (PHI) for an electronic health record system. The privacy officer is concerned that sensitive data is stored in the analytics system. You are tasked with anonymizing the sensitive data in a way that is not reversible. Also, the anonymized data should not preserve the character set and length. Which Google Cloud solution should you use?

   • ACloud Data Loss Prevention with deterministic encryption using AES-SIV
   • BCloud Data Loss Prevention with format-preserving encryption
   • CCloud Data Loss Prevention with cryptographic hashing
   • DCloud Data Loss Prevention with Cloud Key Management Service wrapped cryptographic keys

   Show answer

   Answer: C

   References

   • Google Cloud documentation
   • Google Cloud documentation

   Next question

10. Question 30 · 356 in bank

    Select 2

    You are setting up a CI/CD pipeline to deploy containerized applications to your production clusters on Google Kubernetes Engine (GKE). You need to prevent containers with known vulnerabilities from being deployed. You have the following requirements for your solution: Must be cloud-native -

    

    ✑ Must be cost-efficient ✑ Minimize operational overhead How should you accomplish this? (Choose two.)

    • ACreate a Cloud Build pipeline that will monitor changes to your container templates in a Cloud Source Repositories repository. Add a step to analyze Container Analysis results before allowing the build to continue.
    • BUse a Cloud Function triggered by log events in Google Cloud's operations suite to automatically scan your container images in Container Registry.
    • CUse a cron job on a Compute Engine instance to scan your existing repositories for known vulnerabilities and raise an alert if a non-compliant container image is found.
    • DDeploy Jenkins on GKE and configure a CI/CD pipeline to deploy your containers to Container Registry. Add a step to validate your container images before deploying your container to the cluster.
    • EIn your CI/CD pipeline, add an attestation on your container image when no vulnerabilities have been found. Use a Binary Authorization policy to block deployments of containers with no attestation in your cluster.

    Show answer

    Answer: AE

    Explanation

    AE is the answer. https://cloud.google.com/container-analysis/docs/container-analysis Container Analysis is a service that provides vulnerability scanning and metadata storage for containers. The scanning service performs vulnerability scans on images in Container Registry and Artifact Registry, then stores the resulting metadata and makes it available for consumption through an API. https://cloud.google.com/binary-authorization/docs/attestations After a container image is built, an attestation can be created to affirm that a required activity was performed on the image such as a regression test, vulnerability scan, or other test. The attestation is created by signing the image's unique digest. During deployment, instead of repeating the activities, Binary Authorization verifies the attestations using an attestor. If all of the attestations for an image are verified, Binary Authorization allows the image to be deployed.

    Source: Adapted from community discussion — zellck

    References

    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

PCSE practice, question 21. 356 questions available.