Google Professional Cloud Security Engineer356 questions across 36 pages are complete and free, with no account or card.
356 questions in this bank
Free access · progress saved on this device
You will create a new Service Account that should be able to list the Compute Engine instances in the project. You want to follow Google-recommended practices. What should you do?
Answer: B
Key here is "and grant the Service Account this role.". C and D are giving this role to ALL instances which is overly permissive. A is wrong. Only choice is B
Source: Adapted from community discussion — Roflcopter
In a shared security responsibility model for IaaS, which two layers of the stack does the customer share responsibility for? (Choose two.)
Answer: BD
An organization is starting to move its infrastructure from its on-premises environment to Google Cloud Platform (GCP). The first step the organization wants to take is to migrate its ongoing data backup and disaster recovery solutions to GCP. The organization's on-premises production environment is going to be the next phase for migration to GCP. Stable networking connectivity between the on-premises environment and GCP is also being implemented. Which GCP solution should the organization use?
Answer: B
To migrate ongoing data backup and disaster recovery solutions to Google Cloud Platform (GCP), the most suitable GCP solution for the organization would be Cloud Storage using a scheduled task and gsutil via Cloud Interconnect. This solution offers scalability, cost-efficiency, and features essential for backup and disaster recovery solutions. Cloud Storage provides a scalable object storage service that allows you to store and retrieve large amounts of data. By using a scheduled task and gsutil, you can automate the backup process and ensure that your data is securely stored in the cloud. Cloud Interconnect ensures stable networking connectivity between the on-premises environment and GCP, making it an ideal choice for migrating data backup and disaster recovery solutions
Source: Adapted from community discussion — Xoxoo
What are the steps to encrypt data using envelope encryption? A. ✑ Generate a data encryption key (DEK) locally. ✑ Use a key encryption key (KEK) to wrap the DEK. ✑ Encrypt data with the KEK. ✑ Store the encrypted data and the wrapped KEK. B. ✑ Generate a key encryption key (KEK) locally. ✑ Use the KEK to generate a data encryption key (DEK). ✑ Encrypt data with the DEK. ✑ Store the encrypted data and the wrapped DEK. C. ✑ Generate a data encryption key (DEK) locally. ✑ Encrypt data with the DEK. ✑ Use a key encryption key (KEK) to wrap the DEK. ✑ Store the encrypted data and the wrapped DEK. D. ✑ Generate a key encryption key (KEK) locally. ✑ Generate a data encryption key (DEK) locally. ✑ Encrypt data with the KEK. Store the encrypted data and the wrapped DEK.
This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.
Answer:
Reference: https://cloud.google.com/kms/docs/envelope-encryption
Source: Adapted from community discussion — Tabayashi
A customer wants to make it convenient for their mobile workforce to access a CRM web interface that is hosted on Google Cloud Platform (GCP). The CRM can only be accessed by someone on the corporate network. The customer wants to make it available over the internet. Your team requires an authentication layer in front of the application that supports two-factor authentication Which GCP product should the customer implement to meet these requirements?
Answer: A
My answer is going for A. Cloud IAP is integrated with Google Sign-in which Multi-factor authentication can be enabled. https://cloud.google.com/iap/docs/concepts-overview
Source: Adapted from community discussion — asee
Your company is storing sensitive data in Cloud Storage. You want a key generated on-premises to be used in the encryption process. What should you do?
Answer: C
The anwser is:C This is a Customer-supplied encryption keys (CSEK). We generate our own encryption key and manage it on-premises. A KEK never leaves Cloud KMS.There is no KEK or KMS on-premises. Encryption at rest by default, with various key management options https://cloud.google.com/security/encryption-at-rest
Source: Adapted from community discussion — HateMicrosoft
Last week, a company deployed a new App Engine application that writes logs to BigQuery. No other workloads are running in the project. You need to validate that all data written to BigQuery was done using the App Engine Default Service Account. What should you do?
Answer: A
A. 1. Use StackDriver Logging and filter on BigQuery Insert Jobs. 2. Click on the email address in line with the App Engine Default Service Account in the authentication field. 3. Click Hide Matching Entries. 4. Make sure the resulting list is empty.
Source: Adapted from community discussion — AwesomeGCP
Your team wants to limit users with administrative privileges at the organization level. Which two roles should your team restrict? (Choose two.)
Answer: AB
There is no such role as "Super Admin". There is a Super Admin user. which has the "Owner" role to the how Organisation. Answer is probably A and D.
Source: Adapted from community discussion — singhjoga
An organization's security and risk management teams are concerned about where their responsibility lies for certain production workloads they are running in Google Cloud and where Google's responsibility lies. They are mostly running workloads using Google Cloud's platform-as-a-Service (PaaS) offerings, including App Engine primarily. Which area in the technology stack should they focus on as their primary responsibility when using App Engine?
Answer: B
In PaaS, we're responsible for more controls than in IaaS, including network controls. You share responsibility with us for application-level controls and IAM management. You remain responsible for your data security and client protection. https://cloud.google.com/architecture/framework/security/shared-responsibility-shared-fate#defined_by_workloads
Source: Adapted from community discussion — GHOST1985
A customer implements Cloud Identity-Aware Proxy for their ERP system hosted on Compute Engine. Their security team wants to add a security layer so that the ERP systems only accept traffic from Cloud Identity-Aware Proxy. What should the customer do to meet these requirements?
Answer: A
Use Cryptographic Verification If there is a risk of IAP being turned off or bypassed, your app can check to make sure the identity information it receives is valid. This uses a third web request header added by IAP, called X-Goog-IAP-JWT-Assertion. The value of the header is a cryptographically signed object that also contains the user identity data. Your application can verify the digital signature and use the data provided in this object to be certain that it was provided by IAP without alteration. So answer is A
Source: Adapted from community discussion — bolu
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
PCSE practice, question 291. 356 questions available.
Version 1.0.0. How we source questions