PCSE practice questions 301–310

1. Question 301 · 356 in bank

   An engineering team is launching a web application that will be public on the internet. The web application is hosted in multiple GCP regions and will be directed to the respective backend based on the URL request. Your team wants to avoid exposing the application directly on the internet and wants to deny traffic from a specific list of malicious IP addresses. Which solution should your team implement to meet these requirements?

   • ACloud Armor
   • BNetwork Load Balancing
   • CSSL Proxy Load Balancing
   • DNAT Gateway

   Show answer

   Answer: A

   Explanation

   you are correct. Answer is A The Cloud armor able to directed user traffic to an external HTTP(S) load balancer enters the PoP closest to the user in Premium Tier. https://cloud.google.com/armor/docs/security-policy-overview#edge-security

   Source: Adapted from community discussion — mlyu

   References

   • Google Cloud documentation

   Next question

2. Question 302 · 356 in bank

   Select 2

   A customer is running an analytics workload on Google Cloud Platform (GCP) where Compute Engine instances are accessing data stored on Cloud Storage. Your team wants to make sure that this workload will not be able to access, or be accessed from, the internet. Which two strategies should your team use to meet these requirements? (Choose two.)

   • AConfigure Private Google Access on the Compute Engine subnet
   • BAvoid assigning public IP addresses to the Compute Engine cluster.
   • CMake sure that the Compute Engine cluster is running on a separate subnet.
   • DTurn off IP forwarding on the Compute Engine instances in the cluster.
   • EConfigure a Cloud NAT gateway.

   Show answer

   Answer: AB

   Explanation

   A,B Has to be A and B together. A (Private Google Access) has minimal effect on instances with public IP so we also need to avoid assigning public IP to get the desired (internal only) effect. https://cloud.google.com/vpc/docs/private-google-access

   Source: Adapted from community discussion — [Removed]

   References

   • Google Cloud documentation

   Next question

3. Question 303 · 356 in bank

   A customer wants to run a batch processing system on VMs and store the output files in a Cloud Storage bucket. The networking and security teams have decided that no VMs may reach the public internet. How should this be accomplished?

   • ACreate a firewall rule to block internet traffic from the VM.
   • BProvision a NAT Gateway to access the Cloud Storage API endpoint.
   • CEnable Private Google Access.
   • DMount a Cloud Storage bucket as a local filesystem on every VM.

   Show answer

   Answer: C

   Explanation

   The ask is to store the output files in a Cloud storage bucket. "The networking and security teams have decided that no VMs may reach the public internet" - No VMs MAY reach public internet but not 'MUST'. Hence 'C' is the answer

   Source: Adapted from community discussion — nilopo

   References

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   Next question

4. Question 304 · 356 in bank

   As adoption of the Cloud Data Loss Prevention (Cloud DLP) API grows within your company, you need to optimize usage to reduce cost. Cloud DLP target data is stored in Cloud Storage and BigQuery. The location and region are identified as a suffix in the resource name. Which cost reduction options should you recommend?

   • ASet appropriate rowsLimit value on BigQuery data hosted outside the US and set appropriate bytesLimitPerFile value on multiregional Cloud Storage buckets.
   • BSet appropriate rowsLimit value on BigQuery data hosted outside the US, and minimize transformation units on multiregional Cloud Storage buckets.
   • CUse rowsLimit and bytesLimitPerFile to sample data and use CloudStorageRegexFileSet to limit scans.
   • DUse FindingLimits and TimespanContfig to sample data and minimize transformation units.

   Show answer

   Answer: C

   Explanation

   To optimize usage of the Cloud Data Loss Prevention (Cloud DLP) API and reduce cost, you should consider using sampling and CloudStorageRegexFileSet to limit scans 1. By sampling data, you can limit the amount of data that the DLP API scans, thereby reducing costs 1. You can use the rowsLimit and bytesLimitPerFile options to sample data and limit scans to specific files in Cloud Storage 1. You can also use CloudStorageRegexFileSet to limit scans to only specific files in Cloud Storage 1. In addition, you can set appropriate rowsLimit value on BigQuery data hosted outside the US to further optimize usage and reduce costs 1.

   Source: Adapted from community discussion — Xoxoo

   References

   • Google Cloud documentation
   • Google Cloud documentation

   Next question

5. Question 305 · 356 in bank

   Your team uses a service account to authenticate data transfers from a given Compute Engine virtual machine instance of to a specified Cloud Storage bucket. An engineer accidentally deletes the service account, which breaks application functionality. You want to recover the application as quickly as possible without compromising security. What should you do?

   • ATemporarily disable authentication on the Cloud Storage bucket.
   • BUse the undelete command to recover the deleted service account.
   • CCreate a new service account with the same name as the deleted service account.
   • DUpdate the permissions of another existing service account and supply those credentials to the applications.

   Show answer

   Answer: B

   Explanation

   "B" Answer is B however the documentation has been updated. Not all links in other comments are valid still. Here's the latest link around this topic. https://cloud.google.com/iam/docs/service-accounts-delete-undelete#undeleting

   Source: Adapted from community discussion — [Removed]

   References

   • Google Cloud documentation
   • Google Cloud documentation

   Next question

6. Question 306 · 356 in bank

   You are the Security Admin in your company. You want to synchronize all security groups that have an email address from your LDAP directory in Cloud IAM. What should you do?

   • AConfigure Google Cloud Directory Sync to sync security groups using LDAP search rules that have ג€user email addressג€ as the attribute to facilitate one-way sync.
   • BConfigure Google Cloud Directory Sync to sync security groups using LDAP search rules that have ג€user email addressג€ as the attribute to facilitate bidirectional sync.
   • CUse a management tool to sync the subset based on the email address attribute. Create a group in the Google domain. A group created in a Google domain will automatically have an explicit Google Cloud Identity and Access Management (IAM) role.
   • DUse a management tool to sync the subset based on group object class attribute. Create a group in the Google domain. A group created in a Google domain will automatically have an explicit Google Cloud Identity and Access Management (IAM) role.

   Show answer

   Answer: A

   Explanation

   A. Configure Google Cloud Directory Sync to sync security groups using LDAP search rules that have “user email address” as the attribute to facilitate one-way sync.

   Source: Adapted from community discussion — AwesomeGCP

   References

   • support.google.com documentation
   • support.google.com documentation

   Next question

7. Question 307 · 356 in bank

   You are part of a security team investigating a compromised service account key. You need to audit which new resources were created by the service account. What should you do?

   • AQuery Data Access logs.
   • BQuery Admin Activity logs.
   • CQuery Access Transparency logs.
   • DQuery Stackdriver Monitoring Workspace.

   Show answer

   Answer: B

   Explanation

   "Admin Activity audit logs contain log entries for API calls or other administrative actions that modify the configuration or metadata of resources. For example, these logs record when users create VM instances or change Identity and Access Management permissions". This is exactly what you want to see. What resources were created by the SA? https://cloud.google.com/logging/docs/audit#admin-activity

   Source: Adapted from community discussion — FatCharlie

   References

   • Google Cloud documentation
   • Google Cloud documentation

   Next question

8. Question 308 · 356 in bank

   You have an application where the frontend is deployed on a managed instance group in subnet A and the data layer is stored on a mysql Compute Engine virtual machine (VM) in subnet B on the same VPC. Subnet A and Subnet B hold several other Compute Engine VMs. You only want to allow the application frontend to access the data in the application's mysql instance on port 3306. What should you do?

   • AConfigure an ingress firewall rule that allows communication from the src IP range of subnet A to the tag "data-tag" that is applied to the mysql Compute Engine VM on port 3306.
   • BConfigure an ingress firewall rule that allows communication from the frontend's unique service account to the unique service account of the mysql Compute Engine VM on port 3306.
   • CConfigure a network tag "fe-tag" to be applied to all instances in subnet A and a network tag "data-tag" to be applied to all instances in subnet B. Then configure an egress firewall rule that allows communication from Compute Engine VMs tagged with data-tag to destination Compute Engine VMs tagged fe- tag.
   • DConfigure a network tag "fe-tag" to be applied to all instances in subnet A and a network tag "data-tag" to be applied to all instances in subnet B. Then configure an ingress firewall rule that allows communication from Compute Engine VMs tagged with fe-tag to destination Compute Engine VMs tagged with data-tag.

   Show answer

   Answer: B

   Explanation

   "B" I believe the answer is between B and A since part of the requirement is specifying the port. B is more correct since it leverages service accounts which is best practice for authentication/communication between application and database. Also, answer "A" allows ALL instances in the subnet to reach to reach mysql which is not desired. They only want the specific Frontend instances to reach excluding other instances in the subnet. https://cloud.google.com/firewall/docs/firewalls#best_practices_for_firewall_rules

   Source: Adapted from community discussion — [Removed]

   References

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   Next question

9. Question 309 · 356 in bank

   Your company operates an application instance group that is currently deployed behind a Google Cloud load balancer in us-central-1 and is configured to use the Standard Tier network. The infrastructure team wants to expand to a second Google Cloud region, us-east-2. You need to set up a single external IP address to distribute new requests to the instance groups in both regions. What should you do?

   • AChange the load balancer backend configuration to use network endpoint groups instead of instance groups.
   • BChange the load balancer frontend configuration to use the Premium Tier network, and add the new instance group.
   • CCreate a new load balancer in us-east-2 using the Standard Tier network, and assign a static external IP address.
   • DCreate a Cloud VPN connection between the two regions, and enable Google Private Access.

   Show answer

   Answer: B

   Explanation

   In Premium Tier: Backends can be in any region and any VPC network. In Standard Tier: Backends must be in the same region as the forwarding rule, but can be in any VPC network.

   Source: Adapted from community discussion — Fellipo

   References

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   Next question

10. Question 310 · 356 in bank

    You are the security admin of your company. You have 3,000 objects in your Cloud Storage bucket. You do not want to manage access to each object individually. You also do not want the uploader of an object to always have full control of the object. However, you want to use Cloud Audit Logs to manage access to your bucket. What should you do?

    • ASet up an ACL with OWNER permission to a scope of allUsers.
    • BSet up an ACL with READER permission to a scope of allUsers.
    • CSet up a default bucket ACL and manage access for users using IAM.
    • DSet up Uniform bucket-level access on the Cloud Storage bucket and manage access for users using IAM.

    Show answer

    Answer: D

    Explanation

    To manage access to your Cloud Storage bucket without having to manage access to each object individually, you should set up Uniform bucket-level access on the Cloud Storage bucket and manage access for users using IAM . Uniform bucket-level access allows you to use Identity and Access Management (IAM) alone to manage permissions for all objects contained inside the bucket or groups of objects with common name prefixes . This approach simplifies access management and ensures that all objects in the bucket have the same level of access . By using IAM, you can grant users specific permissions to access your Cloud Storage bucket, such as read, write, or delete permissions . You can also use Cloud Audit Logs to monitor and manage access to your bucket . This approach provides a secure environment for your Cloud Storage bucket while ensuring that only authorized users can access it .

    Source: Adapted from community discussion — Xoxoo

    References

    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

PCSE practice, question 301. 356 questions available.