PCSE practice questions 321–330

1. Question 321 · 356 in bank

   You are asked to recommend a solution to store and retrieve sensitive configuration data from an application that runs on Compute Engine. Which option should you recommend?

   • ACloud Key Management Service
   • BCompute Engine guest attributes
   • CCompute Engine custom metadata
   • DSecret Manager

   Show answer

   Answer: D

   Explanation

   Answer is (D). Secret Manager is a secure and convenient storage system for API keys, passwords, certificates, and other sensitive data. Secret Manager provides a central place and single source of truth to manage, access, and audit secrets across Google Cloud. https://cloud.google.com/secret-manager

   Source: Adapted from community discussion — Tabayashi

   References

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   Next question

2. Question 322 · 356 in bank

   You are responsible for managing identities in your company’s Google Cloud organization. Employees are frequently using your organization's corporate domain name to create unmanaged Google accounts. You want to implement a practical and efficient solution to prevent employees from completing this action in the future. What should you do?

   • ACreate a Google Cloud identity for all users in your organization. Ensure that new users are added automatically.
   • BImplement an automated process that scans all identities in your organization and disables any unmanaged accounts.
   • CRegister a new domain for your Google Cloud resources. Move all existing identities and resources to this domain.
   • DSwitch your corporate email system to another domain to avoid using the same domain for Google Cloud identities and corporate emails.

   Show answer

   Answer: A

   Next question

3. Question 323 · 356 in bank

   Your organization leverages folders to represent different teams within your Google Cloud environment. To support Infrastructure as Code (IaC) practices, each team receives a dedicated service account upon onboarding. You want to ensure that teams have comprehensive permissions to manage resources within their assigned folders while adhering to the principle of least privilege. You must design the permissions for these team-based service accounts in the most effective way possible. What should you do?

   • AGrant each service account the folder administrator role on its respective folder.
   • BGrant each service account the project creator role at the organization level and use folder-level IAM conditions to restrict project creation to specific folders.
   • CAssign each service account the project editor role at the organization level and instruct teams to use IAM bindings at the folder level for fine-grained permissions.
   • DAssign each service account the folder IAM administrator role on its respective folder to allow teams to create and manage additional custom roles if needed.

   Show answer

   Answer: A

   Next question

4. Question 324 · 356 in bank

   Your organization has a workload that is regulated by European laws. You must restrict the creation of resources outside of the EU for this specific workload. You must find an effective way to implement this security control without disrupting the other global applications. What should you do?

   • ACreate a Cloud Function triggered at asset creation that detects and deletes resources outside of the EU.
   • BCreate all your workload’s assets in a regional subnet in the EU in one project or folder.
   • CSegment your workload in the EU in one project or folder by using VPC Service Controls.
   • DImplement an organization policy that only allows the EU as the location for your workload’s project or folder.

   Show answer

   Answer: D

   Next question

5. Question 325 · 356 in bank

   Your organization manages a critical web application that serves international customers on Google Cloud. An increase in malicious traffic targeting this application has strained resources and caused periods of downtime. You need to design security measures to increase the application's resilience against web attacks, enhance perimeter protection, and provide access control. What should you do?

   • AEmploy network load balancing for traffic distribution. Update Identity-Aware Proxy (IAP) policies to allow only administrative access. Implement custom firewall rules on all external IP addresses.
   • BSet up firewall rules on Compute Engine instances within the application's environment. Rely on load balancers for threat detection. Increase instance resources to cope with attack volume.
   • CConfigure firewall rules to block traffic from known malicious IP ranges. Set up Google Cloud Armor and implement Identity-Aware Proxy (IAP) for granular access control.
   • DAdd firewall rules that restrict all internal IP ranges. Establish Cloud DNS security policies. Disable external IP addresses to reduce the attack surface. Create user groups for access control.

   Show answer

   Answer: C

   Next question

6. Question 326 · 356 in bank

   Your organization deploys a large number of containerized applications on Google Kubernetes Engine (GKE). Node updates are currently applied manually. Audit findings show that a critical patch has not been installed due to a missed notification. You need to design a more reliable, cloud-first, and scalable process for node updates. What should you do?

   • AConfigure node auto-upgrades for node pools in the maintenance windows.
   • BDevelop a custom script to continuously check for patch availability, download patches, and apply the patches across all components of the cluster.
   • CMigrate the cluster infrastructure to a self-managed Kubernetes environment for greater control over the patching process.
   • DSchedule a daily reboot for all nodes to automatically upgrade.

   Show answer

   Answer: A

   Next question

7. Question 327 · 356 in bank

   Your organization is migrating its primary web application from on-premises to Google Kubernetes Engine (GKE). You must advise the development team on how to grant their applications access to Google Cloud services from within GKE according to security recommended practices. What should you advise the development team to do?

   • AConfigure the GKE nodes to use the default Compute Engine service account.
   • BEnable Workload Identity for GKE. Assign a Kubernetes service account to the application and configure that Kubernetes service account to act as an Identity and Access Management (IAM) service account. Grant the required roles to the IAM service account.
   • CCreate a user-managed service account with only the roles required for the specific workload. Assign this service account to the GKE nodes.
   • DCreate an application-specific IAM service account and generate a user-managed service account key for it. Inject the key to the workload by storing it as a Kubernetes secret within the same namespace as the application.

   Show answer

   Answer: B

   Next question

8. Question 328 · 356 in bank

   Your organization’s application is being integrated with a partner application that requires read access to customer data to process customer orders. The customer data is stored in one of your Cloud Storage buckets. You have evaluated different options and determined that this activity requires the use of service account keys. You must advise the partner on how to minimize the risk of a compromised service account key causing a loss of data. What should you advise the partner to do?

   • AScan the Cloud Storage bucket with Sensitive Data Protection when new data is added, and automatically mask all customer data.
   • BDefine a VPC Service Controls perimeter, and restrict the Cloud Storage API. Add an ingress rule to the perimeter to allow access to the Cloud Storage API for the service account from outside of the perimeter.
   • CEnsure that all data for the application that is accessed through the relevant service accounts is encrypted at rest by using customer-managed encryption keys (CMEK).
   • DImplement a secret management service. Configure the service to frequently rotate the service account key. Configure proper access control to the key, and restrict who can create service account keys.

   Show answer

   Answer: D

   Next question

9. Question 329 · 356 in bank

   Your organization is implementing a new Python application that will be deployed on Cloud Run. The application needs to connect to a MySQL database that runs on Cloud SQL in a different project in your Google Cloud organization. You must secure the connection from the application to the Cloud SQL instance while minimizing management overhead. What should you do?

   • AUse a public IP address for the Cloud SQL instance. Integrate the Cloud SQL Python Connector into your application code to connect to the Cloud SQL instance.
   • BEnsure that the Cloud SQL instance doesn’t have a public IP address. Configure Cloud Run to use Cloud SQL Auth Proxy to connect to the Cloud SQL instance.
   • CEnsure that the Cloud SQL instance doesn't have a public IP address. Enforce SSL/TLS. Require the use of a trusted client certificate to connect to the Cloud SQL instance.
   • DEnsure that the Cloud SQL instance doesn’t have a public IP address. Configure the application's IP address as an authorized network to connect to the Cloud SQL instance.

   Show answer

   Answer: B

   Next question

10. Question 330 · 356 in bank

    Your organization has Google Cloud applications that require access to external web services. You must monitor, control, and log access to these services. What should you do?

    • ASet up a Secure Web Proxy that allows access to the specific external web services. Configure applications to use the proxy for the web service requests.
    • BSet up a Cloud NAT instance to allow egress traffic from your VPC.
    • CConfigure VPC firewall rules to allow the services to access the IP addresses of required external web services.
    • DConfigure Google Cloud Armor to monitor and protect your applications by checking incoming traffic patterns for attack patterns.

    Show answer

    Answer: A

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

PCSE practice, question 321. 356 questions available.