PCSE practice questions 341–350

1. Question 341 · 356 in bank

   Your organization is deploying a new web application on Compute Engine and needs robust perimeter security. You need to protect the application from common web attacks, including SQL injection and cross-site scripting (XSS), while also controlling network traffic based on the source IP address and user identity. What should you do?

   • AImplement Cloud Load Balancing and Cloud DNS. Set up Cloud CDN to cache content and mitigate some DDoS attacks. Configure Cloud Armor to provide layer 7 protection.
   • BDeploy Cloud Armor with its default WAF rules enabled. Configure network firewall rules on the Compute Engine instances to control all traffic based on source IP addresses. Use Cloud IAM to manage which users have roles granting access to the web application.
   • CUse Google Cloud Armor with pre-configured WAF rules to filter malicious traffic. Implement VPC Service Controls to create a secure perimeter around the application's resources. Manage users with Cloud IAM.
   • DDeploy Cloud Armor, and configure Cloud Firewall rules to control traffic based on source IP addresses. Integrate with Identity-Aware Proxy to control access based on user identity.

   Show answer

   Answer: D

   Next question

2. Question 342 · 356 in bank

   Your company is in a regulated industry that requires low overhead encryption using private connectivity from on-premises data centers to Google Cloud. You need to establish connectivity and ensure high availability across multiple regions. What should you do?

   • ASet up two pairs of HA VPNs using IPSec from the data centers in multiple regions.
   • BSet up pairs of Cloud Interconnect connections to your data centers in multiple regions, and employ MACSec encryption.
   • CSet up L2TP encryption over pairs of dedicated Cloud Interconnect connections from the data centers in multiple regions.
   • DSet up IPSec encryption over Partner Interconnect connections from your data centers in multiple regions.

   Show answer

   Answer: B

   Next question

3. Question 343 · 356 in bank

   You manage the security logs within your cloud environment. You have configured a continuous export of security logs to Cloud Storage buckets for long-term retention. You need to provide auditors the ability to analyze the logs that were exported to Cloud Storage. Your solution must be cost-effective and quickly implemented. What should you do?

   • AUse a VM instance to download the data from Cloud Storage. Provide the auditors access to the VM and allow them to install their preferred analytics toolset.
   • BUse the data in the Cloud Storage bucket as an external table in BigQuery. Provide the auditors access to the BigQuery dataset.
   • CUse Dataflow to import the data from Cloud Storage into Elasticsearch. Provide the auditors with access to Elasticsearch.
   • DUse a Cloud Run job to import the log data from Cloud Storage to Cloud Logging. Provide the auditors access through Log Analytics.

   Show answer

   Answer: B

   Next question

4. Question 344 · 356 in bank

   Your organization currently uses a third-party identity provider (IdP) that only requires a username and password for authentication. You need to enforce 2-step verification (2SV) for the Super admins in Cloud Identity. What should you do?

   • ACreate an organizational unit (OU) for Super admins, and enable 2SV within Cloud Identity for the OU.
   • BCollaborate with the third-party IdP to enable 2SV for Super admins while maintaining the current Cloud Identity configuration.
   • CImplement monitoring tools to track the authentication methods used by Super admins in Cloud Identity. Alert on those not using 2SV.
   • DEvaluate the 2SV options for Super admins offered by both the third-party IdP and Cloud Identity. Implement the solution that provides the strongest second factor.

   Show answer

   Answer: A

   Next question

5. Question 345 · 356 in bank

   Your organization has a hybrid cloud environment with a data center connected to Google Cloud through a dedicated Cloud Interconnect connection. You need to configure private access from your on-premises hosts to Google APIs, specifically Cloud Storage and BigQuery, without exposing traffic to the public internet. What should you do?

   • AConfigure Shared VPC to extend your Google Cloud VPC network to your on-premises environment. Use Private Google Access to access Google APIs.
   • BEstablish VPC peering between your on-premises network and your Google Cloud VPC network. Configure Cloud Firewall rules to allow traffic to Google API IP ranges.
   • CUse Private Google Access for on-premises hosts. Configure DNS resolution to point to the private.googleapis.com domain.
   • DConfigure Cloud NAT on your on-premises network. Configure DNS records in a private DNS zone to send requests to 199.36.153.8/30 to access Google APIs.

   Show answer

   Answer: C

   Next question

6. Question 346 · 356 in bank

   A batch job running on Compute Engine needs temporary write access to a Cloud Storage bucket. You want the batch job to use the minimum permissions necessary to complete the task. What should you do?

   • ACreate a service account with full Cloud Storage administrator permissions. Assign the service account to the Compute Engine instance.
   • BCreate a service account and embed a long-lived service account key file that has write permissions specified directly in the batch job script.
   • CCreate a service account with the storage.objectCreator role. Use service account impersonation in the batch job's code.
   • DGrant the predefined storage.objectCreator role to the Compute Engine instance's default service account.

   Show answer

   Answer: C

   Next question

7. Question 347 · 356 in bank

   Your company has recently enabled Security Command Center at the organization level. You need to implement runtime threat detection for applications running in containers within projects residing in the production folder. Specifically, you need to be notified if additional libraries are loaded or malicious scripts are executed within these running containers. You need to configure Security Command Center to meet this requirement while ensuring findings are visible within Security Command Center. What should you do?

   • ACreate log-based metrics and alerts in Cloud Logging and Cloud Monitoring for suspicious container activity within the production folder.
   • BConfigure Security Health Analytics within Security Command Center to monitor container runtime vulnerabilities in the production folder.
   • CEnsure that the containers in the production folder are running on hosts that are using Container-Optimized OS.
   • DEnable Container Threat Detection in Security Command Center Premium tier for the projects within the production folder.

   Show answer

   Answer: D

   Next question

8. Question 348 · 356 in bank

   You are managing a set of Google Cloud projects that are contained in a folder named Data Warehouse. A new data analysis team has been approved to perform data analysis for all BigQuery data in the projects within the Data Warehouse folder. They should only be able to read the data and not have permissions to modify or delete the data. You want to reduce the operational overhead of provisioning access while adhering to the principle of least privilege. What should you do?

   • AGrant the BigQuery Data Viewer role at the project level for each project within the Data Warehouse folder.
   • BGrant the BigQuery Data Viewer role at the Data Warehouse folder.
   • CGrant the BigQuery Data Viewer role at the dataset level for each BigQuery dataset within each project in the Data Warehouse folder.
   • DGrant the BigQuery Metadata Viewer role at the Data Warehouse folder.

   Show answer

   Answer: B

   Next question

9. Question 349 · 356 in bank

   Your company hosts a critical web application on Google Cloud. The application is experiencing an increasing number of sophisticated layer 7 attacks, including cross-site scripting (XSS) and SQL injection attempts. You need to protect the application from these attacks while minimizing the impact on legitimate traffic and ensuring high availability. What should you do?

   • AImplement a load balancer in front of the web application instances, and enable Adaptive Protection and throttling to mitigate the occurrence of these malicious requests.
   • BConfigure Cloud Next Generation Firewall to block known malicious IP addresses targeting /32 addresses.
   • CEnable Google Cloud Armor’s pre-configured WAF rules for OWASP Top 10 vulnerabilities at the backend service.
   • DConfigure a Cloud Armor security policy with customized and pre-configured WAF rules for OWASP Top 10 vulnerabilities at the load balancer.

   Show answer

   Answer: D

   Next question

10. Question 350 · 356 in bank

    Your financial services company needs to process customer personally identifiable information (PII) for analytics while adhering to strict privacy regulations. You must transform this data to protect individual privacy to ensure that the data retains its original format and consistency for analytical integrity. Your solution must avoid full irreversible deletion. What should you do?

    • AUse Cloud Key Management Service (Cloud KMS) to encrypt the entire dataset with a customer-managed encryption key (CMEK).
    • BSet up VPC Service Controls around the BigQuery project. Implement row-level encryption.
    • CImplement a custom BigQuery user-defined function (UDF) by using JavaScript to hash all sensitive fields before they are loaded into the analytical tables.
    • DConfigure Sensitive Data Protection (SDP) to de-identify PII using format-preserving encryption (FPE).

    Show answer

    Answer: D

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

PCSE practice, question 341. 356 questions available.