PCSE practice questions 351–356

1. Question 351 · 356 in bank

   Your global defense company is migrating top-secret classified data to BigQuery and Cloud Storage. National security regulations demand that master encryption key material never leaves the accredited on-premises cryptographic hardware. You must retain the unilateral ability to revoke data access, independent of any cloud provider. What should you do?

   • AUse customer-managed encryption keys (CMEKs) for the BigQuery datasets and Cloud Storage buckets. Store the keys in Cloud Key Management Service (Cloud KMS).
   • BUse customer-supplied encryption keys (CSEKs) by providing your own encryption keys with each data operation in Cloud Storage and BigQuery.
   • CImport existing on-premises master encryption keys into Cloud Key Management Service (Cloud KMS). Use the imported keys for BigQuery and Cloud Storage encryption.
   • DConfigure Cloud External Key Manager (Cloud EKM) for the BigQuery datasets and Cloud Storage buckets. Integrate EKM with your existing on-premises hardware security modules (HSMs).

   Show answer

   Answer: D

   Next question

2. Question 352 · 356 in bank

   You work at a company in a regulated industry and are responsible for ongoing security of the Cloud environment. You need to prevent and detect misconfigurations in a particular folder based on specific compliance policies. You need to adhere to industry-specific compliance policies and policies that are internal to your company. What should you do?

   • ACreate a Posture file by using custom and predefined SHA or organization policies. Enforce the posture on the folder level.
   • BCreate custom organization policies that follow specific business requirements. Enforce the policies on the folder level.
   • CEnable Assured Workloads on the folder level, with the specific control bundle appropriate for your industry’s regulations.
   • DUse Workload Manager with custom Rego policies to continuously scan the environment for misconfigurations on the folder level.

   Show answer

   Answer: A

   Next question

3. Question 353 · 356 in bank

   Your organization has established a highly sensitive project within a VPC Service Controls perimeter. You need to ensure that only users meeting specific contextual requirements such as having a company-managed device, a specific location, and a valid user identity can access resources within this perimeter. You want to evaluate the impact of this change without blocking legitimate access. What should you do?

   • AEstablish a Context-Aware Access policy that specifies the required contextual attributes, and associate the policy with the VPC Service Controls perimeter in dry run mode.
   • BUse the VPC Service Control Violation dashboard to identify the impact of details about access denials by service perimeters.
   • CConfigure a VPC Service Controls perimeter in dry run mode, and enforce strict network segmentation using firewall rules. Use multi-factor authentication (MFA) for user verification.
   • DUse Cloud Audit Logs to monitor user access to the project resources. Use post-incident analysis to identify unauthorized access attempts.

   Show answer

   Answer: A

   Next question

4. Question 354 · 356 in bank

   Your company’s storage team manages all product images within a specific Google Cloud project. To maintain control, you must isolate access to Cloud Storage for this project, allowing the storage team to manage restrictions at the project level. They must be restricted to using corporate computers. What should you do?

   • AUse Identity and Access Management (IAM) roles at the project level within the storage team’s project. Grant the storage team granular permissions on the project’s Cloud Storage resources.
   • BEmploy organization-level firewall rules to block all traffic to Cloud Storage. Create exceptions for specific service accounts used by the storage team within their project.
   • CUse Context-Aware Access Create an access level that defines the required context. Apply it as an organization policy specifically at the project level, restricting access to Cloud Storage based on that context.
   • DImplement VPC Service Controls by establishing an organization-wide service perimeter with all projects. Configure ingress and egress rules to restrict access to Cloud Storage based on IP address ranges.

   Show answer

   Answer: C

   Next question

5. Question 355 · 356 in bank

   Your organization uses Google Workspace as the primary identity provider for Google Cloud. Users in your organization initially created their passwords. You need to improve password security due to a recent security event. What should you do?

   • AConduct a security awareness training session, and set the password expiration settings to require more frequent updates.
   • BCheck the Enforce strong password box, and check Enforce password policy at the next sign-in.
   • CCheck the Enforce strong password box, and set the password expiration to occur more frequently.
   • DAudit user activity for suspicious logins by using the audit and investigation tool.

   Show answer

   Answer: B

   Next question

6. Question 356 · 356 in bank

   Your company has deployed an artificial intelligence model in a central project. This model has a lot of sensitive intellectual property and must be kept strictly isolated from the internet. You must expose the model endpoint only to a defined list of projects in your organization. What should you do?

   • AWithin the model project, create an internal Application Load Balancer that points to the model endpoint. Expose this load balancer with Private Service Connect to a configured list of projects.
   • BActivate Private Google Access in both the model project and in each project that needs to connect to the model. Create a firewall policy to allow connectivity to Private Google Access addresses.
   • CCreate a central project to host Shared VPC networks that are provided to all other projects. Centrally administer all firewall rules in this project to grant access to the model.
   • DWithin the model project, create an external Application Load Balancer that points to the model endpoint. Create a Cloud Armor policy to restrict IP addresses to Google Cloud.

   Show answer

   Answer: A

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

PCSE practice, question 351. 356 questions available.