PCSE practice questions 41–50

1. Question 41 · 356 in bank

   You need to implement an encryption-at-rest strategy that protects sensitive data and reduces key management complexity for non-sensitive data. Your solution has the following requirements: ✑ Schedule key rotation for sensitive data. ✑ Control which region the encryption keys for sensitive data are stored in. ✑ Minimize the latency to access encryption keys for both sensitive and non-sensitive data. What should you do?

   • AEncrypt non-sensitive data and sensitive data with Cloud External Key Manager.
   • BEncrypt non-sensitive data and sensitive data with Cloud Key Management Service.
   • CEncrypt non-sensitive data with Google default encryption, and encrypt sensitive data with Cloud External Key Manager.
   • DEncrypt non-sensitive data with Google default encryption, and encrypt sensitive data with Cloud Key Management Service.

   Show answer

   Answer: D

   Explanation

   The default already has low latency! "Because of the high volume of keys at Google, and the need for low latency and high availability, DEKs are stored near the data that they encrypt. DEKs are encrypted with (wrapped by) a key encryption key (KEK), using a technique known as envelope encryption. These KEKs are not specific to customers; instead, one or more KEKs exist for each service." We need less complexity and low latency so use default on non-sensitive data!

   Source: Adapted from community discussion — marmar11111

   References

   • Google Cloud documentation

   Next question

2. Question 42 · 356 in bank

   Select 2

   Your security team uses encryption keys to ensure confidentiality of user data. You want to establish a process to reduce the impact of a potentially compromised symmetric encryption key in Cloud Key Management Service (Cloud KMS). Which steps should your team take before an incident occurs? (Choose two.)

   • ADisable and revoke access to compromised keys.
   • BEnable automatic key version rotation on a regular schedule.
   • CManually rotate key versions on an ad hoc schedule.
   • DLimit the number of messages encrypted with each key version.
   • EDisable the Cloud KMS API.

   Show answer

   Answer: BD

   Explanation

   Should be BD. A is wrong because there is no comprise happened as the question states "before an incident". As per document "Limiting the number of messages encrypted with the same key version helps prevent attacks enabled by cryptanalysis." https://cloud.google.com/kms/docs/key-rotation

   Source: Adapted from community discussion — parasthakur

   References

   • Google Cloud documentation

   Next question

3. Question 43 · 356 in bank

   Your company's chief information security officer (CISO) is requiring business data to be stored in specific locations due to regulatory requirements that affect the company's global expansion plans. After working on a plan to implement this requirement, you determine the following: ✑ The services in scope are included in the Google Cloud data residency requirements. ✑ The business data remains within specific locations under the same organization. ✑ The folder structure can contain multiple data residency locations. ✑ The projects are aligned to specific locations. You plan to use the Resource Location Restriction organization policy constraint with very granular control. At which level in the hierarchy should you set the constraint?

   • AOrganization
   • BResource
   • CProject
   • DFolder

   Show answer

   Answer: C

   Explanation

   Answer is C. The key word here is "very granular* control". Most granular choice here is Project, as you cannot apply policy constraints to resources.

   Source: Adapted from community discussion — TheBuckler

   Next question

4. Question 44 · 356 in bank

   A database administrator notices malicious activities within their Cloud SQL instance. The database administrator wants to monitor the API calls that read the configuration or metadata of resources. Which logs should the database administrator review?

   • AAdmin Activity
   • BSystem Event
   • CAccess Transparency
   • DData Access

   Show answer

   Answer: D

   Explanation

   answer D Data Access audit logs contain API calls that read the configuration or metadata of resources, as well as user-driven API calls that create, modify, or read user-provided resource data.

   Source: Adapted from community discussion — GHOST1985

   References

   • Google Cloud documentation
   • Google Cloud documentation

   Next question

5. Question 45 · 356 in bank

   You are backing up application logs to a shared Cloud Storage bucket that is accessible to both the administrator and analysts. Analysts should not have access to logs that contain any personally identifiable information (PII). Log files containing PII should be stored in another bucket that is only accessible to the administrator. What should you do?

   • AUpload the logs to both the shared bucket and the bucket with PII that is only accessible to the administrator. Use the Cloud Data Loss Prevention API to create a job trigger. Configure the trigger to delete any files that contain PII from the shared bucket.
   • BOn the shared bucket, configure Object Lifecycle Management to delete objects that contain PII.
   • COn the shared bucket, configure a Cloud Storage trigger that is only triggered when PII is uploaded. Use Cloud Functions to capture the trigger and delete the files that contain PII.
   • DUse Pub/Sub and Cloud Functions to trigger a Cloud Data Loss Prevention scan every time a file is uploaded to the administrator's bucket. If the scan does not detect PII, have the function move the objects into the shared Cloud Storage bucket.

   Show answer

   Answer: D

   Explanation

   D. Use Pub/Sub and Cloud Functions to trigger a Cloud Data Loss Prevention scan every time a file is uploaded to the administrator's bucket. If the scan does not detect PII, have the function move the objects into the shared Cloud Storage bucket

   Source: Adapted from community discussion — AzureDP900

   Next question

6. Question 46 · 356 in bank

   A business unit at a multinational corporation signs up for GCP and starts moving workloads into GCP. The business unit creates a Cloud Identity domain with an organizational resource that has hundreds of projects. Your team becomes aware of this and wants to take over managing permissions and auditing the domain resources. Which type of access should your team grant to meet this requirement?

   • AOrganization Administrator
   • BSecurity Reviewer
   • COrganization Role Administrator
   • DOrganization Policy Administrator

   Show answer

   Answer: A

   Explanation

   Answer A > Its the only one that allow you to manage permissions on the projects answer B > dont have any iam set permission so is not correct C > organizationRoleAdmin let you only create custom roles, you cant assign it to anyone ( so with thisone you cant manage permissions just create roles) D> org policyes are for manage the ORG policies constrains , that is not about project permissions, for me the correct is A

   Source: Adapted from community discussion — ffdd1234

   References

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   Next question

7. Question 47 · 356 in bank

   You work for an organization in a regulated industry that has strict data protection requirements. The organization backs up their data in the cloud. To comply with data privacy regulations, this data can only be stored for a specific length of time and must be deleted after this specific period. You want to automate the compliance with this regulation while minimizing storage costs. What should you do?

   • AStore the data in a persistent disk, and delete the disk at expiration time.
   • BStore the data in a Cloud Bigtable table, and set an expiration time on the column families.
   • CStore the data in a BigQuery table, and set the table's expiration time.
   • DStore the data in a Cloud Storage bucket, and configure the bucket's Object Lifecycle Management feature.

   Show answer

   Answer: D

   Explanation

   should be D. To miminize costs, it's always GCS even though BQ comes as a close 2nd. But, since the question did not specify what kind of data it is (raw files vs tabular data), it is safe to assume GCS is the preferred option with LifeCycle enablement.

   Source: Adapted from community discussion — Baburao

   References

   • Google Cloud documentation

   Next question

8. Question 48 · 356 in bank

   Select 2

   You have been tasked with configuring Security Command Center for your organization's Google Cloud environment. Your security team needs to receive alerts of potential crypto mining in the organization's compute environment and alerts for common Google Cloud misconfigurations that impact security. Which Security Command Center features should you use to configure these alerts? (Choose two.)

   • AEvent Threat Detection
   • BContainer Threat Detection
   • CSecurity Health Analytics
   • DCloud Data Loss Prevention
   • EGoogle Cloud Armor

   Show answer

   Answer: AC

   Explanation

   AC is the answer. https://cloud.google.com/security-command-center/docs/concepts-event-threat-detection-overview Event Threat Detection is a built-in service for the Security Command Center Premium tier that continuously monitors your organization and identifies threats within your systems in near-real time. https://cloud.google.com/security-command-center/docs/concepts-security-sources#security-health-analytics Security Health Analytics managed vulnerability assessment scanning for Google Cloud can automatically detect common vulnerabilities and misconfigurations across:

   Source: Adapted from community discussion — zellck

   References

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   Next question

9. Question 49 · 356 in bank

   You have noticed an increased number of phishing attacks across your enterprise user accounts. You want to implement the Google 2-Step Verification (2SV) option that uses a cryptographic signature to authenticate a user and verify the URL of the login page. Which Google 2SV option should you use?

   • ATitan Security Keys
   • BGoogle prompt
   • CGoogle Authenticator app
   • DCloud HSM keys

   Show answer

   Answer: A

   Explanation

   A is the answer. https://cloud.google.com/titan-security-key Security keys use public key cryptography to verify a user’s identity and URL of the login page ensuring attackers can’t access your account even if you are tricked into providing your username and password.

   Source: Adapted from community discussion — zellck

   References

   • Google Cloud documentation

   Next question

10. Question 50 · 356 in bank

    Your organization hosts a financial services application running on Compute Engine instances for a third-party company. The third-party company's servers that will consume the application also run on Compute Engine in a separate Google Cloud organization. You need to configure a secure network connection between the Compute Engine instances. You have the following requirements: ✑ The network connection must be encrypted. ✑ The communication between servers must be over private IP addresses. What should you do?

    • AConfigure a Cloud VPN connection between your organization's VPC network and the third party's that is controlled by VPC firewall rules.
    • BConfigure a VPC peering connection between your organization's VPC network and the third party's that is controlled by VPC firewall rules.
    • CConfigure a VPC Service Controls perimeter around your Compute Engine instances, and provide access to the third party via an access level.
    • DConfigure an Apigee proxy that exposes your Compute Engine-hosted application as an API, and is encrypted with TLS which allows access only to the third party.

    Show answer

    Answer: B

    Explanation

    Google encrypts and authenticates data in transit at one or more network layers when data moves outside physical boundaries not controlled by Google or on behalf of Google. All VM-to-VM traffic within a VPC network and peered VPC networks is encrypted. https://cloud.google.com/docs/security/encryption-in-transit#cio-level_summary

    Source: Adapted from community discussion — GHOST1985

    References

    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

PCSE practice, question 41. 356 questions available.