PCSE practice questions 51–60

1. Question 51 · 356 in bank

   Select 2

   Your company's new CEO recently sold two of the company's divisions. Your Director asks you to help migrate the Google Cloud projects associated with those divisions to a new organization node. Which preparation steps are necessary before this migration occurs? (Choose two.)

   • ARemove all project-level custom Identity and Access Management (IAM) roles.
   • BDisallow inheritance of organization policies.
   • CIdentify inherited Identity and Access Management (IAM) roles on projects to be migrated.
   • DCreate a new folder for all projects to be migrated.
   • ERemove the specific migration projects from any VPC Service Controls perimeters and bridges.

   Show answer

   Answer: CE

   Explanation

   C: Identity and Access Management policies and organization policies are inherited through the resource hierarchy, and can block a service from functioning if not set properly. Determine the effective policy at the project's destination in your resource hierarchy to ensure the policy aligns with your governance objectives. [https://cloud.google.com/resource-manager/docs/create-migration-plan#plan_policy] E: You cannot migrate a project that is protected by a VPC Service Controls security perimeter. [https://cloud.google.com/resource-manager/docs/handle-special-cases#vpcsc_security_perimeters] D is recommended but not mandatort [https://cloud.google.com/resource-manager/docs/create-migration-plan#import_export_folders]

   Source: Adapted from community discussion — 3574e4e

   References

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   Next question

2. Question 52 · 356 in bank

   You are a consultant for an organization that is considering migrating their data from its private cloud to Google Cloud. The organization's compliance team is not familiar with Google Cloud and needs guidance on how compliance requirements will be met on Google Cloud. One specific compliance requirement is for customer data at rest to reside within specific geographic boundaries. Which option should you recommend for the organization to meet their data residency requirements on Google Cloud?

   • AOrganization Policy Service constraints
   • BShielded VM instances
   • CAccess control lists
   • DGeolocation access controls
   • EGoogle Cloud Armor

   Show answer

   Answer: A

   Explanation

   To meet the data residency requirements on Google Cloud, you can use Organization Policy Service constraints . This allows you to limit the physical location of a new resource with the Organization Policy Service resource locations constraint . You can use the location property of a resource to identify where it is deployed and maintained by the service. For data-containing resources of some Google Cloud services, this property also reflects the location where data is stored . This constraint allows you to define the allowed Google Cloud locations where the resources for supported services in your hierarchy can be created . After you define resource locations, this limitation will apply only to newly-created resources. Resources you created before setting the resource locations constraint will continue to exist and perform their function . Therefore, option A is the correct answer.

   Source: Adapted from community discussion — Xoxoo

   References

   • Google Cloud documentation
   • Google Cloud documentation

   Next question

3. Question 53 · 356 in bank

   Your security team wants to reduce the risk of user-managed keys being mismanaged and compromised. To achieve this, you need to prevent developers from creating user-managed service account keys for projects in their organization. How should you enforce this?

   • AConfigure Secret Manager to manage service account keys.
   • BEnable an organization policy to disable service accounts from being created.
   • CEnable an organization policy to prevent service account keys from being created.
   • DRemove the iam.serviceAccounts.getAccessToken permission from users.

   Show answer

   Answer: C

   Explanation

   C. https://cloud.google.com/iam/docs/best-practices-for-managing-service-account-keys "To prevent unnecessary usage of service account keys, use organization policy constraints: At the root of your organization's resource hierarchy, apply the Disable service account key creation and Disable service account key upload constraints to establish a default where service account keys are disallowed. When needed, override one of the constraints for selected projects to re-enable service account key creation or upload."

   Source: Adapted from community discussion — Random_Mane

   References

   • Google Cloud documentation

   Next question

4. Question 54 · 356 in bank

   You are responsible for managing your company's identities in Google Cloud. Your company enforces 2-Step Verification (2SV) for all users. You need to reset a user's access, but the user lost their second factor for 2SV. You want to minimize risk. What should you do?

   • AOn the Google Admin console, select the appropriate user account, and generate a backup code to allow the user to sign in. Ask the user to update their second factor.
   • BOn the Google Admin console, temporarily disable the 2SV requirements for all users. Ask the user to log in and add their new second factor to their account. Re-enable the 2SV requirement for all users.
   • COn the Google Admin console, select the appropriate user account, and temporarily disable 2SV for this account. Ask the user to update their second factor, and then re-enable 2SV for this account.
   • DOn the Google Admin console, use a super administrator account to reset the user account's credentials. Ask the user to update their credentials after their first login.

   Show answer

   Answer: A

   Explanation

   A is the answer. https://support.google.com/a/answer/9176734 Use backup codes for account recovery If you need to recover an account, use backup codes. Accounts are still protected by 2-Step Verification, and backup codes are easy to generate.

   Source: Adapted from community discussion — zellck

   References

   • support.google.com documentation
   • support.google.com documentation

   Next question

5. Question 55 · 356 in bank

   Which Google Cloud service should you use to enforce access control policies for applications and resources?

   • AIdentity-Aware Proxy
   • BCloud NAT
   • CGoogle Cloud Armor
   • DShielded VMs

   Show answer

   Answer: A

   References

   • Google Cloud documentation

   Next question

6. Question 56 · 356 in bank

   You want to update your existing VPC Service Controls perimeter with a new access level. You need to avoid breaking the existing perimeter with this change, and ensure the least disruptions to users while minimizing overhead. What should you do?

   • ACreate an exact replica of your existing perimeter. Add your new access level to the replica. Update the original perimeter after the access level has been vetted.
   • BUpdate your perimeter with a new access level that never matches. Update the new access level to match your desired state one condition at a time to avoid being overly permissive.
   • CEnable the dry run mode on your perimeter. Add your new access level to the perimeter configuration. Update the perimeter configuration after the access level has been vetted.
   • DEnable the dry run mode on your perimeter. Add your new access level to the perimeter dry run configuration. Update the perimeter configuration after the access level has been vetted.

   Show answer

   Answer: D

   Explanation

   D is the answer. https://cloud.google.com/vpc-service-controls/docs/dry-run-mode When using VPC Service Controls, it can be difficult to determine the impact to your environment when a service perimeter is created or modified. With dry run mode, you can better understand the impact of enabling VPC Service Controls and changes to perimeters in existing environments.

   Source: Adapted from community discussion — zellck

   References

   • Google Cloud documentation
   • Google Cloud documentation

   Next question

7. Question 57 · 356 in bank

   An application running on a Compute Engine instance needs to read data from a Cloud Storage bucket. Your team does not allow Cloud Storage buckets to be globally readable and wants to ensure the principle of least privilege. Which option meets the requirement of your team?

   • ACreate a Cloud Storage ACL that allows read-only access from the Compute Engine instance's IP address and allows the application to read from the bucket without credentials.
   • BUse a service account with read-only access to the Cloud Storage bucket, and store the credentials to the service account in the config of the application on the Compute Engine instance.
   • CUse a service account with read-only access to the Cloud Storage bucket to retrieve the credentials from the instance metadata.
   • DEncrypt the data in the Cloud Storage bucket using Cloud KMS, and allow the application to decrypt the data with the KMS key.

   Show answer

   Answer: C

   Explanation

   Correct Answer is (B): If your application runs inside a Google Cloud environment that has a default service account, your application can retrieve the service account credentials to call Google Cloud APIs. Such environments include Compute Engine, Google Kubernetes Engine, App Engine, Cloud Run, and Cloud Functions. We recommend using this strategy because it is more convenient and secure than manually passing credentials. Additionally, we recommend you use Google Cloud Client Libraries for your application. Google Cloud Client Libraries use a library called Application Default Credentials (ADC) to automatically find your service account credentials. ADC looks for service account credentials in the following order: https://cloud.google.com/docs/authentication/production#automatically

   Source: Adapted from community discussion — ESP_SAP

   References

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   Next question

8. Question 58 · 356 in bank

   Your organization's Google Cloud VMs are deployed via an instance template that configures them with a public IP address in order to host web services for external users. The VMs reside in a service project that is attached to a host (VPC) project containing one custom Shared VPC for the VMs. You have been asked to reduce the exposure of the VMs to the internet while continuing to service external users. You have already recreated the instance template without a public IP address configuration to launch the managed instance group (MIG). What should you do?

   • ADeploy a Cloud NAT Gateway in the service project for the MIG.
   • BDeploy a Cloud NAT Gateway in the host (VPC) project for the MIG.
   • CDeploy an external HTTP(S) load balancer in the service project with the MIG as a backend.
   • DDeploy an external HTTP(S) load balancer in the host (VPC) project with the MIG as a backend.

   Show answer

   Answer: C

   Explanation

   For me C is the answer. Cloud NAT is for outbound traffic and LB is to handle external customers' request to web services, so it is a LB. Between C and D: In this documentation https://cloud.google.com/load-balancing/docs/https#shared-vpc it says that "The global external IP address, the forwarding rule, the target HTTP(S) proxy, and the associated URL map must be defined in the same service project as the backends." and in the statement it says that the MIG are in the service project, so in my opinion the LB components must be in the service project.

   Source: Adapted from community discussion — crisyeb

   References

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   Next question

9. Question 59 · 356 in bank

   Your privacy team uses crypto-shredding (deleting encryption keys) as a strategy to delete personally identifiable information (PII). You need to implement this practice on Google Cloud while still utilizing the majority of the platform's services and minimizing operational overhead. What should you do?

   • AUse client-side encryption before sending data to Google Cloud, and delete encryption keys on-premises.
   • BUse Cloud External Key Manager to delete specific encryption keys.
   • CUse customer-managed encryption keys to delete specific encryption keys.
   • DUse Google default encryption to delete specific encryption keys.

   Show answer

   Answer: C

   Explanation

   C. https://cloud.google.com/sql/docs/mysql/cmek "You might have situations where you want to permanently destroy data encrypted with CMEK. To do this, you destroy the customer-managed encryption key version. You can't destroy the keyring or key, but you can destroy key versions of the key."

   Source: Adapted from community discussion — Random_Mane

   References

   • Google Cloud documentation

   Next question

10. Question 60 · 356 in bank

    You need to centralize your team's logs for production projects. You want your team to be able to search and analyze the logs using Logs Explorer. What should you do?

    • AEnable Cloud Monitoring workspace, and add the production projects to be monitored.
    • BUse Logs Explorer at the organization level and filter for production project logs.
    • CCreate an aggregate org sink at the parent folder of the production projects, and set the destination to a Cloud Storage bucket.
    • DCreate an aggregate org sink at the parent folder of the production projects, and set the destination to a logs bucket.

    Show answer

    Answer: D

    Explanation

    D is the answer. https://cloud.google.com/logging/docs/export/aggregated_sinks#supported-destinations You can use aggregated sinks to route logs within or between the same organizations and folders to the following destinations: - Another Cloud Logging bucket: Log entries held in Cloud Logging log buckets.

    Source: Adapted from community discussion — zellck

    References

    • Google Cloud documentation
    • Google Cloud documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

PCSE practice, question 51. 356 questions available.