PCSE practice questions 61–70

1. Question 61 · 356 in bank

   You need to use Cloud External Key Manager to create an encryption key to encrypt specific BigQuery data at rest in Google Cloud. Which steps should you do first?

   • A1. Create or use an existing key with a unique uniform resource identifier (URI) in your Google Cloud project. 2. Grant your Google Cloud project access to a supported external key management partner system.
   • B1. Create or use an existing key with a unique uniform resource identifier (URI) in Cloud Key Management Service (Cloud KMS). 2. In Cloud KMS, grant your Google Cloud project access to use the key.
   • C1. Create or use an existing key with a unique uniform resource identifier (URI) in a supported external key management partner system. 2. In the external key management partner system, grant access for this key to use your Google Cloud project.
   • D1. Create an external key with a unique uniform resource identifier (URI) in Cloud Key Management Service (Cloud KMS). 2. In Cloud KMS, grant your Google Cloud project access to use the key.

   Show answer

   Answer: C

   Explanation

   C is the answer. https://cloud.google.com/kms/docs/ekm#how_it_works - First, you create or use an existing key in a supported external key management partner system. This key has a unique URI or key path. - Next, you grant your Google Cloud project access to use the key, in the external key management partner system. - In your Google Cloud project, you create a Cloud EKM key, using the URI or key path for the externally-managed key.

   Source: Adapted from community discussion — zellck

   References

   • Google Cloud documentation

   Next question

2. Question 62 · 356 in bank

   Your company's cloud security policy dictates that VM instances should not have an external IP address. You need to identify the Google Cloud service that will allow VM instances without external IP addresses to connect to the internet to update the VMs. Which service should you use?

   • AIdentity Aware-Proxy
   • BCloud NAT
   • CTCP/UDP Load Balancing
   • DCloud DNS

   Show answer

   Answer: B

   Explanation

   B https://cloud.google.com/nat/docs/overview "Cloud NAT (network address translation) lets certain resources without external IP addresses create outbound connections to the internet."

   Source: Adapted from community discussion — Random_Mane

   References

   • Google Cloud documentation

   Next question

3. Question 63 · 356 in bank

   You want to make sure that your organization's Cloud Storage buckets cannot have data publicly available to the internet. You want to enforce this across all Cloud Storage buckets. What should you do?

   • ARemove Owner roles from end users, and configure Cloud Data Loss Prevention.
   • BRemove Owner roles from end users, and enforce domain restricted sharing in an organization policy.
   • CConfigure uniform bucket-level access, and enforce domain restricted sharing in an organization policy.
   • DRemove *.setIamPolicy permissions from all roles, and enforce domain restricted sharing in an organization policy.

   Show answer

   Answer: C

   References

   • Google Cloud documentation
   • Google Cloud documentation

   Next question

4. Question 64 · 356 in bank

   Select 2

   Your company plans to move most of its IT infrastructure to Google Cloud. They want to leverage their existing on-premises Active Directory as an identity provider for Google Cloud. Which two steps should you take to integrate the company's on-premises Active Directory with Google Cloud and configure access management? (Choose two.)

   • AUse Identity Platform to provision users and groups to Google Cloud.
   • BUse Cloud Identity SAML integration to provision users and groups to Google Cloud.
   • CInstall Google Cloud Directory Sync and connect it to Active Directory and Cloud Identity.
   • DCreate Identity and Access Management (IAM) roles with permissions corresponding to each Active Directory group.
   • ECreate Identity and Access Management (IAM) groups with permissions corresponding to each Active Directory group.

   Show answer

   Answer: CD

   Explanation

   There is a possibility to synchronize groups between AD and Google Cloud so why not to use it and focus on creating roles https://cloud.google.com/architecture/identity/federating-gcp-with-active-directory-introduction?hl=en#mapping_groups

   Source: Adapted from community discussion — a190d62

   References

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   Next question

5. Question 65 · 356 in bank

   Select 2

   You are in charge of creating a new Google Cloud organization for your company. Which two actions should you take when creating the super administrator accounts? (Choose two.)

   • ACreate an access level in the Google Admin console to prevent super admin from logging in to Google Cloud.
   • BDisable any Identity and Access Management (IAM) roles for super admin at the organization level in the Google Cloud Console.
   • CUse a physical token to secure the super admin credentials with multi-factor authentication (MFA).
   • DUse a private connection to create the super admin accounts to avoid sending your credentials over the Internet.
   • EProvide non-privileged identities to the super admin users for their day-to-day activities.

   Show answer

   Answer: CE

   Explanation

   CE is the answer. https://cloud.google.com/resource-manager/docs/super-admin-best-practices#discourage_super_admin_account_usage - Use a security key or other physical authentication device to enforce two-step verification - Give super admins a separate account that requires a separate login

   Source: Adapted from community discussion — zellck

   References

   • Google Cloud documentation

   Next question

6. Question 66 · 356 in bank

   You are deploying a web application hosted on Compute Engine. A business requirement mandates that application logs are preserved for 12 years and data is kept within European boundaries. You want to implement a storage solution that minimizes overhead and is cost-effective. What should you do?

   • ACreate a Cloud Storage bucket to store your logs in the EUROPE-WEST1 region. Modify your application code to ship logs directly to your bucket for increased efficiency.
   • BConfigure your Compute Engine instances to use the Google Cloud's operations suite Cloud Logging agent to send application logs to a custom log bucket in the EUROPE-WEST1 region with a custom retention of 12 years.
   • CUse a Pub/Sub topic to forward your application logs to a Cloud Storage bucket in the EUROPE-WEST1 region.
   • DConfigure a custom retention policy of 12 years on your Google Cloud's operations suite log bucket in the EUROPE-WEST1 region.

   Show answer

   Answer: B

   Explanation

   The A and the C are the two possible (12 years retention is not possible with Cloud Logging...max 3650 days) so now the question is...pub/sub or not pub/sub.... in my opinion when it's said...limit overhead, i should go with the A....but not really sure

   Source: Adapted from community discussion — tangac

   References

   • Google Cloud documentation

   Next question

7. Question 67 · 356 in bank

   Select 2

   You discovered that sensitive personally identifiable information (PII) is being ingested to your Google Cloud environment in the daily ETL process from an on- premises environment to your BigQuery datasets. You need to redact this data to obfuscate the PII, but need to re-identify it for data analytics purposes. Which components should you use in your solution? (Choose two.)

   • ASecret Manager
   • BCloud Key Management Service
   • CCloud Data Loss Prevention with cryptographic hashing
   • DCloud Data Loss Prevention with automatic text redaction
   • ECloud Data Loss Prevention with deterministic encryption using AES-SIV

   Show answer

   Answer: BE

   Explanation

   B: you need KMS to store the CryptoKey https://cloud.google.com/dlp/docs/reference/rest/v2/projects.deidentifyTemplates#crypt E: for the de-identity you need to use CryptoReplaceFfxFpeConfig or CryptoDeterministicConfig https://cloud.google.com/dlp/docs/reference/rest/v2/projects.deidentifyTemplates#cryptodeterministicconfig https://cloud.google.com/dlp/docs/deidentify-sensitive-data

   Source: Adapted from community discussion — GHOST1985

   References

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   Next question

8. Question 68 · 356 in bank

   An organization's typical network and security review consists of analyzing application transit routes, request handling, and firewall rules. They want to enable their developer teams to deploy new applications without the overhead of this full review. How should you advise this organization?

   • AUse Forseti with Firewall filters to catch any unwanted configurations in production.
   • BMandate use of infrastructure as code and provide static analysis in the CI/CD pipelines to enforce policies.
   • CRoute all VPC traffic through customer-managed routers to detect malicious patterns in production.
   • DAll production applications will run on-premises. Allow developers free rein in GCP as their dev and QA platforms.

   Show answer

   Answer: B

   Explanation

   @TNT87 and others, if you say (B) or even (C) or (A) can you provide proof and URLs to support your claims. Simply saying if you have done Cloud Architect you will know Everything under the sun is not the proper response, this is a discussion and a community here trying to learn. Not everyone will be in same standard or level. Be helpful for others please....

   Source: Adapted from community discussion — bluetaurianbull

   References

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   Next question

9. Question 69 · 356 in bank

   Select 2

   You are working with a client that is concerned about control of their encryption keys for sensitive data. The client does not want to store encryption keys at rest in the same cloud service provider (CSP) as the data that the keys are encrypting. Which Google Cloud encryption solutions should you recommend to this client? (Choose two.)

   • ACustomer-supplied encryption keys.
   • BGoogle default encryption
   • CSecret Manager
   • DCloud External Key Manager
   • ECustomer-managed encryption keys

   Show answer

   Answer: AD

   Explanation

   in CMEK, even though the keys are managed by customer, they're still using the cloud service Cloud KMS. So it's still in the same Cloud Provider as where the data is which not desired per the question. Reference: https://cloud.google.com/kms/docs/cmek#cmek

   Source: Adapted from community discussion — [Removed]

   References

   • Google Cloud documentation

   Next question

10. Question 70 · 356 in bank

    You are implementing data protection by design and in accordance with GDPR requirements. As part of design reviews, you are told that you need to manage the encryption key for a solution that includes workloads for Compute Engine, Google Kubernetes Engine, Cloud Storage, BigQuery, and Pub/Sub. Which option should you choose for this implementation?

    • ACloud External Key Manager
    • BCustomer-managed encryption keys
    • CCustomer-supplied encryption keys
    • DGoogle default encryption

    Show answer

    Answer: B

    Explanation

    Answer is A, Customers can also require detailed justification and approval each time a key is requested to decrypt data using External Key Manager, and deny Google the ability to decrypt their data for any reason using Key Access Justifications, which is now in General Availability. https://cloud.google.com/blog/products/compliance/how-google-cloud-helps-customers-stay-current-with-gdpr

    Source: Adapted from community discussion — Table2022

    References

    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

PCSE practice, question 61. 356 questions available.