Google Professional Cloud Security Engineer356 questions across 36 pages are complete and free, with no account or card.
356 questions in this bank
Free access · progress saved on this device
Which Identity-Aware Proxy role should you grant to an Identity and Access Management (IAM) user to access HTTPS resources?
Answer: C
Answer C IAP-Secured Tunnel User: Grants access to tunnel resources that use IAP. IAP-Secured Web App User: Access HTTPS resources which use Identity-Aware Proxy, Grants access to App Engine, Cloud Run, and Compute Engine resources.
Source: Adapted from community discussion — GHOST1985
You need to audit the network segmentation for your Google Cloud footprint. You currently operate Production and Non-Production infrastructure-as-a-service (IaaS) environments. All your VM instances are deployed without any service account customization. After observing the traffic in your custom network, you notice that all instances can communicate freely `" despite tag-based VPC firewall rules in place to segment traffic properly `" with a priority of 1000. What are the most likely reasons for this behavior?
Answer: AD
A. All VM instances are missing the respective network tags. D. A VPC firewall rule is allowing traffic between source/targets based on the same service account with priority 999. If all the VM instances in your Google Cloud environment are able to communicate freely despite tag-based VPC firewall rules in place, it is likely that the instances are missing the necessary network tags. Without the appropriate tags, the firewall rules will not be able to properly segment the traffic. Another possible reason for this behavior could be the existence of a VPC firewall rule that allows traffic between source and target instances based on the same service account, with a priority of 999. This rule would take precedence over the tag-based firewall rules with a priority of 1000. It is unlikely that all the VM instances are residing in the same network subnet or configured with the same network route, or that there is a VPC firewall rule allowing traffic with a priority of 1001.
Source: Adapted from community discussion — GCParchitect2022
You are creating a new infrastructure CI/CD pipeline to deploy hundreds of ephemeral projects in your Google Cloud organization to enable your users to interact with Google Cloud. You want to restrict the use of the default networks in your organization while following Google-recommended best practices. What should you do?
Answer: A
A is the answer. https://cloud.google.com/resource-manager/docs/organization-policy/org-policy-constraints - constraints/compute.skipDefaultNetworkCreation This boolean constraint skips the creation of the default network and related resources during Google Cloud Platform Project resource creation where this constraint is set to True. By default, a default network and supporting resources are automatically created when creating a Project resource.
Source: Adapted from community discussion — zellck
You are a security administrator at your company and are responsible for managing access controls (identification, authentication, and authorization) on Google Cloud. Which Google-recommended best practices should you follow when configuring authentication and authorization? (Choose two.)
Answer: DE
https://cloud.google.com/iam/docs/using-iam-securely#least_privilege Basic roles include thousands of permissions across all Google Cloud services. In production environments, do not grant basic roles unless there is no alternative. Instead, grant the most limited predefined roles or custom roles that meet your needs.
Source: Adapted from community discussion — zellck
You have been tasked with inspecting IP packet data for invalid or malicious content. What should you do?
Answer: A
A is the answer. https://cloud.google.com/vpc/docs/packet-mirroring Packet Mirroring clones the traffic of specified instances in your Virtual Private Cloud (VPC) network and forwards it for examination. Packet Mirroring captures all traffic and packet data, including payloads and headers.
Source: Adapted from community discussion — zellck
You have the following resource hierarchy. There is an organization policy at each node in the hierarchy as shown. Which load balancer types are denied in VPC A?
Answer: A
The answer should be C Link: https://cloud.google.com/resource-manager/docs/organization-policy/understanding-hierarchy Inheritance A resource node that has an organization policy set by default supersedes any policy set by its parent nodes in the hierarchy. However, if a resource node has set inheritFromParent = true, then the effective Policy of the parent resource is inherited, merged, and reconciled to evaluate the resulting effective policy. Project 2 has an organisation policy set and there's no mention of any inheritance.
Source: Adapted from community discussion — WheresWally
Your security team wants to implement a defense-in-depth approach to protect sensitive data stored in a Cloud Storage bucket. Your team has the following requirements: ✑ The Cloud Storage bucket in Project A can only be readable from Project B. ✑ The Cloud Storage bucket in Project A cannot be accessed from outside the network. ✑ Data in the Cloud Storage bucket cannot be copied to an external Cloud Storage bucket. What should the security team do?
Answer: B
Should be B. VPC Peering is between organizations not between Projects in an organization. That is Shared VPC. In this case, both projects are in same organization so having VPC Service Controls around both projects with necessary rules should be fine.
Source: Adapted from community discussion — Baburao
You need to create a VPC that enables your security team to control network resources such as firewall rules. How should you configure the network to allow for separation of duties for network resources?
Answer: D
D. Set up a Shared VPC where the security team manages the firewall rules, and share the network with developers via service projects.
Source: Adapted from community discussion — AzureDP900
An employer wants to track how bonus compensations have changed over time to identify employee outliers and correct earning disparities. This task must be performed without exposing the sensitive compensation data for any individual and must be reversible to identify the outlier. Which Cloud Data Loss Prevention API technique should you use to accomplish this?
Answer: D
Correct Answer is (D): De-identifying sensitive data Cloud Data Loss Prevention (DLP) can de-identify sensitive data in text content, including text stored in container structures such as tables. De-identification is the process of removing identifying information from data. The API detects sensitive data such as personally identifiable information (PII), and then uses a de-identification transformation to mask, delete, or otherwise obscure the data. For example, de-identification techniques can include any of the following: Masking sensitive data by partially or fully replacing characters with a symbol, such as an asterisk (*) or hash (#). Replacing each instance of sensitive data with a token, or surrogate, string. Encrypting and replacing sensitive data using a randomly generated or pre-determined key. When you de-identify data using the CryptoReplaceFfxFpeConfig or CryptoDeterministicConfig infoType transformations, you can re-identify that data, as long as you have the CryptoKey used to originally de-identify the data. https://cloud.google.com/dlp/docs/deidentify-sensitive-data
Source: Adapted from community discussion — ESP_SAP
You are onboarding new users into Cloud Identity and discover that some users have created consumer user accounts using the corporate domain name. How should you manage these consumer user accounts with Cloud Identity?
Answer: C
C is the answer. https://support.google.com/a/answer/6178640?hl=en The transfer tool enables you to see what unmanaged users exist, and then invite those unmanaged users to the domain.
Source: Adapted from community discussion — zellck
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
PCSE practice, question 71. 356 questions available.
Version 1.0.0. How we source questions