PCSE practice questions 81–90

1. Question 81 · 356 in bank

   Select 2

   You have created an OS image that is hardened per your organization's security standards and is being stored in a project managed by the security team. As a Google Cloud administrator, you need to make sure all VMs in your Google Cloud organization can only use that specific OS image while minimizing operational overhead. What should you do? (Choose two.)

   • AGrant users the compute.imageUser role in their own projects.
   • BGrant users the compute.imageUser role in the OS image project.
   • CStore the image in every project that is spun up in your organization.
   • DSet up an image access organization policy constraint, and list the security team managed project in the project's allow list.
   • ERemove VM instance creation permission from users of the projects, and only allow you and your team to create VM instances.

   Show answer

   Answer: BD

   Explanation

   BD is the answer. https://cloud.google.com/resource-manager/docs/organization-policy/org-policy-constraints - constraints/compute.trustedImageProjects This list constraint defines the set of projects that can be used for image storage and disk instantiation for Compute Engine. If this constraint is active, only images from trusted projects will be allowed as the source for boot disks for new instances.

   Source: Adapted from community discussion — zellck

   References

   • Google Cloud documentation
   • Google Cloud documentation

   Next question

2. Question 82 · 356 in bank

   You're developing the incident response plan for your company. You need to define the access strategy that your DevOps team will use when reviewing and investigating a deployment issue in your Google Cloud environment. There are two main requirements: ✑ Least-privilege access must be enforced at all times. ✑ The DevOps team must be able to access the required resources only during the deployment issue. How should you grant access while following Google-recommended best practices?

   • AAssign the Project Viewer Identity and Access Management (IAM) role to the DevOps team.
   • BCreate a custom IAM role with limited list/view permissions, and assign it to the DevOps team.
   • CCreate a service account, and grant it the Project Owner IAM role. Give the Service Account User Role on this service account to the DevOps team.
   • DCreate a service account, and grant it limited list/view permissions. Give the Service Account User Role on this service account to the DevOps team.

   Show answer

   Answer: B

   Explanation

   I think the answer should D. Option B gives them "Always On" permissions but the question asks for "Just in time" permissions. So, this is possible only with a Service Account. Once the incident response team resolves the issue, the service account key can be disabled.

   Source: Adapted from community discussion — Baburao

   Next question

3. Question 83 · 356 in bank

   You are working with a client who plans to migrate their data to Google Cloud. You are responsible for recommending an encryption service to manage their encrypted keys. You have the following requirements: ✑ The master key must be rotated at least once every 45 days. ✑ The solution that stores the master key must be FIPS 140-2 Level 3 validated. ✑ The master key must be stored in multiple regions within the US for redundancy. Which solution meets these requirements?

   • ACustomer-managed encryption keys with Cloud Key Management Service
   • BCustomer-managed encryption keys with Cloud HSM
   • CCustomer-supplied encryption keys
   • DGoogle-managed encryption keys

   Show answer

   Answer: B

   Explanation

   To meet the given requirements, you should recommend using Customer-managed encryption keys with Cloud HSM. This solution allows you to manage your own encryption keys while leveraging the Google Cloud Hardware Security Module (HSM) service, which is FIPS 140-2 Level 3 validated. With Cloud HSM, you can rotate the master key at least once every 45 days and store it in multiple regions within the US for redundancy. While Customer-managed encryption keys with Cloud Key Management Service (KMS) (option A) is a valid choice for managing encryption keys, it does not provide the FIPS 140-2 Level 3 validation required by the given requirements. Customer-supplied encryption keys (option C) are not suitable for this scenario as they do not offer the same level of control and security as customer-managed keys. Google-managed encryption keys (option D) would not meet the requirement of having a solution that stores the master key validated at FIPS 140-2 Level 3.

   Source: Adapted from community discussion — Xoxoo

   References

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   Next question

4. Question 84 · 356 in bank

   You manage your organization's Security Operations Center (SOC). You currently monitor and detect network traffic anomalies in your VPCs based on network logs. However, you want to explore your environment using network payloads and headers. Which Google Cloud product should you use?

   • ACloud IDS
   • BVPC Service Controls logs
   • CVPC Flow Logs
   • DGoogle Cloud Armor
   • EPacket Mirroring

   Show answer

   Answer: E

   Explanation

   E is the answer. https://cloud.google.com/vpc/docs/packet-mirroring Packet Mirroring clones the traffic of specified instances in your Virtual Private Cloud (VPC) network and forwards it for examination. Packet Mirroring captures all traffic and packet data, including payloads and headers.

   Source: Adapted from community discussion — zellck

   References

   • Google Cloud documentation
   • Google Cloud documentation

   Next question

5. Question 85 · 356 in bank

   Select 2

   You are consulting with a client that requires end-to-end encryption of application data (including data in transit, data in use, and data at rest) within Google Cloud. Which options should you utilize to accomplish this? (Choose two.)

   • AExternal Key Manager
   • BCustomer-supplied encryption keys
   • CHardware Security Module
   • DConfidential Computing and Istio
   • EClient-side encryption

   Show answer

   Answer: DE

   Explanation

   Confidential Computing enables encryption for "data-in-use" Client Side encryption enables security for "data in transit" from Customer site to GCP Once data is at rest, use Google's default encryption for "data at rest"

   Source: Adapted from community discussion — GHOST1985

   References

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   Next question

6. Question 86 · 356 in bank

   You need to enforce a security policy in your Google Cloud organization that prevents users from exposing objects in their buckets externally. There are currently no buckets in your organization. Which solution should you implement proactively to achieve this goal with the least operational overhead?

   • ACreate an hourly cron job to run a Cloud Function that finds public buckets and makes them private.
   • BEnable the constraints/storage.publicAccessPrevention constraint at the organization level.
   • CEnable the constraints/storage.uniformBucketLevelAccess constraint at the organization level.
   • DCreate a VPC Service Controls perimeter that protects the storage.googleapis.com service in your projects that contains buckets. Add any new project that contains a bucket to the perimeter.

   Show answer

   Answer: B

   Explanation

   B is the answer. https://cloud.google.com/storage/docs/public-access-prevention Public access prevention protects Cloud Storage buckets and objects from being accidentally exposed to the public. If your bucket is contained within an organization, you can enforce public access prevention by using the organization policy constraint storage.publicAccessPrevention at the project, folder, or organization level.

   Source: Adapted from community discussion — zellck

   References

   • Google Cloud documentation
   • Google Cloud documentation

   Next question

7. Question 87 · 356 in bank

   Your company requires the security and network engineering teams to identify all network anomalies and be able to capture payloads within VPCs. Which method should you use?

   • ADefine an organization policy constraint.
   • BConfigure packet mirroring policies.
   • CEnable VPC Flow Logs on the subnet.
   • DMonitor and analyze Cloud Audit Logs.

   Show answer

   Answer: B

   Explanation

   B is the answer. https://cloud.google.com/vpc/docs/packet-mirroring Packet Mirroring clones the traffic of specified instances in your Virtual Private Cloud (VPC) network and forwards it for examination. Packet Mirroring captures all traffic and packet data, including payloads and headers.

   Source: Adapted from community discussion — zellck

   References

   • Google Cloud documentation

   Next question

8. Question 88 · 356 in bank

   An organization wants to track how bonus compensations have changed over time to identify employee outliers and correct earning disparities. This task must be performed without exposing the sensitive compensation data for any individual and must be reversible to identify the outlier. Which Cloud Data Loss Prevention API technique should you use?

   • ACryptographic hashing
   • BRedaction
   • CFormat-preserving encryption
   • DGeneralization

   Show answer

   Answer: C

   Explanation

   The best option would be C. Format-preserving encryption. Format-preserving encryption (FPE) allows you to encrypt sensitive data in a way that maintains the format of the input data. This is particularly useful when you need to use encrypted data in systems that require data in a specific format. Importantly, FPE is reversible, meaning you can decrypt the data back to its original form when necessary. This would allow the organization to track changes over time and identify outliers, without exposing sensitive compensation data.

   Source: Adapted from community discussion — i_am_robot

   Next question

9. Question 89 · 356 in bank

   You need to set up a Cloud Interconnect connection between your company’s on-premises data center and VPC host network. You want to make sure that on-premises applications can only access Google APIs over the Cloud Interconnect and not through the public internet. You are required to only use APIs that are supported by VPC Service Controls to mitigate against exfiltration risk to non-supported APIs. How should you configure the network?

   • AEnable Private Google Access on the regional subnets and global dynamic routing mode.
   • BCreate a CNAME to map *.googleapis.com to restricted.googleapis.com, and create A records for restricted.googleapis.com mapped to 199.36.153.8/30.
   • CUse private.googleapis.com to access Google APIs using a set of IP addresses only routable from within Google Cloud, which are advertised as routes over the connection.
   • DUse restricted googleapis.com to access Google APIs using a set of IP addresses only routable from within Google Cloud, which are advertised as routes over the Cloud Interconnect connection.

   Show answer

   Answer: D

   Explanation

   D is correct, A - doesn't address the issue B - Looks good but for restricted API the subnet address will be 199.36.153.4/30 not 8/30 c - wrong D - everything looks good

   Source: Adapted from community discussion — cyberpunk21

   References

   • Google Cloud documentation

   Next question

10. Question 90 · 356 in bank

    An organization adopts Google Cloud Platform (GCP) for application hosting services and needs guidance on setting up password requirements for their Cloud Identity account. The organization has a password policy requirement that corporate employee passwords must have a minimum number of characters. Which Cloud Identity password guidelines can the organization use to inform their new requirements?

    • ASet the minimum length for passwords to be 8 characters.
    • BSet the minimum length for passwords to be 10 characters.
    • CSet the minimum length for passwords to be 12 characters.
    • DSet the minimum length for passwords to be 6 characters.

    Show answer

    Answer: A

    Explanation

    The situation changes year on year on GCP.Right now the right answer is C based on minimum requirement of 12 char in GCP as on Jan 2021. https://support.google.com/accounts/answer/32040?hl=en#zippy=%2Cmake-your-password-longer-more-memorable

    Source: Adapted from community discussion — bolu

    References

    • support.google.com documentation
    • support.google.com documentation
    • support.google.com documentation
    • support.google.com documentation
    • support.google.com documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

PCSE practice, question 81. 356 questions available.