Free Google Professional-Cloud-Security-Engineer Sample Questions

Question 1

 QUESTION 233 You manage a mission-critical workload for your organization, which is in a highly regulated industry The workload uses Compute Engine VMs to analyze and process the sensitive data after it is uploaded to Cloud Storage from the endpomt computers. Your compliance team has detected that this workload does not meet the data protection requirements for sensitive dat a. You need to meet these requirements; Manage the data encryption key (DEK) outside the Google Cloud boundary. Maintain full control of encryption keys through a third-party provider. Encrypt the sensitive data before uploading it to Cloud Storage Decrypt the sensitive data during processing in the Compute Engine VMs Encrypt the sensitive data in memory while in use in the Compute Engine VMs What should you do? Choose 2 answers 

A. Create a VPC Service Controls service perimeter across your existing Compute Engine VMs and Cloud Storage buckets 
B. Migrate the Compute Engine VMs to Confidential VMs to access the sensitive data. 
C. Configure Cloud External Key Manager to encrypt the sensitive data before it is uploaded to Cloud Storage and decrypt the sensitive data after it is downloaded into your VMs 
D. Create Confidential VMs to access the sensitive data. 
E. Configure Customer Managed Encryption Keys to encrypt the sensitive data before it is uploaded to Cloud Storage, and decrypt the sensitive data after it is downloaded into your VMs. 

Answer: C,D

Question 2

Your organization wants to be compliant with the General Data Protection Regulation (GDPR) on Google Cloud You must implement data residency and operational sovereignty in the EU. What should you do? Choose 2 answers 

A. Limit the physical location of a new resource with the Organization Policy Service resource locations constraint." 
B. Use Cloud IDS to get east-west and north-south traffic visibility in the EU to monitor intra-VPC and mter-VPC communication. 
C. Limit Google personnel access based on predefined attributes such as their citizenship or geographic location by using Key Access Justifications 
D. Use identity federation to limit access to Google Cloud resources from non-EU entities.
E. Use VPC Flow Logs to monitor intra-VPC and inter-VPC traffic in the EU. 

Answer: A,C

Question 3

Your company's users access data in a BigQuery table. You want to ensure they can only access the data during working hours. What should you do?

A. Assign a BigQuery Data Viewer role along with an 1AM condition that limits the access to specified working hours.
B. Configure Cloud Scheduler so that it triggers a Cloud Functions instance that modifies the organizational policy constraints for BigQuery during the specified working hours. 
C. Assign a BigQuery Data Viewer role to a service account that adds and removes the users daily during the specified working hours 
D. Run a gsuttl script that assigns a BigQuery Data Viewer role, and remove it only during the specified working hours.

Answer: A

Question 4

You are developing a new application that uses exclusively Compute Engine VMs Once a day. this application will execute five different batch jobs Each of the batch jobs requires a dedicated set of permissions on Google Cloud resources outside of your application. You need to design a secure access concept for the batch jobs that adheres to the least-privilege principle What should you do? 

A. 1. Create a general service account **g-sa" to execute the batch jobs. 2 Grant the permissions required to execute the batch jobs to g-sa. 3. Execute the batch jobs with the permissions granted to g-sa 
B. 1. Create a general service account "g-sa" to orchestrate the batch jobs. 2. Create one service account per batch job Mb-sa-[1-5]," and grant only the permissions required to run the individual batch jobs to the service accounts. 3. Grant the Service Account Token Creator role to g-sa Use g-sa to obtain short-lived access tokens for b-sa-[1-5] and to execute the batch jobs with the permissions of b-sa-[1-5]. 
C. 1. Create a workload identity pool and configure workload identity pool providers for each batch job 2 Assign the workload identity user role to each of the identities configured in the providers. 3. Create one service account per batch job Mb-sa-[1-5]". and grant only the permissions required to run the individual batch jobs to the service accounts 4 Generate credential configuration files for each of the providers Use these files to execute the batch jobs with the permissions of b-sa-[1-5].
D. 1. Create a general service account "g-sa" to orchestrate the batch jobs. 2 Create one service account per batch job 'b-sa-[1-5)\ Grant only the permissions required to run the individual batch jobs to the service accounts and generate service account keys for each of these service accounts.3. Store the service account keys in Secret Manager. Grant g-sa access to Secret Manager and run the batch jobs with the permissions of b-sa-[1-5].

Answer: B

Question 5

Employees at your company use their personal computers to access your organization s Google Cloud console. You need to ensure that users can only access the Google Cloud console from their corporate-issued devices and verify that they have a valid enterprise certificate What should you do? 

A. Implement an Identity and Access Management (1AM) conditional policy to verify the device certificate
B. Implement a VPC firewall policy Activate packet inspection and create an allow rule to validate and verify the device certificate. 
C. Implement an organization policy to verify the certificate from the access context. 
D. Implement an Access Policy in BeyondCorp Enterprise to verify the device certificate Create an access binding with the access policy just created. 

Answer: D