| Exam Code | Professional-Cloud-Security-Engineer |
| Exam Name | Google Cloud Certified - Professional Cloud Security Engineer |
| Update Date | 11 Oct, 2024 |
| Total Questions | 234 Questions Answers With Explanation |
Dumpschool.com is a trusted online platform that offers the latest and updated Google Professional-Cloud-Security-Engineer Dumps. These dumps are designed to help candidates prepare for the Professional-Cloud-Security-Engineer certification exam effectively. With a 100% passing guarantee, Dumpschool ensures that candidates can confidently take the exam and achieve their desired score. The exam dumps provided by Dumpschool cover all the necessary topics and include real exam questions, allowing candidates to familiarize themselves with the exam format and improve their knowledge and skills. Whether you are a beginner or have previous experience, Dumpschool.com provides comprehensive study material to ensure your success in the Google Professional-Cloud-Security-Engineer exam.
Preparing for the Google Professional-Cloud-Security-Engineer certification exam can be a daunting task, but with Dumpschool.com, candidates can find the latest and updated exam dumps to streamline their preparation process. The platform's guarantee of a 100% passing grade adds an extra layer of confidence, allowing candidates to approach the exam with a sense of assurance. Dumpschool.com’s comprehensive study material is designed to cater to the needs of individuals at all levels of experience, making it an ideal resource for both beginners and those with previous knowledge. By providing real exam questions and covering all the necessary topics, Dumpschool.com ensures that candidates can familiarize themselves with the exam format and boost their knowledge and skills. With Dumpschool as a trusted online platform, success in the Google Professional-Cloud-Security-Engineer exam is within reach.
We understand the stress and pressure that comes with preparing for exams. That's why we have created a comprehensive collection of Professional-Cloud-Security-Engineer exam dumps to help students to pass their exam easily. Our Professional-Cloud-Security-Engineer dumps PDF are carefully curated and prepared by experienced professionals, ensuring that you have access to the most relevant and up-to-date materials, our dumps will provide you with the edge you need to succeed. With our experts study material you can study at your own pace and be confident in your knowledge before sitting for the exam. Don't let exam anxiety hold you back - let Dumpschool help you breeze through your exams with ease.
DumpSchool understand the importance of staying up-to-date with the latest and most accurate practice questions for the Google Professional-Cloud-Security-Engineer certification exam. That's why we are committed to providing our customers with the most current and comprehensive resources available. With our Google Professional-Cloud-Security-Engineer Practice Questions, you can feel confident knowing that you are preparing with the most relevant and reliable study materials. In addition, we offer a 90-day free update period, ensuring that you have access to any new questions or changes that may arise. Trust Dumpschool.com to help you succeed in your Google Professional-Cloud-Security-Engineer exam preparation.
Dumpschool believe in the quality of our study materials and your ability to succeed in your IT certification exams. That's why we're proud to offer a 100% refund surety if you fail after using our dumps. This guarantee is our commitment to providing you with the best possible resources and support on your journey to certification success.
QUESTION 233 You manage a mission-critical workload for your organization, which is in a highly regulated industry The workload uses Compute Engine VMs to analyze and process the sensitive data after it is uploaded to Cloud Storage from the endpomt computers. Your compliance team has detected that this workload does not meet the data protection requirements for sensitive dat a. You need to meet these requirements; Manage the data encryption key (DEK) outside the Google Cloud boundary. Maintain full control of encryption keys through a third-party provider. Encrypt the sensitive data before uploading it to Cloud Storage Decrypt the sensitive data during processing in the Compute Engine VMs Encrypt the sensitive data in memory while in use in the Compute Engine VMs What should you do? Choose 2 answers
A. Create a VPC Service Controls service perimeter across your existing Compute Engine VMs and Cloud Storage buckets
B. Migrate the Compute Engine VMs to Confidential VMs to access the sensitive data.
C. Configure Cloud External Key Manager to encrypt the sensitive data before it is uploaded to Cloud Storage and decrypt the sensitive data after it is downloaded into your VMs
D. Create Confidential VMs to access the sensitive data.
E. Configure Customer Managed Encryption Keys to encrypt the sensitive data before it is uploaded to Cloud Storage, and decrypt the sensitive data after it is downloaded into your VMs.
Your organization wants to be compliant with the General Data Protection Regulation (GDPR) on Google Cloud You must implement data residency and operational sovereignty in the EU. What should you do? Choose 2 answers
A. Limit the physical location of a new resource with the Organization Policy Service resource locations constraint."
B. Use Cloud IDS to get east-west and north-south traffic visibility in the EU to monitor intra-VPC and
mter-VPC communication.
C. Limit Google personnel access based on predefined attributes such as their citizenship or geographic location by using Key Access Justifications
D. Use identity federation to limit access to Google Cloud resources from non-EU entities.
E. Use VPC Flow Logs to monitor intra-VPC and inter-VPC traffic in the EU.
Your company's users access data in a BigQuery table. You want to ensure they can only access the data during working hours. What should you do?
A. Assign a BigQuery Data Viewer role along with an 1AM condition that limits the access to specified working hours.
B. Configure Cloud Scheduler so that it triggers a Cloud Functions instance that modifies the organizational policy constraints for BigQuery during the specified working hours.
C. Assign a BigQuery Data Viewer role to a service account that adds and removes the users daily during the specified working hours
D. Run a gsuttl script that assigns a BigQuery Data Viewer role, and remove it only during the specified working hours.
You are developing a new application that uses exclusively Compute Engine VMs Once a day. this application will execute five different batch jobs Each of the batch jobs requires a dedicated set of permissions on Google Cloud resources outside of your application. You need to design a secure access concept for the batch jobs that adheres to the least-privilege principle What should you do?
A. 1. Create a general service account **g-sa" to execute the batch jobs. 2 Grant the permissions required to execute the batch jobs to g-sa. 3. Execute the batch jobs with the permissions granted to g-sa
B. 1. Create a general service account "g-sa" to orchestrate the batch jobs. 2. Create one service account per batch job Mb-sa-[1-5]," and grant only the permissions required to run the individual batch jobs to the service accounts. 3. Grant the Service Account Token Creator role to g-sa Use g-sa to obtain short-lived access tokens for b-sa-[1-5] and to execute the batch jobs with the permissions of b-sa-[1-5].
C. 1. Create a workload identity pool and configure workload identity pool providers for each batch job 2 Assign the workload identity user role to each of the identities configured in the providers. 3. Create one service account per batch job Mb-sa-[1-5]". and grant only the permissions required to run the individual batch jobs to the service accounts 4 Generate credential configuration files for each of the providers Use these files to execute the batch jobs with the permissions of b-sa-[1-5].
D. 1. Create a general service account "g-sa" to orchestrate the batch jobs. 2 Create one service account per batch job 'b-sa-[1-5)\ Grant only the permissions required to run the individual batch jobs to the service accounts and generate service account keys for each of these service accounts.3. Store the service account keys in Secret Manager. Grant g-sa access to Secret Manager and run the batch jobs with the permissions of b-sa-[1-5].
Employees at your company use their personal computers to access your organization s Google Cloud console. You need to ensure that users can only access the Google Cloud console from their corporate-issued devices and verify that they have a valid enterprise certificate What should you do?
A. Implement an Identity and Access Management (1AM) conditional policy to verify the device certificate
B. Implement a VPC firewall policy Activate packet inspection and create an allow rule to validate and verify the device certificate.
C. Implement an organization policy to verify the certificate from the access context.
D. Implement an Access Policy in BeyondCorp Enterprise to verify the device certificate Create an access binding with the access policy just created.
You manage a fleet of virtual machines (VMs) in your organization. You have encountered issues with lack of patching in many VMs. You need to automate regular patching in your VMs and view the patch management data across multiple projects. What should you do? Choose 2 answers
A. Deploy patches with VM Manager by using OS patch management
B. View patch management data in VM Manager by using OS patch management.
C. Deploy patches with Security Command Center by using Rapid Vulnerability Detection.
D. View patch management data in a Security Command Center dashboard.
E. View patch management data in Artifact Registry.
Your Google Cloud environment has one organization node, one folder named Apps." and several projects within that folder The organizational node enforces the constraints/iam.allowedPolicyMemberDomains organization policy, which allows members from the terramearth.com organization The "Apps" folder enforces the constraints/iam.allowedPolicyMemberDomains organization policy, which allows members from the flowlogistic.com organization. It also has the inheritFromParent: false property. You attempt to grant access to a project in the Apps folder to the user testuser@terramearth.com. What is the result of your action and why?
A. The action fails because a constraints/iam.allowedPolicyMemberDomains organization policy must be defined on the current project to deactivate the constraint temporarily.
B. The action fails because a constraints/iam.allowedPolicyMemberDomains organization policy is in place and only members from the flowlogistic.com organization are allowed.
C. The action succeeds because members from both organizations, terramearth. com or flowlogistic.com, are allowed on projects in the "Apps" folder
D. The action succeeds and the new member is successfully added to the project's Identity and Access Management (1AM) policy because all policies are inherited by underlying folders and projects.
You control network traffic for a folder in your Google Cloud environment. Your folder includes multiple projects and Virtual Private Cloud (VPC) networks You want to enforce on the folder level that egress connections are limited only to IP range 10.58.5.0 and only from the VPC network dev-vpc." You want to minimize implementation and maintenance effort What should you do?
A. 1. Attach external IP addresses to the VMs in scope. 2. Configure a VPC Firewall rule in "dev-vpc" that allows egress connectivity to IP range 10.58.5.0 for all source addresses in this network
B. 1. Attach external IP addresses to the VMs in scope. 2. Define and apply a hierarchical firewall policy on folder level to deny all egress connections and to allow egress to IP range 10 58.5.0 from network dev-vpc.
C. 1. Leave the network configuration of the VMs in scope unchanged. 2. Create a new project including a new VPC network "new-vpc." 3 Deploy a network appliance in "new-vpc" to filter access requests and only allow egress connections from -dev-vpc" to 10.58.5.0.
D. 1 Leave the network configuration of the VMs in scope unchanged 2 Enable Cloud NAT for dev-vpc" and restrict the target range in Cloud NAT to 10.58.5 0.
Your organization develops software involved in many open source projects and is concerned about software supply chain threats You need to deliver provenance for the build to demonstrate the software is untampered. What should you do?
A. 1- Generate Supply Chain Levels for Software Artifacts (SLSA) level 3 assurance by using Cloud Build. 2. View the build provenance in the Security insights side panel within the Google Cloud console.
B. 1. Review the software process. 2. Generate private and public key pairs and use Pretty Good Privacy (PGP) protocols to sign the output software artifacts together with a file containing the address of your enterprise and point of contact. 3. Publish the PGP signed attestation to your public web page.
C. 1, Publish the software code on GitHub as open source. 2. Establish a bug bounty program, and encourage the open source community to review, report, and fix the vulnerabilities.
D. 1. Hire an external auditor to review and provide provenance 2. Define the scope and conditions. 3. Get support from the Security department or representative. 4. Publish the attestation to your public web page.
You are migrating an application into the cloud The application will need to read data from a Cloud Storage bucket. Due to local regulatory requirements, you need to hold the key material used for encryption fully under your control and you require a valid rationale for accessing the key material. What should you do?
A. Encrypt the data in the Cloud Storage bucket by using Customer Managed Encryption Keys. Configure an 1AM deny policy for unauthorized groups
B. Encrypt the data in the Cloud Storage bucket by using Customer Managed Encryption Keys backed by a Cloud Hardware Security Module (HSM). Enable data access logs.
C. Generate a key in your on-premises environment and store it in a Hardware Security Module (HSM) that is managed on-premises Use this key as an external key in the Cloud Key Management Service (KMS). Activate Key Access Justifications (KAJ) and set the external key system to reject unauthorized accesses.
D. Generate a key in your on-premises environment to encrypt the data before you upload the data to the Cloud Storage bucket Upload the key to the Cloud Key Management Service (KMS). Activate Key Access Justifications (KAJ) and have the external key system reject unauthorized accesses.
You are deploying regulated workloads on Google Cloud. The regulation has data residency and data access requirements. It also requires that support is provided from the same geographical location as where the data resides. What should you do?
A. Enable Access Transparency Logging.
B. Deploy resources only to regions permitted by data residency requirements
C. Use Data Access logging and Access Transparency logging to confirm that no users are accessing data from another region.
D. Deploy Assured Workloads.
You are setting up a new Cloud Storage bucket in your environment that is encrypted with a customer managed encryption key (CMEK). The CMEK is stored in Cloud Key Management Service (KMS). in project "pr j -a", and the Cloud Storage bucket will use project "prj-b". The key is backed by a Cloud Hardware Security Module (HSM) and resides in the region europe-west3. Your storage bucket will be located in the region europe-west1. When you create the bucket, you cannot access the key. and you need to troubleshoot why. What has caused the access issue?
A. A firewall rule prevents the key from being accessible.
B. Cloud HSM does not support Cloud Storage
C. The CMEK is in a different project than the Cloud Storage bucket
D. The CMEK is in a different region than the Cloud Storage bucket.
Your company conducts clinical trials and needs to analyze the results of a recent study that are stored in BigQuery. The interval when the medicine was taken contains start and stop dates The interval data is critical to the analysis, but specific dates may identify a particular batch and introduce bias You need to obfuscate the start and end dates for each row and preserve the interval data. What should you do?
A. Use bucketing to shift values to a predetermined date based on the initial value.
B. Extract the date using TimePartConfig from each date field and append a random month and year
C. Use date shifting with the context set to the unique ID of the test subject
D. Use the FFX mode of format preserving encryption (FPE) and maintain data consistency
Your organization previously stored files in Cloud Storage by using Google Managed Encryption Keys (GMEK). but has recently updated the internal policy to require Customer Managed Encryption Keys (CMEK). You need to re-encrypt the files quickly and efficiently with minimal cost. What should you do?
A. Encrypt the files locally, and then use gsutil to upload the files to a new bucket.
B. Copy the files to a new bucket with CMEK enabled in a secondary region
C. Reupload the files to the same Cloud Storage bucket specifying a key file by using gsutil.
D. Change the encryption type on the bucket to CMEK, and rewrite the objects
Your company is concerned about unauthorized parties gaming access to the Google Cloud environment by using a fake login page. You must implement a solution to protect against person-inthe- middle attacks. Which security measure should you use?
A. Text message or phone call code
B. Security key
C. Google Authenticator application
D. Google prompt
An administrative application is running on a virtual machine (VM) in a managed group at port 5601 inside a Virtual Private Cloud (VPC) instance without access to the internet currently. You want to expose the web interface at port 5601 to users and enforce authentication and authorization Google credentials What should you do?
A. Modify the VPC routing with the default route point to the default internet gateway Modify the VPC Firewall rule to allow access from the internet 0.0.0.0/0 to port 5601 on the application instance
B. Configure the bastion host with OS Login enabled and allow connection to port 5601 at VPC firewall Log in to the bastion host from the Google Cloud console by using SSH-in-browser and then to the web application
C. Configure an HTTP Load Balancing instance that points to the managed group with Identity-Aware Proxy (IAP) protection with Google credentials Modify the VPC firewall to allow access from IAP network range
D. Configure Secure Shell Access (SSH) bastion host in a public network, and allow only the bastion host to connect to the application on port 5601. Use a bastion host as a jump host to connect to the application
A company is using Google Kubernetes Engine (GKE) with container images of a mission-critical application The company wants to scan the images for known security issues and securely share the report with the security team without exposing them outside Google Cloud. What should you do?
A. 1. Enable Container Threat Detection in the Security Command Center Premium tier. 2. Upgrade all clusters that are not on a supported version of GKE to the latest possible GKE version. 3. View and share the results from the Security Command Center
B. 1. Use an open source tool in Cloud Build to scan the images. 2. Upload reports to publicly accessible buckets in Cloud Storage by using gsutil 3. Share the scan report link with your security department.
C. 1. Enable vulnerability scanning in the Artifact Registry settings. 2. Use Cloud Build to build the images 3. Push the images to the Artifact Registry for automatic scanning. 4. View the reports in the Artifact Registry.
D. 1. Get a GitHub subscription. 2. Build the images in Cloud Build and store them in GitHub for automatic scanning 3. Download the report from GitHub and share with the Security Team
Your organization operates Virtual Machines (VMs) with only private IPs in the Virtual Private Cloud (VPC) with internet access through Cloud NAT Everyday, you must patch all VMs with critical OS updates and provide summary reports What should you do?
A. Validate that the egress firewall rules allow any outgoing traffic Log in to each VM and execute OS specific update commands Configure the Cloud Scheduler job to update with critical patches daily for daily updates.
B. Ensure that VM Manager is installed and running on the VMs. In the OS patch management service. configure the patch jobs to update with critical patches daily.
C. Assign public IPs to VMs. Validate that the egress firewall rules allow any outgoing traffic Log in to each VM. and configure a daily cron job to enable for OS updates at night during low activity periods.
D. Copy the latest patches to the Cloud Storage bucket. Log in to each VM. download the patches from the bucket, and install them.
Your organization uses BigQuery to process highly sensitive, structured datasets. Following the "need to know" principle, you need to create the Identity and Access Management (IAM) design to meet the needs of these users: Business user must access curated reports. Data engineer: must administrate the data lifecycle in the platform. Security operator: must review user activity on the data platform. What should you do?
A. Configure data access log for BigQuery services, and grant Project Viewer role to security operators.
B. Generate a CSV data file based on the business user's needs, and send the data to their email addresses.
C. Create curated tables in a separate dataset and assign the role roles/bigquery.dataViewer.
D. Set row-based access control based on the "region" column, and filter the record from the United States for data engineers.
Your organization wants to be General Data Protection Regulation (GDPR) compliant You want to ensure that your DevOps teams can only create Google Cloud resources in the Europe regions. What should you do?
A. Use the org policy constraint "Restrict Resource Service Usage'* on your Google Cloud organization node.
B. Use Identity and Access Management (1AM) custom roles to ensure that your DevOps team can only create resources in the Europe regions
C. Use the org policy constraint Google Cloud Platform - Resource Location Restriction" on your Google Cloud organization node.
D. Use Identity-Aware Proxy (IAP) with Access Context Manager to restrict the location of Google Cloud resources.
0 Review for Google Professional-Cloud-Security-Engineer Exam Dumps