Free Google Professional-Cloud-Security-Engineer Exam Dumps Questions & Answers

An organization's security and risk management teams are concerned about where their responsibility lies for certain production workloads they are running in Google Cloud Platform (GCP), and where Google's responsibility lies. They are mostly running workloads using Google Cloud's Platform-as-a-Service (PaaS) offerings, including App Engine primarily.
Which one of these areas in the technology stack would they need to focus on as their primary responsibility when using App Engine?

• A.  Encrypting all stored data
• B.  Configuring and monitoring VPC Flow Logs
• C.  Manage the latest updates and security patches for the Guest OS
• D.  Defending against XSS and SQLi attacks

You are responsible for the operation of your company's application that runs on Google Cloud. The database for the application will be maintained by an external partner. You need to give the partner team access to the database. This access must be restricted solely to the database and can not extend to any other resources within your company's network. Your solution should follow Google-recommended practices. What should you do?

• A.  Create accounts for the partner team in your corporate identity provider. Synchronize these accounts with Google Cloud Identity. Grant the accounts access to the database.
• B.  Add a public IP address to the application's database. Create database users for each of the partner's employees. Securely distribute the credentials for these users to the partner team.
• C.  Configure Workforce Identity Federation for the partner. Connect the identity pool provider to the partner's identity provider. Grant the workforce pool resources access to the database.
• D.  Ask the partner team to set up Cloud Identity accounts within their own corporate environment and identity provider. Grant the partner's Cloud Identity accounts access to the database.

A customer deployed an application on Compute Engine that takes advantage of the elastic nature of cloud computing.
How can you work with Infrastructure Operations Engineers to best ensure that Windows Compute Engine VMs are up to date with all the latest OS patches?

• A.  Federate a Domain Controller into Compute Engine, and roll out weekly patches via Group Policy Object.
• B.  Reboot all VMs during the weekly maintenance window and allow the StartUp Script to download the latest patches from the internet.
• C.  Use Deployment Manager to provision updated VMs into new serving Instance Groups (IGs).
• D.  Build new base images when patches are available, and use a CI/CD pipeline to rebuild VMs, deploying incrementally.

A company is running their webshop on Google Kubernetes Engine and wants to analyze customer transactions in BigQuery. You need to ensure that no credit card numbers are stored in BigQuery What should you do?

• A.  Create a BigQuery view with regular expressions matching credit card numbers to query and delete affected rows.
• B.  Leverage Security Command Center to scan for the assets of type Credit Card Number in BigQuery.
• C.  Use the Cloud Data Loss Prevention API to redact related infoTypes before data is ingested into BigQuery.
• D.  Enable Cloud Identity-Aware Proxy to filter out credit card numbers before storing the logs in BigQuery.

Your organization has established a highly sensitive project within a VPC Service Controls perimeter. You need to ensure that only users meeting specific contextual requirements-such as having a company-managed device, a specific location, and a valid user identity-can access resources within this perimeter. You want to evaluate the impact of this change without blocking legitimate access. What should you do?

• A.  Establish a Context-Aware Access policy that specifies the required contextual attributes, and associate the policy with the VPC Service Controls perimeter in dry run mode.
• B.  Use Cloud Audit Logs to monitor user access to the project resources.11 Use post-incident analysis to identify unauthorized access attempts.
• C.  Configure a VPC Service Controls perimeter in dry run mode, and enforce strict network segmentation using firewall rules. Use multi-factor authentication (MFA) for user verification.
• D.  Use the VPC Service Control Violation dashboard to identify the impact of details about access denials by service perimeters.