[Q73-Q92] 2023 Updated Professional-Cloud-Security-Engineer Tests Engine pdf - All Free Dumps Guaranteed!

Rate this post

2023 Updated Professional-Cloud-Security-Engineer Tests Engine pdf – All Free Dumps Guaranteed!

Latest Google Cloud Certified Professional-Cloud-Security-Engineer Actual Free Exam Questions

The Google Professional-Cloud-Security-Engineer Certification Exam consists of multiple-choice questions and is designed to test the candidate’s knowledge and skills in securing cloud-based solutions. The exam covers a wide range of topics, including cloud security fundamentals, identity and access management, network security, data protection, and compliance. Candidates are required to have a deep understanding of Google Cloud Platform services and be able to apply their knowledge to real-world scenarios. The certification exam is a great way for professionals to validate their skills in cloud security and gain recognition for their expertise in the field.

The Google Professional-Cloud-Security-Engineer exam is a certification offered by Google for professionals who are responsible for ensuring the security of data and infrastructure in the cloud. This exam is designed to test the candidate’s knowledge and skills in implementing security controls and maintaining compliance in the Google Cloud Platform (GCP). The certification is intended for security engineers, security architects, and other professionals who have experience in cloud security.

QUESTION 73
You are in charge of creating a new Google Cloud organization for your company. Which two actions should you take when creating the super administrator accounts? (Choose two.)

Create an access level in the Google Admin console to prevent super admin from logging in to Google Cloud.

Disable any Identity and Access Management (1AM) roles for super admin at the organization level in the Google Cloud Console.

Use a physical token to secure the super admin credentials with multi-factor authentication (MFA).

Use a private connection to create the super admin accounts to avoid sending your credentials over the Internet.

Provide non-privileged identities to the super admin users for their day-to-day activities.

QUESTION 74
A DevOps team will create a new container to run on Google Kubernetes Engine. As the application will be internet-facing, they want to minimize the attack surface of the container.
What should they do?

Use Cloud Build to build the container images.

Build small containers using small base images.

Delete non-used versions from Container Registry.

Use a Continuous Delivery tool to deploy the application.

QUESTION 75
Your organization has implemented synchronization and SAML federation between Cloud Identity and Microsoft Active Directory. You want to reduce the risk of Google Cloud user accounts being compromised. What should you do?

Create a Cloud Identity password policy with strong password settings, and configure 2-Step Verification with security keys in the Google Admin console.

Create a Cloud Identity password policy with strong password settings, and configure 2-Step Verification with verification codes via text or phone call in the Google Admin console.

Create an Active Directory domain password policy with strong password settings, and configure post-SSO (single sign-on) 2-Step Verification with security keys in the Google Admin console.

Create an Active Directory domain password policy with strong password settings, and configure post-SSO (single sign-on) 2-Step Verification with verification codes via text or phone call in the Google Admin console.

QUESTION 76
Your company operates an application instance group that is currently deployed behind a Google Cloud load balancer in us-central-1 and is configured to use the Standard Tier network. The infrastructure team wants to expand to a second Google Cloud region, us-east-2. You need to set up a single external IP address to distribute new requests to the instance groups in both regions.
What should you do?

Change the load balancer backend configuration to use network endpoint groups instead of instance groups.

Change the load balancer frontend configuration to use the Premium Tier network, and add the new instance group.

Create a new load balancer in us-east-2 using the Standard Tier network, and assign a static external IP address.

Create a Cloud VPN connection between the two regions, and enable Google Private Access.

QUESTION 77
When working with agents in a support center via online chat, an organization’s customers often share pictures of their documents with personally identifiable information (PII). The organization that owns the support center is concerned that the PII is being stored in their databases as part of the regular chat logs they retain for review by internal or external analysts for customer service trend analysis.
Which Google Cloud solution should the organization use to help resolve this concern for the customer while still maintaining data utility?

Use Cloud Key Management Service (KMS) to encrypt the PII data shared by customers before storing it for analysis.

Use Object Lifecycle Management to make sure that all chat records with PII in them are discarded and not saved for analysis.

Use the image inspection and redaction actions of the DLP API to redact PII from the images before storing them for analysis.

Use the generalization and bucketing actions of the DLP API solution to redact PII from the texts before storing them for analysis.

QUESTION 78
A company is running workloads in a dedicated server room. They must only be accessed from within the private company network. You need to connect to these workloads from Compute Engine instances within a Google Cloud Platform project.
Which two approaches can you take to meet the requirements? (Choose two.)

Configure the project with Cloud VPN.

Configure the project with Shared VPC.

Configure the project with Cloud Interconnect.

Configure the project with VPC peering.

Configure all Compute Engine instances with Private Access.

QUESTION 79
You are part of a security team that wants to ensure that a Cloud Storage bucket in Project A can only be readable from Project B.
You also want to ensure that data in the Cloud Storage bucket cannot be accessed from or copied to Cloud Storage buckets outside the network, even if the user has the correct credentials.
What should you do?

Enable VPC Service Controls, create a perimeter with Project A and B, and include Cloud Storage service.

Enable Domain Restricted Sharing Organization Policy and Bucket Policy Only on the Cloud Storage bucket.

Enable Private Access in Project A and B networks with strict firewall rules to allow communication between the networks.

Enable VPC Peering between Project A and B networks with strict firewall rules to allow communication between the networks.

QUESTION 80
Which two security characteristics are related to the use of VPC peering to connect two VPC networks?
(Choose two.)

Central management of routes, firewalls, and VPNs for peered networks

Non-transitive peered networks; where only directly peered networks can communicate

Ability to peer networks that belong to different Google Cloud Platform organizations

Firewall rules that can be created with a tag from one peered network to another peered network

Ability to share specific subnets across peered networks

QUESTION 81
An organization receives an increasing number of phishing emails.
Which method should be used to protect employee credentials in this situation?

Multifactor Authentication

A strict password policy

Captcha on login pages

Encrypted emails

QUESTION 82
Your team uses a service account to authenticate data transfers from a given Compute Engine virtual machine instance of to a specified Cloud Storage bucket. An engineer accidentally deletes the service account, which breaks application functionality. You want to recover the application as quickly as possible without compromising security.
What should you do?

Temporarily disable authentication on the Cloud Storage bucket.

Use the undelete command to recover the deleted service account.

Create a new service account with the same name as the deleted service account.

Update the permissions of another existing service account and supply those credentials to the applications.

QUESTION 83
You are a member of the security team at an organization. Your team has a single GCP project with credit card payment processing systems alongside web applications and data processing systems. You want to reduce the scope of systems subject to PCI audit standards.
What should you do?

Use multi-factor authentication for admin access to the web application.

Use only applications certified compliant with PA-DSS.

Move the cardholder data environment into a separate GCP project.

Use VPN for all connections between your office and cloud environments.

QUESTION 84
You need to enforce a security policy in your Google Cloud organization that prevents users from exposing objects in their buckets externally. There are currently no buckets in your organization. Which solution should you implement proactively to achieve this goal with the least operational overhead?

Create an hourly cron job to run a Cloud Function that finds public buckets and makes them private.

Enable the constraints/storage.publicAccessPrevention constraint at the organization level.

Enable the constraints/storage.uniformBucketLevelAccess constraint at the organization level.

Create a VPC Service Controls perimeter that protects the storage.googleapis.com service in your projects that contains buckets. Add any new project that contains a bucket to the perimeter.

QUESTION 85
When creating a secure container image, which two items should you incorporate into the build if possible?
(Choose two.)

Ensure that the app does not run as PID 1.

Package a single app as a container.

Remove any unnecessary tools not needed by the app.

Use public container images as a base image for the app.

Use many container image layers to hide sensitive information.

QUESTION 86
Your team needs to prevent users from creating projects in the organization. Only the DevOps team should be allowed to create projects on behalf of the requester.
Which two tasks should your team perform to handle this request? (Choose two.)

Remove all users from the Project Creator role at the organizational level.

Create an Organization Policy constraint, and apply it at the organizational level.

Grant the Project Editor role at the organizational level to a designated group of users.

Add a designated group of users to the Project Creator role at the organizational level.

Grant the billing account creator role to the designated DevOps team.

QUESTION 87
You need to follow Google-recommended practices to leverage envelope encryption and encrypt data at the application layer.
What should you do?

Generate a data encryption key (DEK) locally to encrypt the data, and generate a new key encryption key (KEK) in Cloud KMS to encrypt the DEK. Store both the encrypted data and the encrypted DEK.

Generate a data encryption key (DEK) locally to encrypt the data, and generate a new key encryption key (KEK) in Cloud KMS to encrypt the DEK. Store both the encrypted data and the KEK.

Generate a new data encryption key (DEK) in Cloud KMS to encrypt the data, and generate a key encryption key (KEK) locally to encrypt the key. Store both the encrypted data and the encrypted DEK.

Generate a new data encryption key (DEK) in Cloud KMS to encrypt the data, and generate a key encryption key (KEK) locally to encrypt the key. Store both the encrypted data and the KEK.

QUESTION 88
A customer’s data science group wants to use Google Cloud Platform (GCP) for their analytics workloads.
Company policy dictates that all data must be company-owned and all user authentications must go through their own Security Assertion Markup Language (SAML) 2.0 Identity Provider (IdP). The Infrastructure Operations Systems Engineer was trying to set up Cloud Identity for the customer and realized that their domain was already being used by G Suite.
How should you best advise the Systems Engineer to proceed with the least disruption?

Contact Google Support and initiate the Domain Contestation Process to use the domain name in your new Cloud Identity domain.

Ask Google to provision the data science manager’s account as a Super Administrator in the existing domain.

Ask customer’s management to discover any other uses of Google managed services, and work with the existing Super Administrator.

QUESTION 89
What are the steps to encrypt data using envelope encryption?
* A. Generate a data encryption key (DEK) locally.
* Use a key encryption key (KEK) to wrap the DEK.
* Encrypt data with the KEK.
* Store the encrypted data and the wrapped KEK.
* B. Generate a key encryption key (KEK) locally.
* Use the KEK to generate a data encryption key (DEK).
* Encrypt data with the DEK.
* Store the encrypted data and the wrapped DEK.
* C. Generate a data encryption key (DEK) locally.
* Encrypt data with the DEK.
* Use a key encryption key (KEK) to wrap the DEK.
* Store the encrypted data and the wrapped DEK.
* D. Generate a key encryption key (KEK) locally.
* Generate a data encryption key (DEK) locally.
* Encrypt data with the KEK

QUESTION 90
You are a member of the security team at an organization. Your team has a single GCP project with credit card payment processing systems alongside web applications and data processing systems. You want to reduce the scope of systems subject to PCI audit standards.
What should you do?

Use multi-factor authentication for admin access to the web application.

Use only applications certified compliant with PA-DSS.

Move the cardholder data environment into a separate GCP project.

Use VPN for all connections between your office and cloud environments.

QUESTION 91
For compliance reasons, an organization needs to ensure that in-scope PCI Kubernetes Pods reside on “in- scope” Nodes only. These Nodes can only contain the “in-scope” Pods.
How should the organization achieve this objective?

Add a nodeSelector field to the pod configuration to only use the Nodes labeled inscope: true.

Create a node pool with the label inscope: true and a Pod Security Policy that only allows the Pods to run on Nodes with that label.

Place a taint on the Nodes with the label inscope: true and effect NoSchedule and a toleration to match in the Pod configuration.

Run all in-scope Pods in the namespace “in-scope-pci”.

QUESTION 92
A customer wants to make it convenient for their mobile workforce to access a CRM web interface that is hosted on Google Cloud Platform (GCP). The CRM can only be accessed by someone on the corporate network. The customer wants to make it available over the internet. Your team requires an authentication layer in front of the application that supports two-factor authentication Which GCP product should the customer implement to meet these requirements?

Cloud Identity-Aware Proxy

Cloud Armor

Cloud Endpoints

Cloud VPN

Data Protection Ensuring

To answer the questions related to this module, the learners need to have the skills in managing encryption at rest. This comprises their comprehension of use cases for default encryption, customer-supplied encryption keys (CSEK), and customer-managed encryption keys (CMEK). The candidates should also be capable of creating & managing encryption keys for CSEK and CMEK as well as managing application secrets. They should have an understanding of enclave computing, envelope encryption, and object lifecycle policies for Cloud Storage. Moreover, this area requires your competency in preventing data loss using DLP API. This involves the ability to configure tokenization, restrict access to DLP datasets, determine and redact PII, as well as configure the format-preserving substitution.

Professional-Cloud-Security-Engineer Dumps Updated Practice Test and 178 unique questions: https://www.prepawaytest.com/Google/Professional-Cloud-Security-Engineer-practice-exam-dumps.html

[Q73-Q92] 2023 Updated Professional-Cloud-Security-Engineer Tests Engine pdf – All Free Dumps Guaranteed!

Data Protection Ensuring

Leave a Reply Cancel reply