Newest Google Professional-Cloud-Security-Engineer Practice Questions at Zero Cost

Get a glimpse of the real Professional-Cloud-Security-Engineer certification exam challenges with our free Google Professional-Cloud-Security-Engineer practice test questions.

Question 1

Your Google Cloud environment has one organization node, one folder named Apps." and several projects within that folder The organizational node enforces the constraints/iam.allowedPolicyMemberDomains organization policy, which allows members from the terramearth.com organization The "Apps" folder enforces the constraints/iam.allowedPolicyMemberDomains organization policy, which allows members from the flowlogistic.com organization. It also has the inheritFromParent: false property.

You attempt to grant access to a project in the Apps folder to the user testuser@terramearth.com.

What is the result of your action and why?

AThe action fails because a constraints/iam.allowedPolicyMemberDomains organization policy must
be defined on the current project to deactivate the constraint temporarily.

BThe action fails because a constraints/iam.allowedPolicyMemberDomains organization policy is in place and only members from the flowlogistic.com organization are allowed.

CThe action succeeds because members from both organizations, terramearth. com or flowlogistic.com, are allowed on projects in the 'Apps' folder

DThe action succeeds and the new member is successfully added to the project's Identity and Access Management (1AM) policy because all policies are inherited by underlying folders and projects.

Correct Answer: 1

Question 2

You control network traffic for a folder in your Google Cloud environment. Your folder includes multiple projects and Virtual Private Cloud (VPC) networks You want to enforce on the folder level that egress connections are limited only to IP range 10.58.5.0/24 and only from the VPC network dev-vpc." You want to minimize implementation and maintenance effort

What should you do?

A* 1. Attach external IP addresses to the VMs in scope.
* 2. Configure a VPC Firewall rule in 'dev-vpc' that allows egress connectivity to IP range 10.58.5.0/24 for all source addresses in this network.

B* 1. Attach external IP addresses to the VMs in scope.
* 2. Define and apply a hierarchical firewall policy on folder level to deny all egress connections and to allow egress to IP range 10 58.5.0/24 from network dev-vpc.

C* 1. Leave the network configuration of the VMs in scope unchanged.
* 2. Create a new project including a new VPC network 'new-vpc.'
* 3 Deploy a network appliance in 'new-vpc' to filter access requests and only allow egress connections from -dev-vpc' to 10.58.5.0/24.

D* 1 Leave the network configuration of the VMs in scope unchanged
* 2 Enable Cloud NAT for dev-vpc' and restrict the target range in Cloud NAT to 10.58.5 0/24.

Correct Answer: 2

Question 3

Your organization develops software involved in many open source projects and is concerned about software supply chain threats You need to deliver provenance for the build to demonstrate the software is untampered.

What should you do?

A* 1- Generate Supply Chain Levels for Software Artifacts (SLSA) level 3 assurance by using Cloud Build.
* 2. View the build provenance in the Security insights side panel within the Google Cloud console.

B* 1. Review the software process.
* 2. Generate private and public key pairs and use Pretty Good Privacy (PGP) protocols to sign the output software artifacts together with a file containing the address of your enterprise and point of contact.
* 3. Publish the PGP signed attestation to your public web page.

C* 1, Publish the software code on GitHub as open source.
* 2. Establish a bug bounty program, and encourage the open source community to review, report, and fix the vulnerabilities.

D* 1. Hire an external auditor to review and provide provenance
* 2. Define the scope and conditions.
* 3. Get support from the Security department or representative.
* 4. Publish the attestation to your public web page.

Correct Answer: 3

Question 4

You are migrating an application into the cloud The application will need to read data from a Cloud Storage bucket. Due to local regulatory requirements, you need to hold the key material used for encryption fully under your control and you require a valid rationale for accessing the key material.

What should you do?

AEncrypt the data in the Cloud Storage bucket by using Customer Managed Encryption Keys. Configure an 1AM deny policy for unauthorized groups

BEncrypt the data in the Cloud Storage bucket by using Customer Managed Encryption Keys backed by a Cloud Hardware Security Module (HSM). Enable data access logs.

CGenerate a key in your on-premises environment and store it in a Hardware Security Module (HSM) that is managed on-premises Use this key as an external key in the Cloud Key Management Service (KMS). Activate Key Access Justifications (KAJ) and set the external key system to reject unauthorized accesses.

DGenerate a key in your on-premises environment to encrypt the data before you upload the data to the Cloud Storage bucket Upload the key to the Cloud Key Management Service (KMS). Activate Key Access Justifications (KAJ) and have the external key system reject unauthorized accesses.

Correct Answer: 4

Question 5

You are deploying regulated workloads on Google Cloud. The regulation has data residency and data access requirements. It also requires that support is provided from the same geographical location as where the data resides.

What should you do?

AEnable Access Transparency Logging.

BDeploy resources only to regions permitted by data residency requirements

CUse Data Access logging and Access Transparency logging to confirm that no users are accessing data from another region.

DDeploy Assured Workloads.

Correct Answer: 5

Master the Professional Cloud Security Engineer exam like never before! You’ve reviewed the free Professional-Cloud-Security-Engineer practice questions, but the actual Google Cloud Certified certification exam demands more. Elevate your preparation with Certsmarket premium Professional-Cloud-Security-Engineer practice exam questions.

Explore Free Google Professional-Cloud-Security-Engineer Practice Questions for Exam Mastery

Our Community

What our students say about us?