Professional-Cloud-Security-Engineer Practice Questions

A.  

Use Identity Platform to provision users and groups to Google Cloud.

B.  

Use Cloud Identity SAML integration to provision users and groups to Google Cloud.

C.  

Install Google Cloud Directory Sync and connect it to Active Directory and Cloud Identity.

D.  

Create Identity and Access Management (1AM) roles with permissions corresponding to each Active Directory group.

E.  

Create Identity and Access Management (1AM) groups with permissions corresponding to each Active Directory group.

A.  

Assign a static public IP address to each database server. Use firewall rules to restrict external access.

B.  

Create a VPC with a private subnet. Assign a private IP address to each database server.

C.  

Assign both a private IP address and a public IP address to each database server.

D.  

Assign a private IP address to each database server. Use a NAT gateway to provide internet connectivity to the database servers.

A.  

Configure a rate_based_ban action by using Google Cloud Armor and set the ban_duration_sec parameter to the specified time interval.

B.  

Configure a deny action by using Google Cloud Armor to deny the clients that issued too many requests over the specified time interval.

C.  

Configure a throttle action by using Google Cloud Armor to limit the number of requests per client over a specified time interval.

D.  

Configure a firewall rule in your VPC to throttle traffic from the identified IP addresses.

A.  

Disable and revoke access to compromised keys.

B.  

Enable automatic key version rotation on a regular schedule.

C.  

Manually rotate key versions on an ad hoc schedule.

D.  

Limit the number of messages encrypted with each key version.

E.  

Disable the Cloud KMS API.

A.  

Employ organization-level firewall rules to block all traffic to Cloud Storage. Create exceptions for specific service accounts used by the storage team within their project.

B.  

Implement VPC Service Controls by establishing an organization-wide service perimeter with all projects. Configure ingress and egress rules to restrict access to Cloud Storage based on IP address ranges.

C.  

Use Context-Aware Access. Create an access level that defines the required context. Apply it as an organization policy specifically at the project level, restricting access to Cloud Storage based on that context.

D.  

Use Identity and Access Management (IAM) roles at the project level within the storage team's project. Grant the storage team granular permissions on the project's Cloud Storage resources.

A.  

Run each tier in its own Project, and segregate using Project labels.

B.  

Run each tier with a different Service Account (SA), and use SA-based firewall rules.

C.  

Run each tier in its own subnet, and use subnet-based firewall rules.

D.  

Run each tier with its own VM tags, and use tag-based firewall rules.

A.  

Use Policy Analyzer lo query the permissions compute, firewalls, create ofcompute, firewalls. Create of compute,firewalls.delete.

B.  

Reference the Security Health Analytics - Firewall Vulnerability Findings in the Security Command Center.

C.  

Use Policy Analyzer to query the permissions compute, firewalls, get of compute, firewalls, list.

D.  

Use Firewall Insights to understand your firewall rules usage patterns.

A.  

Change the load balancer backend configuration to use network endpoint groups instead of instance groups.

B.  

Change the load balancer frontend configuration to use the Premium Tier network, and add the new instance group.

C.  

Create a new load balancer in us-east-2 using the Standard Tier network, and assign a static external IP address.

D.  

Create a Cloud VPN connection between the two regions, and enable Google Private Access.

A.  

Create an Instance Template, and allow the Service Account Read Only access for the Compute Engine Access Scope.

B.  

Create a custom role with the permission compute.instances.list and grant the Service Account this role.

C.  

Give the Service Account the role of Compute Viewer, and use the new Service Account for all instances.

D.  

Give the Service Account the role of Project Viewer, and use the new Service Account for all instances.

A.  

Make sure that the ERP system can validate the JWT assertion in the HTTP requests.

B.  

Make sure that the ERP system can validate the identity headers in the HTTP requests.

C.  

Make sure that the ERP system can validate the x-forwarded-for headers in the HTTP requests.

D.  

Make sure that the ERP system can validate the user’s unique identifier headers in the HTTP requests.