Professional-Cloud-Security-Engineer Practice Questions

A.  

Scan your BigQuery and Cloud SQL data using the Cloud DLP data profiling feature. Use the data profiling results to create a de-identification strategy with either Cloud Sensitive Data Protection's de-identification templates or custom configurations.

B.  

Create a new BigQuery dataset and Cloud SQL instance. Copy a small subset of the data to these new locations. Use Cloud Data Loss Prevention API to scan this subset for PII. Based on the results, create a custom anonymization script and apply the script to the entire 3 TB dataset in the original locations.

C.  

Export all 3TB of data from BigQuery and Cloud SQL to Cloud Storage. Use Cloud Sensitive Data Protection to anonymize the exported data. Re-import the anonymized data back into BigQuery and Cloud SQL.

D.  

Inspect a representative sample of the data in BigQuery and Cloud SQL to identify PII. Based on this analysis, develop a custom script to anonymize the identified PII.

A.  

Enable Access Transparency Logging.

B.  

Deploy resources only to regions permitted by data residency requirements

C.  

Use Data Access logging and Access Transparency logging to confirm that no users are accessing data from another region.

D.  

Deploy Assured Workloads.

A.  

Explain the development of custom network firewalls around the image classification service for deep intrusion detection and prevention. Describe vulnerability scanning tools for known vulnerabilities.

B.  

Explain Google's shared responsibility model. Focus the configuration review on Identity and Access Management (IAM) permissions, secure data upload/download procedures, and monitoring logs for any potential malicious activity.

C.  

Explain that using platform-as-a-service (PaaS) transfers security concerns to Google. Describe the need for strict API usage limits to protect against unexpected usage and billing spikes.

D.  

Explain the security aspects of the code that transforms user-uploaded images using Google's service. Define Cloud IAM for fine-grained access control within the development team.

A.  

Enable the constraints/compute.skipDefaultNetworkCreation organization policy constraint at the organization level.

B.  

Create a cron job to trigger a daily Cloud Function to automatically delete all default networks for each project.

C.  

Grant your users the 1AM Owner role at the organization level. Create a VPC Service Controls perimeter around the project that restricts the compute.googleapis.com API.

D.  

Only allow your users to use your CI/CD pipeline with a predefined set of infrastructure templates they can deploy to skip the creation of the default networks.

A.  

Use a Shared VPC to enable communication between all projects, and use firewall rules to prevent data exfiltration.

B.  

Create access levels in Access Context Manager to prevent data exfiltration, and use a shared VPC for communication between projects.

C.  

Use an infrastructure-as-code software tool to set up a single service perimeter and to deploy a Cloud Function that monitors the "implementation" folder via Stackdriver and Cloud Pub/Sub. When the function notices that a new project is added to the folder, it executes Terraform to add the new project to the associated perimeter.

D.  

Use an infrastructure-as-code software tool to set up three different service perimeters for dev, staging, and prod and to deploy a Cloud Function that monitors the "implementation" folder via Stackdriver and Cloud Pub/Sub. When the function notices that a new project is added to the folder, it executes Terraform to add the new project to the respective perimeter.

A.  

Enable Cloud Monitoring workspace, and add the production projects to be monitored.

B.  

Use Logs Explorer at the organization level and filter for production project logs.

C.  

Create an aggregate org sink at the parent folder of the production projects, and set the destination to a Cloud Storage bucket.

D.  

Create an aggregate org sink at the parent folder of the production projects, and set the destination to a logs bucket.

A.  

roles/logging.privateLogViewer

B.  

roles/logging.admin

C.  

roles/viewer

D.  

roles/logging.viewer

A.  

Cloud Armor

B.  

Network Load Balancing

C.  

SSL Proxy Load Balancing

D.  

NAT Gateway

A.  

Turn off the domain restriction sharing organization policy. Set the policy value to "Allow All."

B.  

Turn off the domain restricted sharing organization policy. Provide the external partners with the required permissions using Google's Identity and Access Management (IAM) service.

C.  

Turn off the domain restricted sharing organization policy. Add each partner's Google Workspace customer ID to a Google group, add the Google group as an exception under the organization policy, and then turn the policy back on.

D.  

Turn off the domain restricted sharing organization policy. Set the policy value to "Custom." Add each external partner's Cloud Identity or Google Workspace customer ID as an exception under the organization policy, and then turn the policy back on.

A.  

Add the host project containing the Shared VPC to the service perimeter.

B.  

Add the service project where the Compute Engine instances reside to the service perimeter.

C.  

Create a service perimeter between the service project where the Compute Engine instances reside and the host project that contains the Shared VP

C.  

D.  

Create a perimeter bridge between the service project where the Compute Engine instances reside and the perimeter that contains the protected BigQuery datasets.