Pre-Summer Sale Limited Time 65% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: 65pass65

Professional-Cloud-Security-Engineer Google Cloud Certified - Professional Cloud Security Engineer is now Stable and With Pass Result | Test Your Knowledge for Free

Exams4sure Dumps

Professional-Cloud-Security-Engineer Practice Questions

Google Cloud Certified - Professional Cloud Security Engineer

Last Update 22 hours ago
Total Questions : 318

Dive into our fully updated and stable Professional-Cloud-Security-Engineer practice test platform, featuring all the latest Google Cloud Certified exam questions added this week. Our preparation tool is more than just a Google study aid; it's a strategic advantage.

Our free Google Cloud Certified practice questions crafted to reflect the domains and difficulty of the actual exam. The detailed rationales explain the 'why' behind each answer, reinforcing key concepts about Professional-Cloud-Security-Engineer. Use this test to pinpoint which areas you need to focus your study on.

Professional-Cloud-Security-Engineer PDF

Professional-Cloud-Security-Engineer PDF (Printable)
$43.75
$124.99

Professional-Cloud-Security-Engineer Testing Engine

Professional-Cloud-Security-Engineer PDF (Printable)
$50.75
$144.99

Professional-Cloud-Security-Engineer PDF + Testing Engine

Professional-Cloud-Security-Engineer PDF (Printable)
$63.7
$181.99
Question # 71

You are a security administrator at your company and are responsible for managing access controls (identification, authentication, and authorization) on Google Cloud. Which Google-recommended best practices should you follow when configuring authentication and authorization? (Choose two.)

Options:

A.  

Use Google default encryption.

B.  

Manually add users to Google Cloud.

C.  

Provision users with basic roles using Google's Identity and Access Management (1AM) service.

D.  

Use SSO/SAML integration with Cloud Identity for user authentication and user lifecycle management.

E.  

Provide granular access with predefined roles.

Discussion 0
Question # 72

Your company must follow industry specific regulations. Therefore, you need to enforce customer-managed encryption keys (CMEK) for all new Cloud Storage resources in the organization called org1.

What command should you execute?

Options:

A.  

• organization policy: constraints/gcp.restrictStorageNonCraekServices• binding at: orgl• policy type: deny• policy value: storage.gcogleapis.com

B.  

• organization policy: constraints/gcp.restrictHonCmekServices• binding at: orgl• policy type: deny• policy value: storage.googleapis.com

C.  

• organization policy:constraints/gcp.restrictStorageNonCraekServices• binding at: orgl• policy type: allow• policy value: all supported services

D.  

• organization policy: constramts/gcp.restrictNonCmekServices• binding at: orgl• policy type: allow• policy value: storage.googleapis.com

Discussion 0
Question # 73

You are working with a network engineer at your company who is extending a large BigQuery-based data analytics application. Currently, all of the data for that application is ingested from on-premises applications over a Dedicated Interconnect connection with a 20Gbps capacity. You need to onboard a data source on Microsoft Azure that requires a daily ingestion of approximately 250 TB of data. You need to ensure that the data gets transferred securely and efficiently. What should you do?

Options:

A.  

Establish a Cross-Cloud Interconnect connection between Microsoft Azure and Google Cloud. Configure a network route over this connection to transfer the data.

B.  

Establish a VPN connection with the Microsoft Azure subscription where the source application is running. Transfer the data through the VPN connection.

C.  

Use the existing Dedicated Interconnect connection through the on-premises network and establish connectivity to Microsoft Azure.

D.  

Set up a SFTP server with a public IP address that runs on a VM in your Google Cloud project. Connect from Microsoft Azure to this server.

Discussion 0
Question # 74

You are working with protected health information (PHI) for an electronic health record system. The privacy officer is concerned that sensitive data is stored in the analytics system. You are tasked with anonymizing the sensitive data in a way that is not reversible. Also, the anonymized data should not preserve the character set and length. Which Google Cloud solution should you use?

Options:

A.  

Cloud Data Loss Prevention with deterministic encryption using AES-SIV

B.  

Cloud Data Loss Prevention with format-preserving encryption

C.  

Cloud Data Loss Prevention with cryptographic hashing

D.  

Cloud Data Loss Prevention with Cloud Key Management Service wrapped cryptographic keys

Discussion 0
Question # 75

You are in charge of migrating a legacy application from your company datacenters to GCP before the current maintenance contract expires. You do not know what ports the application is using and no documentation is available for you to check. You want to complete the migration without putting your environment at risk.

What should you do?

Options:

A.  

Migrate the application into an isolated project using a “Lift & Shift” approach. Enable all internal TCP traffic using VPC Firewall rules. Use VPC Flow logs to determine what traffic should be allowed for theapplication to work properly.

B.  

Migrate the application into an isolated project using a “Lift & Shift” approach in a custom network. Disable all traffic within the VPC and look at the Firewall logs to determine what traffic should be allowed for the application to work properly.

C.  

Refactor the application into a micro-services architecture in a GKE cluster. Disable all traffic from outside the cluster using Firewall Rules. Use VPC Flow logs to determine what traffic should be allowed for the application to work properly.

D.  

Refactor the application into a micro-services architecture hosted in Cloud Functions in an isolated project.Disable all traffic from outside your project using Firewall Rules. Use VPC Flow logs to determine what traffic should be allowed for the application to work properly.

Discussion 0
Question # 76

Your organization is using Vertex AI Workbench Instances. You must ensure that newly deployed instances are automatically kept up-to-date and that users cannot accidentally alter settings in the operating system. What should you do?

Options:

A.  

Enable the VM Manager and ensure the corresponding Google Compute Engine instances are added.

B.  

Enforce the disableRootAccess and requireAutoUpgradeSchedule organization policies for newly deployed instances.

C.  

Assign the AI Notebooks Runner and AI Notebooks Viewer roles to the users of the AI Workbench Instances.

D.  

Implement a firewall rule that prevents Secure Shell access to the corresponding Google Compute Engine instances by using tags.

Discussion 0
Question # 77

Your DevOps team uses Packer to build Compute Engine images by using this process:

1 Create an ephemeral Compute Engine VM.

2 Copy a binary from a Cloud Storage bucket to the VM's file system.

3 Update the VM's package manager.

4 Install external packages from the internet onto the VM.

Your security team just enabled the organizational policy. consrraints/compure.vnExtemallpAccess. to restrict the usage of public IP Addresses on VMs. In response your DevOps team updated their scripts to remove public IP addresses on the Compute Engine VMs however the build pipeline is failing due to connectivity issues.

What should you do?

Choose 2 answers

Options:

A.  

Provision a Cloud NAT instance in the same VPC and region as the Compute Engine VM

B.  

Provision an HTTP load balancer with the VM in an unmanaged instance group to allow inbound connections from the internet to your VM.

C.  

Update the VPC routes to allow traffic to and from the internet.

D.  

Provision a Cloud VPN tunnel in the same VPC and region as the Compute Engine VM.

E.  

Enable Private Google Access on the subnet that the Compute Engine VM is deployed within.

Discussion 0
Question # 78

An organization is evaluating the use of Google Cloud Platform (GCP) for certain IT workloads. A well- established directory service is used to manage user identities and lifecycle management. This directory service must continue for the organization to use as the “source of truth” directory for identities.

Which solution meets the organization's requirements?

Options:

A.  

Google Cloud Directory Sync (GCDS)

B.  

Cloud Identity

C.  

Security Assertion Markup Language (SAML)

D.  

Pub/Sub

Discussion 0
Question # 79

A customer’s company has multiple business units. Each business unit operates independently, and each has their own engineering group. Your team wants visibility into all projects created within the company and wants to organize their Google Cloud Platform (GCP) projects based on different business units. Each business unit also requires separate sets of IAM permissions.

Which strategy should you use to meet these needs?

Options:

A.  

Create an organization node, and assign folders for each business unit.

B.  

Establish standalone projects for each business unit, using gmail.com accounts.

C.  

Assign GCP resources in a project, with a label identifying which business unit owns the resource.

D.  

Assign GCP resources in a VPC for each business unit to separate network access.

Discussion 0
Question # 80

You need to set up a Cloud interconnect connection between your company's on-premises data center and VPC host network. You want to make sure that on-premises applications can only access Google APIs over the Cloud Interconnect and not through the public internet. You are required to only use APIs that are supported by VPC Service Controls to mitigate against exfiltration risk to non-supported APIs. How should you configure the network?

Options:

A.  

Enable Private Google Access on the regional subnets and global dynamic routing mode.

B.  

Set up a Private Service Connect endpoint IP address with the API bundle of "all-apis", which is advertised as a route over the Cloud interconnect connection.

C.  

Use private.googleapis.com to access Google APIs using a set of IP addresses only routable from within Google Cloud, which are advertised as routes over the connection.

D.  

Use restricted googleapis.com to access Google APIs using a set of IP addresses only routable from within Google Cloud, which are advertised as routes over the Cloud Interconnect connection.

Discussion 0
Get Professional-Cloud-Security-Engineer dumps and pass your exam in 24 hours!

Free Exams Sample Questions