Online Access Free Professional-Cloud-Security-Engineer Exam Questions

Your organization operates Virtual Machines (VMs) with only private IPs in the Virtual Private Cloud (VPC) with internet access through Cloud NAT Everyday, you must patch all VMs with critical OS updates and provide summary reports What should you do?

• A.Copy the latest patches to the Cloud Storage bucket. Log in to each VM. download the patches from the bucket, and install them.
• B.Assign public IPs to VMs. Validate that the egress firewall rules allow any outgoing traffic Log in to each VM. and configure a daily cron job to enable for OS updates at night during low activity periods.
• C.Validate that the egress firewall rules allow any outgoing traffic Log in to each VM and execute OS specific update commands Configure the Cloud Scheduler job to update with critical patches daily for daily updates.
• D.Ensure that VM Manager is installed and running on the VMs. In the OS patch management service.
  configure the patch jobs to update with critical patches daily.

What are the steps to encrypt data using envelope encryption?

• A.Generate a key encryption key (KEK) locally.Use the KEK to generate a data encryption key (DEK).
  Encrypt data with the DEK.Store the encrypted data and the wrapped DEK.
• B.Generate a data encryption key (DEK) locally.Encrypt data with the DEK.Use a key encryption key (KEK) to wrap the DEK. Store the encrypted data and the wrapped DEK.
• C.Generate a key encryption key (KEK) locally.Generate a data encryption key (DEK) locally. Encrypt data with the KEK.Store the encrypted data and the wrapped DEK.
• D.Generate a data encryption key (DEK) locally.Use a key encryption key (KEK) to wrap the DEK.
  Encrypt data with the KEK.Store the encrypted data and the wrapped KEK.

A customer's company has multiple business units. Each business unit operates independently, and each has their own engineering group. Your team wants visibility into all projects created within the company and wants to organize their Google Cloud Platform (GCP) projects based on different business units. Each business unit also requires separate sets of IAM permissions.
Which strategy should you use to meet these needs?

• A.Assign GCP resources in a VPC for each business unit to separate network access.
• B.Establish standalone projects for each business unit, using gmail.com accounts.
• C.Assign GCP resources in a project, with a label identifying which business unit owns the resource.
• D.Create an organization node, and assign folders for each business unit.

A manager wants to start retaining security event logs for 2 years while minimizing costs. You write a filter to select the appropriate log entries.
Where should you export the logs?

• A.Cloud Pub/Sub topics
• B.Cloud Storage buckets
• C.BigQuery datasets
• D.StackDriver logging

You have created an OS image that is hardened per your organization's security standards and is being stored in a project managed by the security team. As a Google Cloud administrator, you need to make sure all VMs in your Google Cloud organization can only use that specific OS image while minimizing operational overhead. What should you do? (Choose two.)

• A.Grant users the compuce.imageUser role in the OS image project.
• B.Remove VM instance creation permission from users of the projects, and only allow you and your team to create VM instances.
• C.Store the image in every project that is spun up in your organization.
• D.Set up an image access organization policy constraint, and list the security team managed project in the projects allow list.
• E.Grant users the compuce.imageUser role in their own projects.