Online Access Free Professional-Cloud-Security-Engineer Exam Questions

Your organization has established a highly sensitive project within a VPC Service Controls perimeter. You need to ensure that only users meeting specific contextual requirements such as having a company-managed device, a specific location, and a valid user identity can access resources within this perimeter. You want to evaluate the impact of this change without blocking legitimate access. What should you do?

• A.Use the VPC Service Control Violation dashboard to identify the impact of details about access denials by service perimeters.
• B.Configure a VPC Service Controls perimeter in dry run mode, and enforce strict network segmentation using firewall rules. Use multi-factor authentication (MFA) for user verification.
• C.Use Cloud Audit Logs to monitor user access to the project resources. Use post-incident analysis to identify unauthorized access attempts.
• D.Establish a Context-Aware Access policy that specifies the required contextual attributes, and associate the policy with the VPC Service Controls perimeter in dry run mode.

Your organization acquired a new workload. The Web and Application (App) servers will be running on Compute Engine in a newly created custom VPC. You are responsible for configuring a secure network communication solution that meets the following requirements:
Only allows communication between the Web and App tiers.
Enforces consistent network security when autoscaling the Web and App tiers.
Prevents Compute Engine Instance Admins from altering network traffic.
What should you do?

• A.1. Re-deploy the Web and App servers with instance templates configured with respective network tags.
  2. Create an allow VPC firewall rule that specifies the target/source with respective network tags.
• B.1. Configure all running Web and App servers with respective service accounts.2. Create an allow VPC firewall rule that specifies the target/source with respective service accounts.
• C.1. Configure all running Web and App servers with respective network tags.2. Create an allow VPC firewall rule that specifies the target/source with respective network tags.
• D.1. Re-deploy the Web and App servers with instance templates configured with respective service accounts.2. Create an allow VPC firewall rule that specifies the target/source with respective service accounts.

A centralized security service has been implemented by your company. All applications running in Google Cloud are required to send data to this service. You need to ensure that developers have high autonomy to configure firewall rules within their projects, while preventing accidental blockage of access to the central security service. What should you do?

• A.Implement a hierarchical firewall policy that prioritizes the central security service by allowing its connections and directing all other traffic to the subsequent firewall level.
• B.Deploy a central Secure Web Proxy and connect it to all VPC networks. Create a Secure Web Proxy policy to allow traffic to the central security service.
• C.Create a central project to manage Shared VPC networks which will be accessible to all other projects.
  Administer all firewall rules centrally within this project.
• D.Use Terraform to automate the creation of the required firewall rule in all projects. Restrict rule change permissions solely to the Terraform service account.

Your organization wants to protect its supply chain from attacks. You need to automatically scan your deployment pipeline for vulnerabilities and ensure only scanned and verified containers can be executed in your production environment. You want to minimize management overhead. What should you do?

• A.Use Cloud Next Generation Firewall (Cloud NGFW) Enterprise with traffic inspection to restrict access to containerized applications in the production environment.
• B.Integrate Artifact Registry vulnerability scanning and Binary Authorization into your CI/CD pipeline to ensure only verified images are deployed to production.
• C.Review container images before deployment to production, checking for known vulnerabilities using a public vulnerability database. Use Grafeas and Kritis to prevent deployment of containers that haven't been built using your build pipeline.
• D.Deploy all container images to a staging environment and use Container Threat Detection to detect malicious content before promoting them to production.

After completing a security vulnerability assessment, you learned that cloud administrators leave Google Cloud CLI sessions open for days. You need to reduce the risk of attackers who might exploit these open sessions by setting these sessions to the minimum duration.
What should you do?

• A.Set the organization policy constraintconstraints/iam.allowServiceAccountCredentialLifetimeExtension to one hour.
• B.Set the reauthentication frequency (or the Google Cloud Session Control to one hour.
• C.Set the organization policy constraint constraints/iam. serviceAccountKeyExpiryHours to onehour and inheritFromParent to false.
• D.Set the session duration for the Google session control to one hour.