Online Access Free Google.Professional-Cloud-Security-Engineer.v2023-10-27.q86 Practice Test (Page 18)

Professional-Cloud-Security-Engineer Exam Question 81

A customer is running an analytics workload on Google Cloud Platform (GCP) where Compute Engine instances are accessing data stored on Cloud Storage. Your team wants to make sure that this workload will not be able to access, or be accessed from, the internet.
Which two strategies should your team use to meet these requirements? (Choose two.)

A.Turn off IP forwarding on the Compute Engine instances in the cluster.

B.Configure Private Google Access on the Compute Engine subnet

C.Make sure that the Compute Engine cluster is running on a separate subnet.

D.Configure a Cloud NAT gateway.

E.Avoid assigning public IP addresses to the Compute Engine cluster.

Professional-Cloud-Security-Engineer Exam Question 82

A customer wants to deploy a large number of 3-tier web applications on Compute Engine.
How should the customer ensure authenticated network separation between the different tiers of the application?

A.Run each tier in its own Project, and segregate using Project labels.

B.Run each tier with a different Service Account (SA), and use SA-based firewall rules.

C.Run each tier in its own subnet, and use subnet-based firewall rules.

D.Run each tier with its own VM tags, and use tag-based firewall rules.

Professional-Cloud-Security-Engineer Exam Question 83

You are the security admin of your company. Your development team creates multiple GCP projects under the "implementation" folder for several dev, staging, and production workloads. You want to prevent data exfiltration by malicious insiders or compromised code by setting up a security perimeter. However, you do not want to restrict communication between the projects.
What should you do?

A.Use a Shared VPC to enable communication between all projects, and use firewall rules to prevent data exfiltration.

B.Create access levels in Access Context Manager to prevent data exfiltration, and use a shared VPC for communication between projects.

C.Use an infrastructure-as-code software tool to set up a single service perimeter and to deploy a Cloud Function that monitors the "implementation" folder via Stackdriver and Cloud Pub/Sub. When the function notices that a new project is added to the folder, it executes Terraform to add the new project to the associated perimeter.

D.Use an infrastructure-as-code software tool to set up three different service perimeters for dev, staging, and prod and to deploy a Cloud Function that monitors the "implementation" folder via Stackdriver and Cloud Pub/Sub. When the function notices that a new project is added to the folder, it executes Terraform to add the new project to the respective perimeter.

Professional-Cloud-Security-Engineer Exam Question 84

A company has redundant mail servers in different Google Cloud Platform regions and wants to route customers to the nearest mail server based on location.
How should the company accomplish this?

A.Configure TCP Proxy Load Balancing as a global load balancing service listening on port 995.

B.Create a Network Load Balancer to listen on TCP port 995 with a forwarding rule to forward traffic based on location.

C.Use Cross-Region Load Balancing with an HTTP(S) load balancer to route traffic to the nearest region.

D.Use Cloud CDN to route the mail traffic to the closest origin mail server based on client IP address.

Professional-Cloud-Security-Engineer Exam Question 85

You are a security engineer at a finance company. Your organization plans to store data on Google Cloud, but your leadership team is worried about the security of their highly sensitive data Specifically, your company is concerned about internal Google employees' ability to access your company's data on Google Cloud. What solution should you propose?

A.Use customer-managed encryption keys.

B.Use Google's Identity and Access Management (IAM) service to manage access controls on Google Cloud.

C.Enable Admin activity logs to monitor access to resources.

D.Enable Access Transparency logs with Access Approval requests for Google employees.

Other Version: 549Google.Professional-Cloud-Security-Engineer.v2026-02-09.q123; 759Google.Professional-Cloud-Security-Engineer.v2025-12-26.q111; 1214Google.Professional-Cloud-Security-Engineer.v2024-11-26.q142; 1294Google.Professional-Cloud-Security-Engineer.v2023-03-25.q71; 1088Google.Professional-Cloud-Security-Engineer.v2023-03-10.q59; 103Google.Actualtests4sure.Professional-Cloud-Security-Engineer.v2022-05-23.by.clare.108q.pdf; 2504Google.Professional-Cloud-Security-Engineer.v2022-05-10.q108; 3002Google.Professional-Cloud-Security-Engineer.v2021-10-23.q83; 134Google.Ipassleader.Professional-Cloud-Security-Engineer.v2021-09-16.by.winston.77q.pdf

Latest Upload: 143CrowdStrike.CCSE-204.v2026-06-12.q25; 161VMware.2V0-17.25.v2026-06-12.q49; 150Appian.ACA-100.v2026-06-11.q23; 208CompTIA.220-1202.v2026-06-11.q114; 163CheckPoint.156-590.v2026-06-11.q47; 224CompTIA.220-1202.v2026-06-10.q109; 205CertiProf.CEHPC.v2026-06-10.q54; 152Hitachi.HQT-4160.v2026-06-10.q25; 403PMI.PMI-ACP-CN.v2026-06-09.q453; 192Splunk.SPLK-5002.v2026-06-08.q52

Professional-Cloud-Security-Engineer Exam Question 81

Professional-Cloud-Security-Engineer Exam Question 82

Professional-Cloud-Security-Engineer Exam Question 83

Professional-Cloud-Security-Engineer Exam Question 84

Professional-Cloud-Security-Engineer Exam Question 85

Download PDF File