PROFESSIONAL-CLOUD-SECURITY-ENGINEER Exam Questions
381 real PROFESSIONAL-CLOUD-SECURITY-ENGINEER exam questions with expert-verified answers and explanations. Page 6 of 8.
- Question #251Ensuring data protection
You are migrating an application into the cloud. The application will need to read data from a Cloud Storage bucket. Due to local regulatory requirements, you need to hold the key...
Cloud Storage EncryptionCustomer Controlled KeysHardware Security Module (HSM)Client-Side Encryption - Question #252Configuring access within a cloud solution environment
Your organization uses the top-tier folder to separate application environments (prod and dev). The developers need to see all application development audit logs, but they are not...
IAM RolesLeast PrivilegeResource HierarchyAudit Logs - Question #253Managing operations within a cloud solution environment
You manage a fleet of virtual machines (VMs) in your organization. You have encountered issues with lack of patching in many VMs. You need to automate regular patching in your VMs...
VM PatchingOS ManagementSecurity MonitoringVulnerability Management - Question #254Configuring access within a cloud solution environment
Your organization uses BigQuery to process highly sensitive, structured datasets. Following the "need to know" principle, you need to create the Identity and Access Management (IAM...
BigQuery access controlIAM designData segmentationLeast privilege principle - Question #255Ensuring data protection
You are setting up a new Cloud Storage bucket in your environment that is encrypted with a customer managed encryption key (CMEK). The CMEK is stored in Cloud Key Management Servic...
Cloud KMSCloud StorageCMEKRegionality - Question #256Ensuring compliance
You are deploying regulated workloads on Google Cloud. The regulation has data residency and data access requirements. It also requires that support is provided from the same geogr...
Assured WorkloadsRegulatory ComplianceData ResidencyPersonnel Access Controls - Question #257Ensuring data protection
Your organization wants full control of the keys used to encrypt data at rest in their Google Cloud environments. Keys must be generated and stored outside of Google and integrate...
Cloud External Key Management (EKM)Key ManagementData at Rest EncryptionCustomer-managed keys - Question #258Configuring access within a cloud solution environment
Your company is concerned about unauthorized parties gaining access to the Google Cloud environment by using a fake login page. You must implement a solution to protect against per...
Multi-factor authentication (MFA)Phishing protectionMan-in-the-middle (MITM) attacksSecurity keys - Question #259Configuring network security
You control network traffic for a folder in your Google Cloud environment. Your folder includes multiple projects and Virtual Private Cloud (VPC) networks. You want to enforce on t...
Network SecurityEgress FilteringFolder-level EnforcementExternal IP Addresses - Question #260Configuring network security
Your customer has an on-premises Public Key Infrastructure (PKI) with a certificate authority (CA). You need to issue certificates for many HTTP load balancer frontends. The on-pre...
Hybrid PKICertificate Authority Service (CAS)Certificate managementLoad balancer certificates - Question #261Configuring access within a cloud solution environment
You are developing a new application that uses exclusively Compute Engine VMs. Once a day, this application will execute five different batch jobs. Each of the batch jobs requires...
Service AccountsLeast PrivilegeCompute EngineBatch Processing - Question #262Configuring access within a cloud solution environment
Your Google Cloud environment has one organization node, one folder named "Apps", and several projects within that folder. The organizational node enforces the constraints/iam.allo...
Organization PoliciesIAM PoliciesPolicy InheritanceallowedPolicyMemberDomains - Question #263Configuring access within a cloud solution environment
An administrative application is running on a virtual machine (VM) in a managed group at port 5601 inside a Virtual Private Cloud (VPC) instance without access to the internet curr...
Identity-Aware Proxy (IAP)HTTP(S) Load BalancerAccess ControlSecure Application Exposure - Question #264Configuring access within a cloud solution environment
Your company's users access data in a BigQuery table. You want to ensure they can only access the data during working hours. What should you do?
IAMBigQuery SecurityConditional AccessTime-based access control - Question #265Configuring access within a cloud solution environment
You have placed several Compute Engine instances in a private subnet. You want to allow these instances to access Google Cloud services, like Cloud Storage, without traversing the...
Private Google AccessVPC private accessCompute Engine networkingCloud Storage access - Question #266Ensuring compliance
Your organization relies heavily on Cloud Run for its containerized applications. You utilize Cloud Build for image creation, Artifact Registry for image storage, and Cloud Run for...
Binary AuthorizationVulnerability ManagementCloud Run SecurityDeployment Policy - Question #267Configuring access within a cloud solution environment
You run a web application on top of Cloud Run that is exposed to the internet with an Application Load Balancer. You want to ensure that only privileged users from your organizatio...
Identity-Aware Proxy (IAP)Application Load BalancerSingle Sign-On (SSO)Access Control - Question #268Managing operations within a cloud solution environment
During a routine security review, your team discovered a suspicious login attempt to impersonate a highly privileged but regularly used service account by an unknown IP address. Yo...
Security Incident InvestigationEvent Threat DetectionSecurity Command CenterService Account Security - Question #269Configuring access within a cloud solution environment
Your organization has an operational image classification model running on a managed AI service on Google Cloud. You are in a configuration review with stakeholders and must descri...
Shared Responsibility ModelCloud Security GovernanceIdentity and Access Management (IAM)Managed Services Security - Question #270Managing operations within a cloud solution environment
You are managing data in your organization's Cloud Storage buckets and are required to retain objects. To reduce storage costs, you must automatically downgrade the storage class o...
Cloud StorageLifecycle ManagementStorage ClassesCost Optimization - Question #271Configuring access within a cloud solution environment
Your organization has a centralized identity provider that is used to manage human and machine access. You want to leverage this existing identity management system to enable on-pr...
Workload Identity FederationIdentity and Access Management (IAM)Hybrid Cloud AccessCredential-less Access - Question #272Ensuring data protection
Your organization is migrating a sensitive data processing workflow from on-premises infrastructure to Google Cloud. This workflow involves the collection, storage, and analysis of...
Data Exfiltration PreventionPII ProtectionCloud DLPSensitive Data Security - Question #273Ensuring data protection
Your organization is building a chatbot that is powered by generative AI to deliver automated conversations with internal employees. You must ensure that no data with personally id...
Data Loss PreventionPIIChatbot securityGenerative AI - Question #274Configuring access within a cloud solution environment
Your organization has applications that run in multiple clouds. The applications require access to a Google Cloud resource running in your project. You must use short-lived access...
Workload Identity FederationCross-cloud authenticationShort-lived credentialsIdentity and Access Management - Question #275Ensuring data protection
Your organization's financial modeling application is already deployed on Google Cloud. The application processes large amounts of sensitive customer financial data. Application co...
Confidential VMsData in use encryptionSide-channel attacksCompute Engine security - Question #276Configuring network security
Your organization has two VPC Service Controls service perimeters, Perimeter-A and Perimeter- B, in Google Cloud. You want to allow data to be copied from a Cloud Storage bucket in...
VPC Service ControlsData Exfiltration PreventionEgress/Ingress RulesCross-perimeter Access - Question #277Configuring access within a cloud solution environment
You are running code in Google Kubernetes Engine (GKE) containers in Google Cloud that require access to objects stored in a Cloud Storage bucket. You need to securely grant the Po...
Workload IdentityGKE SecurityCloud Storage AccessIAM - Question #278Configuring access within a cloud solution environment
Your organization is adopting Google Cloud and wants to ensure sensitive resources are only accessible from devices within the internal on-premises corporate network. You must conf...
Access Context ManagerAccess LevelsService PerimetersIP-based Access Control - Question #279Configuring access within a cloud solution environment
Your team maintains 1PB of sensitive data within BigOuery that contains personally identifiable information (PII). You need to provide access to this dataset to another team within...
BigQuery securityData maskingPII protectionAccess control - Question #280Ensuring data protection
Your organization uses Google Cloud to process large amounts of location data for analysis and visualization. The location data is potentially sensitive. You must design a solution...
Data ResidencyBigQuery SecuritySensitive Data ProtectionCompliance - Question #281Configuring network security
Your organization utilizes Cloud Run services within multiple projects underneath the non- production folder which requires primarily internal communication. Some services need ext...
Hierarchical Firewall PoliciesNetwork Egress ControlFQDN FilteringCloud Run Security - Question #282Configuring network security
Your organization hosts a sensitive web application in Google Cloud. To protect the web application, you've set up a virtual private cloud (VPC) with dedicated subnets for the appl...
Network SecurityCloud FirewallCloud ArmorWAF - Question #283Managing operations within a cloud solution environment
Your organization relies heavily on virtual machines (VMs) in Compute Engine. Due to team growth and resource demands, VM sprawl is becoming problematic. Maintaining consistent sec...
VM ManagerOS Patch ManagementVM Security HardeningLifecycle Management - Question #284Configuring network security
Customers complain about error messages when they access your organization's website. You suspect that the web application firewall rules configured in Cloud Armor are too strict....
Cloud ArmorLoggingWeb Application Firewall (WAF)Application Load Balancer - Question #285Ensuring compliance
Your organization must follow the Payment Card Industry Data Security Standard (PCI DSS). To prepare for an audit, you must detect deviations on an infrastructure-as-a-service leve...
PCI DSSCompliance MonitoringSecurity Command CenterInfrastructure Security - Question #286Configuring access within a cloud solution environment
Your organization is migrating a complex application to Google Cloud. The application has multiple internal components that interact with each other across several Google Cloud pro...
Google Cloud IAMLeast PrivilegeSeparation of DutiesRole Management - Question #287Configuring access within a cloud solution environment
Your organization operates in a highly regulated industry and needs to implement strict controls around temporary access to sensitive Google Cloud resources. You have been using Ac...
Access ApprovalCloud EKMExternal HSMCustom Signing Key - Question #288Configuring access within a cloud solution environment
Your organization has sensitive data stored in BigQuery and Cloud Storage. You need to design a solution that provides granular and flexible control authorization to read data. Wha...
IAMAccess ControlBigQuery SecurityCloud Storage Security - Question #289Configuring network security
Your organization is using Security Command Center Premium as a central tool to detect and alert on security threats. You also want to alert on suspicious outbound traffic that is...
Network SecurityFirewall RulesThreat IntelligenceEgress Filtering - Question #290Ensuring compliance
You work for a healthcare provider that is expanding into the cloud to store and process sensitive patient data. You must ensure the chosen Google Cloud configuration meets these s...
Assured WorkloadsAccess ApprovalData ResidencyRegulatory Compliance - Question #291Managing operations within a cloud solution environment
You work for a multinational organization that has systems deployed across multiple cloud providers, including Google Cloud. Your organization maintains an extensive on-premises se...
Log ExportCloud LoggingPub/SubSIEM Integration - Question #292Ensuring compliance
You work for a global company. Due to compliance requirements, certain Compute Engine instances that reside within specific projects must be located exclusively in cloud regions wi...
Organization PolicyRegion EnforcementComplianceCompute Engine - Question #293Ensuring data protection
You are working with developers to secure custom training jobs running on Vertex AI. For compliance reasons, all supported data types must be encrypted by key materials that reside...
Vertex AI SecurityCMEKData EncryptionCompliance - Question #294Ensuring data protection
Your EU-based organization stores both Personally Identifiable Information (PII) and non-PII data in Cloud Storage buckets across multiple Google Cloud regions. EU data privacy law...
Sensitive Data ProtectionData Loss Prevention (DLP)Data ResidencyCompliance - Question #295Configuring access within a cloud solution environment
Your organization is migrating business critical applications to Google Cloud across multiple projects. You only have the required IAM permission at the Google Cloud organization l...
Workforce Identity FederationIAMExternal IdentitiesIdP Integration - Question #296Configuring network security
You are creating a secure network architecture. You must fully isolate development and production environments, and prevent any network traffic between the two environments. The ne...
VPC Network DesignNetwork IsolationHybrid ConnectivityHub-and-Spoke Network - Question #297Configuring access within a cloud solution environment
You work for a large organization that is using Cloud Identity as the identity provider (IdP) on Google Cloud. Your InfoSec team has mandated the enforcement of a strong password w...
Cloud IdentityPassword PoliciesPolicy EnforcementIdentity Management Configuration - Question #298Ensuring compliance
Your organization is preparing to build business services in Google Cloud for the first time. You must determine where to apply appropriate controls or policies. You must also iden...
Shared Responsibility ModelCloud Security FundamentalsCloud GovernanceSecurity Controls - Question #299Configuring access within a cloud solution environment
Your organization operates a hybrid cloud environment and has recently deployed a private Artifact Registry repository in Google Cloud. On-premises developers cannot resolve the Ar...
DNS ResolutionHybrid Cloud NetworkingArtifact RegistryGoogle APIs Private Access - Question #300Configuring access within a cloud solution environment
Your organization has an application hosted in Cloud Run. You must control access to the application by using Cloud Identity-Aware Proxy (IAP) with these requirements: - Only users...
Cloud IAPAccess Context ManagerAccess LevelsIdentity and Access Management