Professional Cloud Security Engineer Free Practice Questions — Page 15
Question 141
Your organization is using GitHub Actions as a continuous integration and delivery (CI/CD) platform. You must enable access to Google Cloud resources from the CI/CD pipelines in the most secure way.
What should you do?
A. Create a service account key, and add it to the GitHub pipeline configuration file.
B. Create a service account key, and add it to the GitHub repository content.
C. Configure a Google Kubernetes Engine cluster that uses Workload Identity to supply credentials to GitHub.
D. Configure workload identity federation to use GitHub as an identity pool provider.
Show Answer
Correct Answer: D
Explanation: Workload Identity Federation is the recommended and most secure approach for GitHub Actions to access Google Cloud resources because it enables short-lived, federated credentials without storing long-lived service account keys. Options A and B rely on service account keys, which are less secure. Option C applies Workload Identity for workloads running on GKE, not GitHub-hosted CI/CD runners.
Question 142
Your organization wants to be compliant with the General Data Protection Regulation (GDPR) on Google Cloud. You must implement data residency and operational sovereignty in the EU.
What should you do? (Choose two.)
A. Limit the physical location of a new resource with the Organization Policy Service "resource locations constraint."
B. Use Cloud IDS to get east-west and north-south traffic visibility in the EU to monitor intra-VPC and inter-VPC communication.
C. Limit Google personnel access based on predefined attributes such as their citizenship or geographic location by using Key Access Justifications.
D. Use identity federation to limit access to Google Cloud resources from non-EU entities.
E. Use VPC Flow Logs to monitor intra-VPC and inter-VPC traffic in the EU.
Show Answer
Correct Answer: A, C
Explanation: Data residency is achieved by enforcing the Organization Policy 'resource locations' constraint so resources are created only in approved EU locations. Operational sovereignty is addressed through sovereign controls that restrict Google support access to customer-managed encryption keys using Key Access Justifications in Assured Workloads, including personnel attribute restrictions. Identity federation manages user authentication but does not implement EU data residency or Google operational sovereignty. Network monitoring options do not satisfy the stated requirements.
Question 143
Your company uses Google Cloud and has publicly exposed network assets. You want to discover the assets and perform a security audit on these assets by using a software tool in the least amount of time.
What should you do?
A. Run a platform security scanner on all instances in the organization.
B. Identify all external assets by using Cloud Asset Inventory, and then run a network security scanner against them.
C. Contact a Google approved security vendor to perform the audit.
D. Notify Google about the pending audit, and wait for confirmation before performing the scan.
Show Answer
Correct Answer: B
Explanation: Cloud Asset Inventory helps identify your Google Cloud assets, including publicly exposed resources. After identifying external assets, running a network security scanner against those assets is the fastest and most targeted way to perform a security audit. Scanning all instances is less efficient and may miss other exposed asset types. Using a third-party vendor is unnecessary for this requirement, and Google does not require prior notification for standard vulnerability scanning of your own Google Cloud resources.
Question 144
Your organization recently activated the Security Command Center (SCC) standard tier. There are a few Cloud Storage buckets that were accidentally made accessible to the public. You need to investigate the impact of the incident and remediate it.
What should you do?
A. 1. Remove the Identity and Access Management (IAM) granting access to all Users from the buckets. 2. Apply the organization policy storage.uniformBucketLevelAccess to prevent regressions. 3. Query the data access logs to report on unauthorized access.
B. 1. Change permissions to limit access for authorized users. 2. Enforce a VPC Service Controls perimeter around all the production projects to immediately stop any unauthorized access. 3. Review the administrator activity audit logs to report on any unauthorized access.
C. 1. Change the bucket permissions to limit access. 2. Query the bucket's usage logs to report on unauthorized access to the data. 3. Enforce the organization policy storage.publicAccessPrevention to avoid regressions.
D. 1. Change bucket permissions to limit access. 2. Query the data access audit logs for any unauthorized access to the buckets. 3. After the misconfiguration is corrected, mute the finding in the Security Command Center.
Show Answer
Correct Answer: C
Explanation: The priority is to remove public access, investigate whether the exposed data was accessed, and prevent recurrence. Changing bucket permissions remediates the exposure. For impact analysis, Cloud Storage usage/access logs are appropriate for determining object access, whereas Admin Activity logs do not record data reads and Data Access audit logs are not always enabled by default. To prevent regressions, enforcing the organization policy storage.publicAccessPrevention is the correct control because it blocks public exposure of buckets. Uniform bucket-level access simplifies IAM but does not itself prevent public access.
Question 145
You have numerous private virtual machines on Google Cloud. You occasionally need to manage the servers through Secure Socket Shell (SSH) from a remote location. You want to configure remote access to the servers in a manner that optimizes security and cost efficiency.
What should you do?
A. Create a site-to-site VPN from your corporate network to Google Cloud.
B. Configure server instances with public IP addresses. Create a firewall rule to only allow traffic from your corporate IPs.
C. Create a firewall rule to allow access from the Identity-Aware Proxy (IAP) IP range. Grant the role of an IAP-secured Tunnel User to the administrators.
D. Create a jump host instance with public IP. Manage the instances by connecting through the jump host.
Show Answer
Correct Answer: C
Explanation: Identity-Aware Proxy (IAP) TCP forwarding is the recommended way to provide occasional SSH access to private Google Cloud VM instances without assigning public IP addresses. Allow ingress from the IAP IP range and grant administrators the IAP-secured Tunnel User role. This provides strong identity-based access control, avoids the cost and maintenance of a bastion host or VPN for this use case, and keeps the VMs private.
Question 146
Your organization's record data exists in Cloud Storage. You must retain all record data for at least seven years. This policy must be permanent.
What should you do?
A. 1. Identify buckets with record data. 2. Apply a retention policy, and set it to retain for seven years. 3. Monitor the bucket by using log-based alerts to ensure that no modifications to the retention policy occurs.
B. 1. Identify buckets with record data. 2. Apply a retention policy, and set it to retain for seven years. 3. Remove any Identity and Access Management (IAM) roles that contain the storage buckets update permission.
C. 1. Identify buckets with record data. 2. Enable the bucket policy only to ensure that data is retained. 3. Enable bucket lock.
D. 1. Identify buckets with record data. 2. Apply a retention policy and set it to retain for seven years. 3. Enable bucket lock.
Show Answer
Correct Answer: D
Explanation: To permanently enforce a seven-year minimum retention period in Google Cloud Storage, you must configure a bucket retention policy for seven years and then enable Bucket Lock. Bucket Lock makes the retention policy immutable, preventing it from being reduced or removed, which satisfies the requirement that the policy be permanent.
Question 147
Your organization must comply with the regulation to keep instance logging data within Europe. Your workloads will be hosted in the Netherlands in region europe-west4 in a new project. You must configure Cloud Logging to keep your data in the country.
What should you do?
A. Configure the organization policy constraint gcp.resourceLocations to europe-west4.
B. Configure log sink to export all logs into a Cloud Storage bucket in europe-west4.
C. Create a new log bucket in europe-west4, and redirect the _Default bucket to the new bucket.
D. Set the logging storage region to europe-west4 by using the gcloud CLI logging settings update.
Show Answer
Correct Answer: D
Explanation: For a new project, configure the Cloud Logging default storage location before logs are created. The logging settings update with --storage-location causes the project's default log buckets to be created in the specified region, satisfying data residency without needing to create and redirect custom buckets. Creating and redirecting a bucket is the migration approach for existing projects.
Question 148
You are running applications outside Google Cloud that need access to Google Cloud resources. You are using workload identity federation to grant external identities Identity and Access Management (IAM) roles to eliminate the maintenance and security burden associated with service account keys. You must protect against attempts to spoof another user's identity and gain unauthorized access to Google Cloud resources.
What should you do? (Choose two.)
A. Enable data access logs for IAM APIs.
B. Limit the number of external identities that can impersonate a service account.
C. Use a dedicated project to manage workload identity pools and providers.
D. Use immutable attributes in attribute mappings.
E. Limit the resources that a service account can access.
Show Answer
Correct Answer: C, D
Explanation: To protect against identity spoofing in Workload Identity Federation, Google recommends using a dedicated project to manage workload identity pools and providers and using immutable attributes in attribute mappings so identities cannot be spoofed by changing mutable claims. The other options are good security practices but are not the primary controls for preventing spoofing attacks.
Question 149
Your company is moving to Google Cloud. You plan to sync your users first by using Google Cloud Directory Sync (GCDS). Some employees have already created Google Cloud accounts by using their company email addresses that were created outside of GCDS. You must create your users on Cloud Identity.
What should you do?
A. Configure GCDS and use GCDS search rules to sync these users.
B. Use the transfer tool to migrate unmanaged users.
C. Write a custom script to identify existing Google Cloud users and call the Admin SDK: Directory API to transfer their account.
D. Configure GCDS and use GCDS exclusion rules to ensure users are not suspended.
Show Answer
Correct Answer: B
Explanation: Users who previously signed up with company email addresses are unmanaged accounts. Before or while establishing Cloud Identity management for the domain, these accounts should be converted to managed accounts using the unmanaged user transfer process. GCDS synchronizes directory users but does not transfer ownership of existing unmanaged Google accounts, and exclusion/search rules do not solve this. A custom Directory API script is unnecessary because Google provides the transfer tool for this purpose.
Question 150
Your organization is transitioning to Google Cloud. You want to ensure that only trusted container images are deployed on Google Kubernetes Engine (GKE) clusters in a project. The containers must be deployed from a centrally managed Container Registry and signed by a trusted authority.
What should you do? (Choose two.)
A. Enable Container Threat Detection in the Security Command Center (SCC) for the project.
B. Configure the trusted image organization policy constraint for the project.
C. Create a custom organization policy constraint to enforce Binary Authorization for Google Kubernetes Engine (GKE).
D. Enable PodSecurity standards, and set them to Restricted.
E. Configure the Binary Authorization policy with respective attestations for the project.
Show Answer
Correct Answer: C, E
Explanation: Binary Authorization is the Google Cloud feature that enforces deployment of only trusted, signed container images on GKE through attestations. You configure a Binary Authorization policy with required attestations, and you can enforce its use across GKE using a custom organization policy constraint. The trusted image organization policy constraint (compute.trustedImageProjects) applies to Compute Engine disk images, not GKE container images. Container Threat Detection and Pod Security Standards do not enforce trusted signed image deployment.
$19
Get all 351 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.