Professional Cloud Security Engineer Free Practice Questions — Page 18
Question 169
You need to set up a Cloud Interconnect connection between your company’s on-premises data center and VPC host network. You want to make sure that on-premises applications can only access Google APIs over the Cloud Interconnect and not through the public internet. You are required to only use APIs that are supported by VPC Service Controls to mitigate against exfiltration risk to non-supported APIs. How should you configure the network?
A. Enable Private Google Access on the regional subnets and global dynamic routing mode.
B. Create a CNAME to map *.googleapis.com to restricted.googleapis.com, and create A records for restricted.googleapis.com mapped to 199.36.153.8/30.
C. Use private.googleapis.com to access Google APIs using a set of IP addresses only routable from within Google Cloud, which are advertised as routes over the connection.
D. Use restricted googleapis.com to access Google APIs using a set of IP addresses only routable from within Google Cloud, which are advertised as routes over the Cloud Interconnect connection.
Show Answer
Correct Answer: D
Explanation: To ensure on-premises systems access Google APIs only over Cloud Interconnect and to restrict access to only APIs supported by VPC Service Controls, use restricted.googleapis.com. The restricted.googleapis.com VIPs are advertised over Cloud Interconnect and only expose supported Google APIs, reducing exfiltration risk. Option A does not enforce restricted API access. Option B uses the wrong IP range for restricted.googleapis.com (it should be 199.36.153.4/30, not .8/30). Option C uses private.googleapis.com, which allows access to a broader set of Google APIs and does not meet the VPC Service Controls restriction requirement.
Question 170
Your company conducts clinical trials and needs to analyze the results of a recent study that are stored in BigQuery. The interval when the medicine was taken contains start and stop dates. The interval data is critical to the analysis, but specific dates may identify a particular batch and introduce bias. You need to obfuscate the start and end dates for each row and preserve the interval data.
What should you do?
A. Use date shifting with the context set to the unique ID of the test subject.
B. Extract the date using TimePartConfig from each date field and append a random month and year.
C. Use bucketing to shift values to a predetermined date based on the initial value.
D. Use the FFX mode of format preserving encryption (FPE) and maintain data consistency.
Show Answer
Correct Answer: A
Explanation: Date shifting is designed to obfuscate dates while preserving the duration and sequence of intervals. By using the test subject's unique ID as the context, the same deterministic shift is applied to both the start and end dates for that subject, preserving the interval while hiding the actual dates. Bucketing loses precision, TimePartConfig does not preserve intervals, and FPE preserves exact values in encrypted form rather than providing date-specific interval-preserving de-identification.
Question 171
Your organization develops software involved in many open source projects and is concerned about software supply chain threats. You need to deliver provenance for the build to demonstrate the software is untampered.
What should you do?
A. 1. Hire an external auditor to review and provide provenance. 2. Define the scope and conditions. 3. Get support from the Security department or representative. 4. Publish the attestation to your public web page.
B. 1. Review the software process. 2. Generate private and public key pairs and use Pretty Good Privacy (PGP) protocols to sign the output software artifacts together with a file containing the address of your enterprise and point of contact. 3. Publish the PGP signed attestation to your public web page.
C. 1. Publish the software code on GitHub as open source. 2. Establish a bug bounty program, and encourage the open source community to review, report, and fix the vulnerabilities.
D. 1. Generate Supply Chain Levels for Software Artifacts (SLSA) level 3 assurance by using Cloud Build. 2. View the build provenance in the Security insights side panel within the Google Cloud console.
Show Answer
Correct Answer: D
Explanation: Build provenance is a core goal of the SLSA (Supply-chain Levels for Software Artifacts) framework. Using Google Cloud Build to generate SLSA Level 3 provenance provides cryptographically verifiable build attestations demonstrating how software artifacts were produced and helping show they were not tampered with. Viewing the build provenance in the Security insights panel is the corresponding Google Cloud workflow. The other options do not provide standardized, verifiable build provenance.
Question 172
You have a highly sensitive BigQuery workload that contains personally identifiable information (PII) that you want to ensure is not accessible from the internet. To prevent data exfiltration, only requests from authorized IP addresses are allowed to query your BigQuery tables.
What should you do?
A. Use service perimeter and create an access level based on the authorized source IP address as the condition.
B. Use Google Cloud Armor security policies defining an allowlist of authorized IP addresses at the global HTTPS load balancer.
C. Use the Restrict Resource Service Usage organization policy constraint along with Cloud Data Loss Prevention (DLP).
D. Use the Restrict allowed Google Cloud APIs and services organization policy constraint along with Cloud Data Loss Prevention (DLP).
Show Answer
Correct Answer: A
Explanation: To restrict BigQuery access based on source IP addresses and prevent data exfiltration, use VPC Service Controls with a service perimeter and an Access Context Manager access level that allows only authorized source IPs. Cloud Armor protects HTTP(S) applications behind load balancers and does not control BigQuery API access. Organization policy constraints and DLP do not enforce source-IP-based access to BigQuery.
Question 173
Your organization is moving virtual machines (VMs) to Google Cloud. You must ensure that operating system images that are used across your projects are trusted and meet your security requirements.
What should you do?
A. Implement an organization policy to enforce that boot disks can only be created from images that come from the trusted image project.
B. Implement an organization policy constraint that enables the Shielded VM service on all projects to enforce the trusted image repository usage.
C. Create a Cloud Function that is automatically triggered when a new virtual machine is created from the trusted image repository. Verify that the image is not deprecated.
D. Automate a security scanner that verifies that no common vulnerabilities and exposures (CVEs) are present in your trusted image repository.
Show Answer
Correct Answer: A
Explanation: The correct approach is to enforce an organization policy that restricts VM boot disk creation to images from a trusted image project. This centrally ensures that only approved OS images are used across projects, directly addressing trust and security requirements. Shielded VM improves runtime integrity but does not enforce use of a trusted image repository. A Cloud Function that checks after VM creation is reactive and does not prevent untrusted images. Scanning for CVEs is a useful security practice but does not enforce that only trusted images are used.
Question 174
Employees at your company use their personal computers to access your organization's Google Cloud console. You need to ensure that users can only access the Google Cloud console from their corporate-issued devices and verify that they have a valid enterprise certificate.
What should you do?
A. Implement an Access Policy in BeyondCorp Enterprise to verify the device certificate. Create an access binding with the access policy just created.
B. Implement a VPC firewall policy. Activate packet inspection and create an allow rule to validate and verify the device certificate.
C. Implement an organization policy to verify the certificate from the access context.
D. Implement an Identity and Access Management (IAM) conditional policy to verify the device certificate.
Show Answer
Correct Answer: A
Explanation: BeyondCorp Enterprise provides context-aware access controls for Google Cloud resources, including the Google Cloud console. Access policies and access bindings can enforce that access is allowed only from managed corporate devices presenting a valid enterprise certificate. VPC firewall policies protect network traffic rather than console authentication, organization policies do not validate device certificates for console access, and IAM Conditions alone do not perform enterprise device certificate verification.
Question 175
Your application is deployed as a highly available, cross-region solution behind a global external HTTP(S) load balancer. You notice significant spikes in traffic from multiple IP addresses, but it is unknown whether the IPs are malicious. You are concerned about your application's availability. You want to limit traffic from these clients over a specified time interval.
What should you do?
A. Configure a throttle action by using Google Cloud Armor to limit the number of requests per client over a specified time interval.
B. Configure a rate_based_ban action by using Google Cloud Armor and set the ban_duration_sec parameter to the specified lime interval.
C. Configure a firewall rule in your VPC to throttle traffic from the identified IP addresses.
D. Configure a deny action by using Google Cloud Armor to deny the clients that issued too many requests over the specified time interval.
Show Answer
Correct Answer: A
Explanation: Use Google Cloud Armor's throttle rate limiting to limit the number of requests per client over a specified time interval while still allowing compliant traffic. This is appropriate when the IPs are not yet known to be malicious and the goal is to preserve application availability without outright blocking clients. A rate_based_ban temporarily bans clients that exceed the threshold, and deny actions block traffic instead of limiting it. VPC firewall rules do not provide request-rate throttling for HTTP(S) traffic behind the global external HTTP(S) load balancer.
Question 176
For compliance reporting purposes, the internal audit department needs you to provide the list of virtual machines (VMs) that have critical operating system (OS) security updates available, but not installed. You must provide this list every six months, and you want to perform this task quickly.
What should you do?
A. Run a Security Command Center security scan on all VMs to extract a list of VMs with critical OS vulnerabilities every six months.
B. Run a gcloud CLI command from the Command Line Interface (CLI) to extract the VM's OS version information every six months.
C. Ensure that the Cloud Logging agent is installed on all VMs, and extract the OS last update log date every six months.
D. Ensure the OS Config agent is installed on all VMs and extract the patch status dashboard every six months.
Show Answer
Correct Answer: D
Explanation: VM Manager's OS Config agent provides patch management and patch compliance reporting, including identifying available but not installed critical OS updates. The patch status dashboard is designed for exactly this reporting use case and is the fastest way to generate recurring compliance reports. Security Command Center is not the primary mechanism for OS patch compliance reporting, while OS version or logging data alone do not identify missing critical security updates.
Question 177
Your organization operates Virtual Machines (VMs) with only private IPs in the Virtual Private Cloud (VPC) with internet access through Cloud NAT. Everyday, you must patch all VMs with critical OS updates and provide summary reports.
What should you do?
A. Validate that the egress firewall rules allow any outgoing traffic. Log in to each VM and execute OS specific update commands. Configure the Cloud Scheduler job to update with critical patches daily for daily updates.
B. Copy the latest patches to the Cloud Storage bucket. Log in to each VM, download the patches from the bucket, and install them.
C. Assign public IPs to VMs. Validate that the egress firewall rules allow any outgoing traffic. Log in to each VM, and configure a daily cron job to enable for OS updates at night during low activity periods.
D. Ensure that VM Manager is installed and running on the VMs. In the OS patch management service, configure the patch jobs to update with critical patches dally.
Show Answer
Correct Answer: D
Explanation: VM Manager provides OS patch management for Compute Engine VMs, including scheduling recurring patch jobs, applying only critical updates, and generating patch compliance and summary reporting. VMs with only private IPs can still access update repositories through Cloud NAT, so public IPs and manual login are unnecessary. The other options rely on manual processes or public IPs and do not provide centralized automated patching and reporting.
Question 178
For data residency requirements, you want your secrets in Google Clouds Secret Manager to only have payloads in europe-west1 and europe-west4. Your secrets must be highly available in both regions.
What should you do?
A. Create your secret with a user managed replication policy, and choose only compliant locations.
B. Create your secret with an automatic replication policy, and choose only compliant locations.
C. Create two secrets by using Terraform, one in europe-west1 and the other in europe-west4.
D. Create your secret with an automatic replication policy, and create an organizational policy to deny secret creation in non-compliant locations.
Show Answer
Correct Answer: A
Explanation: User-managed replication allows you to explicitly choose the regions where secret payloads are stored. Specifying europe-west1 and europe-west4 satisfies the data residency requirement while Secret Manager replicates the secret across those selected regions for high availability. Automatic replication is Google-managed and does not let you restrict replication to only specific regions.
$19
Get all 351 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.