Professional Cloud Security Engineer Free Practice Questions — Page 18
Question 172
You have a highly sensitive BigQuery workload that contains personally identifiable information (PII) that you want to ensure is not accessible from the internet. To prevent data exfiltration, only requests from authorized IP addresses are allowed to query your BigQuery tables.
What should you do?
A. Use service perimeter and create an access level based on the authorized source IP address as the condition.
B. Use Google Cloud Armor security policies defining an allowlist of authorized IP addresses at the global HTTPS load balancer.
C. Use the Restrict Resource Service Usage organization policy constraint along with Cloud Data Loss Prevention (DLP).
D. Use the Restrict allowed Google Cloud APIs and services organization policy constraint along with Cloud Data Loss Prevention (DLP).
Show Answer
Correct Answer: A
Explanation: To restrict BigQuery access based on source IP addresses and prevent data exfiltration, use VPC Service Controls with a service perimeter and an Access Context Manager access level that allows only authorized source IPs. Cloud Armor protects HTTP(S) applications behind load balancers and does not control BigQuery API access. Organization policy constraints and DLP do not enforce source-IP-based access to BigQuery.
Question 173
Your organization is moving virtual machines (VMs) to Google Cloud. You must ensure that operating system images that are used across your projects are trusted and meet your security requirements.
What should you do?
A. Implement an organization policy to enforce that boot disks can only be created from images that come from the trusted image project.
B. Implement an organization policy constraint that enables the Shielded VM service on all projects to enforce the trusted image repository usage.
C. Create a Cloud Function that is automatically triggered when a new virtual machine is created from the trusted image repository. Verify that the image is not deprecated.
D. Automate a security scanner that verifies that no common vulnerabilities and exposures (CVEs) are present in your trusted image repository.
Show Answer
Correct Answer: A
Explanation: The correct approach is to enforce an organization policy that restricts VM boot disk creation to images from a trusted image project. This centrally ensures that only approved OS images are used across projects, directly addressing trust and security requirements. Shielded VM improves runtime integrity but does not enforce use of a trusted image repository. A Cloud Function that checks after VM creation is reactive and does not prevent untrusted images. Scanning for CVEs is a useful security practice but does not enforce that only trusted images are used.
Question 174
Employees at your company use their personal computers to access your organization's Google Cloud console. You need to ensure that users can only access the Google Cloud console from their corporate-issued devices and verify that they have a valid enterprise certificate.
What should you do?
A. Implement an Access Policy in BeyondCorp Enterprise to verify the device certificate. Create an access binding with the access policy just created.
B. Implement a VPC firewall policy. Activate packet inspection and create an allow rule to validate and verify the device certificate.
C. Implement an organization policy to verify the certificate from the access context.
D. Implement an Identity and Access Management (IAM) conditional policy to verify the device certificate.
Show Answer
Correct Answer: A
Explanation: BeyondCorp Enterprise provides context-aware access controls for Google Cloud resources, including the Google Cloud console. Access policies and access bindings can enforce that access is allowed only from managed corporate devices presenting a valid enterprise certificate. VPC firewall policies protect network traffic rather than console authentication, organization policies do not validate device certificates for console access, and IAM Conditions alone do not perform enterprise device certificate verification.
Question 175
Your application is deployed as a highly available, cross-region solution behind a global external HTTP(S) load balancer. You notice significant spikes in traffic from multiple IP addresses, but it is unknown whether the IPs are malicious. You are concerned about your application's availability. You want to limit traffic from these clients over a specified time interval.
What should you do?
A. Configure a throttle action by using Google Cloud Armor to limit the number of requests per client over a specified time interval.
B. Configure a rate_based_ban action by using Google Cloud Armor and set the ban_duration_sec parameter to the specified lime interval.
C. Configure a firewall rule in your VPC to throttle traffic from the identified IP addresses.
D. Configure a deny action by using Google Cloud Armor to deny the clients that issued too many requests over the specified time interval.
Show Answer
Correct Answer: A
Explanation: Use Google Cloud Armor's throttle rate limiting to limit the number of requests per client over a specified time interval while still allowing compliant traffic. This is appropriate when the IPs are not yet known to be malicious and the goal is to preserve application availability without outright blocking clients. A rate_based_ban temporarily bans clients that exceed the threshold, and deny actions block traffic instead of limiting it. VPC firewall rules do not provide request-rate throttling for HTTP(S) traffic behind the global external HTTP(S) load balancer.
Question 176
For compliance reporting purposes, the internal audit department needs you to provide the list of virtual machines (VMs) that have critical operating system (OS) security updates available, but not installed. You must provide this list every six months, and you want to perform this task quickly.
What should you do?
A. Run a Security Command Center security scan on all VMs to extract a list of VMs with critical OS vulnerabilities every six months.
B. Run a gcloud CLI command from the Command Line Interface (CLI) to extract the VM's OS version information every six months.
C. Ensure that the Cloud Logging agent is installed on all VMs, and extract the OS last update log date every six months.
D. Ensure the OS Config agent is installed on all VMs and extract the patch status dashboard every six months.
Show Answer
Correct Answer: D
Explanation: VM Manager's OS Config agent provides patch management and patch compliance reporting, including identifying available but not installed critical OS updates. The patch status dashboard is designed for exactly this reporting use case and is the fastest way to generate recurring compliance reports. Security Command Center is not the primary mechanism for OS patch compliance reporting, while OS version or logging data alone do not identify missing critical security updates.
Question 177
Your organization operates Virtual Machines (VMs) with only private IPs in the Virtual Private Cloud (VPC) with internet access through Cloud NAT. Everyday, you must patch all VMs with critical OS updates and provide summary reports.
What should you do?
A. Validate that the egress firewall rules allow any outgoing traffic. Log in to each VM and execute OS specific update commands. Configure the Cloud Scheduler job to update with critical patches daily for daily updates.
B. Copy the latest patches to the Cloud Storage bucket. Log in to each VM, download the patches from the bucket, and install them.
C. Assign public IPs to VMs. Validate that the egress firewall rules allow any outgoing traffic. Log in to each VM, and configure a daily cron job to enable for OS updates at night during low activity periods.
D. Ensure that VM Manager is installed and running on the VMs. In the OS patch management service, configure the patch jobs to update with critical patches dally.
Show Answer
Correct Answer: D
Explanation: VM Manager provides OS patch management for Compute Engine VMs, including scheduling recurring patch jobs, applying only critical updates, and generating patch compliance and summary reporting. VMs with only private IPs can still access update repositories through Cloud NAT, so public IPs and manual login are unnecessary. The other options rely on manual processes or public IPs and do not provide centralized automated patching and reporting.
Question 178
For data residency requirements, you want your secrets in Google Clouds Secret Manager to only have payloads in europe-west1 and europe-west4. Your secrets must be highly available in both regions.
What should you do?
A. Create your secret with a user managed replication policy, and choose only compliant locations.
B. Create your secret with an automatic replication policy, and choose only compliant locations.
C. Create two secrets by using Terraform, one in europe-west1 and the other in europe-west4.
D. Create your secret with an automatic replication policy, and create an organizational policy to deny secret creation in non-compliant locations.
Show Answer
Correct Answer: A
Explanation: User-managed replication allows you to explicitly choose the regions where secret payloads are stored. Specifying europe-west1 and europe-west4 satisfies the data residency requirement while Secret Manager replicates the secret across those selected regions for high availability. Automatic replication is Google-managed and does not let you restrict replication to only specific regions.
Question 179
An organization wants to track how bonus compensations have changed over time to identify employee outliers and correct earning disparities. This task must be performed without exposing the sensitive compensation data for any individual and must be reversible to identify the outlier.
Which Cloud Data Loss Prevention API technique should you use?
A. Cryptographic hashing
B. Redaction
C. Format-preserving encryption
D. Generalization
Show Answer
Correct Answer: C
Explanation: Format-preserving encryption (FPE) encrypts sensitive values while preserving their original format and is reversible with the appropriate key. This allows compensation data to remain protected while still enabling longitudinal analysis and, when necessary, decryption to identify specific outliers. Cryptographic hashing, redaction, and generalization are not reversible, so they do not meet the requirement.
Question 180
You work for a large organization where each business unit has thousands of users. You need to delegate management of access control permissions to each business unit. You have the following requirements:
✑ Each business unit manages access controls for their own projects.
✑ Each business unit manages access control permissions at scale.
✑ Business units cannot access other business units' projects.
✑ Users lose their access if they move to a different business unit or leave the company.
✑ Users and access control permissions are managed by the on-premises directory service.
What should you do? (Choose two.)
A. Use VPC Service Controls to create perimeters around each business unit's project.
B. Organize projects in folders, and assign permissions to Google groups at the folder level.
C. Group business units based on Organization Units (OUs) and manage permissions based on OUs
D. Create a project naming convention, and use Google's IAM Conditions to manage access based on the prefix of project names.
E. Use Google Cloud Directory Sync to synchronize users and group memberships in Cloud Identity.
Show Answer
Correct Answer: B, E
Explanation: Use the resource hierarchy by organizing projects into folders per business unit and grant IAM roles to Google Groups at the folder level so permissions inherit to projects and remain isolated between business units. Synchronize users and group memberships from the on-premises directory to Cloud Identity using Google Cloud Directory Sync (GCDS), allowing centralized lifecycle management so access is automatically updated when users move or leave. Organization Units are not used for Google Cloud IAM authorization, VPC Service Controls protect data exfiltration rather than delegate IAM administration, and IAM Conditions based on project name prefixes are not an appropriate scalable access management strategy.
Question 181
You need to create a VPC that enables your security team to control network resources such as firewall rules. How should you configure the network to allow for separation of duties for network resources?
A. Set up multiple VPC networks, and set up multi-NIC virtual appliances to connect the networks.
B. Set up VPC Network Peering, and allow developers to peer their network with a Shared VPC.
C. Set up a VPC in a project. Assign the Compute Network Admin role to the security team, and assign the Compute Admin role to the developers.
D. Set up a Shared VPC where the security team manages the firewall rules, and share the network with developers via service projects.
Show Answer
Correct Answer: D
Explanation: A Shared VPC is designed to separate network administration from application development. The security or networking team manages the host project's VPC, including firewall rules and other network resources, while developers deploy workloads in attached service projects without needing control over the shared network. This provides the required separation of duties.
$19
Get all 351 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.