Professional Cloud Security Engineer Free Practice Questions — Page 9
Question 78
Your organization operates a hybrid cloud environment and has recently deployed a private Artifact Registry repository in Google Cloud. On-premises developers cannot resolve the Artifact Registry hostname and therefore cannot push or pull artifacts. You've verified the following:
• Connectivity to Google Cloud is established by Cloud VPN or Cloud Interconnect.
• No custom DNS configurations exist on-premises.
• There is no route to the internet from the on-premises network.
You need to identify the cause and enable the developers to push and pull artifacts. What is likely causing the issue and what should you do to fix the issue?
A. On-premises DNS servers lack the necessary records to resolve private Google API domains. Create DNS records for restricted.googleapis.com or private.googleapis.com pointing to Google's published IP ranges.
B. Developers must be granted the artifactregistry.writer IAM role. Grant the relevant developer group this role.
C. Private Google Access is not enabled for the subnet hosting the Artifact Registry. Enable Private Google Access for the appropriate subnet.
D. Artifact Registry requires external HTTP/HTTPS access. Create a new firewall rule allowing ingress traffic on ports 80 and 443 from the developer's IP ranges.
Show Answer
Correct Answer: A
Explanation: The issue is DNS resolution, not IAM, firewalling, or Private Google Access on a subnet. In a hybrid environment with Cloud VPN/Interconnect, no internet route, and no custom on-prem DNS configuration, on-prem clients cannot resolve Google API hostnames for Artifact Registry unless DNS is configured for Private Google Access domains. Configure on-prem DNS to resolve private.googleapis.com or restricted.googleapis.com (per your organization's access model) to Google's published VIPs so Artifact Registry hostnames resolve and traffic is sent over the private connection.
Question 79
You work for a large organization that is using Cloud Identity as the identity provider (IdP) on Google Cloud. Your InfoSec team has mandated the enforcement of a strong password with a length between 12 and 16 characters for all users. After configuring this requirement, users are still able to access the Google Cloud console with passwords that are less than 12 characters. You need to fix this problem within the Admin console. What should you do?
A. Review each user's password configuration and reset existing passwords.
B. Review the organization password management setting and select Enforce password policy at the next sign-in.
C. Review each user's password configuration and select Enforce strong password.
D. Review the organization password management setting and select Enforce strong password.
Show Answer
Correct Answer: B
Explanation: Password policy changes (such as requiring 12–16 character passwords) generally apply to new or changed passwords and do not automatically invalidate existing passwords. To bring existing users into compliance, enable the organization setting to enforce the password policy at the next sign-in, which forces affected users to update their passwords to meet the new requirements.
Question 80
Your organization is preparing to build business services in Google Cloud for the first time. You must determine where to apply appropriate controls or policies. You must also identify what aspects of your cloud deployment are managed by Google. What should you do?
A. Model your deployment on the Google Enterprise foundations blueprint. Follow the blueprint exactly and rely on the blueprint to maintain the posture necessary for your business.
B. Use the Risk Manager tool in the Risk Protection Program to generate a report on your cloud security posture. Obtain cyber insurance coverage.
C. Subscribe to the Google Cloud release notes to keep up on product updates and when new services are available. Evaluate new services for appropriate use before enabling their API.
D. Study the shared responsibilities model. Depending on your business scenario, you might need to consider your responsibilities based on the location of your business offices, your customers, and your data.
Show Answer
Correct Answer: D
Explanation: The correct choice is D because the shared responsibility model defines which security, compliance, and operational responsibilities are managed by Google (security of the cloud) versus which remain with the customer (security in the cloud). This directly addresses determining where to apply controls and policies and identifying what Google manages. The other options are either supplemental best practices or specific services that do not answer the fundamental responsibility question.
Question 81
You are creating a secure network architecture. You must fully isolate development and production environments, and prevent any network traffic between the two environments. The network team requires that there is only one central entry point to the cloud network from the on-premises environment. What should you do?
A. Create one Virtual Private Cloud (VPC) network per environment. Add the on-premises entry point to the production VPC. Peer the VPCs with each other and create firewall rules to prevent traffic.
B. Create one shared Virtual Private Cloud (VPC) network and use it as the entry point to the cloud network. Create separate subnets per environment. Create firewall rules to prevent traffic.
C. Create one Virtual Private Cloud (VPC) network per environment. Create a VPC Service Controls perimeter per environment and add one environment VPC to each.
D. Create one Virtual Private Cloud (VPC) network per environment. Create one additional VPC for the entry point to the cloud network. Peer the entry point VPC with the environment VPCs.
Show Answer
Correct Answer: D
Explanation: Use a hub-and-spoke design: create separate VPCs for development and production to ensure network isolation, plus a dedicated hub VPC that serves as the single on-premises entry point. Peer the hub VPC with each environment VPC. Because VPC Network Peering is non-transitive, the development and production VPCs cannot communicate with each other through the hub, satisfying the requirement to prevent traffic between environments while maintaining one central ingress.
Question 82
Your EU-based organization stores both Personally Identifiable Information (PII) and non-PII data in Cloud Storage buckets across multiple Google Cloud regions. EU data privacy laws require that the PII data must not be stored outside of the EU. To help meet this compliance requirement, you want to detect if Cloud Storage buckets outside of the EU contain healthcare data. What should you do?
A. Create a Sensitive Data Protection job. Specify the infoType of data to be detected and run the job across all Google Cloud Storage buckets.
B. Create a log sink with a filter on resourceLocation.currentLocations. Trigger an alert if a log message appears with a non- EUcountry.
C. Activate Security Command Center Premium. Use compliance monitoring to detect resources that do not follow the applicable healthcare regulation.
D. Enforce the gcp.resourceLocations organization policy and add "EU" in a custom rule that only applies on resources with the tag "healthcare".
Show Answer
Correct Answer: A
Explanation: Sensitive Data Protection (formerly Cloud DLP) is the service designed to inspect Cloud Storage contents for sensitive information such as PII and healthcare-related infoTypes. Running an inspection job across Cloud Storage buckets allows you to identify buckets outside the EU that contain sensitive data, which directly addresses the detection requirement. The other options either monitor resource configuration rather than inspect stored data, provide broader compliance posture rather than content discovery, or prevent future resource placement without detecting existing sensitive data in non-EU buckets.
Question 83
Your organization is migrating business critical applications to Google Cloud across multiple projects. You only have the required IAM permission at the Google Cloud organization level. You want to grant project access to support engineers from two partner organizations using their existing identity provider (IdP) credentials. What should you do?
A. Create two single sign-on (SSO) profiles for the internal and partner IdPs by using SSO for Cloud Identity.
B. Create users manually by using the Google Cloud console. Assign the users to groups.
C. Create two workforce identity pools for the partner IdPs.
D. Sync user identities from their existing IdPs to Cloud Identity by using Google Cloud Directory Sync (GCDS).
Show Answer
Correct Answer: C
Explanation: Use Workforce Identity Federation by creating separate workforce identity pools for each partner organization's external IdP. This allows partner users to authenticate with their existing credentials and be granted IAM access to Google Cloud resources without creating or synchronizing Google-managed identities. SSO for Cloud Identity is intended for your organization's users, GCDS synchronizes directories rather than enabling federated external workforce access, and manually creating users does not meet the requirement to use existing partner IdP credentials.
Question 84
You are working with developers to secure custom training jobs running on Vertex AI. For compliance reasons, all supported data types must be encrypted by key materials that reside in the Europe region and are controlled by your organization. The encryption activity must not impact the training operation in Vertex AI. What should you do?
A. Encrypt the code, training data, and metadata with Google default encryption. Use customer-managed encryption keys (CMEK) for the trained models exported to Cloud Storage buckets.
B. Encrypt the code, training data, metadata, and exported trained models with customer-managed encryption keys (CMEK).
C. Encrypt the code, training data, and exported trained models with customer-managed encryption keys (CMEK).
D. Encrypt the code, training data, and metadata with Google default encryption. Implement an organization policy that enforces a constraint to restrict the Cloud KMS location to the Europe region.
Show Answer
Correct Answer: C
Explanation: Vertex AI supports CMEK for custom training code/artifacts, training data, and exported trained models, but operational metadata is generally not encryptable with CMEK and remains encrypted with Google-managed encryption. Therefore the maximum compliant configuration among the options is to use CMEK for the supported resources (with keys in the Europe region under your organization's control). Option B incorrectly claims metadata can be encrypted with CMEK, while D relies on Google-managed encryption and does not satisfy the requirement for organizational control.
Question 85
You work for a global company. Due to compliance requirements, certain Compute Engine instances that reside within specific projects must be located exclusively in cloud regions within the European Union (EU). You need to ensure that existing non-compliant workloads are remediated and prevent future Compute Engine instances from being launched in restricted regions. What should you do?
A. Use a third-party configuration management tool to monitor the location of Compute Engine instances. Automatically delete or migrate non-compliant instances, including existing deployments.
B. Deploy a Security Command Center source to detect Compute Engine instances created outside the EU. Use a custom remediation function to automatically relocate the instances, run the function once a day.
C. Use organization policy constraints in Resource Manager to enforce allowed regions for Compute Engine instance creation within specific projects.
D. Set an organization policy that denies the creation of Compute Engine instances outside the EU. Apply the policy to the appropriate projects. Identify existing non-compliant instances and migrate the instances to compliant EU regions.
Show Answer
Correct Answer: D
Explanation: The requirement has two parts: remediate existing non-compliant Compute Engine instances and prevent future deployments outside EU regions. Organization Policy with the resource location constraint can enforce allowed locations for future resource creation when applied to the appropriate projects. It does not automatically move existing instances, so existing non-compliant workloads must be identified and migrated to EU regions. Option C only addresses prevention, while D covers both prevention and remediation.
Question 86
You work for a multinational organization that has systems deployed across multiple cloud providers, including Google Cloud. Your organization maintains an extensive on-premises security information and event management (SIEM) system. New security compliance regulations require that relevant Google Cloud logs be integrated seamlessly with the existing SIEM to provide a unified view of security events. You need to implement a solution that exports Google Cloud logs to your on-premises SIEM by using a push-based, near real-time approach. You must prioritize fault tolerance, security, and auto scaling capabilities. In particular, you must ensure that if a log delivery fails, logs are re-sent. What should you do?
A. Create a Pub/Sub topic for log aggregation. Write a custom Python script on a Cloud Function Leverage the Cloud Logging API to periodically pull logs from Google Cloud and forward the logs to the SIEM. Schedule the Cloud Function to run twice per day.
B. Collect all logs into an organization-level aggregated log sink and send the logs to a Pub/Sub topic. Implement a primary Dataflow pipeline that consumes logs from this Pub/Sub topic and delivers the logs to the SIEM. Implement a secondary Dataflow pipeline that replays failed messages.
C. Deploy a Cloud Logging sink with a filter that routes all logs directly to a syslog endpoint. The endpoint is based on a single Compute Engine hosted on Google Cloud that routes all logs to the on-premises SIEM. Implement a Cloud Function that triggers a retry action in case of failure.
D. Utilize custom firewall rules to allow your SIEM to directly query Google Cloud logs. Implement a Cloud Function that notifies the SIEM of a failed delivery and triggers a retry action.
Show Answer
Correct Answer: B
Explanation: An organization-level aggregated Cloud Logging sink exporting to Pub/Sub provides push-based, near real-time log delivery. Dataflow is managed, fault-tolerant, and auto-scaling for streaming logs to an on-premises SIEM. Using retry/dead-letter handling and a replay pipeline satisfies the requirement to resend failed log deliveries. The other options rely on polling, unsupported direct routing, or do not provide the required scalable, fault-tolerant streaming architecture.
Question 87
You work for a healthcare provider that is expanding into the cloud to store and process sensitive patient data. You must ensure the chosen Google Cloud configuration meets these strict regulatory requirements:
• Data must reside within specific geographic regions.
• Certain administrative actions on patient data require explicit approval from designated compliance officers.
• Access to patient data must be auditable.
What should you do?
A. Select a standard Google Cloud region. Restrict access to patient data based on user location and job function by using Access Context Manager. Enable both Cloud Audit Logging and Access Transparency.
B. Deploy an Assured Workloads environment in an approved region. Configure Access Approval for sensitive operations on patient data. Enable both Cloud Audit Logs and Access Transparency.
C. Deploy an Assured Workloads environment in multiple regions for redundancy. Utilize custom IAM roles with granular permissions. Isolate network-level data by using VPC Service Controls.
D. Select multiple standard Google Cloud regions for high availability. Implement Access Control Lists (ACLs) on individual storage objects containing patient data. Enable Cloud Audit Logs.
Show Answer
Correct Answer: B
Explanation: Assured Workloads helps enforce data residency and compliance requirements in approved regions. Access Approval provides explicit customer approval before certain Google support/administrative actions on covered resources. Cloud Audit Logs provide auditable access records, and Access Transparency logs Google's administrative access, satisfying the auditing requirement. The other options omit either Assured Workloads or Access Approval, which are key to the stated regulatory requirements.
$19
Get all 351 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.