2024 Current Professional-Cloud-Security-Engineer dumps Preparation through Our Practice Test
100% Reliable Microsoft Professional-Cloud-Security-Engineer Exam Dumps Test Pdf Exam Material
NEW QUESTION # 87
Your company's new CEO recently sold two of the company's divisions. Your Director asks you to help migrate the Google Cloud projects associated with those divisions to a new organization node. Which preparation steps are necessary before this migration occurs? (Choose two.)
- A. Identify inherited Identity and Access Management (1AM) roles on projects to be migrated.
- B. Remove the specific migration projects from any VPC Service Controls perimeters and bridges.
- C. Remove all project-level custom Identity and Access Management (1AM) roles.
- D. Create a new folder for all projects to be migrated.
- E. Disallow inheritance of organization policies.
Answer: A
Explanation:
Explanation
https://cloud.google.com/resource-manager/docs/project-migration#plan_policy When you migrate your project, it will no longer inherit the policies from its current place in the resource hierarchy, and will be subject to the effective policy evaluation at its destination. We recommend making sure that the effective policies at the project's destination match as much as possible the policies that the project had in its source location.https://cloud.google.com/resource-manager/docs/project-migration#import_export_folders Policy inheritance can cause unintended effects when you are migrating a project, both in the source and destination organization resources. You can mitigate this risk by creating specific folders to hold only projects for export and import, and ensuring that the same policies are inherited by the folders in both organization resources. You can also set permissions on these folders that will be inherited to the projects moved within them, helping to accelerate the project migration process.
NEW QUESTION # 88
A business unit at a multinational corporation signs up for GCP and starts moving workloads into GCP. The business unit creates a Cloud Identity domain with an organizational resource that has hundreds of projects.
Your team becomes aware of this and wants to take over managing permissions and auditing the domain resources.
Which type of access should your team grant to meet this requirement?
- A. Organization Administrator
- B. Security Reviewer
- C. Organization Role Administrator
- D. Organization Policy Administrator
Answer: C
Explanation:
Here are the permissions available to organizationRoleAdmin
iam.roles.create
iam.roles.delete
iam.roles.undelete
iam.roles.get
iam.roles.list
iam.roles.update
resourcemanager.projects.get
resourcemanager.projects.getIamPolicy
resourcemanager.projects.list
resourcemanager.organizations.get
resourcemanager.organizations.getIamPolicy
There are sufficient as per least privilege policy. You can do user management as well as auditing.
https://cloud.google.com/iam/docs/understanding-custom-roles
NEW QUESTION # 89
You need to set up a Cloud interconnect connection between your company's on-premises data center and VPC host network. You want to make sure that on-premises applications can only access Google APIs over the Cloud Interconnect and not through the public internet. You are required to only use APIs that are supported by VPC Service Controls to mitigate against exfiltration risk to non-supported APIs. How should you configure the network?
- A. Use private.googleapis.com to access Google APIs using a set of IP addresses only routable from within Google Cloud, which are advertised as routes over the connection.
- B. Use restricted googleapis.com to access Google APIs using a set of IP addresses only routable from within Google Cloud, which are advertised as routes over the Cloud Interconnect connection.
- C. Set up a Private Service Connect endpoint IP address with the API bundle of "all-apis", which is advertised as a route over the Cloud interconnect connection.
- D. Enable Private Google Access on the regional subnets and global dynamic routing mode.
Answer: B
Explanation:
https://cloud.google.com/vpc/docs/private-service-connect
An API bundle:
All APIs (all-apis): most Google APIs
(same as private.googleapis.com).
VPC-SC (vpc-sc): APIs that VPC Service Controls supports
(same as restricted.googleapis.com).
VMs in the same VPC network as the endpoint (all regions)
On-premises systems that are connected to the VPC network that contains the endpoint
NEW QUESTION # 90
Your organization recently deployed a new application on Google Kubernetes Engine. You need to deploy a solution to protect the application. The solution has the following requirements:
Scans must run at least once per week
Must be able to detect cross-site scripting vulnerabilities
Must be able to authenticate using Google accounts
Which solution should you use?
- A. Security Health Analytics
- B. Container Threat Detection
- C. Web Security Scanner
- D. Google Cloud Armor
Answer: C
NEW QUESTION # 91
You are developing a new application that uses exclusively Compute Engine VMs Once a day. this application will execute five different batch jobs Each of the batch jobs requires a dedicated set of permissions on Google Cloud resources outside of your application. You need to design a secure access concept for the batch jobs that adheres to the least-privilege principle What should you do?
- A. 1. Create a general service account "g-sa" to orchestrate the batch jobs.
* 2. Create one service account per batch job Mb-sa-[1-5]," and grant only the permissions required to run the individual batch jobs to the service accounts.
* 3. Grant the Service Account Token Creator role to g-sa Use g-sa to obtain short-lived access tokens for b-sa-[1-5] and to execute the batch jobs with the permissions of b-sa-[1-5]. - B. 1. Create a workload identity pool and configure workload identity pool providers for each batch job
* 2 Assign the workload identity user role to each of the identities configured in the providers.
* 3. Create one service account per batch job Mb-sa-[1-5]". and grant only the permissions required to run the individual batch jobs to the service accounts
* 4 Generate credential configuration files for each of the providers Use these files to execute the batch jobs with the permissions of b-sa-[1-5]. - C. 1. Create a general service account **g-sa" to execute the batch jobs.
* 2 Grant the permissions required to execute the batch jobs to g-sa.
* 3. Execute the batch jobs with the permissions granted to g-sa - D. * 1. Create a general service account "g-sa" to orchestrate the batch jobs.
* 2 Create one service account per batch job 'b-sa-[1-5)\ Grant only the permissions required to run the individual batch jobs to the service accounts and generate service account keys for each of these service accounts
* 3. Store the service account keys in Secret Manager. Grant g-sa access to Secret Manager and run the batch jobs with the permissions of b-sa-[1-5].
Answer: A
NEW QUESTION # 92
Your team wants to centrally manage GCP IAM permissions from their on-premises Active Directory Service. Your team wants to manage permissions by AD group membership.
What should your team do to meet these requirements?
- A. Use the Admin SDK to create groups and assign IAM permissions from Active Directory.
- B. Use the Cloud Identity and Access Management API to create groups and IAM permissions from Active Directory.
- C. Set up SAML 2.0 Single Sign-On (SSO), and assign IAM permissions to the groups.
- D. Set up Cloud Directory Sync to sync groups, and set IAM permissions on the groups.
Answer: D
Explanation:
"In order to be able to keep using the existing identity management system, identities need to be synchronized between AD and GCP IAM. To do so google provides a tool called Cloud Directory Sync. This tool will read all identities in AD and replicate those within GCP. Once the identities have been replicated then it's possible to apply IAM permissions on the groups. After that you will configure SAML so google can act as a service provider and either you ADFS or other third party tools like Ping or Okta will act as the identity provider. This way you effectively delegate the authentication from Google to something that is under your control."
NEW QUESTION # 93
Your company's Chief Information Security Officer (CISO) creates a requirement that business data must be stored in specific locations due to regulatory requirements that affect the company's global expansion plans.
After working on the details to implement this requirement, you determine the following:
The services in scope are included in the Google Cloud Data Residency Terms.
The business data remains within specific locations under the same organization.
The folder structure can contain multiple data residency locations.
You plan to use the Resource Location Restriction organization policy constraint. At which level in the resource hierarchy should you set the constraint?
- A. Organization
- B. Resource
- C. Folder
- D. Project
Answer: D
Explanation:
Explanation
https://cloud.google.com/resource-manager/docs/organization-policy/defining-locations
NEW QUESTION # 94
You discovered that sensitive personally identifiable information (PII) is being ingested to your Google Cloud environment in the daily ETL process from an on-premises environment to your BigQuery datasets. You need to redact this data to obfuscate the PII, but need to re-identify it for data analytics purposes. Which components should you use in your solution? (Choose two.)
- A. Secret Manager
- B. Cloud Data Loss Prevention with cryptographic hashing
- C. Cloud Key Management Service
- D. Cloud Data Loss Prevention with deterministic encryption using AES-SIV
- E. Cloud Data Loss Prevention with automatic text redaction
Answer: D,E
NEW QUESTION # 95
While migrating your organization's infrastructure to GCP, a large number of users will need to access GCP Console. The Identity Management team already has a well-established way to manage your users and want to keep using your existing Active Directory or LDAP server along with the existing SSO password.
What should you do?
- A. Users sign in directly to the GCP Console using the credentials from your on-premises Kerberos compliant identity provider.
- B. Users sign in using OpenID (OIDC) compatible IdP, receive an authentication token, then use that token to log in to the GCP Console.
- C. Manually synchronize the data in Google domain with your existing Active Directory or LDAP server.
- D. Use Google Cloud Directory Sync to synchronize the data in Google domain with your existing Active Directory or LDAP server.
Answer: D
Explanation:
Explanation
Explanation/Reference: https://cloud.google.com/blog/products/identity-security/using-your-existing-identity-management- system-with-google-cloud-platform
NEW QUESTION # 96
You will create a new Service Account that should be able to list the Compute Engine instances in the project. You want to follow Google-recommended practices.
What should you do?
- A. Give the Service Account the role of Project Viewer, and use the new Service Account for all instances.
- B. Create a custom role with the permission compute.instances.list and grant the Service Account this role.
- C. Give the Service Account the role of Compute Viewer, and use the new Service Account for all instances.
- D. Create an Instance Template, and allow the Service Account Read Only access for the Compute Engine Access Scope.
Answer: B
Explanation:
https://cloud.google.com/compute/docs/access/iam
NEW QUESTION # 97
How should a customer reliably deliver Stackdriver logs from GCP to their on-premises SIEM system?
- A. Configure Organizational Log Sinks to export logs to a Cloud Pub/Sub Topic, which will be sent to the SIEM via Dataflow.
- B. Build a connector for the SIEM to query for all logs in real time from the GCP RESTful JSON APIs.
- C. Send all logs to the SIEM system via an existing protocol such as syslog.
- D. Configure every project to export all their logs to a common BigQuery DataSet, which will be queried by the SIEM system.
Answer: A
Explanation:
Explanation
Scenarios for exporting Cloud Logging data: Splunk This scenario shows how to export selected logs from Cloud Logging to Pub/Sub for ingestion into Splunk. Splunk is a security information and event management (SIEM) solution that supports several ways of ingesting data, such as receiving streaming data out of Google Cloud through Splunk HTTP Event Collector (HEC) or by fetching data from Google Cloud APIs through Splunk Add-on for Google Cloud. Using the Pub/Sub to Splunk Dataflow template, you can natively forward logs and events from a Pub/Sub topic into Splunk HEC. If Splunk HEC is not available in your Splunk deployment, you can use the Add-on to collect the logs and events from the Pub/Sub topic.
https://cloud.google.com/solutions/exporting-stackdriver-logging-for-splunk
NEW QUESTION # 98
Your security team wants to implement a defense-in-depth approach to protect sensitive data stored in a Cloud Storage bucket. Your team has the following requirements:
The Cloud Storage bucket in Project A can only be readable from Project B.
The Cloud Storage bucket in Project A cannot be accessed from outside the network.
Data in the Cloud Storage bucket cannot be copied to an external Cloud Storage bucket.
What should the security team do?
- A. Enable Private Access in both Project A and B's networks with strict firewall rules that allow communication between the networks.
- B. Enable domain restricted sharing in an organization policy, and enable uniform bucket-level access on the Cloud Storage bucket.
- C. Enable VPC Peering between Project A and B's networks with strict firewall rules that allow communication between the networks.
- D. Enable VPC Service Controls, create a perimeter around Projects A and B. and include the Cloud Storage API in the Service Perimeter configuration.
Answer: D
Explanation:
VPC Peering is between organizations not between Projects in an organization. That is Shared VPC. In this case, both projects are in same organization so having VPC Service Controls around both projects with necessary rules should be fine.
https://cloud.google.com/vpc-service-controls/docs/overview
NEW QUESTION # 99
You recently joined the networking team supporting your company's Google Cloud implementation. You are tasked with familiarizing yourself with the firewall rules configuration and providing recommendations based on your networking and Google Cloud experience. What product should you recommend to detect firewall rules that are overlapped by attributes from other firewall rules with higher or equal priority?
- A. Firewall Insights
- B. Security Command Center
- C. VPC Flow Logs
- D. Firewall Rules Logging
Answer: A
Explanation:
https://cloud.google.com/network-intelligence-center/docs/firewall-insights/concepts/overview#shadowed-firewall-rules Firewall Insights analyzes your firewall rules to detect firewall rules that are shadowed by other rules. A shadowed rule is a firewall rule that has all of its relevant attributes, such as its IP address and port ranges, overlapped by attributes from one or more rules with higher or equal priority, called shadowing rules.
NEW QUESTION # 100
You are creating an internal App Engine application that needs to access a user's Google Drive on the user's behalf. Your company does not want to rely on the current user's credentials. It also wants to follow Google- recommended practices.
What should you do?
- A. Create a new Service account, and give all application users the role of Service Account User.
- B. Create a new Service account, and add all application users to a Google Group. Give this group the role of Service Account User.
- C. Create a new service account, and grant it G Suite domain-wide delegation. Have the application use it to impersonate the user.
- D. Use a dedicated G Suite Admin account, and authenticate the application's operations with these G Suite credentials.
Answer: C
Explanation:
https://developers.google.com/admin-sdk/directory/v1/guides/delegation
NEW QUESTION # 101
An organization's typical network and security review consists of analyzing application transit routes, request handling, and firewall rules. They want to enable their developer teams to deploy new applications without the overhead of this full review.
How should you advise this organization?
- A. Mandate use of infrastructure as code and provide static analysis in the CI/CD pipelines to enforce policies.
- B. Use Forseti with Firewall filters to catch any unwanted configurations in production.
- C. All production applications will run on-premises. Allow developers free rein in GCP as their dev and QA platforms.
- D. Route all VPC traffic through customer-managed routers to detect malicious patterns in production.
Answer: A
Explanation:
Explanation
https://cloud.google.com/recommender/docs/tutorial-iac
NEW QUESTION # 102
......
Free Professional-Cloud-Security-Engineer Dumps are Available for Instant Access: https://www.passleadervce.com/Google-Cloud-Certified/reliable-Professional-Cloud-Security-Engineer-exam-learning-guide.html
Based on Official Syllabus Topics of Actual Google Professional-Cloud-Security-Engineer Exam: https://drive.google.com/open?id=1qk-N1IZiNay3S1CwumihKastJojS_1sh