20:00

PDF|

Guide for Professional-Cloud-Security-Engineer: Google Professional Cloud Security Engineer

Quiz Professional-Cloud-Security-Engineer: Google Professional Cloud Security Engineer

Free Test
/ 10

Quiz

1/10
YourteamneedstomakesurethataComputeEngineinstancedoesnothaveaccesstotheinternet
ortoanyGoogleAPIsorservices.
Whichtwosettingsmustremaindisabledtomeettheserequirements?(Choosetwo.)
A.PublicIP
B.IPForwarding
C.PrivateGoogleAccess
D.Staticroutes
E.IAMNetworkUserRole
Select the answer
2 correct answers
ToensurethataComputeEngineinstancedoesnothaveaccesstotheinternetortoanyGoogleAPIs
orservices,youneedtodisablethefollowingsettings:
PublicIP:DisablingthepublicIPaddressensuresthattheinstancedoesnothaveadirectconnection
totheinternet.WithoutapublicIPaddress,theinstancecannotbeaccessedfromorcommunicate
withtheinternetdirectly.
PrivateGoogleAccess:DisablingPrivateGoogleAccessensuresthattheinstancedoesnothave
[http://www.justcerts.com](http://www.justcerts.com)
Questions&AnswersPDF P-3
accesstoGoogleAPIsandservicesthroughtheinternalGooglenetwork.PrivateGoogleAccess
allowsinstanceswithoutapublicIPtoreachGoogleAPIsandservicesusingprivateIPaddresses,but
disablingitwillblockthispath.
Disablingthesesettingswilleffectivelyisolatetheinstancefromboththepublicinternetand
Google'sinternalAPIservices.
Reference
GoogleCloudVPCDocumentation-Overview
ConfiguringPrivateGoogleAccess
ComputeEngineNetworkOverview

Quiz

2/10
WhichtwoimpliedfirewallrulesaredefinedonaVPCnetwork?(Choosetwo.)
A.Arulethatallowsalloutboundconnections
B.Arulethatdeniesallinboundconnections
C.Arulethatblocksallinboundport25connections
D.Arulethatblocksalloutboundconnections
E.Arulethatallowsallinboundport80connections
Select the answer
2 correct answers
ImpliedIPv4allowegressrule.Anegressrulewhoseactionisallow,destinationis0.0.0.0/0,and
priorityisthelowestpossible(65535)letsanyinstancesendtraffictoanydestination
ImpliedIPv4denyingressrule.Aningressrulewhoseactionisdeny,sourceis0.0.0.0/0,andpriority
isthelowestpossible(65535)protectsallinstancesbyblockingincomingconnectionstothem.
[http://www.justcerts.com](http://www.justcerts.com)
Questions&AnswersPDF P-4
[https://cloud.google.com/vpc/docs/firewalls?hl=en#default_firewall_rules](https://cloud.google.com/vpc/docs/firewalls?hl=en#default_firewall_rules)

Quiz

3/10
Acustomerneedsanalternativetostoringtheirplaintextsecretsintheirsource-codemanagement
(SCM)system.
HowshouldthecustomerachievethisusingGoogleCloudPlatform?
A.UseCloudSourceRepositories,andstoresecretsinCloudSQL.
B.EncryptthesecretswithaCustomer-ManagedEncryptionKey(CMEK),andstoretheminCloud
Storage.
C.RuntheCloudDataLossPreventionAPItoscanthesecrets,andstoretheminCloudSQL.
D.DeploytheSCMtoaComputeEngineVMwithlocalSSDs,andenablepreemptibleVMs.
Select the answer
1 correct answer
Storingsecretssecurelyiscrucialformaintainingtheintegrityandconfidentialityofyour
applications.HereishowyoucanachievethisusingGoogleCloudPlatform:
EncrypttheSecrets:UseCustomer-ManagedEncryptionKeys(CMEK)toencryptyoursecrets.CMEK
allowsyoutohavegreatercontrolovertheencryptionkeysusedtoprotectyourdata.Thisensures
thatevenifthestoragemediumiscompromised,thesecretsremainprotectedbystrongencryption.
StoreinCloudStorage:StoretheencryptedsecretsinGoogleCloudStorage.CloudStorageisa
secureandscalableobjectstorageservice.Byusingencryptedstorage,youcanensurethatthe
secretsaresecurelystoredandcanonlybeaccessedbyauthorizedentities.
Thismethodprovidesasecureandmanagedwaytostoresecrets,ensuringthattheyarenotexposed
inplaintextwithinyoursourcecodemanagementsystem.
Reference
Customer-ManagedEncryptionKeys(CMEK)
GoogleCloudStorageSecurity
[http://www.justcerts.com](http://www.justcerts.com)
Questions&AnswersPDF P-5

Quiz

4/10
YourteamwantstocentrallymanageGCPIAMpermissionsfromtheiron-premisesActiveDirectory
Service.YourteamwantstomanagepermissionsbyADgroupmembership.
Whatshouldyourteamdotomeettheserequirements?
A.SetupCloudDirectorySynctosyncgroups,andsetIAMpermissionsonthegroups.
B.SetupSAML2.0SingleSign-On(SSO),andassignIAMpermissionstothegroups.
C.UsetheCloudIdentityandAccessManagementAPItocreategroupsandIAMpermissionsfrom
ActiveDirectory.
D.UsetheAdminSDKtocreategroupsandassignIAMpermissionsfromActiveDirectory.
Select the answer
1 correct answer
"Inordertobeabletokeepusingtheexistingidentitymanagementsystem,identitiesneedtobe
synchronizedbetweenADandGCP IAM.TodosogoogleprovidesatoolcalledCloudDirectorySync.
ThistoolwillreadallidentitiesinADandreplicatethosewithinGCP.Oncetheidentitieshavebeen
replicatedthenit'spossibletoapplyIAMpermissionsonthegroups.Afterthatyouwillconfigure
SAMLsogooglecanactasaserviceproviderandeitheryouADFS orotherthirdpartytoolslikePing
orOktawillactastheidentityprovider.Thiswayyoueffectivelydelegatetheauthenticationfrom
Googletosomethingthatisunderyourcontrol."

Quiz

5/10
Whencreatingasecurecontainerimage,whichtwoitemsshouldyouincorporateintothebuildif
possible?(Choosetwo.)
A.EnsurethattheappdoesnotrunasPID1.
B.Packageasingleappasacontainer.
[http://www.justcerts.com](http://www.justcerts.com)
Questions&AnswersPDF P-6
C.Removeanyunnecessarytoolsnotneededbytheapp.
D.Usepubliccontainerimagesasabaseimagefortheapp.
E.Usemanycontainerimagelayerstohidesensitiveinformation.
Select the answer
2 correct answers
Whencreatingasecurecontainerimage,itisessentialtofollowbestpracticestominimize
vulnerabilitiesandensurethecontaineroperatesasintended.Herearethetwokeypractices:
PackageaSingleAppasaContainer:Bypackagingonlyasingleapplicationwithinacontainer,you
reducecomplexityandpotentialattacksurfaces.Thispracticealignswiththeprincipleofsingle
responsibility,ensuringeachcontainerhasaclearandfocusedpurpose.
RemoveAnyUnnecessaryTools:Anyadditionaltoolsorsoftwarethatarenotrequiredbythe
applicationshouldberemovedfromthecontainerimage.Thisminimizesthenumberofpotential
vulnerabilitiesandreducestheattacksurface.Aminimalcontainerimagealsoleadstosmallerimage
sizesandfasterdeploymenttimes.
Thesepracticescontributetocreatingamoresecureandefficientcontainerimage.
Reference
ContainerSecurityBestPractices
SecuringContainerImages

Quiz

6/10
Acustomerneedstolauncha3-tierinternalwebapplicationonGoogleCloudPlatform(GCP).The
customer’sinternalcompliancerequirementsdictatethatend-useraccessmayonlybeallowedifthe
trafficseemstooriginatefromaspecificknowngoodCIDR.Thecustomeracceptstheriskthattheir
applicationwillonlyhaveSYNfloodDDoSprotection.TheywanttouseGCP’snativeSYNflood
protection.
Whichproductshouldbeusedtomeettheserequirements?
[http://www.justcerts.com](http://www.justcerts.com)
Questions&AnswersPDF P-7
A.CloudArmor
B.VPCFirewallRules
C.CloudIdentityandAccessManagement
D.CloudCDN
Select the answer
1 correct answer
Toensureend-useraccessisonlyallowedifthetrafficoriginatesfromaspecificknowngoodCIDR
andtoutilizeGCP'snativeSYNfloodprotection,youcanusethefollowingproduct:
VPCFirewallRules:ByconfiguringVPCfirewallrules,youcancontroltraffictoandfromyour
instancesbasedonIPaddress,protocol,andport.Youcansetrulestoonlyallowtrafficfroma
specificCIDRblock,ensuringthatonlyauthorizedtrafficcanreachyourapplication.
Additionally,GoogleCloudPlatformprovidesbuilt-inprotectionsagainstSYNfloodattacks,whichare
atypeofDDoSattack.Theseprotectionsarepartoftheunderlyinginfrastructureanddonotrequire
additionalconfiguration.
UsingVPCfirewallruleswillhelpyoucomplywiththeinternalrequirementofallowingaccessonly
fromaspecificCIDRandprovidethenecessarySYNfloodDDoSprotection.
Reference
GoogleCloudVPCFirewallRules
GoogleCloudDDoSProtection

Quiz

7/10
Acompanyisrunningworkloadsinadedicatedserverroom.Theymustonlybeaccessedfromwithin
theprivatecompanynetwork.YouneedtoconnecttotheseworkloadsfromComputeEngine
instanceswithinaGoogleCloudPlatformproject.
Whichtwoapproachescanyoutaketomeettherequirements?(Choosetwo.)
A.ConfiguretheprojectwithCloudVPN.
[http://www.justcerts.com](http://www.justcerts.com)
Questions&AnswersPDF P-8
B.ConfiguretheprojectwithSharedVPC.
C.ConfiguretheprojectwithCloudInterconnect.
D.ConfiguretheprojectwithVPCpeering.
E.ConfigureallComputeEngineinstanceswithPrivateAccess.
Select the answer
2 correct answers
ToconnectComputeEngineinstanceswithinaGoogleCloudPlatformprojecttoworkloadsrunning
inadedicatedserverroomthatcanonlybeaccessedfromwithintheprivatecompanynetwork,you
canusethefollowingapproaches:
CloudVPN:CloudVPNsecurelyconnectsyouron-premisesnetworktoyourGoogleCloudVirtual
PrivateCloud(VPC)networkthroughanIPsecVPNconnection.Thisenablessecurecommunication
betweenyourGCPinstancesandyouron-premisesworkloadsovertheinternet.
CloudInterconnect:CloudInterconnectprovidesdirectphysicalconnectionsbetweenyouron-
premisesnetworkandGoogle'snetwork.Itoffershigherbandwidthandlowerlatencycomparedto
CloudVPN,makingitsuitableforworkloadsthatrequirefastandreliableconnectivity.
BothCloudVPNandCloudInterconnectallowyoutosecurelyconnectyouron-premises
environmentstoGoogleCloud,ensuringthattheworkloadsremainwithintheprivatecompany
network.
Reference
CloudVPNOverview
CloudInterconnectOverview

Quiz

8/10
AcustomerimplementsCloudIdentity-AwareProxyfortheirERPsystemhostedonComputeEngine.
TheirsecurityteamwantstoaddasecuritylayersothattheERPsystemsonlyaccepttrafficfrom
CloudIdentity-AwareProxy.
Whatshouldthecustomerdotomeettheserequirements?
[http://www.justcerts.com](http://www.justcerts.com)
Questions&AnswersPDF P-9
A.MakesurethattheERPsystemcanvalidatetheJWTassertionintheHTTPrequests.
B.MakesurethattheERPsystemcanvalidatetheidentityheadersintheHTTPrequests.
C.MakesurethattheERPsystemcanvalidatethex-forwarded-forheadersintheHTTPrequests.
D.MakesurethattheERPsystemcanvalidatetheuser’suniqueidentifierheadersintheHTTP
requests.
Select the answer
1 correct answer
UseCryptographicVerificationIfthereisariskofIAPbeingturnedofforbypassed,yourappcan
checktomakesuretheidentityinformationitreceivesisvalid.Thisusesathirdwebrequestheader
addedbyIAP,calledX-Goog-IAP-JWT-Assertion.Thevalueoftheheaderisacryptographicallysigned
objectthatalsocontainstheuseridentitydata.Yourapplicationcanverifythedigitalsignatureand
usethedataprovidedinthisobjecttobecertainthatitwasprovidedbyIAPwithoutalteration.

Quiz

9/10
AcompanyhasbeenrunningtheirapplicationonComputeEngine.Abugintheapplicationallowed
amalicioususertorepeatedlyexecuteascriptthatresultsintheComputeEngineinstancecrashing.
Althoughthebughasbeenfixed,youwanttogetnotifiedincasethishackre-occurs.
Whatshouldyoudo?
A.CreateanAlertingPolicyinStackdriverusingaProcessHealthcondition,checkingthatthe
numberofexecutionsofthescriptremainsbelowthedesiredthreshold.Enablenotifications.
B.CreateanAlertingPolicyinStackdriverusingtheCPUusagemetric.Setthethresholdto80%tobe
notifiedwhentheCPUusagegoesabovethis80%.
C.LogeveryexecutionofthescripttoStackdriverLogging.CreateaUser-definedmetricin
StackdriverLoggingonthelogs,andcreateaStackdriverDashboarddisplayingthemetric.
D.LogeveryexecutionofthescripttoStackdriverLogging.ConfigureBigQueryasalogsink,and
createaBigQueryscheduledquerytocountthenumberofexecutionsinaspecifictimeframe.
[http://www.justcerts.com](http://www.justcerts.com)
Questions&AnswersPDF P-10
Select the answer
1 correct answer
TomonitorandgetnotifiedincasethescriptcausingtheComputeEngineinstancetocrashis
executedagain,youshouldcreateanAlertingPolicyinStackdriver(nowknownasGoogleCloud
Monitoring).TheProcessHealthconditioncanbesettomonitorthenumberofexecutionsofthe
scriptandensureitremainsbelowthedesiredthreshold.Byenablingnotifications,youwillbe
alertedifthisthresholdisexceeded.
Step-by-Step:
LogScriptExecutions:Ensurethatthescriptexecutionislogged.
CreateaUser-DefinedMetric:GotoGoogleCloudConsole>Logging>Logs-basedMetrics,and
createanewuser-definedmetricthatcountsthenumberoftimesthescriptexecutes.
SetUpAlertingPolicy:
NavigatetoGoogleCloudConsole>Monitoring>Alerting.
Clickon“CreatePolicy”.
Addaconditionandselect“Logs-basedMetric”.
Configuretheconditiontotriggerwhenthenumberofscriptexecutionsexceedsthethreshold.
ConfigureNotifications:Addnotificationchannels(email,SMS,etc.)tothealertingpolicy.
SaveandTest:Savethepolicyandtesttoensurenotificationsarereceivedwhenthescriptis
executedbeyondthethreshold.
GoogleCloudLoggingUser-definedMetrics
GoogleCloudMonitoringAlertingPolicies

Quiz

10/10
YourteamneedstoobtainaunifiedlogviewofalldevelopmentcloudprojectsinyourSIEM.The
developmentprojectsareundertheNONPRODorganizationfolderwiththetestandpre-production
projects.ThedevelopmentprojectssharetheABC-BILLINGbillingaccountwiththerestofthe
organization.
[http://www.justcerts.com](http://www.justcerts.com)
Questions&AnswersPDF P-11
Whichloggingexportstrategyshouldyouusetomeettherequirements?
A.1.ExportlogstoaCloudPub/Subtopicwithfolders/NONPRODparentandincludeChildren
propertysettoTrueinadedicatedSIEMproject.2.SubscribeSIEMtothetopic.
B.1.CreateaCloudStoragesinkwithbillingAccounts/ABC-BILLINGparentandincludeChildren
propertysettoFalseinadedicatedSIEMproject.2.ProcessCloudStorageobjectsinSIEM.
C.1.ExportlogsineachdevprojecttoaCloudPub/SubtopicinadedicatedSIEMproject.2.Subscribe
SIEMtothetopic.
D.1.CreateaCloudStoragesinkwithapubliclysharedCloudStoragebucketineach
project.2.ProcessCloudStorageobjectsinSIEM.
Select the answer
1 correct answer
"YourteamneedstoobtainaunifiedlogviewofalldevelopmentcloudprojectsinyourSIEM"-This
meansweareONLYinterestedindevelopmentprojects."Thedevelopmentprojectsareunderthe
NONPRODorganizationfolderwiththetestandpre-productionprojects"-Wewillneedtofilterout
developmentfromothersi.etestandpre-prod."ThedevelopmentprojectssharetheABC-BILLING
billingaccountwiththerestoftheorganization."-Thisisunnecessaryinformation.
Looking for more questions?Buy now

Professional-Cloud-Security-Engineer: Google Professional Cloud Security Engineer Practice test unlocks all online simulator questions

Thank you for choosing the free version of the Professional-Cloud-Security-Engineer: Google Professional Cloud Security Engineer practice test! Further deepen your knowledge on Google Simulator; by unlocking the full version of our Professional-Cloud-Security-Engineer: Google Professional Cloud Security Engineer Simulator you will be able to take tests with over 318 constantly updated questions and easily pass your exam. 98% of people pass the exam in the first attempt after preparing with our 318 questions.

BUY NOW

What to expect from our Professional-Cloud-Security-Engineer: Google Professional Cloud Security Engineer practice tests and how to prepare for any exam?

The Professional-Cloud-Security-Engineer: Google Professional Cloud Security Engineer Simulator Practice Tests are part of the Google Database and are the best way to prepare for any Professional-Cloud-Security-Engineer: Google Professional Cloud Security Engineer exam. The Professional-Cloud-Security-Engineer: Google Professional Cloud Security Engineer practice tests consist of 318 questions and are written by experts to help you and prepare you to pass the exam on the first attempt. The Professional-Cloud-Security-Engineer: Google Professional Cloud Security Engineer database includes questions from previous and other exams, which means you will be able to practice simulating past and future questions. Preparation with Professional-Cloud-Security-Engineer: Google Professional Cloud Security Engineer Simulator will also give you an idea of the time it will take to complete each section of the Professional-Cloud-Security-Engineer: Google Professional Cloud Security Engineer practice test . It is important to note that the Professional-Cloud-Security-Engineer: Google Professional Cloud Security Engineer Simulator does not replace the classic Professional-Cloud-Security-Engineer: Google Professional Cloud Security Engineer study guides; however, the Simulator provides valuable insights into what to expect and how much work needs to be done to prepare for the Professional-Cloud-Security-Engineer: Google Professional Cloud Security Engineer exam.

BUY NOW

Professional-Cloud-Security-Engineer: Google Professional Cloud Security Engineer Practice test therefore represents an excellent tool to prepare for the actual exam together with our Google practice test . Our Professional-Cloud-Security-Engineer: Google Professional Cloud Security Engineer Simulator will help you assess your level of preparation and understand your strengths and weaknesses. Below you can read all the quizzes you will find in our Professional-Cloud-Security-Engineer: Google Professional Cloud Security Engineer Simulator and how our unique Professional-Cloud-Security-Engineer: Google Professional Cloud Security Engineer Database made up of real questions:

Info quiz:

  • Quiz name:Professional-Cloud-Security-Engineer: Google Professional Cloud Security Engineer
  • Total number of questions:318
  • Number of questions for the test:50
  • Pass score:80%

You can prepare for the Professional-Cloud-Security-Engineer: Google Professional Cloud Security Engineer exams with our mobile app. It is very easy to use and even works offline in case of network failure, with all the functions you need to study and practice with our Professional-Cloud-Security-Engineer: Google Professional Cloud Security Engineer Simulator.

Use our Mobile App, available for both Android and iOS devices, with our Professional-Cloud-Security-Engineer: Google Professional Cloud Security Engineer Simulator . You can use it anywhere and always remember that our mobile app is free and available on all stores.

Our Mobile App contains all Professional-Cloud-Security-Engineer: Google Professional Cloud Security Engineer practice tests which consist of 318 questions and also provide study material to pass the final Professional-Cloud-Security-Engineer: Google Professional Cloud Security Engineer exam with guaranteed success. Our Professional-Cloud-Security-Engineer: Google Professional Cloud Security Engineer database contain hundreds of questions and Google Tests related to Professional-Cloud-Security-Engineer: Google Professional Cloud Security Engineer Exam. This way you can practice anywhere you want, even offline without the internet.

BUY NOW