Online Access Free Professional-Cloud-Security-Engineer Practice Test

Your organization is deploying a serverless web application on Cloud Run that must be publicly accessible over HTTPS. To meet security requirements, you need to terminate TLS at the edge, apply threat mitigation, and prepare for geo-based access restrictions. What should you do?

• A.Deploy an external HTTP(S) load balancer with a serverless NEG that points to the Cloud Run service.
  Use a Google-managed certificate for TLS termination. Configure a Cloud Armor policy with geo- based access control.
• B.Create a Cloud DNS public zone for the Cloud Run URL. Bind a static IP to the service. Use VPC firewall rules to restrict incoming traffic based on IP ranges and threat signatures.
• C.Make the Cloud Run service public by enabling allUsers access. Configure Identity-Aware Proxy (IAP) for authentication and IP-based access control. Use custom SSL certificates for HTTPS.
• D.Assign a custom domain to the Cloud Run service. Enable HTTPS. Configure IAM to allow allUsers to invoke the service. Use firewall rules and VPC Service Controls for geo-based restriction and traffic filtering.

You want to prevent users from accidentally deleting a Shared VPC host project. Which organization-level policy constraint should you enable?

• A.compute.restrictSharedVpcHostProjects
• B.compute.restrictSharedVpcSubnetworks
• C.compute.sharedReservationsOwnerProjects
• D.compute.restrictXpnProjectLienRemoval

Your organization has hired a small, temporary partner team for 18 months. The temporary team will work alongside your DevOps team to develop your organization's application that is hosted on Google Cloud. You must give the temporary partner team access to your application's resources on Google Cloud and ensure that partner employees lose access if they are removed from their employer's organization. What should you do?

• A.Add the identities of the temporary partner team members to your identity provider (IdP).
• B.Create a temporary username and password for the temporary partner team members. Auto-clean the usernames and passwords after the work engagement has ended.
• C.Create a workforce identity pool and federate the identity pool with the identity provider (IdP) of the temporary partner team.
• D.Implement just-in-time privileged access to Google Cloud for the temporary partner team.

Your organization wants full control of the keys used to encrypt data at rest in their Google Cloud environments. Keys must be generated and stored outside of Google and integrate with many Google Services including BigQuery.
What should you do?

• A.Create a KMS key that is stored on a Google managed FIPS 140-2 level 3 Hardware Security Module (HSM) Manage the Identity and Access Management (IAM) permissions settings, and set up the key rotation period.
• B.Create a Cloud Key Management Service (KMS) key with imported key material Wrap the key for protection during import. Import the key generated on a trusted system in Cloud KMS.
• C.Use customer-supplied encryption keys (CSEK) with keys generated on trusted external systems Provide the raw CSEK as part of the API call.
• D.Use Cloud External Key Management (EKM) that integrates with an external Hardware Security Module(HSM) system from supported vendors.

You are in charge of migrating a legacy application from your company datacenters to GCP before the current maintenance contract expires. You do not know what ports the application is using and no documentation is available for you to check. You want to complete the migration without putting your environment at risk.
What should you do?

• A.Refactor the application into a micro-services architecture hosted in Cloud Functions in an isolated project.Disable all traffic from outside your project using Firewall Rules. Use VPC Flow logs to determine what traffic should be allowed for the application to work properly.
• B.Refactor the application into a micro-services architecture in a GKE cluster. Disable all traffic from outside the cluster using Firewall Rules. Use VPC Flow logs to determine what traffic should be allowed for the application to work properly.
• C.Migrate the application into an isolated project using a "Lift & Shift" approach in a custom network.
  Disable all traffic within the VPC and look at the Firewall logs to determine what traffic should be allowed for the application to work properly.
• D.Migrate the application into an isolated project using a "Lift & Shift" approach. Enable all internal TCP traffic using VPC Firewall rules. Use VPC Flow logs to determine what traffic should be allowed for theapplication to work properly.