Free Access Google.Professional-Cloud-Security-Engineer.v2022-01-23.q100 Practice Test (Page 5)

Question 16

What are the steps to encrypt data using envelope encryption?

A.Generate a data encryption key (DEK) locally.
Use a key encryption key (KEK) to wrap the DEK.
Encrypt data with the KEK.
Store the encrypted data and the wrapped KEK.

B.Generate a key encryption key (KEK) locally.
Use the KEK to generate a data encryption key (DEK).
Encrypt data with the DEK.
Store the encrypted data and the wrapped DEK.

C.Generate a data encryption key (DEK) locally.
Encrypt data with the DEK.
Use a key encryption key (KEK) to wrap the DEK.
Store the encrypted data and the wrapped DEK.

D.Generate a key encryption key (KEK) locally.
Generate a data encryption key (DEK) locally.
Encrypt data with the KEK.
Store the encrypted data and the wrapped DEK.

Question 17

You are in charge of migrating a legacy application from your company datacenters to GCP before the current maintenance contract expires. You do not know what ports the application is using and no documentation is available for you to check. You want to complete the migration without putting your environment at risk.
What should you do?

A.Migrate the application into an isolated project using a "Lift & Shift" approach. Enable all internal TCP traffic using VPC Firewall rules. Use VPC Flow logs to determine what traffic should be allowed for the application to work properly.

B.Refactor the application into a micro-services architecture in a GKE cluster. Disable all traffic from outside the cluster using Firewall Rules. Use VPC Flow logs to determine what traffic should be allowed for the application to work properly.

C.Refactor the application into a micro-services architecture hosted in Cloud Functions in an isolated project. Disable all traffic from outside your project using Firewall Rules. Use VPC Flow logs to determine what traffic should be allowed for the application to work properly.

D.Migrate the application into an isolated project using a "Lift & Shift" approach in a custom network. Disable all traffic within the VPC and look at the Firewall logs to determine what traffic should be allowed for the application to work properly.

Question 18

Your company has deployed an application on Compute Engine. The application is accessible by clients on port 587. You need to balance the load between the different instances running the application. The connection should be secured using TLS, and terminated by the Load Balancer.
What type of Load Balancing should you use?

A.Network Load Balancing

B.HTTP(S) Load Balancing

C.TCP Proxy Load Balancing

D.SSL Proxy Load Balancing

Question 19

You need to follow Google-recommended practices to leverage envelope encryption and encrypt data at the application layer.
What should you do?

A.Generate a data encryption key (DEK) locally to encrypt the data, and generate a new key encryption key (KEK) in Cloud KMS to encrypt the DEK. Store both the encrypted data and the encrypted DEK.

B.Generate a data encryption key (DEK) locally to encrypt the data, and generate a new key encryption key (KEK) in Cloud KMS to encrypt the DEK. Store both the encrypted data and the KEK.

C.Generate a new data encryption key (DEK) in Cloud KMS to encrypt the data, and generate a key encryption key (KEK) locally to encrypt the key. Store both the encrypted data and the encrypted DEK.

D.Generate a new data encryption key (DEK) in Cloud KMS to encrypt the data, and generate a key encryption key (KEK) locally to encrypt the key. Store both the encrypted data and the KEK.

Question 20

You need to set up two network segments: one with an untrusted subnet and the other with a trusted subnet. You want to configure a virtual appliance such as a next-generation firewall (NGFW) to inspect all traffic between the two network segments. How should you design the network to inspect the traffic?

A.1. Set up one VPC with two subnets: one trusted and the other untrusted.
2. Configure a custom route for all RFC1918 subnets pointed to the virtual appliance.

B.1. Set up two VPC networks: one trusted and the other untrusted, and peer them together.
2. Configure a custom route on each network pointed to the virtual appliance.

C.1. Set up one VPC with two subnets: one trusted and the other untrusted.
2. Configure a custom route for all traffic (0.0.0.0/0) pointed to the virtual appliance.

D.1. Set up two VPC networks: one trusted and the other untrusted.
2. Configure a virtual appliance using multiple network interfaces, with each interface connected to one of the VPC networks.

Other Version: 2949Google.Professional-Cloud-Security-Engineer.v2022-10-17.q111; 2938Google.Professional-Cloud-Security-Engineer.v2022-08-22.q116

Latest Upload: 202PaloAltoNetworks.NGFW-Engineer.v2026-05-01.q43; 299Nokia.4A0-113.v2026-05-01.q69; 255EC-COUNCIL.312-49v11.v2026-04-30.q214; 228Microsoft.MB-820.v2026-04-30.q101; 211Salesforce.MC-202.v2026-04-30.q57; 206BICSI.INSTC_V8.v2026-04-29.q53; 335NMLS.MLO.v2026-04-28.q82; 243NCARB.Project-Management.v2026-04-28.q27; 462EMC.D-AV-DY-23.v2026-04-27.q184; 1116ServiceNow.CSA.v2026-04-27.q483

Question 16

Question 17

Question 18

Question 19

Question 20

Download PDF File