Free Access Google.Professional-Cloud-Security-Engineer.v2022-01-23.q100 Practice Test (Page 6)

Question 21

A customer terminates an engineer and needs to make sure the engineer's Google account is automatically deprovisioned.
What should the customer do?

A.Configure Cloud Directory Sync with their directory service to remove their IAM permissions in Cloud Identity.

B.Configure Cloud Directory Sync with their directory service to provision and deprovision users from Cloud Identity.

C.Use the Cloud SDK with their directory service to provision and deprovision users from Cloud Identity.

D.Use the Cloud SDK with their directory service to remove their IAM permissions in Cloud Identity.

Question 22

Your organization has had a few recent DDoS attacks. You need to authenticate responses to domain name lookups. Which Google Cloud service should you use?

A.HTTP(S) Load Balancing

B.Google Cloud Armor

C.Cloud NAT

D.Cloud DNS with DNSSEC

Question 23

Last week, a company deployed a new App Engine application that writes logs to BigQuery. No other workloads are running in the project. You need to validate that all data written to BigQuery was done using the App Engine Default Service Account.
What should you do?

A.1. Go to the IAM section on the project.
2. Validate that the App Engine Default Service Account is the only account that has a role that can write to BigQuery.

B.1. Use StackDriver Logging and filter on BigQuery Insert Jobs.
2. Click on the email address in line with the App Engine Default Service Account in the authentication field.
3. Click Hide Matching Entries.
4. Make sure the resulting list is empty.

C.1. In BigQuery, select the related dataset.
2. Make sure the App Engine Default Service Account is the only account that can write to the dataset.

D.1. Use StackDriver Logging and filter on BigQuery Insert Jobs.
2. Click on the email address in line with the App Engine Default Service Account in the authentication field.
3. Click Show Matching Entries.
4. Make sure the resulting list is empty.

Question 24

A large financial institution is moving its Big Data analytics to Google Cloud Platform. They want to have maximum control over the encryption process of data stored at rest in BigQuery.
What technique should the institution use?

A.Use Cloud Storage as a federated Data Source.

B.Use a Cloud Hardware Security Module (Cloud HSM).

C.Customer-managed encryption keys (CMEK).

D.Customer-supplied encryption keys (CSEK).

Question 25

You are troubleshooting access denied errors between Compute Engine instances connected to a Shared VPC and BigQuery datasets. The datasets reside in a project protected by a VPC Service Controls perimeter. What should you do?

A.Add the host project containing the Shared VPC to the service perimeter.

B.Create a service perimeter between the service project where the Compute Engine instances reside and the host project that contains the Shared VPC.

C.Add the service project where the Compute Engine instances reside to the service perimeter.

D.Create a perimeter bridge between the service project where the Compute Engine instances reside and the perimeter that contains the protected BigQuery datasets.

Other Version: 2948Google.Professional-Cloud-Security-Engineer.v2022-10-17.q111; 2937Google.Professional-Cloud-Security-Engineer.v2022-08-22.q116

Latest Upload: 201PaloAltoNetworks.NGFW-Engineer.v2026-05-01.q43; 296Nokia.4A0-113.v2026-05-01.q69; 253EC-COUNCIL.312-49v11.v2026-04-30.q214; 228Microsoft.MB-820.v2026-04-30.q101; 209Salesforce.MC-202.v2026-04-30.q57; 205BICSI.INSTC_V8.v2026-04-29.q53; 333NMLS.MLO.v2026-04-28.q82; 243NCARB.Project-Management.v2026-04-28.q27; 460EMC.D-AV-DY-23.v2026-04-27.q184; 1113ServiceNow.CSA.v2026-04-27.q483

Question 21

Question 22

Question 23

Question 24

Question 25

Download PDF File