Free Access Google.Professional-Cloud-Security-Engineer.v2022-01-23.q100 Practice Test (Page 8)

Question 31

A company's application is deployed with a user-managed Service Account key. You want to use Google-recommended practices to rotate the key.
What should you do?

A.Open Cloud Shell and run gcloud iam service-accounts enable-auto-rotate --iam-account=IAM_ACCOUNT.

B.Create a new key, and use the new key in the application. Store the old key on the system as a backup key.

C.Open Cloud Shell and run gcloud iam service-accounts keys rotate --iam-account=IAM_ACCOUNT --key=NEW_KEY.

D.Create a new key, and use the new key in the application. Delete the old key from the Service Account.

Question 32

An application running on a Compute Engine instance needs to read data from a Cloud Storage bucket. Your team does not allow Cloud Storage buckets to be globally readable and wants to ensure the principle of least privilege.
Which option meets the requirement of your team?

A.Use a service account with read-only access to the Cloud Storage bucket to retrieve the credentials from the instance metadata.

B.Create a Cloud Storage ACL that allows read-only access from the Compute Engine instance's IP address and allows the application to read from the bucket without credentials.

C.Encrypt the data in the Cloud Storage bucket using Cloud KMS, and allow the application to decrypt the data with the KMS key.

D.Use a service account with read-only access to the Cloud Storage bucket, and store the credentials to the service account in the config of the application on the Compute Engine instance.

Question 33

You are a member of the security team at an organization. Your team has a single GCP project with credit card payment processing systems alongside web applications and data processing systems. You want to reduce the scope of systems subject to PCI audit standards.
What should you do?

A.Use multi-factor authentication for admin access to the web application.

B.Use only applications certified compliant with PA-DSS.

C.Move the cardholder data environment into a separate GCP project.

D.Use VPN for all connections between your office and cloud environments.

Question 34

Applications often require access to "secrets" - small pieces of sensitive data at build or run time. The administrator managing these secrets on GCP wants to keep a track of "who did what, where, and when?" within their GCP projects.
Which two log streams would provide the information that the administrator is looking for? (Choose two.)

A.Admin Activity logs

B.System Event logs

C.Data Access logs

D.VPC Flow logs

E.Agent logs

Question 35