Google Professional Security Engineer

Your company runs a website that will store PII on Google Cloud Platform. To comply with data privacy regulations, this data can only be stored for a specific amount of time and must be fully deleted after this specific period. Data that has not yet reached the time period should not be deleted. You want to automate the process of complying with this regulation.
What should you do?

• Store the data in a single Persistent Disk, and delete the disk at expiration time

• Store the data in a single BigQuery table and set the appropriate table expiration time.

• Store the data in a single Cloud Storage bucket and configure the bucket's Time to Live.

• Store the data in a single BigTable table and set an expiration time on the column families.

For compliance reasons, an organization needs to ensure that in-scope PCI Kubernetes Pods reside on `in-scope` Nodes only. These Nodes can only contain the
`in-scope` Pods.
How should the organization achieve this objective?

• Add a nodeSelector field to the pod configuration to only use the Nodes labeled inscope: true.

• Create a node pool with the label inscope: true and a Pod Security Policy that only allows the Pods to run on Nodes with that label.

• Place a taint on the Nodes with the label inscope: true and effect NoSchedule and a toleration to match in the Pod configuration.

• Run all in-scope Pods in the namespace ג€in-scope-pciג€.

A company has redundant mail servers in different Google Cloud Platform regions and wants to route customers to the nearest mail server based on location.
How should the company accomplish this?

• Configure TCP Proxy Load Balancing as a global load balancing service listening on port 995.

• Create a Network Load Balancer to listen on TCP port 995 with a forwarding rule to forward traffic based on location.

• Use Cross-Region Load Balancing with an HTTP(S) load balancer to route traffic to the nearest region.

• Use Cloud CDN to route the mail traffic to the closest origin mail server based on client IP address.

You control network traffic for a folder in your Google Cloud environment. Your folder includes multiple projects and Virtual Private Cloud (VPC) networks. You want to enforce on the folder level that egress connections are limited only to IP range 10.58.5.0/24 and only from the VPC network “dev-vpc”. You want to minimize implementation and maintenance effort.
What should you do?

• 1. Leave the network configuration of the VMs in scope unchanged.
  2. Create a new project including a new VPC network “new-vpc”.
  3. Deploy a network appliance in “new-vpc” to filter access requests and only allow egress connections from “dev-vpc” to 10.58.5.0/24.

• 1. Leave the network configuration of the VMs in scope unchanged.
  2. Enable Cloud NAT for “dev-vpc” and restrict the target range in Cloud NAT to 10.58.5.0/24.

• 1. Attach external IP addresses to the VMs in scope.
  2. Define and apply a hierarchical firewall policy on folder level to deny all egress connections and to allow egress to IP range 10.58.5.0/24 from network dev-vpc.

• 1. Attach external IP addresses to the VMs in scope.
  2. Configure a VPC Firewall rule in “dev-vpc” that allows egress connectivity to IP range 10.58.5.0/24 for all source addresses in this network.

You have stored company approved compute images in a single Google Cloud project that is used as an image repository. This project is protected with VPC Service Controls and exists in the perimeter along with other projects in your organization. This lets other projects deploy images from the image repository project. A team requires deploying a third-party disk image that is stored in an external Google Cloud organization. You need to grant read access to the disk image so that it can be deployed into the perimeter.
What should you do?

• Allow the external project by using the organizational policy, constraints/compute.trustedImageProjects.

• 1. Update the perimeter.
  2. Configure the egressTo field to include the external Google Cloud project number as an allowed resource and the serviceName to compute.googleapis.com.
  3. Configure the egressFrom field to set identityType to ANY_IDENTITY.

• 1. Update the perimeter.
  2. Configure the ingressFrom field to set identityType to ANY_IDENTITY.
  3. Configure the ingressTo field to include the external Google Cloud project number as an allowed resource and the serviceName to compute.googleapis.com.

• 1. Update the perimeter.
  2. Configure the egressTo field to set identityType to ANY_IDENTITY.
  3. Configure the egressFrom field to include the external Google Cloud project number as an allowed resource and the serviceName to compute.googleapis.com.

Your company is storing sensitive data in Cloud Storage. You want a key generated on-premises to be used in the encryption process.
What should you do?

• Use the Cloud Key Management Service to manage a data encryption key (DEK).

• Use the Cloud Key Management Service to manage a key encryption key (KEK).

• Use customer-supplied encryption keys to manage the data encryption key (DEK).

• Use customer-supplied encryption keys to manage the key encryption key (KEK).

A customer wants to deploy a large number of 3-tier web applications on Compute Engine.
How should the customer ensure authenticated network separation between the different tiers of the application?

• Run each tier in its own Project, and segregate using Project labels.

• Run each tier with a different Service Account (SA), and use SA-based firewall rules.

• Run each tier in its own subnet, and use subnet-based firewall rules.

• Run each tier with its own VM tags, and use tag-based firewall rules.

An organization adopts Google Cloud Platform (GCP) for application hosting services and needs guidance on setting up password requirements for their Cloud
Identity account. The organization has a password policy requirement that corporate employee passwords must have a minimum number of characters.
Which Cloud Identity password guidelines can the organization use to inform their new requirements?

• Set the minimum length for passwords to be 8 characters.

• Set the minimum length for passwords to be 10 characters.

• Set the minimum length for passwords to be 12 characters.

• Set the minimum length for passwords to be 6 characters.

You are implementing data protection by design and in accordance with GDPR requirements. As part of design reviews, you are told that you need to manage the encryption key for a solution that includes workloads for Compute Engine, Google Kubernetes Engine, Cloud Storage, BigQuery, and Pub/Sub. Which option should you choose for this implementation?

• Cloud External Key Manager

• Customer-managed encryption keys

• Customer-supplied encryption keys

• Google default encryption

You are deploying a web application hosted on Compute Engine. A business requirement mandates that application logs are preserved for 12 years and data is kept within European boundaries. You want to implement a storage solution that minimizes overhead and is cost-effective. What should you do?

• Create a Cloud Storage bucket to store your logs in the EUROPE-WEST1 region. Modify your application code to ship logs directly to your bucket for increased efficiency.

• Configure your Compute Engine instances to use the Google Cloud's operations suite Cloud Logging agent to send application logs to a custom log bucket in the EUROPE-WEST1 region with a custom retention of 12 years.

• Use a Pub/Sub topic to forward your application logs to a Cloud Storage bucket in the EUROPE-WEST1 region.

• Configure a custom retention policy of 12 years on your Google Cloud's operations suite log bucket in the EUROPE-WEST1 region.