Google Cloud Professional Cloud Security Engineer (Part 5)

Your organization must comply with the regulation to keep instance logging data within Europe. Your workloads will be hosted in the Netherlands in region europe-west4 in a new project. You must configure Cloud Logging to keep your data in the country.

What should you do?

• • A. Configure the organization policy constraint gcp.resourceLocations to europe-west4.

• • B. Configure log sink to export all logs into a Cloud Storage bucket in europe-west4.

• C. Create a new log bucket in europe-west4, and redirect the _Default bucket to the new bucket.

• • D. Set the logging storage region to europe-west4 by using the gcloud CLI logging settings update.

You are using Security Command Center (SCC) to protect your workloads and receive alerts for suspected security breaches at your company. You need to detect cryptocurrency mining software.

Which SCC service should you use?

• A. Virtual Machine Threat Detection

• • B. Container Threat Detection

• • C. Rapid Vulnerability Detection

• • D. Web Security Scanner

You are running applications outside Google Cloud that need access to Google Cloud resources. You are using workload identity federation to grant external identities Identity and Access Management (IAM) roles to eliminate the maintenance and security burden associated with service account keys. You must protect against attempts to spoof another user's identity and gain unauthorized access to Google Cloud resources.

What should you do? (Choose two.)

• • A. Enable data access logs for IAM APIs.

• • B. Limit the number of external identities that can impersonate a service account.

• C. Use a dedicated project to manage workload identity pools and providers.

• D. Use immutable attributes in attribute mappings

• • E. Limit the resources that a service account can access.

You manage a BigQuery analytical data warehouse in your organization. You want to keep data for all your customers in a common table while you also restrict query access based on rows and columns permissions. Non-query operations should not be supported.

What should you do? (Choose two.)

• • A. Create row-level access policies to restrict the result data when you run queries with the filter expression set to TRUE.

• • B. Configure column-level encryption by using Authenticated Encryption with Associated Data (AEAD) functions with Cloud Key Management Service (KMS) to control access to columns at query runtime.

• C. Create row-level access policies to restrict the result data when you run queries with the filter expression set to FALSE.

• • D. Configure dynamic data masking rules to control access to columns at query runtime.

• E. Create column-level policy tags to control access to columns at query runtime.

Your DevOps team uses Packer to build Compute Engine images by using this process:

1. Create an ephemeral Compute Engine VM.
2. Copy a binary from a Cloud Storage bucket to the VM's file system.
3. Update the VM's package manager.
4. Install external packages from the internet onto the VM.

Your security team just enabled the organizational policy, constraints/ compute.vmExternalIpAccess, to restrict the usage of public IP Addresses on VMs. In response, your DevOps team updated their scripts to remove public IP addresses on the Compute Engine VMs; however, the build pipeline is failing due to connectivity issues.

What should you do? (Choose two.)

• • A. Provision an HTTP load balancer with the VM in an unmanaged instance group to allow inbound connections from the internet to your VM.

• B. Provision a Cloud NAT instance in the same VPC and region as the Compute Engine VM.

• C. Enable Private Google Access on the subnet that the Compute Engine VM is deployed within.

• • D. Update the VPC routes to allow traffic to and from the internet.

• • E. Provision a Cloud VPN tunnel in the same VPC and region as the Compute Engine VM.

Your organization recently activated the Security Command Center (SCC) standard tier. There are a few Cloud Storage buckets that were accidentally made accessible to the public. You need to investigate the impact of the incident and remediate it.

What should you do?

• • A. 1. Remove the Identity and Access Management (IAM) granting access to all Users from the buckets.
    2. Apply the organization policy storage.uniformBucketLevelAccess to prevent regressions.
    3. Query the data access logs to report on unauthorized access.

• B. 1. Change permissions to limit access for authorized users.
  2. Enforce a VPC Service Controls perimeter around all the production projects to immediately stop any unauthorized access.
  3. Review the administrator activity audit logs to report on any unauthorized ac

• C. 1. Change the bucket permissions to limit access.
  2. Query the bucket's usage logs to report on unauthorized access to the data.
  3. Enforce the organization policy storage.publicAccessPrevention to avoid regressions.

• • D. 1. Change bucket permissions to limit access.
    2. Query the data access audit logs for any unauthorized access to the buckets.
    3. After the misconfiguration is corrected, mute the finding in the Security Command Center.

Your organization is transitioning to Google Cloud. You want to ensure that only trusted container images are deployed on Google Kubernetes Engine (GKE) clusters in a project. The containers must be deployed from a centrally managed Container Registry and signed by a trusted authority.

What should you do? (Choose two.)

• • A. Enable Container Threat Detection in the Security Command Center (SCC) for the project.

• B. Configure the trusted image organization policy constraint for the project.

• • C. Create a custom organization policy constraint to enforce Binary Authorization for Google Kubernetes Engine (GKE).

• • D. Enable PodSecurity standards, and set them to Restricted.

• E. Configure the Binary Authorization policy with respective attestations for the project.

Your company uses Google Cloud and has publicly exposed network assets. You want to discover the assets and perform a security audit on these assets by using a software tool in the least amount of time.

What should you do?

• • A. Run a platform security scanner on all instances in the organization.

• B. Identify all external assets by using Cloud Asset Inventory, and then run a network security scanner against them.

• • C. Contact a Google approved security vendor to perform the audit.

• • D. Notify Google about the pending audit, and wait for confirmation before performing the scan.

Your organization wants to be compliant with the General Data Protection Regulation (GDPR) on Google Cloud. You must implement data residency and operational sovereignty in the EU.

What should you do? (Choose two.)

• A. Limit the physical location of a new resource with the Organization Policy Service "resource locations constraint."

• • B. Use Cloud IDS to get east-west and north-south traffic visibility in the EU to monitor intra-VPC and inter-VPC communication.

• C. Limit Google personnel access based on predefined attributes such as their citizenship or geographic location by using Key Access Justifications.

• • D. Use identity federation to limit access to Google Cloud resources from non-EU entities.

• • E. Use VPC Flow Logs to monitor intra-VPC and inter-VPC traffic in the EU.

  Hide Solution  Discussion  10

Your company is moving to Google Cloud. You plan to sync your users first by using Google Cloud Directory Sync (GCDS). Some employees have already created Google Cloud accounts by using their company email addresses that were created outside of GCDS. You must create your users on Cloud Identity.

What should you do?

• • A. Configure GCDS and use GCDS search rules to sync these users.

• B. Use the transfer tool to migrate unmanaged users

• • C. Write a custom script to identify existing Google Cloud users and call the Admin SDK: Directory API to transfer their account.

• • D. Configure GCDS and use GCDS exclusion rules to ensure users are not suspended.