Font size
WorksheetsPSE-2
Total questions: 50
Worksheet time: 27mins
You want to limit the images that can be used as boot disk sources. These images will be kept in a separate project.
What are your options?
Use the Organization Policy Service to create a compute.trustedimageProjects constraint on the organization level. List the trusted project as the whitelist in an allow operation.
Use the Organization Policy Service to create a compute.trustedimageProjects constraint on the organization level. List the trusted projects as the exceptions in a deny operation.
In Resource Manager, edit the project permissions for the trusted project. Add the organization as member with the role: Compute Image User.
In Resource Manager, edit the organization permissions. Add the project ID as member with the role: Compute Image User.
Your team must prevent users from creating new projects within the organization. Only the DevOps team should be allowed to create projects on behalf of the requester. Which two tasks should your team perform to handle this request? (Choose two.)
Remove all users from the Project Creator role at the organizational level.
Create an Organization Policy constraint, and apply it at the organizational level.
Grant the Project Editor role at the organizational level to a designated group of users.
Add a designated group of users to the Project Creator role at the organizational level.
Grant the billing account creator role to the designated DevOps team.
A customer deployed an application on Compute Engine that takes advantage of the elastic nature of cloud computing. How can you work with Infrastructure Operations Engineers to best ensure that Windows Compute Engine VMs are up to date with all the latest OS patches?
Build new base images when patches are available, and use a CI/CD pipeline to rebuild VMs, deploying incrementally.
Federate a Domain Controller into Compute Engine, and roll out weekly patches via Group Policy Object.
Use Deployment Manager to provision updated VMs into new serving Instance Groups (IGs).
Reboot all VMs during the weekly maintenance window and allow the StartUp Script to download the latest patches from the internet.
Your team must ensure that no other instances on the network may access their backend database, which is only accessible by the frontend application. How ought your team to lay out this network?
Create an ingress firewall rule to allow access only from the application to the database using firewall tags.
Create a different subnet for the frontend application and database to ensure network isolation.
Create two VPC networks, and connect the two networks using Cloud VPN gateways to ensure network isolation.
Create two VPC networks, and connect the two networks using VPC peering to ensure network isolation.
Phishing emails are being received by an organisation in greater numbers. Which technique should be applied in this case to safeguard employee credentials?
Multifactor Authentication
A strict password policy
Captcha on login pages
Encrypted emails
A customer is collaborating with another company to build an application on Compute Engine. The customer is building the application tier in their GCP Organization, and the other company is building the storage tier in a different GCP Organization. This is a 3-tier web application. Communication between portions of the application must not traverse the public internet by any means. Which connectivity option should be implemented?
VPC peering
Cloud VPN
Cloud Interconnect
Shared VPC
Your team wants to ensure that no Compute Engine instances in your production project have public IP addresses. Compute Engine instances for frontend applications will require public IP addresses. The Editor role allows product engineers to modify resources. Your team wishes to impose this requirement.
How should your team meet these specifications?
Enable Private Access on the VPC network in the production project.
Remove the Editor role and grant the Compute Admin IAM role to the engineers.
Set up an organization policy to only permit public IPs for the front-end Compute Engine instances.
Set up a VPC network with two subnets: one with public IPs and one without public IPs.
What are the two security characteristics associated with using VPC peering to connect two VPC networks? (Select two.)
Central management of routes, firewalls, and VPNs for peered networks
Non-transitive peered networks; where only directly peered networks can communicate
Ability to peer networks that belong to different Google Cloud organizations
Firewall rules that can be created with a tag from one peered network to another peered network
Ability to share specific subnets across peered networks
A vulnerability patch has been released, and a DevOps team must update their Google Kubernetes Engine running containers (GKE).
How should the DevOps team go about doing this?
Use Puppet or Chef to push out the patch to the running container.
Verify that auto upgrade is enabled; if so, Google will upgrade the nodes in a GKE cluster.
Update the application code or apply a patch, build a new image, and redeploy it.
Configure containers to automatically upgrade when the base image is available in Container Registry.
Wipro is running their webshop on Google Kubernetes Engine and wants to analyze customer transactions in BigQuery. You need to ensure that no credit card numbers are stored in BigQuery What should you do?
Create a BigQuery view with regular expressions matching credit card numbers to query and delete affected rows.
Use the Cloud Data Loss Prevention API to redact related infoTypes before data is ingested into BigQuery.
Leverage Security Command Center to scan for the assets of type Credit Card Number in BigQuery.
Enable Cloud Identity-Aware Proxy to filter out credit card numbers before storing the logs in BigQuery.
A client wants to use Compute Engine to deploy a large number of 3-tier web applications.
How should the customer make sure that the various application layers have their own authenticated networks?
Run each tier in its own Project, and segregate using Project labels.
Run each tier with a different Service Account (SA), and use SA-based firewall rules.
Run each tier in its own subnet, and use subnet-based firewall rules.
Run each tier with its own VM tags, and use tag-based firewall rules.
Your project manager wants to start retaining security event logs for 2 years while minimizing costs. You write a filter to select the appropriate log entries. Where should you export the logs?
BigQuery datasets
Cloud Storage buckets
StackDriver logging
Cloud Pub/Sub topics
For compliance reasons, an organization needs to ensure that in-scope PCI Kubernetes Pods reside on `in-scope` Nodes only. These Nodes can only contain the `in-scope` Pods. How should the organization achieve this objective?
Add a nodeSelector field to the pod configuration to only use the Nodes labeled inscope: true.
Create a node pool with the label inscope: true and a Pod Security Policy that only allows the Pods to run on Nodes with that label.
Place a taint on the Nodes with the label inscope: true and effect NoSchedule and a toleration to match in the Pod configuration.
Run all in-scope Pods in the namespace in-scope-pci
Your company's messaging app will now use GCP computing and network services in an effort to comply with FIPS 140-2.The messaging app architecture includes a Managed Instance Group (MIG) that controls a cluster of Compute Engine instances. The instances use Local SSDs for data caching and UDP for instance-to-instance communications. The app development team is willing to make any changes necessary to comply with the standard Which options should you recommend to meet the requirements?
Encrypt all cache storage and VM-to-VM communication using the BoringCrypto module.
Set Disk Encryption on the Instance Template used by the MIG to customer-managed key and use BoringSSL for all data transit between instances.
Set Disk Encryption on the Instance Template used by the MIG to customer-managed key and use BoringSSL for all data transit between instances.
Set Disk Encryption on the Instance Template used by the MIG to Google-managed Key and use BoringSSL library on all instance-to-instance communications.
A customer has an analytics workload running on Compute Engine that should have limited internet access. Your team created an egress firewall rule to deny (priority 1000) all traffic to the internet. The Compute Engine instances now need to reach out to the public repository to get security updates. What should your team do?
Create an egress firewall rule to allow traffic to the CIDR range of the repository with a priority greater than 1000.
Create an egress firewall rule to allow traffic to the CIDR range of the repository with a priority less than 1000.
Create an egress firewall rule to allow traffic to the hostname of the repository with a priority greater than 1000.
Create an egress firewall rule to allow traffic to the hostname of the repository with a priority less than 1000.
You want data on Compute Engine disks to be encrypted at rest with keys managed by Cloud Key Management Service (KMS). Cloud Identity and Access Management (IAM) permissions to these keys must be managed in a grouped way because the permissions should be the same for all keys. What should you do?
Create a single KeyRing for all persistent disks and all Keys in this KeyRing. Manage the IAM permissions at the Key level.
Create a single KeyRing for all persistent disks and all Keys in this KeyRing. Manage the IAM permissions at the KeyRing level.
Create a KeyRing per persistent disk, with each KeyRing containing a single Key. Manage the IAM permissions at the Key level.
Create a KeyRing per persistent disk, with each KeyRing containing a single Key. Manage the IAM permissions at the KeyRing level.
Hotstar is backing up application logs to a Cloud Storage bucket shared with both analysts and the administrator. Analysts should only have access to logs that do not contain any personally identifiable information (PII). Log files containing PII should be stored in another bucket that is only accessible by the administrator. What should you do?
Use Cloud Pub/Sub and Cloud Functions to trigger a Data Loss Prevention scan every time a file is uploaded to the shared bucket. If the scan detects PII, have the function move into a Cloud Storage bucket only accessible by the administrator.
Upload the logs to both the shared bucket and the bucket only accessible by the administrator. Create a job trigger using the Cloud Data Loss Prevention API. Configure the trigger to delete any files from the shared bucket that contain PII.
On the bucket shared with both the analysts and the administrator, configure Object Lifecycle Management to delete objects that contain any PII.
On the bucket shared with both the analysts and the administrator, configure a Cloud Storage Trigger that is only triggered when PII data is uploaded. Use Cloud Functions to capture the trigger and delete such files.
Twitter fired an engineer and needs to make sure the engineer's Google account is automatically deprovisioned. What should the customer do?
Use the Cloud SDK with their directory service to remove their IAM permissions in Cloud Identity.
Use the Cloud SDK with their directory service to provision and deprovision users from Cloud Identity.
Configure Cloud Directory Sync with their directory service to provision and deprovision users from Cloud Identity.
Configure Cloud Directory Sync with their directory service to remove their IAM permissions in Cloud Identity.
An organization is evaluating the use of Google Cloud Platform (GCP) for certain IT workloads. A well-established directory service is used to manage user identities and lifecycle management. This directory service must continue for the organization to use as the `source of truth` directory for identities. Which solution meets the organization's requirements?
Google Cloud Directory Sync (GCDS)
Cloud Identity
Security Assertion Markup Language (SAML)
Pub/Sub
Which international compliance standard provides guidelines for information security controls applicable to the provision and use of cloud services?
ISO 27001
ISO 27002
ISO 27017
ISO 27018
Your team lead assigned a task to create a new Service Account that should be able to list the Compute Engine instances in the project. You want to follow Google recommended practices. What should you do?
Create an Instance Template, and allow the Service Account Read Only access for the Compute Engine Access Scope.
Create a custom role with the permission compute.instances.list and grant the Service Account this role.
Give the Service Account the role of Compute Viewer, and use the new Service Account for all instances.
Give the Service Account the role of Project Viewer, and use the new Service Account for all instances.
In a shared security responsibility model for IaaS, which two layers of the stack does the customer share responsibility for? (Choose two.)
Hardware
Network Security
Storage Encryption
Access Policies
Boot
An organization is starting to move its infrastructure from its on-premises environment to Google Cloud Platform (GCP). The first step the organization wants to take is to migrate its ongoing data backup and disaster recovery solutions to GCP. The organization's on-premises production environment is going to be the next phase for migration to GCP. Stable networking connectivity between the on-premises environment and GCP is also being implemented. Which GCP solution should the organization use?
BigQuery using a data pipeline job with continuous updates via Cloud VPN
Cloud Storage using a scheduled task and gsutil via Cloud Interconnect
Compute Engines Virtual Machines using Persistent Disk via Cloud Interconnect
Cloud Datastore using regularly scheduled batch upload jobs via Cloud VPN
You are working in a project as Cloud Security Engineer. What are the steps to encrypt data using envelope encryption?
✑ Generate a data encryption key (DEK) locally.
✑ Use a key encryption key (KEK) to wrap the DEK.
✑ Encrypt data with the KEK. ✑ Store the encrypted data and the wrapped KEK.
✑ Generate a key encryption key (KEK) locally.
✑ Use the KEK to generate a data encryption key (DEK).
✑ Encrypt data with the DEK.
✑ Store the encrypted data and the wrapped DEK.
✑ Generate a data encryption key (DEK) locally.
✑ Encrypt data with the DEK.
✑ Use a key encryption key (KEK) to wrap the DEK.
✑ Store the encrypted data and the wrapped DEK.
✑ Generate a key encryption key (KEK) locally.
✑ Generate a data encryption key (DEK) locally.
✑ Encrypt data with the KEK.
✑Store the encrypted data and the wrapped DEK.
The goal of a client is to make it simple for their mobile workforce to access a Google Cloud Platform-hosted CRM web interface (GCP).
Only those with access to the company network can use the CRM. The client wishes to make it accessible online. Your group needs a two-factor authentication layer to be placed in front of the application.
Which GCP product should the client use to fulfil these needs?
Cloud Identity-Aware Proxy
Cloud Armor
Cloud Endpoints
Cloud VPN
Your company is storing sensitive data in Cloud Storage. You want a key generated on-premises to be used in the encryption process. What should you do?
Use the Cloud Key Management Service to manage a data encryption key (DEK).
Use the Cloud Key Management Service to manage a key encryption key (KEK).
Use customer-supplied encryption keys to manage the data encryption key (DEK).
Use customer-supplied encryption keys to manage the key encryption key (KEK).
Last week, a company deployed a new App Engine application that writes logs to BigQuery. No other workloads are running in the project. You need to validate that all data written to BigQuery was done using the App Engine Default Service Account. What should you do?
1. Use Cloud Logging and filter on BigQuery Insert Jobs.
2. Click on the email address in line with the App Engine Default Service Account in the authentication field.
3. Click Hide Matching Entries. 4. Make sure the resulting list is empty.
1. Use Cloud Logging and filter on BigQuery Insert Jobs.
2. Click on the email address in line with the App Engine Default Service Account in the authentication field.
3. Click Show Matching Entries.
4. Make sure the resulting list is empty.
1. In BigQuery, select the related dataset.
2. Make sure that the App Engine Default Service Account is the only account that can write to the dataset.
1. Go to the Identity and Access Management (IAM) section of the project.
2. Validate that the App Engine Default Service Account is the only account that has a role that can write to BigQuery.
Your team wants to limit users with administrative privileges at the organization level. Which two roles should your team restrict? (Choose two.)
Organization Administrator
Super Admin
GKE Cluster Admin
Compute Admin
Organization Role Viewer
An organization's security and risk management teams are concerned about where their responsibility lies for certain production workloads they are running in Google Cloud and where Google's responsibility lies. They are mostly running workloads using Google Cloud's platform-as-a-Service (PaaS) offerings, including App Engine primarily. Which area in the technology stack should they focus on as their primary responsibility when using App Engine?
Configuring and monitoring VPC Flow Logs
Defending against XSS and SQLi attacks
Managing the latest updates and security patches for the Guest OS
Encrypting all stored data
A online application being developed by an engineering team will soon go live. The web application is hosted in multiple GCP regions and will be directed to the respective backend based on the URL request. Your team wants to avoid exposing the application directly on the internet and wants to deny traffic from a specific list of malicious IP addresses. Which solution should your team implement to meet these requirements?
Cloud Armor
Network Load Balancing
SSL Proxy Load Balancing
NAT Gateway
A customer is running an analytics workload on Google Cloud Platform (GCP) where Compute Engine instances are accessing data stored on Cloud Storage. Your team wants to make sure that this workload will not be able to access, or be accessed from, the internet. Which two strategies should your team use to meet these requirements? (Choose two.)
Configure Private Google Access on the Compute Engine subnet
Avoid assigning public IP addresses to the Compute Engine cluster.
Make sure that the Compute Engine cluster is running on a separate subnet.
Turn off IP forwarding on the Compute Engine instances in the cluster.
Configure a Cloud NAT gateway.
A customer wishes to run a batch processing system on virtual machines and save the output files to a Cloud Storage bucket. The networking and security teams have decided that no VMs will be able to connect to the public internet.
How should this be accomplished?
Create a firewall rule to block internet traffic from the VM.
Provision a NAT Gateway to access the Cloud Storage API endpoint.
Enable Private Google Access.
Mount a Cloud Storage bucket as a local filesystem on every VM.
As adoption of the Cloud Data Loss Prevention (Cloud DLP) API grows within your company, you need to optimize usage to reduce cost. Cloud DLP target data is stored in Cloud Storage and BigQuery. The location and region are identified as a suffix in the resource name. Which cost reduction options should you recommend?Set appropriate rowsLimit value on BigQuery data hosted outside the US and set appropriate bytesLimitPerFile value on multiregional Cloud Storage buckets.
Set appropriate rowsLimit value on BigQuery data hosted outside the US and set appropriate bytesLimitPerFile value on multiregional Cloud Storage buckets.
Set appropriate rowsLimit value on BigQuery data hosted outside the US, and minimize transformation units on multiregional Cloud Storage buckets.
Use rowsLimit and bytesLimitPerFile to sample data and use CloudStorageRegexFileSet to limit scans.
Use FindingLimits and TimespanContfig to sample data and minimize transformation units.
Your team uses a service account to authenticate data transfers from a given Compute Engine virtual machine instance of to a specified Cloud Storage bucket. An engineer accidentally deletes the service account, which breaks application functionality. You want to recover the application as quickly as possible without compromising security. What should you do?
Temporarily disable authentication on the Cloud Storage bucket.
Use the undelete command to recover the deleted service account.
Create a new service account with the same name as the deleted service account.
Update the permissions of another existing service account and supply those credentials to the applications.
You are the Security Admin in your organization. You want to synchronise in Cloud IAM all security groups that have an email address from your LDAP directory.
What are your options?
Configure Google Cloud Directory Sync to sync security groups using LDAP search rules that have user email addressג as the attribute to facilitate one-way sync.
Configure Google Cloud Directory Sync to sync security groups using LDAP search rules that have ג€user email addressג €as the attribute to facilitate bidirectional sync.
Use a management tool to sync the subset based on the email address attribute. Create a group in the Google domain. A group created in a Google domain will automatically have an explicit Google Cloud Identity and Access Management (IAM) role.
Use a management tool to sync the subset based on group object class attribute. Create a group in the Google domain. A group created in a Google domain will automatically have an explicit Google Cloud Identity and Access Management (IAM) role.
You are part of a security team investigating a compromised service account key. You need to audit which new resources were created by the service account. What should you do?
Query Data Access logs.
Query Admin Activity logs.
Query Access Transparency logs.
Query Stackdriver Monitoring Workspace.
You have an application where the frontend is deployed on a managed instance group in subnet A and the data layer is stored on a mysql Compute Engine virtual machine (VM) in subnet B on the same VPC. Subnet A and Subnet B hold several other Compute Engine VMs. You only want to allow the application frontend to access the data in the application's mysql instance on port 3306. What should you do?
Configure an ingress firewall rule that allows communication from the src IP range of subnet A to the tag "data-tag" that is applied to the mysql Compute Engine VM on port 3306.
Configure an ingress firewall rule that allows communication from the frontend's unique service account to the unique service account of the mysql Compute Engine VM on port 3306.
Configure a network tag "fe-tag" to be applied to all instances in subnet A and a network tag "data-tag" to be applied to all instances in subnet B. Then configure an egress firewall rule that allows communication from Compute Engine VMs tagged with data-tag to destination Compute Engine VMs tagged fe- tag.
Configure a network tag "fe-tag" to be applied to all instances in subnet A and a network tag "data-tag" to be applied to all instances in subnet B. Then configure an ingress firewall rule that allows communication from Compute Engine VMs tagged with fe-tag to destination Compute Engine VMs tagged with data-tag.
Your company operates an application instance group that is currently deployed behind a Google Cloud load balancer in us-central-1 and is configured to use the Standard Tier network. The infrastructure team wants to expand to a second Google Cloud region, us-east-2. You need to set up a single external IP address to distribute new requests to the instance groups in both regions. What should you do?
Change the load balancer backend configuration to use network endpoint groups instead of instance groups.
Change the load balancer frontend configuration to use the Premium Tier network, and add the new instance group.
Create a new load balancer in us-east-2 using the Standard Tier network, and assign a static external IP address.
Create a Cloud VPN connection between the two regions, and enable Google Private Access.
Your company's security administrator is you. Your Cloud Storage bucket has 3,000 objects. You shouldn't control who has access to each object separately.
Additionally, you do not want the person who uploaded an object to constantly be in complete control of it. To administer, however, you want to use Cloud Audit Logs.
to your bucket, please.
What ought you to do?
Set up an ACL with OWNER permission to a scope of allUsers.
Set up an ACL with READER permission to a scope of allUsers.
Set up a default bucket ACL and manage access for users using IAM.
Set up Uniform bucket-level access on the Cloud Storage bucket and manage access for users using IAM.
In Wipro you are the security admin. Your development team creates multiple GCP projects under the "implementation" folder for several dev, staging, and production workloads. You want to prevent data exfiltration by malicious insiders or compromised code by setting up a security perimeter. However, you do not want to restrict communication between the projects. What should you do?
Use a Shared VPC to enable communication between all projects, and use firewall rules to prevent data exfiltration.
Create access levels in Access Context Manager to prevent data exfiltration, and use a shared VPC for communication between projects.
Use an infrastructure-as-code software tool to set up a single service perimeter and to deploy a Cloud Function that monitors the "implementation" folder via Stackdriver and Cloud Pub/Sub. When the function notices that a new project is added to the folder, it executes Terraform to add the new project to the associated perimeter.
Use an infrastructure-as-code software tool to set up three different service perimeters for dev, staging, and prod and to deploy a Cloud Function that monitors the "implementation" folder via Stackdriver and Cloud Pub/Sub. When the function notices that a new project is added to the folder, it executes Terraform to add the new project to the respective perimeter.
You need to provide a corporate user account in Google Cloud for each of your developers and operational staff who need direct access to GCP resources. Corporate policy requires you to maintain the user identity in a third-party identity management provider and leverage single sign-on. You learn that a significant number of users are using their corporate domain email addresses for personal Google accounts, and you need to follow Google recommended practices to convert existing unmanaged users to managed accounts. Which two actions should you take? (Choose two.
Use Google Cloud Directory Sync to synchronize your local identity management system to Cloud Identity.
Use the Google Admin console to view which managed users are using a personal account for their recovery email.
Add users to your managed Google account and force users to change the email addresses associated with their personal accounts.
Use the Transfer Tool for Unmanaged Users (TTUU) to find users with conflicting accounts and ask them to transfer their personal Google accounts.
Send an email to all of your employees and ask those users with corporate email addresses for personal Google accounts to delete the personal accounts immediately.
You work on the development team for your company. You noticed that your web application hosted in staging on GKE dynamically includes user data in web pages without first properly validating the inputted data. This could allow an attacker to execute gibberish commands and display arbitrary content in a victim user's browser in a production environment. How should you prevent and fix this vulnerability?
Use Cloud IAP based on IP address or end-user device attributes to prevent and fix the vulnerability.
Set up an HTTPS load balancer, and then use Cloud Armor for the production environment to prevent the potential XSS attack.
Use Web Security Scanner to validate the usage of an outdated library in the code, and then use a secured version of the included library.
Use Web Security Scanner in staging to simulate an XSS injection attack, and then use a templating system that supports contextual autoescapin
You are part of a Wipro security team that wants to ensure that a Cloud Storage bucket in Project A can only be readable from Project B. You also want to ensure that data in the Cloud Storage bucket cannot be accessed from or copied to Cloud Storage buckets outside the network, even if the user has the correct credentials. What should you do?
Enable VPC Service Controls, create a perimeter with Project A and B, and include Cloud Storage service.
Enable Domain Restricted Sharing Organization Policy and Bucket Policy Only on the Cloud Storage bucket.
Enable Private Access in Project A and B networks with strict firewall rules to allow communication between the networks.
Enable VPC Peering between Project A and B networks with strict firewall rules to allow communication between the networks.
Protecting highly sensitive data in BigQuery is your responsibility.
Your operations teams need access to this data, but given privacy regulations, you want to ensure that they cannot read the sensitive fields such as email addresses and first names. These specific sensitive fields should only be available on a need-to- know basis to the Human Resources team. What should you do?
Perform data masking with the Cloud Data Loss Prevention API, and store that data in BigQuery for later use.
Perform data redaction with the Cloud Data Loss Prevention API, and store that data in BigQuery for later use.
Perform data inspection with the Cloud Data Loss Prevention API, and store that data in BigQuery for later use.
Perform tokenization for Pseudonymization with the Cloud Data Loss Prevention API, and store that data in BigQuery for later use.
You work for Wipro as a Security Administrator. Within production environments, you must restrict the ability to create service accounts. This is something you desire to do corporately. What ought you to do?
Use Identity and Access Management (IAM) to restrict access of all users and service accounts that have access to the production environment.
Use organization policy constraints/iam.disableServiceAccountKeyCreation boolean to disable the creation of new service accounts.
Use organization policy constraints/iam.disableServiceAccountKeyUpload boolean to disable the creation of new service accounts.
Use organization policy constraints/iam.disableServiceAccountCreation boolean to disable the creation of new service accounts.
As an Identity and Access Management (IAM) administrator, you are the project owner for a regulated workload that operates in a project you control and oversee. You must present information supporting access reviews for a forthcoming audit. What tool should you use?
Policy Troubleshooter
Policy Analyzer
IAM Recommender
Policy Simulator
Your company has set up SAML federation and synchronisation between Microsoft Active Directory and Cloud Identity. You wish to lessen the chance that user accounts for Google Cloud will be compromised. What ought you to do?
Create a Cloud Identity password policy with strong password settings, and configure 2-Step Verification with security keys in the Google Admin console.
Create a Cloud Identity password policy with strong password settings, and configure 2-Step Verification with verification codes via text or phone call in the Google Admin console.
Create an Active Directory domain password policy with strong password settings, and configure post-SSO (single sign-on) 2-Step Verification with security keys in the Google Admin console.
Create an Active Directory domain password policy with strong password settings, and configure post-SSO (single sign-on) 2-Step Verification with verification codes via text or phone call in the Google Admin console.
For a Google Cloud public application, you are responsible for enabling external web application protection against common web application attacks.
Before these policy changes are put into effect, you want to confirm them. Which service ought you to employ?
Google Cloud Armor's preconfigured rules in preview mode
Prepopulated VPC firewall rules in monitor mode
The inherent protections of Google Front End (GFE)
Cloud Load Balancing firewall rules
You are asked to recommend a solution to store and retrieve sensitive configuration data from an application that runs on Compute Engine. Which option should you recommend?
Cloud Key Management Service
Compute Engine guest attributes
Compute Engine custom metadata
Secret Manager
You need to implement an encryption at-rest strategy that reduces key management complexity for non-sensitive data and protects sensitive data while providing the flexibility of controlling the key residency and rotation schedule. FIPS 140-2 L1 compliance is required for all data types. What should you do?
Encrypt non-sensitive data and sensitive data with Cloud External Key Manager.
Encrypt non-sensitive data and sensitive data with Cloud Key Management Service
Encrypt non-sensitive data with Google default encryption, and encrypt sensitive data with Cloud External Key Manager.
Encrypt non-sensitive data with Google default encryption, and encrypt sensitive data with Cloud Key Management Service.
