Font size
WorksheetsPSE-4
Total questions: 27
Worksheet time: 15mins
Your privacy team uses crypto-shredding (deleting encryption keys) as a strategy to delete personally identifiable information (PII). You need to implement this practice on Google Cloud while still utilizing the majority of the platform's services and minimizing operational overhead. What should you do?
Use client-side encryption before sending data to Google Cloud, and delete encryption keys on-premises.
Use Cloud External Key Manager to delete specific encryption keys.
Use customer-managed encryption keys to delete specific encryption keys.
Use Google default encryption to delete specific encryption keys.
For production projects, you must centralise your team's logs. You want your team to be able to use Logs Explorer to search and analyse logs.
What are your options?
Enable Cloud Monitoring workspace, and add the production projects to be monitored.
Use Logs Explorer at the organization level and filter for production project logs.
Create an aggregate org sink at the parent folder of the production projects, and set the destination to a Cloud Storage bucket.
Create an aggregate org sink at the parent folder of the production projects, and set the destination to a logs bucket.
You need to use Cloud External Key Manager to create an encryption key to encrypt specific BigQuery data at rest in Google Cloud. Which steps should you do first?
1. Create or use an existing key with a unique uniform resource identifier (URI) in your Google Cloud project. 2. Grant your Google Cloud project access to a supported external key management partner system.
1. Create or use an existing key with a unique uniform resource identifier (URI) in Cloud Key Management Service (Cloud KMS). 2. In Cloud KMS, grant your Google Cloud project access to use the key.
1. Create or use an existing key with a unique uniform resource identifier (URI) in a supported external key management partner system. 2. In the external key management partner system, grant access for this key to use your Google Cloud project.
1. Create an external key with a unique uniform resource identifier (URI) in Cloud Key Management Service (Cloud KMS). 2. In Cloud KMS, grant your Google Cloud project access to use the key.
Your company's cloud security policy dictates that VM instances should not have an external IP address. You need to identify the Google Cloud service that will allow VM instances without external IP addresses to connect to the internet to update the VMs. Which service should you use?
Identity Aware-Proxy
Cloud NAT
TCP/UDP Load Balancing
Cloud DNS
You want to make sure that your organization's Cloud Storage buckets cannot have data publicly available to the internet. You want to enforce this across all Cloud Storage buckets. What should you do?
Remove Owner roles from end users, and configure Cloud Data Loss Prevention.
Remove Owner roles from end users, and enforce domain restricted sharing in an organization policy.
Configure uniform bucket-level access, and enforce domain restricted sharing in an organization policy.
Remove *.setIamPolicy permissions from all roles, and enforce domain restricted sharing in an organization policy.
Your company intends to migrate the majority of its IT infrastructure to Google Cloud. They want to leverage their existing on-premises Active Directory as an identity provider for Google Cloud. Which two steps should you take to integrate the company's on-premises Active Directory with Google Cloud and configure access management? (Choose two.)
Use Identity Platform to provision users and groups to Google Cloud.
Use Cloud Identity SAML integration to provision users and groups to Google Cloud.
Install Google Cloud Directory Sync and connect it to Active Directory and Cloud Identity.
Create Identity and Access Management (IAM) roles with permissions corresponding to each Active Directory group.
Create Identity and Access Management (IAM) groups with permissions corresponding to each Active Directory group.
You are in charge of creating a new Google Cloud organization for your company. Which two actions should you take when creating the super administrator accounts? (Choose two.)
Create an access level in the Google Admin console to prevent super admin from logging in to Google Cloud.
Disable any Identity and Access Management (IAM) roles for super admin at the organization level in the Google Cloud Console.
Use a physical token to secure the super admin credentials with multi-factor authentication (MFA).
Use a private connection to create the super admin accounts to avoid sending your credentials over the Internet.
Provide non-privileged identities to the super admin users for their day-to-day activities.
You are deploying a web application hosted on Compute Engine. A business requirement mandates that application logs are preserved for 12 years and data is kept within European boundaries. You want to implement a storage solution that minimizes overhead and is cost-effective. What should you do?
Create a Cloud Storage bucket to store your logs in the EUROPE-WEST1 region. Modify your application code to ship logs directly to your bucket for increased efficiency.
Configure your Compute Engine instances to use the Google Cloud's operations suite Cloud Logging agent to send application logs to a custom log bucket in the EUROPE-WEST1 region with a custom retention of 12 years.
Use a Pub/Sub topic to forward your application logs to a Cloud Storage bucket in the EUROPE-WEST1 region.
Configure a custom retention policy of 12 years on your Google Cloud's operations suite log bucket in the EUROPE-WEST1 region.
You discovered that sensitive personally identifiable information (PII) is being ingested to your Google Cloud environment in the daily ETL process from an on- premises environment to your BigQuery datasets. You need to redact this data to obfuscate the PII, but need to re-identify it for data analytics purposes. Which components should you use in your solution? (Choose two.)
Secret Manager
Cloud Key Management Service
Cloud Data Loss Prevention with cryptographic hashing
Cloud Data Loss Prevention with automatic text redaction
Cloud Data Loss Prevention with deterministic encryption using AES-SIV
You are working with a client that is concerned about control of their encryption keys for sensitive data. The client does not want to store encryption keys at rest in the same cloud service provider (CSP) as the data that the keys are encrypting. Which Google Cloud encryption solutions should you recommend to this client? (Choose two.)
Customer-supplied encryption keys.
Google default encryption
Secret Manager
Cloud External Key Manager
Customer-managed encryption keys
You are implementing data protection by design and in accordance with GDPR requirements. As part of design reviews, you are told that you need to manage the encryption key for a solution that includes workloads for Compute Engine, Google Kubernetes Engine, Cloud Storage, BigQuery, and Pub/Sub. Which option should you choose for this implementation?
Cloud External Key Manager
Customer-managed encryption keys
Customer-supplied encryption keys
Google default encryption
Which Identity-Aware Proxy role should you grant to an Identity and Access Management (IAM) user to access HTTPS resources?
Security Reviewer
IAP-Secured Tunnel User
IAP-Secured Web App User
Service Broker Operator
You need to audit the network segmentation for your Google Cloud footprint. You currently operate Production and Non-Production infrastructure as-a-service (IaaS) environments. All your VM instances are deployed without any service account customization. After observing the traffic in your custom network, you notice that all instances can communicate freely `" despite tag-based VPC firewall rules in place to segment traffic properly `" with a priority of 1000. What are the most likely reasons for this behavior?
All VM instances are missing the respective network tags.
All VM instances are residing in the same network subnet.
All VM instances are configured with the same network route.
A VPC firewall rule is allowing traffic between source/targets based on the same service account with priority 999. E . A VPC firewall rule is allowing traffic between source/targets based on the same service account with priority 1001.
You are creating a new infrastructure CI/CD pipeline to deploy hundreds of ephemeral projects in your Google Cloud organization to enable your users to interact with Google Cloud. You want to restrict the use of the default networks in your organization while following Google recommended best practices. What should you do?
Enable the constraints/compute.skipDefaultNetworkCreation organization policy constraint at the organization level.
Create a cron job to trigger a daily Cloud Function to automatically delete all default networks for each project.
Grant your users the IAM Owner role at the organization level. Create a VPC Service Controls perimeter around the project that restricts the compute.googleapis.com API.
Only allow your users to use your CI/CD pipeline with a predefined set of infrastructure templates they can deploy to skip the creation of the default networks.
You are a security administrator at your company and are responsible for managing access controls (identification, authentication, and authorization) on Google Cloud. Which Google-recommended best practices should you follow when configuring authentication and authorization? (Choose two.)
Use Google default encryption.
Manually add users to Google Cloud.
Provision users with basic roles using Google's Identity and Access Management (IAM) service.
Use SSO/SAML integration with Cloud Identity for user authentication and user lifecycle management.
Provide granular access with predefined roles.
You have been tasked with inspecting IP packet data for invalid or malicious content. What should you do?
Use Packet Mirroring to mirror traffic to and from particular VM instances. Perform inspection using security software that analyzes the mirrored traffic.
Enable VPC Flow Logs for all subnets in the VPC. Perform inspection on the Flow Logs data using Cloud Logging.
Configure the Fluentd agent on each VM Instance within the VPC. Perform inspection on the log data using Cloud Logging.
Configure Google Cloud Armor access logs to perform inspection on the log data.
You have the following resource hierarchy. There is an organization policy at each node in the hierarchy as shown. Which load balancer types are denied in VPC
All load balancer types are denied in accordance with the global node's policy.
INTERNAL_TCP_UDP, INTERNAL_HTTP_HTTPS is denied in accordance with the folder's policy.
EXTERNAL_TCP_PROXY, EXTERNAL_SSL_PROXY are denied in accordance with the project's policy.
EXTERNAL_TCP_PROXY, EXTERNAL_SSL_PROXY, INTERNAL_TCP_UDP, and INTERNAL_HTTP_HTTPS are denied in accordance with the folder and project's policies.
Your security team wants to implement a defense-in-depth approach to protect sensitive data stored in a Cloud Storage bucket. Your team has the following requirements:
✑ The Cloud Storage bucket in Project A can only be readable from Project B.
✑ The Cloud Storage bucket in Project A cannot be accessed from outside the network.
✑ Data in the Cloud Storage bucket cannot be copied to an external Cloud Storage bucket. What should the security team do?
Enable domain restricted sharing in an organization policy, and enable uniform bucket-level access on the Cloud Storage bucket.
Enable VPC Service Controls, create a perimeter around Projects A and B, and include the Cloud Storage API in the Service Perimeter configuration.
Enable Private Access in both Project A and B's networks with strict firewall rules that allow communication between the networks.
Enable VPC Peering between Project A and B's networks with strict firewall rules that allow communication between the networks.
You need to create a VPC that enables your security team to control network resources such as firewall rules. How should you configure the network to allow for separation of duties for network resources?
Set up multiple VPC networks, and set up multi-NIC virtual appliances to connect the networks.
Set up VPC Network Peering, and allow developers to peer their network with a Shared VPC.
Set up a VPC in a project. Assign the Compute Network Admin role to the security team, and assign the Compute Admin role to the developers.
Set up a Shared VPC where the security team manages the firewall rules, and share the network with developers via service projects.
You are onboarding new users into Cloud Identity and discover that some users have created consumer user accounts using the corporate domain name. How should you manage these consumer user accounts with Cloud Identity?
Use Google Cloud Directory Sync to convert the unmanaged user accounts.
Create a new managed user account for each consumer user account.
Use the transfer tool for unmanaged user accounts.
Configure single sign-on using a customer's third-party provider.
You have created an OS image that is hardened per your organization's security standards and is being stored in a project managed by the security team. As a Google Cloud administrator, you need to make sure all VMs in your Google Cloud organization can only use that specific OS image while minimizing operational overhead. What should you do? (Choose two.)
Grant users the compute.imageUser role in their own projects.
Grant users the compute.imageUser role in the OS image project.
Store the image in every project that is spun up in your organization.
Set up an image access organization policy constraint, and list the security team managed project in the project's allow list.
Remove VM instance creation permission from users of the projects, and only allow you and your team to create VM instances.
You're developing the incident response plan for your company. You need to define the access strategy that your DevOps team will use when reviewing and investigating a deployment issue in your Google Cloud environment. There are two main requirements:
✑ Least-privilege access must be enforced at all times.
✑ The DevOps team must be able to access the required resources only during the deployment issue. How should you grant access while following Google-recommended best practices?
Assign the Project Viewer Identity and Access Management (IAM) role to the DevOps team.
Create a custom IAM role with limited list/view permissions, and assign it to the DevOps team.
Create a service account, and grant it the Project Owner IAM role. Give the Service Account User Role on this service account to the DevOps team.
Create a service account, and grant it limited list/view permissions. Give the Service Account User Role on this service account to the DevOps team.
You are working with a client who plans to migrate their data to Google Cloud. You are responsible for recommending an encryption service to manage their encrypted keys. You have the following requirements:
✑ The master key must be rotated at least once every 45 days.
✑ The solution that stores the master key must be FIPS 140-2 Level 3 validated. ✑ The master key must be stored in multiple regions within the US for redundancy.
Which solution meets these requirements?
Customer-managed encryption keys with Cloud Key Management Service
Customer-managed encryption keys with Cloud HSM
Customer-supplied encryption keys
Google-managed encryption keys
You manage your organization's Security Operations Center (SOC). You currently monitor and detect network traffic anomalies in your VPCs based on network logs. However, you want to explore your environment using network payloads and headers. Which Google Cloud product should you use?
Cloud IDS
VPC Service Controls logs
VPC Flow Logs
Google Cloud Armor
Packet Mirroring
You are consulting with a client that requires end-to-end encryption of application data (including data in transit, data in use, and data at rest) within Google Cloud. Which options should you utilize to accomplish this? (Choose two.)
External Key Manager
Customer-supplied encryption keys
Hardware Security Module
Confidential Computing and Istio
Client-side encryption
You need to enforce a security policy in your Google Cloud organization that prevents users from exposing objects in their buckets externally. There are currently no buckets in your organization. Which solution should you implement proactively to achieve this goal with the least operational overhead?
Create an hourly cron job to run a Cloud Function that finds public buckets and makes them private.
Enable the constraints/storage.publicAccessPrevention constraint at the organization level.
Enable the constraints/storage.uniformBucketLevelAccess constraint at the organization level.
Create a VPC Service Controls perimeter that protects the storage.googleapis.com service in your projects that contains buckets. Add any new project that contains a bucket to the perimeter.
Your company requires the security and network engineering teams to identify all network anomalies and be able to capture payloads within VPCs. Which method should you use?
Define an organization policy constraint.
Configure packet mirroring policies.
Enable VPC Flow Logs on the subnet.
Monitor and analyze Cloud Audit Logs.
