Font size
WorksheetsGoogle Professional Security Engineer
Total questions: 105
Worksheet time: 57mins
Your company runs a website that will store PII on Google Cloud Platform. To comply with data privacy regulations, this data can only be stored for a specific amount of time and must be fully deleted after this specific period. Data that has not yet reached the time period should not be deleted. You want to automate the process of complying with this regulation.
What should you do?
Store the data in a single Persistent Disk, and delete the disk at expiration time
Store the data in a single BigQuery table and set the appropriate table expiration time.
Store the data in a single Cloud Storage bucket and configure the bucket's Time to Live.
Store the data in a single BigTable table and set an expiration time on the column families.
For compliance reasons, an organization needs to ensure that in-scope PCI Kubernetes Pods reside on `in-scope` Nodes only. These Nodes can only contain the
`in-scope` Pods.
How should the organization achieve this objective?
Add a nodeSelector field to the pod configuration to only use the Nodes labeled inscope: true.
Create a node pool with the label inscope: true and a Pod Security Policy that only allows the Pods to run on Nodes with that label.
Place a taint on the Nodes with the label inscope: true and effect NoSchedule and a toleration to match in the Pod configuration.
Run all in-scope Pods in the namespace ג€in-scope-pciג€.
A company has redundant mail servers in different Google Cloud Platform regions and wants to route customers to the nearest mail server based on location.
How should the company accomplish this?
Configure TCP Proxy Load Balancing as a global load balancing service listening on port 995.
Create a Network Load Balancer to listen on TCP port 995 with a forwarding rule to forward traffic based on location.
Use Cross-Region Load Balancing with an HTTP(S) load balancer to route traffic to the nearest region.
Use Cloud CDN to route the mail traffic to the closest origin mail server based on client IP address.
You control network traffic for a folder in your Google Cloud environment. Your folder includes multiple projects and Virtual Private Cloud (VPC) networks. You want to enforce on the folder level that egress connections are limited only to IP range 10.58.5.0/24 and only from the VPC network “dev-vpc”. You want to minimize implementation and maintenance effort.
What should you do?
1. Leave the network configuration of the VMs in scope unchanged.
2. Create a new project including a new VPC network “new-vpc”.
3. Deploy a network appliance in “new-vpc” to filter access requests and only allow egress connections from “dev-vpc” to 10.58.5.0/24.
1. Leave the network configuration of the VMs in scope unchanged.
2. Enable Cloud NAT for “dev-vpc” and restrict the target range in Cloud NAT to 10.58.5.0/24.
1. Attach external IP addresses to the VMs in scope.
2. Define and apply a hierarchical firewall policy on folder level to deny all egress connections and to allow egress to IP range 10.58.5.0/24 from network dev-vpc.
1. Attach external IP addresses to the VMs in scope.
2. Configure a VPC Firewall rule in “dev-vpc” that allows egress connectivity to IP range 10.58.5.0/24 for all source addresses in this network.
You have stored company approved compute images in a single Google Cloud project that is used as an image repository. This project is protected with VPC Service Controls and exists in the perimeter along with other projects in your organization. This lets other projects deploy images from the image repository project. A team requires deploying a third-party disk image that is stored in an external Google Cloud organization. You need to grant read access to the disk image so that it can be deployed into the perimeter.
What should you do?
Allow the external project by using the organizational policy, constraints/compute.trustedImageProjects.
1. Update the perimeter.
2. Configure the egressTo field to include the external Google Cloud project number as an allowed resource and the serviceName to compute.googleapis.com.
3. Configure the egressFrom field to set identityType to ANY_IDENTITY.
1. Update the perimeter.
2. Configure the ingressFrom field to set identityType to ANY_IDENTITY.
3. Configure the ingressTo field to include the external Google Cloud project number as an allowed resource and the serviceName to compute.googleapis.com.
1. Update the perimeter.
2. Configure the egressTo field to set identityType to ANY_IDENTITY.
3. Configure the egressFrom field to include the external Google Cloud project number as an allowed resource and the serviceName to compute.googleapis.com.
Your company is storing sensitive data in Cloud Storage. You want a key generated on-premises to be used in the encryption process.
What should you do?
Use the Cloud Key Management Service to manage a data encryption key (DEK).
Use the Cloud Key Management Service to manage a key encryption key (KEK).
Use customer-supplied encryption keys to manage the data encryption key (DEK).
Use customer-supplied encryption keys to manage the key encryption key (KEK).
A customer wants to deploy a large number of 3-tier web applications on Compute Engine.
How should the customer ensure authenticated network separation between the different tiers of the application?
Run each tier in its own Project, and segregate using Project labels.
Run each tier with a different Service Account (SA), and use SA-based firewall rules.
Run each tier in its own subnet, and use subnet-based firewall rules.
Run each tier with its own VM tags, and use tag-based firewall rules.
An organization adopts Google Cloud Platform (GCP) for application hosting services and needs guidance on setting up password requirements for their Cloud
Identity account. The organization has a password policy requirement that corporate employee passwords must have a minimum number of characters.
Which Cloud Identity password guidelines can the organization use to inform their new requirements?
Set the minimum length for passwords to be 8 characters.
Set the minimum length for passwords to be 10 characters.
Set the minimum length for passwords to be 12 characters.
Set the minimum length for passwords to be 6 characters.
You are implementing data protection by design and in accordance with GDPR requirements. As part of design reviews, you are told that you need to manage the encryption key for a solution that includes workloads for Compute Engine, Google Kubernetes Engine, Cloud Storage, BigQuery, and Pub/Sub. Which option should you choose for this implementation?
Cloud External Key Manager
Customer-managed encryption keys
Customer-supplied encryption keys
Google default encryption
You are deploying a web application hosted on Compute Engine. A business requirement mandates that application logs are preserved for 12 years and data is kept within European boundaries. You want to implement a storage solution that minimizes overhead and is cost-effective. What should you do?
Create a Cloud Storage bucket to store your logs in the EUROPE-WEST1 region. Modify your application code to ship logs directly to your bucket for increased efficiency.
Configure your Compute Engine instances to use the Google Cloud's operations suite Cloud Logging agent to send application logs to a custom log bucket in the EUROPE-WEST1 region with a custom retention of 12 years.
Use a Pub/Sub topic to forward your application logs to a Cloud Storage bucket in the EUROPE-WEST1 region.
Configure a custom retention policy of 12 years on your Google Cloud's operations suite log bucket in the EUROPE-WEST1 region.
Your company plans to move most of its IT infrastructure to Google Cloud. They want to leverage their existing on-premises Active Directory as an identity provider for Google Cloud. Which two steps should you take to integrate the company's on-premises Active Directory with Google Cloud and configure access management? (Choose two.)
Use Identity Platform to provision users and groups to Google Cloud.
Use Cloud Identity SAML integration to provision users and groups to Google Cloud.
Install Google Cloud Directory Sync and connect it to Active Directory and Cloud Identity.
Create Identity and Access Management (IAM) roles with permissions corresponding to each Active Directory group.
Create Identity and Access Management (IAM) groups with permissions corresponding to each Active Directory group.
A customer wants to move their sensitive workloads to a Compute Engine-based cluster using Managed Instance Groups (MIGs). The jobs are bursty and must be completed quickly. They have a requirement to be able to control the key lifecycle.
Which boot disk encryption solution should you use on the cluster to meet this customer's requirements?
Customer-supplied encryption keys (CSEK)
Customer-managed encryption keys (CMEK) using Cloud Key Management Service (KMS)
Encryption by default
Pre-encrypting files before transferring to Google Cloud Platform (GCP) for analysis
You manage one of your organization's Google Cloud projects (Project A). A VPC Service Control (SC) perimeter is blocking API access requests to this project, including Pub/Sub. A resource running under a service account in another project (Project B) needs to collect messages from a Pub/Sub topic in your project. Project B is not included in a VPC SC perimeter. You need to provide access from Project B to the Pub/Sub topic in Project A using the principle of least privilege.
What should you do?
Configure an ingress policy for the perimeter in Project A, and allow access for the service account in Project B to collect messages.
Create an access level that allows a developer in Project B to subscribe to the Pub/Sub topic that is located in Project A.
Create a perimeter bridge between Project A and Project B to allow the required communication between both projects.
Remove the Pub/Sub API from the list of restricted services in the perimeter configuration for Project A.
As part of your organization's zero trust strategy, you use Identity-Aware Proxy (IAP) to protect multiple applications. You need to ingest logs into a Security Information and Event Management (SIEM) system so that you are alerted to possible intrusions.
Which logs should you analyze?
Data Access audit logs
Policy Denied audit logs
Cloud Identity user log events
Admin Activity audit logs
Your organization wants full control of the keys used to encrypt data at rest in their Google Cloud environments. Keys must be generated and stored outside of Google and integrate with many Google Services including BigQuery.
What should you do?
Use customer-supplied encryption keys (CSEK) with keys generated on trusted external systems. Provide the raw CSEK as part of the API call.
Create a KMS key that is stored on a Google managed FIPS 140-2 level 3 Hardware Security Module (HSM). Manage the Identity and Access Management (IAM) permissions settings, and set up the key rotation period.
Use Cloud External Key Management (EKM) that integrates with an external Hardware Security Module (HSM) system from supported vendors.
Create a Cloud Key Management Service (KMS) key with imported key material. Wrap the key for protection during import. Import the key generated on a trusted system in Cloud KMS.
A customer is collaborating with another company to build an application on Compute Engine. The customer is building the application tier in their GCP
Organization, and the other company is building the storage tier in a different GCP Organization. This is a 3-tier web application. Communication between portions of the application must not traverse the public internet by any means.
Which connectivity option should be implemented?
VPC peering
Cloud VPN
Cloud Interconnect
Shared VPC
Your company is using GSuite and has developed an application meant for internal usage on Google App Engine. You need to make sure that an external user cannot gain access to the application even when an employee's password has been compromised.
What should you do?
Enforce 2-factor authentication in GSuite for all users.
Configure Cloud Identity-Aware Proxy for the App Engine Application.
Provision user passwords using GSuite Password Sync.
Configure Cloud VPN between your private network and GCP.
A company is deploying their application on Google Cloud Platform. Company policy requires long-term data to be stored using a solution that can automatically replicate data over at least two geographic places.
Which Storage solution are they allowed to use?
Cloud Bigtable
Cloud BigQuery
Compute Engine SSD Disk
Compute Engine Persistent Disk
A company is running their webshop on Google Kubernetes Engine and wants to analyze customer transactions in BigQuery. You need to ensure that no credit card numbers are stored in BigQuery
What should you do?
Create a BigQuery view with regular expressions matching credit card numbers to query and delete affected rows.
Use the Cloud Data Loss Prevention API to redact related infoTypes before data is ingested into BigQuery.
Leverage Security Command Center to scan for the assets of type Credit Card Number in BigQuery.
Enable Cloud Identity-Aware Proxy to filter out credit card numbers before storing the logs in BigQuery.
You are tasked with exporting and auditing security logs for login activity events for Google Cloud console and API calls that modify configurations to Google
Cloud resources. Your export must meet the following requirements:
✑ Export related logs for all projects in the Google Cloud organization.
✑ Export logs in near real-time to an external SIEM.
What should you do? (Choose two.)
Create a Log Sink at the organization level with a Pub/Sub destination.
Create a Log Sink at the organization level with the includeChildren parameter, and set the destination to a Pub/Sub topic.
Enable Data Access audit logs at the organization level to apply to all projects.
Enable Google Workspace audit logs to be shared with Google Cloud in the Admin Console.
Ensure that the SIEM processes the AuthenticationInfo field in the audit log entry to gather identity information.
You are developing a new application that uses exclusively Compute Engine VMs. Once a day, this application will execute five different batch jobs. Each of the batch jobs requires a dedicated set of permissions on Google Cloud resources outside of your application. You need to design a secure access concept for the batch jobs that adheres to the least-privilege principle.
What should you do?
1. Create a general service account “g-sa” to orchestrate the batch jobs.
2. Create one service account per batch job ‘b-sa-[1-5]’. Grant only the permissions required to run the individual batch jobs to the service accounts and generate service account keys for each of these service accounts.
3. Store the service account keys in Secret Manager. Grant g-sa access to Secret Manager and run the batch jobs with the permissions of b-sa-[1-5].
1. Create a general service account “g-sa” to execute the batch jobs.
2. Grant the permissions required to execute the batch jobs to g-sa.
3. Execute the batch jobs with the permissions granted to g-sa.
1. Create a workload identity pool and configure workload identity pool providers for each batch job.
2. Assign the workload identity user role to each of the identities configured in the providers.
3. Create one service account per batch job “b-sa-[1-5]”, and grant only the permissions required to run the individual batch jobs to the service accounts.
4. Generate credential configuration files for each of the providers. Use these files to execute the batch jobs with the permissions of b-sa-[1-5].
1. Create a general service account “g-sa” to orchestrate the batch jobs.
2. Create one service account per batch job “b-sa-[1-5]”, and grant only the permissions required to run the individual batch jobs to the service accounts.
3. Grant the Service Account Token Creator role to g-sa. Use g-sa to obtain short-lived access tokens for b-sa-[1-5] and to execute the batch jobs with the permissions of b-sa-[1-5].
Your organization is transitioning to Google Cloud. You want to ensure that only trusted container images are deployed on Google Kubernetes Engine (GKE) clusters in a project. The containers must be deployed from a centrally managed Container Registry and signed by a trusted authority.
What should you do? (Choose two.)
Enable Container Threat Detection in the Security Command Center (SCC) for the project.
Configure the trusted image organization policy constraint for the project.
Create a custom organization policy constraint to enforce Binary Authorization for Google Kubernetes Engine (GKE).
Enable PodSecurity standards, and set them to Restricted.
Configure the Binary Authorization policy with respective attestations for the project.
You have a highly sensitive BigQuery workload that contains personally identifiable information (PII) that you want to ensure is not accessible from the internet. To prevent data exfiltration, only requests from authorized IP addresses are allowed to query your BigQuery tables.
What should you do?
Use service perimeter and create an access level based on the authorized source IP address as the condition.
Use Google Cloud Armor security policies defining an allowlist of authorized IP addresses at the global HTTPS load balancer.
Use the Restrict Resource Service Usage organization policy constraint along with Cloud Data Loss Prevention (DLP).
Use the Restrict allowed Google Cloud APIs and services organization policy constraint along with Cloud Data Loss Prevention (DLP).
A customer needs to launch a 3-tier internal web application on Google Cloud Platform (GCP). The customer's internal compliance requirements dictate that end- user access may only be allowed if the traffic seems to originate from a specific known good CIDR. The customer accepts the risk that their application will only have SYN flood DDoS protection. They want to use GCP's native SYN flood protection.
Which product should be used to meet these requirements?
Cloud Armor
VPC Firewall Rules
Cloud Identity and Access Management
Cloud CDN
A retail customer allows users to upload comments and product reviews. The customer needs to make sure the text does not include sensitive data before the comments or reviews are published.
Which Google Cloud Service should be used to achieve this?
Cloud Key Management Service
Cloud Data Loss Prevention API
BigQuery
Web Security Scanner
Your company is using Cloud Dataproc for its Spark and Hadoop jobs. You want to be able to create, rotate, and destroy symmetric encryption keys used for the persistent disks used by Cloud Dataproc. Keys can be stored in the cloud.
What should you do?
Use the Cloud Key Management Service to manage the data encryption key (DEK).
Use the Cloud Key Management Service to manage the key encryption key (KEK).
Use customer-supplied encryption keys to manage the data encryption key (DEK).
Use customer-supplied encryption keys to manage the key encryption key (KEK).
Your organization uses BigQuery to process highly sensitive, structured datasets. Following the “need to know” principle, you need to create the Identity and Access Management (IAM) design to meet the needs of these users:
• Business user: must access curated reports.
• Data engineer: must administrate the data lifecycle in the platform.
• Security operator: must review user activity on the data platform.
What should you do?
Configure data access log for BigQuery services, and grant Project Viewer role to security operator.
Set row-based access control based on the “region” column, and filter the record from the United States for data engineers.
Create curated tables in a separate dataset and assign the role roles/bigquery.dataViewer.
Generate a CSV data file based on the business user's needs, and send the data to their email addresses.
A customer's internal security team must manage its own encryption keys for encrypting data on Cloud Storage and decides to use customer-supplied encryption keys (CSEK).
How should the team complete this task?
Upload the encryption key to a Cloud Storage bucket, and then upload the object to the same bucket.
Use the gsutil command line tool to upload the object to Cloud Storage, and specify the location of the encryption key.
Generate an encryption key in the Google Cloud Platform Console, and upload an object to Cloud Storage using the specified key.
Encrypt the object, then use the gsutil command line tool or the Google Cloud Platform Console to upload the object to Cloud Storage.
An employer wants to track how bonus compensations have changed over time to identify employee outliers and correct earning disparities. This task must be performed without exposing the sensitive compensation data for any individual and must be reversible to identify the outlier.
Which Cloud Data Loss Prevention API technique should you use to accomplish this?
Generalization
Redaction
CryptoHashConfig
CryptoReplaceFfxFpeConfig
You are consulting with a client that requires end-to-end encryption of application data (including data in transit, data in use, and data at rest) within Google Cloud.
Which options should you utilize to accomplish this? (Choose two.)
External Key Manager
Customer-supplied encryption keys
Hardware Security Module
Confidential Computing and Istio
Client-side encryption
Your company's Chief Information Security Officer (CISO) creates a requirement that business data must be stored in specific locations due to regulatory requirements that affect the company's global expansion plans. After working on the details to implement this requirement, you determine the following:
✑ The services in scope are included in the Google Cloud Data Residency Terms.
✑ The business data remains within specific locations under the same organization.
✑ The folder structure can contain multiple data residency locations.
You plan to use the Resource Location Restriction organization policy constraint. At which level in the resource hierarchy should you set the constraint?
Folder
Resource
Project
Organization
You are setting up a new Cloud Storage bucket in your environment that is encrypted with a customer managed encryption key (CMEK). The CMEK is stored in Cloud Key Management Service (KMS), in project “prj-a”, and the Cloud Storage bucket will use project “prj-b”. The key is backed by a Cloud Hardware Security Module (HSM) and resides in the region europe-west3. Your storage bucket will be located in the region europe-west1. When you create the bucket, you cannot access the key, and you need to troubleshoot why.
What has caused the access issue?
A firewall rule prevents the key from being accessible.
Cloud HSM does not support Cloud Storage.
The CMEK is in a different project than the Cloud Storage bucket.
The CMEK is in a different region than the Cloud Storage bucket.
Your organization wants to be compliant with the General Data Protection Regulation (GDPR) on Google Cloud. You must implement data residency and operational sovereignty in the EU.
What should you do? (Choose two.)
Limit the physical location of a new resource with the Organization Policy Service "resource locations constraint."
Use Cloud IDS to get east-west and north-south traffic visibility in the EU to monitor intra-VPC and inter-VPC communication.
Limit Google personnel access based on predefined attributes such as their citizenship or geographic location by using Key Access Justifications.
Use identity federation to limit access to Google Cloud resources from non-EU entities.
Use VPC Flow Logs to monitor intra-VPC and inter-VPC traffic in the EU.
Your team needs to make sure that a Compute Engine instance does not have access to the internet or to any Google APIs or services.
Which two settings must remain disabled to meet these requirements? (Choose two.)
Public IP
IP Forwarding
Private Google Access
Static routes
IAM Network User Role
A company's application is deployed with a user-managed Service Account key. You want to use Google-recommended practices to rotate the key.
What should you do?
Open Cloud Shell and run gcloud iam service-accounts enable-auto-rotate --iam-account=IAM_ACCOUNT.
Open Cloud Shell and run gcloud iam service-accounts keys rotate --iam-account=IAM_ACCOUNT --key=NEW_KEY.
Create a new key, and use the new key in the application. Delete the old key from the Service Account.
Create a new key, and use the new key in the application. Store the old key on the system as a backup key.
You are creating an internal App Engine application that needs to access a user's Google Drive on the user's behalf. Your company does not want to rely on the current user's credentials. It also wants to follow Google-recommended practices.
What should you do?
Create a new Service account, and give all application users the role of Service Account User.
Create a new Service account, and add all application users to a Google Group. Give this group the role of Service Account User.
Use a dedicated G Suite Admin account, and authenticate the application's operations with these G Suite credentials.
Create a new service account, and grant it G Suite domain-wide delegation. Have the application use it to impersonate the user.
Your organization must comply with the regulation to keep instance logging data within Europe. Your workloads will be hosted in the Netherlands in region europe-west4 in a new project. You must configure Cloud Logging to keep your data in the country.
What should you do?
Configure the organization policy constraint gcp.resourceLocations to europe-west4.
Configure log sink to export all logs into a Cloud Storage bucket in europe-west4.
Create a new log bucket in europe-west4, and redirect the _Default bucket to the new bucket.
Set the logging storage region to europe-west4 by using the gcloud CLI logging settings update.
A company migrated their entire data/center to Google Cloud Platform. It is running thousands of instances across multiple projects managed by different departments. You want to have a historical record of what was running in Google Cloud Platform at any point in time.
What should you do?
Use Resource Manager on the organization level.
Use Forseti Security to automate inventory snapshots.
Use Stackdriver to create a dashboard across all projects.
Use Security Command Center to view all assets across the organization.
You manage a fleet of virtual machines (VMs) in your organization. You have encountered issues with lack of patching in many VMs. You need to automate regular patching in your VMs and view the patch management data across multiple projects.
What should you do? (Choose two.)
View patch management data in VM Manager by using OS patch management.
View patch management data in Artifact Registry.
View patch management data in a Security Command Center dashboard.
Deploy patches with Security Command Genter by using Rapid Vulnerability Detection.
Deploy patches with VM Manager by using OS patch management.
You plan to synchronize identities to Cloud Identity from a third-party identity provider (IdP). You discovered that some employees used their corporate email address to set up consumer accounts to access Google services. You need to ensure that the organization has control over the configuration, security, and lifecycle of these consumer accounts.
What should you do? (Choose two.)
Mandate that those corporate employees delete their unmanaged consumer accounts.
Reconcile accounts that exist in Cloud Identity but not in the third-party IdP.
Evict the unmanaged consumer accounts in the third-party IdP before you sync identities.
Use Google Cloud Directory Sync (GCDS) to migrate the unmanaged consumer accounts' emails as user aliases.
Use the transfer tool to invite those corporate employees to transfer their unmanaged consumer accounts to the corporate domain.
A customer deploys an application to App Engine and needs to check for Open Web Application Security Project (OWASP) vulnerabilities.
Which service should be used to accomplish this?
Cloud Armor
Google Cloud Audit Logs
Web Security Scanner
Anomaly Detection
You define central security controls in your Google Cloud environment. For one of the folders in your organization, you set an organizational policy to deny the assignment of external IP addresses to VMs. Two days later, you receive an alert about a new VM with an external IP address under that folder.
What could have caused this alert?
The VM was created with a static external IP address that was reserved in the project before the organizational policy rule was set.
The organizational policy constraint wasn't properly enforced and is running in "dry run" mode.
A project level, the organizational policy control has been overwritten with an "allow" value.
The policy constraint on the folder level does not have any effect because of an "allow" value for that constraint on the organizational level.
In order to meet PCI DSS requirements, a customer wants to ensure that all outbound traffic is authorized.
Which two cloud offerings meet this requirement without additional compensating controls? (Choose two.)
App Engine
Cloud Functions
Compute Engine
Google Kubernetes Engine
Cloud Storage
Your company’s users access data in a BigQuery table. You want to ensure they can only access the data during working hours.
What should you do?
Assign a BigQuery Data Viewer role along with an IAM condition that limits the access to specified working hours.
Run a gsutil script that assigns a BigQuery Data Viewer role, and remove it only during the specified working hours.
Assign a BigQuery Data Viewer role to a service account that adds and removes the users daily during the specified working hours.
Configure Cloud Scheduler so that it triggers a Cloud Functions instance that modifies the organizational policy constraint for BigQuery during the specified working hours.
Your company is concerned about unauthorized parties gaining access to the Google Cloud environment by using a fake login page. You must implement a solution to protect against person-in-the-middle attacks.
Which security measure should you use?
Security key
Google prompt
Text message or phone call code
Google Authenticator application
Your organization uses the top-tier folder to separate application environments (prod and dev). The developers need to see all application development audit logs, but they are not permitted to review production logs. Your security team can review all logs in production and development environments. You must grant Identity and Access Management (IAM) roles at the right resource level for the developers and security team while you ensure least privilege.
What should you do?
1. Grant logging.viewer role to the security team at the organization resource level.
2. Grant logging.viewer role to the developer team at the folder resource level that contains all the dev projects.
1. Grant logging.viewer role to the security team at the organization resource level.
2. Grant logging.admin role to the developer team at the organization resource level.
1. Grant logging.admin role to the security team at the organization resource level.
2. Grant logging.viewer role to the developer team at the folder resource level that contains all the dev projects.
1. Grant logging.admin role to the security team at the organization resource level.
2. Grant logging.admin role to the developer team at the organization resource level.
After completing a security vulnerability assessment, you learned that cloud administrators leave Google Cloud CLI sessions open for days. You need to reduce the risk of attackers who might exploit these open sessions by setting these sessions to the minimum duration.
What should you do?
Set the session duration for the Google session control to one hour.
Set the reauthentication frequency for the Google Cloud Session Control to one hour.
Set the organization policy constraint constraints/iam.allowServiceAccountCredentialLifetimeExtension to one hour.
Set the organization policy constraint constraints/iam.serviceAccountKeyExpiryHours to one hour and inheritFromParent to false.
You are migrating an on-premises data warehouse to BigQuery, Cloud SQL, and Cloud Storage. You need to configure security services in the data warehouse. Your company compliance policies mandate that the data warehouse must:
• Protect data at rest with full lifecycle management on cryptographic keys.
• Implement a separate key management provider from data management.
• Provide visibility into all encryption key requests.
What services should be included in the data warehouse implementation? (Choose two.)
Customer-managed encryption keys
Customer-Supplied Encryption Keys
Key Access Justifications
Access Transparency and Approval
Cloud External Key Manager
Your company uses Google Cloud and has publicly exposed network assets. You want to discover the assets and perform a security audit on these assets by using a software tool in the least amount of time.
What should you do?
Run a platform security scanner on all instances in the organization.
Identify all external assets by using Cloud Asset Inventory, and then run a network security scanner against them.
Contact a Google approved security vendor to perform the audit.
Notify Google about the pending audit, and wait for confirmation before performing the scan.
Your organization has on-premises hosts that need to access Google Cloud APIs. You must enforce private connectivity between these hosts, minimize costs, and optimize for operational efficiency.
What should you do?
Set up VPC peering between the hosts on-premises and the VPC through the internet.
Route all on-premises traffic to Google Cloud through an IPsec VPN tunnel to a VPC with Private Google Access enabled.
Enforce a security policy that mandates all applications to encrypt data with a Cloud Key Management Service (KMS) key before you send it over the network.
Route all on-premises traffic to Google Cloud through a dedicated or Partner Interconnect to a VPC with Private Google Access enabled.
Your team needs to obtain a unified log view of all development cloud projects in your SIEM. The development projects are under the NONPROD organization folder with the test and pre-production projects. The development projects share the ABC-BILLING billing account with the rest of the organization.
Which logging export strategy should you use to meet the requirements?
1. Export logs to a Cloud Pub/Sub topic with folders/NONPROD parent and includeChildren property set to True in a dedicated SIEM project.
2. Subscribe SIEM to the topic.
1. Create a Cloud Storage sink with billingAccounts/ABC-BILLING parent and includeChildren property set to False in a dedicated SIEM project.
2. Process Cloud Storage objects in SIEM.
1. Export logs in each dev project to a Cloud Pub/Sub topic in a dedicated SIEM project.
2. Subscribe SIEM to the topic.
1. Create a Cloud Storage sink with a publicly shared Cloud Storage bucket in each project.
2. Process Cloud Storage objects in SIEM.
Your organization's Customers must scan and upload the contract and their driver license into a web portal in Cloud Storage. You must remove all personally identifiable information (PII) from files that are older than 12 months. Also, you must archive the anonymized files for retention purposes.
What should you do?
Set a time to live (TTL) of 12 months for the files in the Cloud Storage bucket that removes PII and moves the files to the archive storage class.
Create a Cloud Data loss Prevention (DLP) inspection job that de-identifies PII in files created more than 12 months ago and archives them to another Cloud Storage bucket. Delete the original files.
Configure the Autoclass feature of the Cloud Storage bucket to de-identify PII. Archive the files that are older than 12 months. Delete the original files.
Schedule a Cloud Key Management Service (KMS) rotation period of 12 months for the encryption keys of the Cloud Storage files containing PII to de-identify them. Delete the original keys.
Employees at your company use their personal computers to access your organization's Google Cloud console. You need to ensure that users can only access the Google Cloud console from their corporate-issued devices and verify that they have a valid enterprise certificate.
What should you do?
Implement an Access Policy in BeyondCorp Enterprise to verify the device certificate. Create an access binding with the access policy just created.
Implement a VPC firewall policy. Activate packet inspection and create an allow rule to validate and verify the device certificate.
Implement an organization policy to verify the certificate from the access context.
Implement an Identity and Access Management (IAM) conditional policy to verify the device certificate.
You manage your organization's Security Operations Center (SOC). You currently monitor and detect network traffic anomalies in your VPCs based on network logs. However, you want to explore your environment using network payloads and headers. Which Google Cloud product should you use?
Cloud IDS
VPC Service Controls logs
VPC Flow Logs
Google Cloud Armor
Packet Mirroring
You have created an OS image that is hardened per your organization's security standards and is being stored in a project managed by the security team. As a
Google Cloud administrator, you need to make sure all VMs in your Google Cloud organization can only use that specific OS image while minimizing operational overhead. What should you do? (Choose two.)
Grant users the compute.imageUser role in their own projects.
Grant users the compute.imageUser role in the OS image project.
Store the image in every project that is spun up in your organization.
Set up an image access organization policy constraint, and list the security team managed project in the project's allow list.
Remove VM instance creation permission from users of the projects, and only allow you and your team to create VM instances.
You need to create a VPC that enables your security team to control network resources such as firewall rules. How should you configure the network to allow for separation of duties for network resources?
Set up multiple VPC networks, and set up multi-NIC virtual appliances to connect the networks.
Set up VPC Network Peering, and allow developers to peer their network with a Shared VPC.
Set up a VPC in a project. Assign the Compute Network Admin role to the security team, and assign the Compute Admin role to the developers.
Set up a Shared VPC where the security team manages the firewall rules, and share the network with developers via service projects.
You need to audit the network segmentation for your Google Cloud footprint. You currently operate Production and Non-Production infrastructure-as-a-service
(IaaS) environments. All your VM instances are deployed without any service account customization.
After observing the traffic in your custom network, you notice that all instances can communicate freely `" despite tag-based VPC firewall rules in place to segment traffic properly `" with a priority of 1000. What are the most likely reasons for this behavior?
All VM instances are missing the respective network tags.
All VM instances are residing in the same network subnet.
All VM instances are configured with the same network route.
A VPC firewall rule is allowing traffic between source/targets based on the same service account with priority 999. E . A VPC firewall rule is allowing traffic between source/targets based on the same service account with priority 1001.
Your company's chief information security officer (CISO) is requiring business data to be stored in specific locations due to regulatory requirements that affect the company's global expansion plans. After working on a plan to implement this requirement, you determine the following:
✑ The services in scope are included in the Google Cloud data residency requirements.
✑ The business data remains within specific locations under the same organization.
✑ The folder structure can contain multiple data residency locations.
✑ The projects are aligned to specific locations.
You plan to use the Resource Location Restriction organization policy constraint with very granular control. At which level in the hierarchy should you set the constraint?
Organization
Resource
Project
Folder
You plan to use a Google Cloud Armor policy to prevent common attacks such as cross-site scripting (XSS) and SQL injection (SQLi) from reaching your web application's backend. What are two requirements for using Google Cloud Armor security policies? (Choose two.)
The load balancer must be an external SSL proxy load balancer.
Google Cloud Armor Policy rules can only match on Layer 7 (L7) attributes.
The load balancer must use the Premium Network Service Tier.
The backend service's load balancing scheme must be EXTERNAL.
The load balancer must be an external HTTP(S) load balancer.
Last week, a company deployed a new App Engine application that writes logs to BigQuery. No other workloads are running in the project. You need to validate that all data written to BigQuery was done using the App Engine Default Service Account.
What should you do?
1. Use Cloud Logging and filter on BigQuery Insert Jobs.
2. Click on the email address in line with the App Engine Default Service Account in the authentication field.
3. Click Hide Matching Entries. 4. Make sure the resulting list is empty.
1. Use Cloud Logging and filter on BigQuery Insert Jobs.
2. Click on the email address in line with the App Engine Default Service Account in the authentication field.
3. Click Show Matching Entries.
4. Make sure the resulting list is empty.
1. In BigQuery, select the related dataset. 2. Make sure that the App Engine Default Service Account is the only account that can write to the dataset.
1. Go to the Identity and Access Management (IAM) section of the project.
2. Validate that the App Engine Default Service Account is the only account that has a role that can write to BigQuery.
You are part of a security team investigating a compromised service account key. You need to audit which new resources were created by the service account.
What should you do?
Query Data Access logs.
Query Admin Activity logs.
Query Access Transparency logs.
Query Stackdriver Monitoring Workspace.
You are troubleshooting access denied errors between Compute Engine instances connected to a Shared VPC and BigQuery datasets. The datasets reside in a project protected by a VPC Service Controls perimeter. What should you do?
Add the host project containing the Shared VPC to the service perimeter.
Add the service project where the Compute Engine instances reside to the service perimeter.
Create a service perimeter between the service project where the Compute Engine instances reside and the host project that contains the Shared VPC.
Create a perimeter bridge between the service project where the Compute Engine instances reside and the perimeter that contains the protected BigQuery datasets.
You are the security admin of your company. Your development team creates multiple GCP projects under the "implementation" folder for several dev, staging, and production workloads. You want to prevent data exfiltration by malicious insiders or compromised code by setting up a security perimeter. However, you do not want to restrict communication between the projects.
What should you do?
Use a Shared VPC to enable communication between all projects, and use firewall rules to prevent data exfiltration.
Create access levels in Access Context Manager to prevent data exfiltration, and use a shared VPC for communication between projects.
Use an infrastructure-as-code software tool to set up a single service perimeter and to deploy a Cloud Function that monitors the "implementation" folder via Stackdriver and Cloud Pub/Sub. When the function notices that a new project is added to the folder, it executes Terraform to add the new project to the associated perimeter.
Use an infrastructure-as-code software tool to set up three different service perimeters for dev, staging, and prod and to deploy a Cloud Function that monitors the "implementation" folder via Stackdriver and Cloud Pub/Sub. When the function notices that a new project is added to the folder, it executes Terraform to add the new project to the respective perimeter.
Your Google Cloud organization allows for administrative capabilities to be distributed to each team through provision of a Google Cloud project with Owner role (roles/owner). The organization contains thousands of Google Cloud projects. Security Command Center Premium has surfaced multiple OPEN_MYSQL_PORT findings. You are enforcing the guardrails and need to prevent these types of common misconfigurations.
What should you do?
Create a hierarchical firewall policy configured at the organization to deny all connections from 0.0.0.0/0.
Create a hierarchical firewall policy configured at the organization to allow connections only from internal IP ranges.
Create a Google Cloud Armor security policy to deny traffic from 0.0.0.0/0.
Create a firewall rule for each virtual private cloud (VPC) to deny traffic from 0.0.0.0/0 with priority 0.
You are auditing all your Google Cloud resources in the production project. You want to identify all principals who can change firewall rules.
What should you do?
Use Policy Analyzer to query the permissions compute.firewalls.get or compute.firewalls.list.
Use Firewall Insights to understand your firewall rules usage patterns.
Reference the Security Health Analytics – Firewall Vulnerability Findings in the Security Command Center.
Use Policy Analyzer to query the permissions compute.firewalls.create or compute.firewalls.update or compute.firewalls.delete.
A company is using Google Kubernetes Engine (GKE) with container images of a mission-critical application. The company wants to scan the images for known security issues and securely share the report with the security team without exposing them outside Google Cloud.
What should you do?
1. Enable Container Threat Detection in the Security Command Center Premium tier.
2. Upgrade all clusters that are not on a supported version of GKE to the latest possible GKE version.
3. View and share the results from the Security Command Center.
1. Use an open source tool in Cloud Build to scan the images.
2. Upload reports to publicly accessible buckets in Cloud Storage by using gsutil.
3. Share the scan report link with your security department.
1. Enable vulnerability scanning in the Artifact Registry settings.
2. Use Cloud Build to build the images.
3. Push the images to the Artifact Registry for automatic scanning.
4. View the reports in the Artifact Registry.
1. Get a GitHub subscription.
2. Build the images in Cloud Build and store them in GitHub for automatic scanning.
3. Download the report from GitHub and share with the Security Team.
You have been tasked with configuring Security Command Center for your organization's Google Cloud environment. Your security team needs to receive alerts of potential crypto mining in the organization's compute environment and alerts for common Google Cloud misconfigurations that impact security. Which Security
Command Center features should you use to configure these alerts? (Choose two.)
Event Threat Detection
Container Threat Detection
Security Health Analytics
Cloud Data Loss Prevention
Google Cloud Armor
You need to set up a Cloud interconnect connection between your company's on-premises data center and VPC host network. You want to make sure that on- premises applications can only access Google APIs over the Cloud Interconnect and not through the public internet. You are required to only use APIs that are supported by VPC Service Controls to mitigate against exfiltration risk to non-supported APIs. How should you configure the network?
Enable Private Google Access on the regional subnets and global dynamic routing mode.
Set up a Private Service Connect endpoint IP address with the API bundle of "all-apis", which is advertised as a route over the Cloud interconnect connection.
Use private.googleapis.com to access Google APIs using a set of IP addresses only routable from within Google Cloud, which are advertised as routes over the connection.
Use restricted googleapis.com to access Google APIs using a set of IP addresses only routable from within Google Cloud, which are advertised as routes over the Cloud Interconnect connection.
Your security team uses encryption keys to ensure confidentiality of user data. You want to establish a process to reduce the impact of a potentially compromised symmetric encryption key in Cloud Key Management Service (Cloud KMS).
Which steps should your team take before an incident occurs? (Choose two.)
Disable and revoke access to compromised keys.
Enable automatic key version rotation on a regular schedule.
Manually rotate key versions on an ad hoc schedule.
Limit the number of messages encrypted with each key version.
Disable the Cloud KMS API.
Your team needs to make sure that their backend database can only be accessed by the frontend application and no other instances on the network.
How should your team design this network?
Create an ingress firewall rule to allow access only from the application to the database using firewall tags.
Create a different subnet for the frontend application and database to ensure network isolation.
Create two VPC networks, and connect the two networks using Cloud VPN gateways to ensure network isolation.
Create two VPC networks, and connect the two networks using VPC peering to ensure network isolation.
You work for a large organization where each business unit has thousands of users. You need to delegate management of access control permissions to each business unit. You have the following requirements:
✑ Each business unit manages access controls for their own projects.
✑ Each business unit manages access control permissions at scale.
✑ Business units cannot access other business units' projects.
✑ Users lose their access if they move to a different business unit or leave the company.
✑ Users and access control permissions are managed by the on-premises directory service.
What should you do? (Choose two.)
Use VPC Service Controls to create perimeters around each business unit's project.
Organize projects in folders, and assign permissions to Google groups at the folder level.
Group business units based on Organization Units (OUs) and manage permissions based on OUs
Create a project naming convention, and use Google's IAM Conditions to manage access based on the prefix of project names.
Use Google Cloud Directory Sync to synchronize users and group memberships in Cloud Identity.
You are asked to recommend a solution to store and retrieve sensitive configuration data from an application that runs on Compute Engine. Which option should you recommend?
Cloud Key Management Service
Compute Engine guest attributes
Compute Engine custom metadata
Secret Manager
You have been tasked with implementing external web application protection against common web application attacks for a public application on Google Cloud.
You want to validate these policy changes before they are enforced. What service should you use?
Google Cloud Armor's preconfigured rules in preview mode
Prepopulated VPC firewall rules in monitor mode
The inherent protections of Google Front End (GFE)
Cloud Load Balancing firewall rules
VPC Service Controls in dry run mode
You have an application where the frontend is deployed on a managed instance group in subnet A and the data layer is stored on a mysql Compute Engine virtual machine (VM) in subnet B on the same VPC. Subnet A and Subnet B hold several other Compute Engine VMs. You only want to allow the application frontend to access the data in the application's mysql instance on port 3306.
What should you do?
Configure an ingress firewall rule that allows communication from the src IP range of subnet A to the tag "data-tag" that is applied to the mysql Compute Engine VM on port 3306.
Configure an ingress firewall rule that allows communication from the frontend's unique service account to the unique service account of the mysql Compute Engine VM on port 3306.
Configure a network tag "fe-tag" to be applied to all instances in subnet A and a network tag "data-tag" to be applied to all instances in subnet B. Then configure an egress firewall rule that allows communication from Compute Engine VMs tagged with data-tag to destination Compute Engine VMs tagged fe- tag.
Configure a network tag "fe-tag" to be applied to all instances in subnet A and a network tag "data-tag" to be applied to all instances in subnet B. Then configure an ingress firewall rule that allows communication from Compute Engine VMs tagged with fe-tag to destination Compute Engine VMs tagged with data-tag.
You are the security admin of your company. You have 3,000 objects in your Cloud Storage bucket. You do not want to manage access to each object individually.
You also do not want the uploader of an object to always have full control of the object. However, you want to use Cloud Audit Logs to manage access to your bucket.
What should you do?
Set up an ACL with OWNER permission to a scope of allUsers.
Set up an ACL with READER permission to a scope of allUsers.
Set up a default bucket ACL and manage access for users using IAM.
Set up Uniform bucket-level access on the Cloud Storage bucket and manage access for users using IAM.
An administrative application is running on a virtual machine (VM) in a managed group at port 5601 inside a Virtual Private Cloud (VPC) instance without access to the internet currently. You want to expose the web interface at port 5601 to users and enforce authentication and authorization Google credentials.
What should you do?
Configure the bastion host with OS Login enabled and allow connection to port 5601 at VPC firewall. Log in to the bastion host from the Google Cloud console by using SSH-in-browser and then to the web application.
Modify the VPC routing with the default route point to the default internet gateway. Modify the VPC Firewall rule to allow access from the internet 0.0.0.0/0 to port 5601 on the application instance.
Configure Secure Shell Access (SSH) bastion host in a public network, and allow only the bastion host to connect to the application on port 5601. Use a bastion host as a jump host to connect to the application.
Configure an HTTP Load Balancing instance that points to the managed group with Identity-Aware Proxy (IAP) protection with Google credentials. Modify the VPC firewall to allow access from IAP network range.
Your organization uses Google Workspace Enterprise Edition for authentication. You are concerned about employees leaving their laptops unattended for extended periods of time after authenticating into Google Cloud. You must prevent malicious people from using an employee's unattended laptop to modify their environment.
What should you do?
Create a policy that requires employees to not leave their sessions open for long durations.
Review and disable unnecessary Google Cloud APIs.
Require strong passwords and 2SV through a security token or Google authenticator.
Set the session length timeout for Google Cloud services to a shorter duration.
In a shared security responsibility model for IaaS, which two layers of the stack does the customer share responsibility for? (Choose two.)
Hardware
Network Security
Storage Encryption
Access Policies
Boot
You need to set up a Cloud Interconnect connection between your company’s on-premises data center and VPC host network. You want to make sure that on-premises applications can only access Google APIs over the Cloud Interconnect and not through the public internet. You are required to only use APIs that are supported by VPC Service Controls to mitigate against exfiltration risk to non-supported APIs. How should you configure the network?
Enable Private Google Access on the regional subnets and global dynamic routing mode.
Create a CNAME to map *.googleapis.com to restricted.googleapis.com, and create A records for restricted.googleapis.com mapped to 199.36.153.8/30.
Use private.googleapis.com to access Google APIs using a set of IP addresses only routable from within Google Cloud, which are advertised as routes over the connection.
Use restricted googleapis.com to access Google APIs using a set of IP addresses only routable from within Google Cloud, which are advertised as routes over the Cloud Interconnect connection.
When working with agents in the support center via online chat, your organization's customers often share pictures of their documents with personally identifiable information (PII). Your leadership team is concerned that this PII is being stored as part of the regular chat logs, which are reviewed by internal or external analysts for customer service trends.
You want to resolve this concern while still maintaining data utility. What should you do?
Use Cloud Key Management Service to encrypt PII shared by customers before storing it for analysis.
Use Object Lifecycle Management to make sure that all chat records containing PII are discarded and not saved for analysis.
Use the image inspection and redaction actions of the DLP API to redact PII from the images before storing them for analysis.
Use the generalization and bucketing actions of the DLP API solution to redact PII from the texts before storing them for analysis.
A business unit at a multinational corporation signs up for GCP and starts moving workloads into GCP. The business unit creates a Cloud Identity domain with an organizational resource that has hundreds of projects.
Your team becomes aware of this and wants to take over managing permissions and auditing the domain resources.
Which type of access should your team grant to meet this requirement?
Organization Administrator
Security Reviewer
Organization Role Administrator
Organization Policy Administrator
You are working with protected health information (PHI) for an electronic health record system. The privacy officer is concerned that sensitive data is stored in the analytics system. You are tasked with anonymizing the sensitive data in a way that is not reversible. Also, the anonymized data should not preserve the character set and length. Which Google Cloud solution should you use?
Cloud Data Loss Prevention with deterministic encryption using AES-SIV
Cloud Data Loss Prevention with format-preserving encryption
Cloud Data Loss Prevention with cryptographic hashing
Cloud Data Loss Prevention with Cloud Key Management Service wrapped cryptographic keys
You want to use the gcloud command-line tool to authenticate using a third-party single sign-on (SSO) SAML identity provider. Which options are necessary to ensure that authentication is supported by the third-party identity provider (IdP)? (Choose two.)
SSO SAML as a third-party IdP
Identity Platform
OpenID Connect
Identity-Aware Proxy
Cloud Identity
You are designing a new governance model for your organization's secrets that are stored in Secret Manager. Currently, secrets for Production and Non-
Production applications are stored and accessed using service accounts. Your proposed solution must:
✑ Provide granular access to secrets
✑ Give you control over the rotation schedules for the encryption keys that wrap your secrets
✑ Maintain environment separation
✑ Provide ease of management
Which approach should you take?
1. Use separate Google Cloud projects to store Production and Non-Production secrets.
2. Enforce access control to secrets using project-level identity and Access Management (IAM) bindings.
3. Use customer-managed encryption keys to encrypt secrets.
1. Use a single Google Cloud project to store both Production and Non-Production secrets.
2. Enforce access control to secrets using secret-level Identity and Access Management (IAM) bindings.
3. Use Google-managed encryption keys to encrypt secrets.
1. Use separate Google Cloud projects to store Production and Non-Production secrets.
2. Enforce access control to secrets using secret-level Identity and Access Management (IAM) bindings.
3. Use Google-managed encryption keys to encrypt secrets.
1. Use a single Google Cloud project to store both Production and Non-Production secrets.
2. Enforce access control to secrets using project-level Identity and Access Management (IAM) bindings.
3. Use customer-managed encryption keys to encrypt secrets.
You are migrating your users to Google Cloud. There are cookie replay attacks with Google web and Google Cloud CLI SDK sessions on endpoint devices. You need to reduce the risk of these threats.
What should you do? (Choose two.)
Configure Google session control to a shorter duration.
Set an organizational policy for OAuth 2.0 access token with a shorter duration.
Set a reauthentication policy for Google Cloud services to a shorter duration.
Configure a third-party identity provider with session management.
Enforce Security Key Authentication with 2SV.
An organization is starting to move its infrastructure from its on-premises environment to Google Cloud Platform (GCP). The first step the organization wants to take is to migrate its current data backup and disaster recovery solutions to GCP for later analysis. The organization's production environment will remain on- premises for an indefinite time. The organization wants a scalable and cost-efficient solution.
Which GCP solution should the organization use?
BigQuery using a data pipeline job with continuous updates
Cloud Storage using a scheduled task and gsutil
Compute Engine Virtual Machines using Persistent Disk
Cloud Datastore using regularly scheduled batch upload jobs
A company has been running their application on Compute Engine. A bug in the application allowed a malicious user to repeatedly execute a script that results in the Compute Engine instance crashing. Although the bug has been fixed, you want to get notified in case this hack re-occurs.
What should you do?
Create an Alerting Policy in Stackdriver using a Process Health condition, checking that the number of executions of the script remains below the desired threshold. Enable notifications.
Create an Alerting Policy in Stackdriver using the CPU usage metric. Set the threshold to 80% to be notified when the CPU usage goes above this 80%.
Log every execution of the script to Stackdriver Logging. Create a User-defined metric in Stackdriver Logging on the logs, and create a Stackdriver Dashboard displaying the metric.
Log every execution of the script to Stackdriver Logging. Configure BigQuery as a log sink, and create a BigQuery scheduled query to count the number of executions in a specific timeframe.
You are running applications outside Google Cloud that need access to Google Cloud resources. You are using workload identity federation to grant external identities Identity and Access Management (IAM) roles to eliminate the maintenance and security burden associated with service account keys. You must protect against attempts to spoof another user's identity and gain unauthorized access to Google Cloud resources.
What should you do? (Choose two.)
Enable data access logs for IAM APIs.
Limit the number of external identities that can impersonate a service account.
Use a dedicated project to manage workload identity pools and providers.
Use immutable attributes in attribute mappings.
Limit the resources that a service account can access.
An organization's security and risk management teams are concerned about where their responsibility lies for certain production workloads they are running in
Google Cloud and where Google's responsibility lies. They are mostly running workloads using Google Cloud's platform-as-a-Service (PaaS) offerings, including
App Engine primarily.
Which area in the technology stack should they focus on as their primary responsibility when using App Engine?
Configuring and monitoring VPC Flow Logs
Defending against XSS and SQLi attacks
Managing the latest updates and security patches for the Guest OS
Encrypting all stored data
A customer wants to make it convenient for their mobile workforce to access a CRM web interface that is hosted on Google Cloud Platform (GCP). The CRM can only be accessed by someone on the corporate network. The customer wants to make it available over the internet. Your team requires an authentication layer in front of the application that supports two-factor authentication
Which GCP product should the customer implement to meet these requirements?
Cloud Identity-Aware Proxy
Cloud Armor
Cloud Endpoints
Cloud VPN
An organization is starting to move its infrastructure from its on-premises environment to Google Cloud Platform (GCP). The first step the organization wants to take is to migrate its ongoing data backup and disaster recovery solutions to GCP. The organization's on-premises production environment is going to be the next phase for migration to GCP. Stable networking connectivity between the on-premises environment and GCP is also being implemented.
Which GCP solution should the organization use?
BigQuery using a data pipeline job with continuous updates via Cloud VPN
Cloud Storage using a scheduled task and gsutil via Cloud Interconnect
Compute Engines Virtual Machines using Persistent Disk via Cloud Interconnect
Cloud Datastore using regularly scheduled batch upload jobs via Cloud VPN
A customer has an analytics workload running on Compute Engine that should have limited internet access.
Your team created an egress firewall rule to deny (priority 1000) all traffic to the internet.
The Compute Engine instances now need to reach out to the public repository to get security updates.
What should your team do?
Create an egress firewall rule to allow traffic to the CIDR range of the repository with a priority greater than 1000.
Create an egress firewall rule to allow traffic to the CIDR range of the repository with a priority less than 1000.
Create an egress firewall rule to allow traffic to the hostname of the repository with a priority greater than 1000.
Create an egress firewall rule to allow traffic to the hostname of the repository with a priority less than 1000.
You manage your organization's Security Operations Center (SOC). You currently monitor and detect network traffic anomalies in your Google Cloud VPCs based on packet header information. However, you want the capability to explore network flows and their payload to aid investigations. Which Google Cloud product should you use?
Marketplace IDS
VPC Flow Logs
VPC Service Controls logs
Packet Mirroring
Google Cloud Armor Deep Packet Inspection
Your company requires the security and network engineering teams to identify all network anomalies within and across VPCs, internal traffic from VMs to VMs, traffic between end locations on the internet and VMs, and traffic between VMs to Google Cloud services in production. Which method should you use?
Define an organization policy constraint.
Configure packet mirroring policies.
Enable VPC Flow Logs on the subnet.
Monitor and analyze Cloud Audit Logs.
A manager wants to start retaining security event logs for 2 years while minimizing costs. You write a filter to select the appropriate log entries.
Where should you export the logs?
BigQuery datasets
Cloud Storage buckets
StackDriver logging
Cloud Pub/Sub topics
You need to implement an encryption at-rest strategy that reduces key management complexity for non-sensitive data and protects sensitive data while providing the flexibility of controlling the key residency and rotation schedule. FIPS 140-2 L1 compliance is required for all data types. What should you do?
Encrypt non-sensitive data and sensitive data with Cloud External Key Manager.
Encrypt non-sensitive data and sensitive data with Cloud Key Management Service
Encrypt non-sensitive data with Google default encryption, and encrypt sensitive data with Cloud External Key Manager.
Encrypt non-sensitive data with Google default encryption, and encrypt sensitive data with Cloud Key Management Service.
You are in charge of migrating a legacy application from your company datacenters to GCP before the current maintenance contract expires. You do not know what ports the application is using and no documentation is available for you to check. You want to complete the migration without putting your environment at risk.
What should you do?
Migrate the application into an isolated project using a ג€Lift & Shiftג€ approach. Enable all internal TCP traffic using VPC Firewall rules. Use VPC Flow logs to determine what traffic should be allowed for the application to work properly.
Migrate the application into an isolated project using a ג€Lift & Shiftג€ approach in a custom network. Disable all traffic within the VPC and look at the Firewall logs to determine what traffic should be allowed for the application to work properly.
Refactor the application into a micro-services architecture in a GKE cluster. Disable all traffic from outside the cluster using Firewall Rules. Use VPC Flow logs to determine what traffic should be allowed for the application to work properly.
Refactor the application into a micro-services architecture hosted in Cloud Functions in an isolated project. Disable all traffic from outside your project using Firewall Rules. Use VPC Flow logs to determine what traffic should be allowed for the application to work properly.
You need to follow Google-recommended practices to leverage envelope encryption and encrypt data at the application layer.
What should you do?
Generate a data encryption key (DEK) locally to encrypt the data, and generate a new key encryption key (KEK) in Cloud KMS to encrypt the DEK. Store both the encrypted data and the encrypted DEK.
Generate a data encryption key (DEK) locally to encrypt the data, and generate a new key encryption key (KEK) in Cloud KMS to encrypt the DEK. Store both the encrypted data and the KEK.
Generate a new data encryption key (DEK) in Cloud KMS to encrypt the data, and generate a key encryption key (KEK) locally to encrypt the key. Store both the encrypted data and the encrypted DEK.
Generate a new data encryption key (DEK) in Cloud KMS to encrypt the data, and generate a key encryption key (KEK) locally to encrypt the key. Store both the encrypted data and the KEK.
Which two security characteristics are related to the use of VPC peering to connect two VPC networks? (Choose two.)
Central management of routes, firewalls, and VPNs for peered networks
Non-transitive peered networks; where only directly peered networks can communicate
Ability to peer networks that belong to different Google Cloud organizations
Firewall rules that can be created with a tag from one peered network to another peered network
Ability to share specific subnets across peered networks
A DevOps team will create a new container to run on Google Kubernetes Engine. As the application will be internet-facing, they want to minimize the attack surface of the container.
What should they do?
Use Cloud Build to build the container images.
Build small containers using small base images.
Delete non-used versions from Container Registry.
Use a Continuous Delivery tool to deploy the application.
You want to evaluate your organization's Google Cloud instance for PCI compliance. You need to identify Google's inherent controls.
Which document should you review to find the information?
Google Cloud Platform: Customer Responsibility Matrix
PCI DSS Requirements and Security Assessment Procedures
PCI SSC Cloud Computing Guidelines
Product documentation for Compute Engine
An organization is migrating from their current on-premises productivity software systems to G Suite. Some network security controls were in place that were mandated by a regulatory body in their region for their previous on-premises system. The organization's risk team wants to ensure that network security controls are maintained and effective in G Suite. A security architect supporting this migration has been asked to ensure that network security controls are in place as part of the new shared responsibility model between the organization and Google Cloud.
What solution would help meet the requirements?
Ensure that firewall rules are in place to meet the required controls.
Set up Cloud Armor to ensure that network security controls can be managed for G Suite.
Network security is a built-in solution and Google's Cloud responsibility for SaaS products like G Suite.
Set up an array of Virtual Private Cloud (VPC) networks to control network security as mandated by the relevant regulation.
An organization receives an increasing number of phishing emails.
Which method should be used to protect employee credentials in this situation?
Multifactor Authentication
A strict password policy
Captcha on login pages
Encrypted emails
A customer deployed an application on Compute Engine that takes advantage of the elastic nature of cloud computing.
How can you work with Infrastructure Operations Engineers to best ensure that Windows Compute Engine VMs are up to date with all the latest OS patches?
Build new base images when patches are available, and use a CI/CD pipeline to rebuild VMs, deploying incrementally.
Federate a Domain Controller into Compute Engine, and roll out weekly patches via Group Policy Object.
Use Deployment Manager to provision updated VMs into new serving Instance Groups (IGs).
Reboot all VMs during the weekly maintenance window and allow the StartUp Script to download the latest patches from the internet.
You want to limit the images that can be used as the source for boot disks. These images will be stored in a dedicated project.
What should you do?
Use the Organization Policy Service to create a compute.trustedimageProjects constraint on the organization level. List the trusted project as the whitelist in an allow operation.
Use the Organization Policy Service to create a compute.trustedimageProjects constraint on the organization level. List the trusted projects as the exceptions in a deny operation.
In Resource Manager, edit the project permissions for the trusted project. Add the organization as member with the role: Compute Image User.
In Resource Manager, edit the organization permissions. Add the project ID as member with the role: Compute Image User.
