Summer Certification Limited Time 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code = getmirror

Pass the Google Cloud Certified Professional-Cloud-Security-Engineer Questions and answers with ExamsMirror

Practice at least 50% of the questions to maximize your chances of passing.

Exam Professional-Cloud-Security-Engineer Premium Access

View all detail and faqs for the Professional-Cloud-Security-Engineer exam

Go to Exam

646 Students Passed

90% Average Score

91% Same Questions

Viewing page 9 out of 10 pages

Viewing questions 81-90 out of questions

Questions # 81:

You are a Security Administrator at your organization. You need to restrict service account creation capability within production environments. You want to accomplish this centrally across the organization. What should you do?

Options:

Use Identity and Access Management (IAM) to restrict access of all users and service accounts that have access to the production environment.

Use organization policy constraints/iam.disableServiceAccountKeyCreation boolean to disable the creation of new service accounts.

Use organization policy constraints/iam.disableServiceAccountKeyUpload boolean to disable the creation of new service accounts.

Use organization policy constraints/iam.disableServiceAccountCreation boolean to disable the creation of new service accounts.

Questions # 82:

A company is backing up application logs to a Cloud Storage bucket shared with both analysts and the administrator. Analysts should only have access to logs that do not contain any personally identifiable information (PII). Log files containing PII should be stored in another bucket that is only accessible by the administrator.

What should you do?

Options:

Use Cloud Pub/Sub and Cloud Functions to trigger a Data Loss Prevention scan every time a file is uploaded to the shared bucket. If the scan detects PII, have the function move into a Cloud Storage bucket only accessible by the administrator.

Upload the logs to both the shared bucket and the bucket only accessible by the administrator. Create ajob trigger using the Cloud Data Loss Prevention API. Configure the trigger to delete any files from the shared bucket that contain PII.

On the bucket shared with both the analysts and the administrator, configure Object Lifecycle Management to delete objects that contain any PII.

On the bucket shared with both the analysts and the administrator, configure a Cloud Storage Trigger that is only triggered when PII data is uploaded. Use Cloud Functions to capture the trigger and delete such files.

Questions # 83:

You need to set up a Cloud interconnect connection between your company's on-premises data center and VPC host network. You want to make sure that on-premises applications can only access Google APIs over the Cloud Interconnect and not through the public internet. You are required to only use APIs that are supported by VPC Service Controls to mitigate against exfiltration risk to non-supported APIs. How should you configure the network?

Options:

Enable Private Google Access on the regional subnets and global dynamic routing mode.

Set up a Private Service Connect endpoint IP address with the API bundle of "all-apis", which is advertised as a route over the Cloud interconnect connection.

Use private.googleapis.com to access Google APIs using a set of IP addresses only routable from within Google Cloud, which are advertised as routes over the connection.

Use restricted googleapis.com to access Google APIs using a set of IP addresses only routable from within Google Cloud, which are advertised as routes over the Cloud Interconnect connection.

Questions # 84:

Your organization has 3 TB of information in BigQuery and Cloud SQL. You need to develop a cost-effective, scalable, and secure strategy to anonymize the personally identifiable information (PII) that exists today. What should you do?

Options:

Scan your BigQuery and Cloud SQL data using the Cloud DLP data profiling feature. Use the data profiling results to create a de-identification strategy with either Cloud Sensitive Data Protection's de-identification templates or custom configurations.

Create a new BigQuery dataset and Cloud SQL instance. Copy a small subset of the data to these new locations. Use Cloud Data Loss Prevention API to scan this subset for PII. Based on the results, create a custom anonymization script and apply the script to the entire 3 TB dataset in the original locations.

Export all 3TB of data from BigQuery and Cloud SQL to Cloud Storage. Use Cloud Sensitive Data Protection to anonymize the exported data. Re-import the anonymized data back into BigQuery and Cloud SQL.

Inspect a representative sample of the data in BigQuery and Cloud SQL to identify PII. Based on this analysis, develop a custom script to anonymize the identified PII.

Answer

Explanation

The problem requires a cost-effective, scalable, and secure strategy to anonymize 3 TB of PII in BigQuery and Cloud SQL.

Cloud Sensitive Data Protection (Cloud DLP): Cloud DLP is Google Cloud's fully managed service designed for discovering, classifying, and de-identifying sensitive data, including PII, across various Google Cloud services and on-premises environments. It is specifically built for scale and security.

Extract Reference: "Sensitive Data Protection helps you discover, classify, and de-identify sensitive data." and "Sensitive Data Protection includes advanced de-identification techniques, such as tokenization, masking, and format-preserving encryption, to help you protect your sensitive data while preserving its utility for analysis." (Google Cloud Documentation: "Sensitive Data Protection overview" - https://cloud.google.com/sensitive-data-protection/docs/overview)

Data Profiling: Cloud DLP's data profiling feature automatically scans your data (e.g., BigQuery tables, Cloud SQL databases) to identify where sensitive data resides and to understand its characteristics. This is crucial for developing an effective de-identification strategy.

Extract Reference: "Data profiles provide metrics and insights about your sensitive and high-risk data, helping you make informed decisions about data protection, access, and storage." and "When you configure Sensitive Data Protection to profile data in BigQuery, Cloud Storage, and Datastore, it automatically scans your data for sensitive information." (Google Cloud Documentation: "About data profiles" - https://cloud.google.com/sensitive-data-protection/docs/concepts-data-profiles)

De-identification Templates and Custom Configurations: After profiling identifies the PII, Cloud DLP offers various de-identification methods, which can be applied using pre-built templates or custom configurations. This allows for flexible and targeted anonymization. For BigQuery specifically, DLP can integrate with remote functions for de-identification at query time, minimizing data movement.

Extract Reference: "De-identification techniques, like encryption, obfuscate raw sensitive identifiers in your data. These techniques let you preserve the utility of your data for joining or analytics, while reducing the risk of handling the data." and "You can use this tutorial to replace that pipeline with a SQL query for only re-identification or both de-identification and re-identification." (Google Cloud Documentation: "De-identify BigQuery data at query time | Sensitive Data Protection Documentation" - https://cloud.google.com/sensitive-data-protection/docs/deidentify-bq-tutorial)

Let's evaluate the other options:

B. Copy small subset... create a custom anonymization script... apply the script to the entire 3 TB dataset: Relying on a "custom anonymization script" for 3 TB of data is generally not scalable, cost-effective, or secure compared to a managed service like Cloud DLP. Custom scripts require significant development, testing, maintenance, and robust error handling for large datasets, and might introduce security vulnerabilities.

C. Export all 3TB of data... to Cloud Storage... anonymize... Re-import: While feasible, exporting and re-importing 3 TB of data is a very time-consuming and potentially costly process due to data transfer and storage operations. Cloud DLP can often process data in-place or integrate more efficiently, especially with BigQuery. This option might not be the most cost-effective or efficient.

D. Inspect a representative sample... develop a custom script: Similar to option B, this relies on a custom script, which is less ideal for scalability, cost-effectiveness, and security than a managed service like Cloud DLP for 3 TB of sensitive data. Sample inspection is a good initial step, but the subsequent custom script for anonymization is the weak point.

Therefore, using Cloud DLP's data profiling to inform a de-identification strategy with its managed templates and configurations is the most appropriate, scalable, secure, and cost-effective approach for anonymizing PII in BigQuery and Cloud SQL.

Questions # 85:

Which Identity-Aware Proxy role should you grant to an Identity and Access Management (IAM) user to access HTTPS resources?

Options:

Security Reviewer

lAP-Secured Tunnel User

lAP-Secured Web App User

Service Broker Operator

Questions # 86:

An office manager at your small startup company is responsible for matching payments to invoices and creating billing alerts. For compliance reasons, the office manager is only permitted to have the Identity and Access Management (IAM) permissions necessary for these tasks. Which two IAM roles should the office manager have? (Choose two.)

Options:

Organization Administrator

Project Creator

Billing Account Viewer

Billing Account Costs Manager

Billing Account User

Questions # 87:

Employees at your company use their personal computers to access your organization s Google Cloud console. You need to ensure that users can only access the Google Cloud console from their corporate-issued devices and verify that they have a valid enterprise certificate

What should you do?

Options:

Implement an Identity and Access Management (1AM) conditional policy to verify the device certificate

Implement a VPC firewall policy Activate packet inspection and create an allow rule to validate and verify the device certificate.

Implement an organization policy to verify the certificate from the access context.

Implement an Access Policy in BeyondCorp Enterprise to verify the device certificate Create an access binding with the access policy just created.

Questions # 88:

Your organization develops software involved in many open source projects and is concerned about software supply chain threats You need to deliver provenance for the build to demonstrate the software is untampered.

What should you do?

Options:

• 1- Generate Supply Chain Levels for Software Artifacts (SLSA) level 3 assurance by using Cloud Build.• 2. View the build provenance in the Security insights side panel within the Google Cloud console.

• 1. Review the software process.• 2. Generate private and public key pairs and use Pretty Good Privacy (PGP) protocols to sign the output software artifacts together with a file containing the address of your enterprise and point of contact.• 3. Publish the PGP signed attestation to your public web page.

• 1, Publish the software code on GitHub as open source.• 2. Establish a bug bounty program, and encourage the open source community to review, report, and fix the vulnerabilities.

• 1. Hire an external auditor to review and provide provenance• 2. Define the scope and conditions.• 3. Get support from the Security department or representative.• 4. Publish the attestation to your public web page.

Questions # 89:

You are in charge of creating a new Google Cloud organization for your company. Which two actions should you take when creating the super administrator accounts? (Choose two.)

Options:

Create an access level in the Google Admin console to prevent super admin from logging in to Google Cloud.

Disable any Identity and Access Management (1AM) roles for super admin at the organization level in the Google Cloud Console.

Use a physical token to secure the super admin credentials with multi-factor authentication (MFA).

Use a private connection to create the super admin accounts to avoid sending your credentials over the Internet.

Provide non-privileged identities to the super admin users for their day-to-day activities.

Questions # 90:

You need to implement an encryption at-rest strategy that reduces key management complexity for non-sensitive data and protects sensitive data while providing the flexibility of controlling the key residency and rotation schedule. FIPS 140-2 L1 compliance is required for all data types. What should you do?