Google Cloud Certified - Professional Cloud Security Engineer - Professional-Cloud-Security-Engineer Free Exam Questions

A. Generate a data encryption key (DEK) locally.Use a key encryption key (KEK) to wrap the DEK.
Encrypt data with the KEK.Store the encrypted data and the wrapped KEK.

B. Generate a key encryption key (KEK) locally.Generate a data encryption key (DEK) locally. Encrypt data with the KEK.Store the encrypted data and the wrapped DEK.

C. Generate a key encryption key (KEK) locally.Use the KEK to generate a data encryption key (DEK).
Encrypt data with the DEK.Store the encrypted data and the wrapped DEK.

D. Generate a data encryption key (DEK) locally.Encrypt data with the DEK.Use a key encryption key (KEK) to wrap the DEK. Store the encrypted data and the wrapped DEK.

A. Create a service account and embed a long-lived service account key file that has write permissions specified directly in the batch jobscript.

B. Create a service account with full Cloud Storage administrator permissions. Assign the service account to the Compute Engine instance.

C. Create a service account with the storage .objectcreator role. Use service account impersonation in the batch job's code.

D. Grant the predefined storage.objectcreator role to the Compute Engine instances default service account.

A. Set up multiple VPC networks, and set up multi-NIC virtual appliances to connect the networks.

B. Set up a Shared VPC where the security team manages the firewall rules, and share the network with developers via service projects.

C. Set up VPC Network Peering, and allow developers to peer their network with a Shared VPC.

D. Set up a VPC in a project. Assign the Compute Network Admin role to the security team, and assign the Compute Admin role to the developers.

A. Client-side encryption

B. Hardware Security Module

C. External Key Manager

D. Customer-supplied encryption keys

E. Confidential Computing and Istio

A. Configure a Google Kubernetes Engine cluster that uses Workload Identity to supply credentials to GitHub.

B. Create a service account key and add it to the GitHub repository content.

C. Create a service account key and add it to the GitHub pipeline configuration file.

D. Configure workload identity federation to use GitHub as an identity pool provider.

A. Use VPC Service Controls to create security perimeters around the projects for BigQuery. Cloud Storage, and Cloud SQL services. restricting access based on the network origin of the requests.

B. Configure an access level to control access to the Google Cloud console for users managing these data services. Require multi-factor authentication for all access attempts.

C. Enable project-level data access logs for BigQuery. Cloud Storage, and Cloud SQL. Configure log sinks to export these logs to Security Command Center to identify unauthorized access attempts.

D. Grant project-level group permissions by using specific Cloud IAM roles. Use BigQuery authorized views. Cloud Storage uniform bucket-level access, and Cloud SQL database roles.

A. Customer-managed encryption keys

B. Customer-Supplied Encryption Keys

C. Access Transparency and Approval

D. Key Access Justifications

E. Cloud External Key Manager

A. Customer-managed encryption keys

B. Cloud External Key Manager

C. Google default encryption

D. Secret Manager

E. Customer-supplied encryption keys.

A. Remove Owner roles from end users, and configure Cloud Data Loss Prevention.

B. Configure uniform bucket-level access, and enforce domain restricted sharing in an organization policy.

C. Remove Owner roles from end users, and enforce domain restricted sharing in an organization policy.

D. Remove *.setIamPolicy permissions from all roles, and enforce domain restricted sharing in an organization policy.

A. Automate a security scanner that verifies that no common vulnerabilities and exposures (CVEs) are present in your trusted image repository.

B. Create a Cloud Function that is automatically triggered when a new virtual machine is created from the trusted image repository Verify that the image is not deprecated.

C. Implement an organization policy to enforce that boot disks can only be created from images that come from the trusted image project.

D. Implement an organization policy constraint that enables the Shielded VM service on all projects to enforce the trusted image repository usage.

A. In Google Workspace, grant the Groups Editor role to the service account. Enable the Cloud Identity API. Use a service account key.

B. In Google Workspace, grant the service account client ID access to the scope, https://www.googleapis.
com/auth/admin.directory.group, by using domain-wide delegation, and use a service account key.

C. In Google Workspace, grant the service account client ID access to the scope, https://www.googleapis.
com/auth/admin.directory.group, by using domain-wide delegation. Use Application Default Credentials with the resource-attached service account.

D. In Google Workspace, grant the Groups Editor role to the service account, enable the Cloud Identity API, and use Application Default Credentials with the resource-attached service account.

A. Firewall rules that can be created with a tag from one peered network to another peered network

B. Non-transitive peered networks; where only directly peered networks can communicate

C. Ability to peer networks that belong to different Google Cloud Platform organizations

D. Central management of routes, firewalls, and VPNs for peered networks

E. Ability to share specific subnets across peered networks

A. Do nothing. Vertex AI foundation models are frozen by default and do not use your data for model- tuning purposes.

B. Do not use Vertex AI for sensitive data. Use only public data with minimal privacy requirements.

C. Encrypt your data by using customer-managed encryption keys (CMEK) to have full control over encryption key access.

D. Contact Google support to opt out of model tuning.

A. Set up a workload identity pool with an OpenID Connect (OIDC) service on the name machine Configure a rule to let principals in the pool impersonate the Google Cloud service account.

B. Set up a workload identity pool with an OpenID Connect (OIDC) service on the same machine Let all principals in the pool impersonate the Google Cloud service account.

C. Set up a workload identity pool with your corporate Active Directory Federation Service (ADFS) Configure a rule to let principals in the pool impersonate the Google Cloud service account.

D. Set up a workload identity pool with your corporate Active Directory Federation Service (ADFS) Let all principals in the pool impersonate the Google Cloud service account.

A. Create an organization policy at the folder level using the Restrict Resource Service Usage constraint, and define the allowed services per folder.

B. Configure VPC Service Controls perimeters around each folder, and define the allowed services within the perimeter.

C. Create a global organization policy at the organization level with the Restrict Resource Service Usage constraint, and apply exceptions for other folders.

D. Implement IAM conditions on service account creation within each folder.