Question 1

Your Google Cloud environment has one organization node, one folder named Apps." and several projects within that folder The organizational node enforces the constraints/iam.allowedPolicyMemberDomains organization policy, which allows members from the terramearth.com organization The "Apps" folder enforces the constraints/iam.allowedPolicyMemberDomains organization policy, which allows members from the flowlogistic.com organization. It also has the inheritFromParent: false property. You attempt to grant access to a project in the Apps folder to the user [email protected]. What is the result of your action and why?

Options :

A : The action fails because a constraints/iam.allowedPolicyMemberDomains organization policy must be defined on the current project to deactivate the constraint temporarily

B : The action fails because a constraints/iam.allowedPolicyMemberDomains organization policy is in place and only members from the flowlogistic.com organization are allowed.

C : The action succeeds because members from both organizations, terramearth. com or flowlogistic.com, are allowed on projects in the "Apps" folder

D : The action succeeds and the new member is successfully added to the project-s Identity and Access Management (1AM) policy because all policies are inherited by underlying folders and projects.

Answer: B

Question 2

A large e-retailer is moving to Google Cloud Platform with its ecommerce website. The company wants toensure payment information is encrypted between the customer’s browser and GCP when the customerscheckout online.What should they do?

Options :

A : Configure an SSL Certificate on an L7 Load Balancer and require encryption

B : Configure an SSL Certificate on a Network TCP Load Balancer and require encryption

C : Configure the firewall to allow inbound traffic on port 443, and block all other inbound traffic

D : Configure the firewall to allow outbound traffic on port 443, and block all other outbound traffic.

Answer: A

Question 3

A customer’s company has multiple business units. Each business unit operates independently, and each has their own engineering group. Your team wants visibility into all projects created within the company and wants to organize their Google Cloud Platform (GCP) projects based on different business units. Each business unit also requires separate sets of IAM permissions. Which strategy should you use to meet these needs?

Options :

A : Create an organization node, and assign folders for each business unit.

B : Establish standalone projects for each business unit, using gmail.com accounts.

C : Assign GCP resources in a project, with a label identifying which business unit owns the resource.

D : Assign GCP resources in a VPC for each business unit to separate network access.

Answer: A

Question 4

A customer has 300 engineers. The company wants to grant different levels of access and efficiently manage IAM permissions between users in the development and production environment projects. Which two steps should the company take to meet these requirements? (Choose two.)

Options :

A : Create a project with multiple VPC networks for each environment.

B : Create a folder for each development and production environment.

C : Create a Google Group for the Engineering team, and assign permissions at the folder level.

D : Create an Organizational Policy constraint for each folder environment.

E : Create projects for each environment, and grant IAM rights to each engineering user.

Answer: B,C

Question 5

You are consulting with a client that requires end-to-end encryption of application data (including data in transit, data in use, and data at rest) within Google Cloud. Which options should you utilize to accomplish this? (Choose two.)

Options :

A : External Key Manager

B : Customer-supplied encryption keys

C : Hardware Security Module

D : Confidential Computing and Istio

E : Client-side encryption

Answer: D,E

Free Professional-Cloud-Security-Engineer Mock Exam – Practice Online Confidently

Buying Options: