Question 1

As a Blockchain-based payment system company, we are migrating to Google Cloud and want to ensure network security controls are maintained. What solution can we implement to ensure effective network security controls as part of the new shared responsibility model between our company and Google Cloud?

Options :

A : Make certain that the necessary controls are met by implementing firewall rules.

B : Configure Cloud Armor to enable centralized management of network security controls for G Suite.

C : Configure a range of Virtual Private Cloud (VPC) networks in compliance with the applicable regulations to manage network security.

D : Google Cloud has a built-in network security solution that is responsible for ensuring the security of SaaS products such as G Suite.

Answer: D

Question 2

You plan to deploy your cloud infrastructure using a CI/CD cluster hosted on Compute Engine. You want to minimize the risk of its credentials being stolen by a third party. What should you do?

Options :

A : Create a dedicated Cloud Identity user account for the cluster. Use a strong self-hosted vault solution to store the user-s temporary credentials

B : Create a dedicated Cloud Identity user account for the cluster. Enable the constraints/ iam.disableServiceAccountCreation organization policy at the project level.

C : Create a custom service account for the cluster Enable the constraints/iam. disableServiceAccountKeyCreation organization policy at the project level.

D : Create a custom service account for the cluster Enable the constraints/ iam.allowServiceAccountCredentialLifetimeExtension organization policy at the project level.

Answer: C

Question 3

You are on your company's development team. You noticed that your web application hosted in staging on GKE dynamically includes user data in web pages without first properly validating the inputted data. This could allow an attacker to execute gibberish commands and display arbitrary content in a victim user's browser in a production environment. How should you prevent and fix this vulnerability?

Options :

A : Use Cloud IAP based on IP address or end-user device attributes to prevent and fix the vulnerability.

B : Set up an HTTPS load balancer, and then use Cloud Armor for the production environment to prevent the potential XSS attack.

C : Use Web Security Scanner to validate the usage of an outdated library in the code, and then use a secured version of the included library.

D : Use Web Security Scanner in staging to simulate an XSS injection attack, and then use a templating system that supports contextual auto-escaping.

Answer: D

Question 4

Your Google Cloud environment has one organization node, one folder named Apps." and several projects within that folder The organizational node enforces the constraints/iam.allowedPolicyMemberDomains organization policy, which allows members from the terramearth.com organization The "Apps" folder enforces the constraints/iam.allowedPolicyMemberDomains organization policy, which allows members from the flowlogistic.com organization. It also has the inheritFromParent: false property. You attempt to grant access to a project in the Apps folder to the user [email protected]. What is the result of your action and why?

Options :

A : The action fails because a constraints/iam.allowedPolicyMemberDomains organization policy must be defined on the current project to deactivate the constraint temporarily

B : The action fails because a constraints/iam.allowedPolicyMemberDomains organization policy is in place and only members from the flowlogistic.com organization are allowed.

C : The action succeeds because members from both organizations, terramearth. com or flowlogistic.com, are allowed on projects in the "Apps" folder

D : The action succeeds and the new member is successfully added to the project-s Identity and Access Management (1AM) policy because all policies are inherited by underlying folders and projects.

Answer: B

Question 5

You are the security admin of your company. You have 3,000 objects in your Cloud Storage bucket. You do not want to manage access to each object individually. You also do not want the uploader of an object to always have full control of the object. However, you want to use Cloud Audit Logs to manage access to your bucket. What should you do?

Options :

A : Set up an ACL with OWNER permission to a scope of allUsers.

B : Set up an ACL with READER permission to a scope of allUsers.

C : Set up a default bucket ACL and manage access for users using IAM

D : Set up Uniform bucket-level access on the Cloud Storage bucket and manage access for users using IAM.

Answer: D

Free Professional-Cloud-Security-Engineer Mock Exam – Practice Online Confidently

Buying Options: