Google PROFESSIONAL-CLOUD-SECURITY-ENGINEER Exam Questions & Answers

Your security team wants to implement a defense-in-depth approach to protect sensitive data stored in a Cloud Storage bucket. Your team has the following requirements:

1.

The Cloud Storage bucket in Project A can only be readable from Project B.

2.

The Cloud Storage bucket in Project A cannot be accessed from outside the network.

3.

Data in the Cloud Storage bucket cannot be copied to an external Cloud Storage bucket. What should the security team do?

A. Enable domain restricted sharing in an organization policy, and enable uniform bucket-level access on the Cloud Storage bucket.

B. Enable VPC Service Controls, create a perimeter around Projects A and B. and include the Cloud Storage API in the Service Perimeter configuration.

C. Enable Private Access in both Project A and B's networks with strict firewall rules that allow communication between the networks.

D. Enable VPC Peering between Project A and B's networks with strict firewall rules that allow communication between the networks.

A retail customer allows users to upload comments and product reviews. The customer needs to make sure the text does not include sensitive data before the comments or reviews are published. Which Google Cloud Service should be used to achieve this?

A. Cloud Key Management Service

B. Cloud Data Loss Prevention API

C. BigQuery

D. Cloud Security Scanner

Your organization operates Virtual Machines (VMs) with only private IPs in the Virtual Private Cloud (VPC) with internet access through Cloud NAT. Everyday, you must patch all VMs with critical OS updates and provide summary reports. What should you do?

A. Validate that the egress firewall rules allow any outgoing traffic. Log in to each VM and execute OS specific update commands. Configure the Cloud Scheduler job to update with critical patches daily for daily updates.

B. Copy the latest patches to the Cloud Storage bucket. Log in to each VM, download the patches from the bucket, and install them.

C. Assign public IPs to VMs. Validate that the egress firewall rules allow any outgoing traffic. Log in to each VM, and configure a daily cron job to enable for OS updates at night during low activity periods.

D. Ensure that VM Manager is installed and running on the VMs. In the OS patch management service, configure the patch jobs to update with critical patches dally.