Updated May 16, 2026 Verified Professional-Cloud-Security-Engineer dumps Q&As - 100% Pass
New 2026 Latest Questions Professional-Cloud-Security-Engineer Dumps - Use Updated Google Exam
Exam Info
The Google Professional Cloud Security Engineer certification exam is two hours long. The applicants will be asked to answer multiple-select and multiple-choice questions during the test. To register for the exam, the individuals will be required to pay the fee of $200 plus applicable taxes. They can select the convenient mode of delivery while completing the registration process. They can take it as an online proctored test from a remote location or as an onsite proctored exam at the nearest testing center. At the present moment, this qualifying exam is given to the learners in the English language only.
NEW QUESTION # 172
You are on your company's development team. You noticed that your web application hosted in staging on GKE dynamically includes user data in web pages without first properly validating the inputted dat a. This could allow an attacker to execute gibberish commands and display arbitrary content in a victim user's browser in a production environment.
How should you prevent and fix this vulnerability?
- A. Set up an HTTPS load balancer, and then use Cloud Armor for the production environment to prevent the potential XSS attack.
- B. Use Web Security Scanner in staging to simulate an XSS injection attack, and then use a templating system that supports contextual auto-escaping.
- C. Use Cloud IAP based on IP address or end-user device attributes to prevent and fix the vulnerability.
- D. Use Web Security Scanner to validate the usage of an outdated library in the code, and then use a secured version of the included library.
Answer: B
Explanation:
There is mention about simulating in Web Security Scanner. "Web Security Scanner cross-site scripting (XSS) injection testing *simulates* an injection attack by inserting a benign test string into user-editable fields and then performing various user actions." https://cloud.google.com/security-command-center/docs/how-to-remediate-web-security-scanner-findings#xss
NEW QUESTION # 173
Your company's detection and response team requires break-glass access to the Google Cloud organization in the event of a security investigation At the end of each day, all security group membership is removed You need to automate user provisioning to a Cloud Identity security group You have created a service account to provision group memberships Your solution must follow Google-recommended practices and comply with the principle of least privilege What should you do?
- A. In Google Workspace, grant the Groups Editor role to the service account, enable the Cloud Identity API, and use Application Default Credentials with the resource-attached service account
- B. In Google Workspace, grant the Groups Editor role to the service account Enable the Cloud Identity API Use a service account key
- C. In Google Workspace, grant the service account client ID access to the scope, https://wwwgoogleapiscom/auth/admindirectorygroup, by using domain-wide delegation Use Application Default Credentials with the resource-attached service account
- D. In Google Workspace, grant the service account client ID access to the scope, https://wwwgoogleapiscom/auth/admindirectorygroup, by using domain-wide delegation, and use a service account key
Answer: C
Explanation:
The problem requires automating user provisioning to a Cloud Identity security group using a service account, adhering to Google-recommended practices and the principle of least privilege Cloud Identity Groups and Google Workspace: Cloud Identity groups are managed as part of Google Workspace To programmatically manage Google Workspace resources (like groups), you typically use the Admin SDK APIs Domain-Wide Delegation: Service accounts cannot directly authenticate to Google Workspace APIs using IAM roles Instead, they require "domain-wide delegation" to impersonate a user with the necessary administrative privileges within Google Workspace This allows a service account to access user data or perform administrative tasks across the domain The correct scope for managing groups is https://wwwgoogleapiscom/auth/admindirectorygroupExtract Reference: "To allow a service account to access user data on behalf of users in a Google Workspace domain, you must delegate domain-wide authority to your service account" (Google Cloud documentation: https://developersgooglecom/identity/protocols/oauth2/service-account#delegating) Extract Reference (Admin SDK Scopes): The https://wwwgoogleapiscom/auth/admindirectorygroup scope is explicitly listed for "View and manage all groups on the domain" (Google Workspace Admin SDK documentation: https://developersgooglecom/admin-sdk/directory/v1/scopes) Application Default Credentials (ADC) with Resource-Attached Service Account: Google-recommended practices strongly advise against using service account keys directly for authentication when running on Google Cloud infrastructure Instead, it's recommended to use Application Default Credentials (ADC) with a service account attached to the resource (eg, a Compute Engine VM, Cloud Run service, or Cloud Functions) This method manages credentials automatically and securely, reducing the risk associated with managing and rotating keysExtract Reference: "For most Google Cloud services, Application Default Credentials (ADC) is the recommended way to authenticate" and "When running code in a Google Cloud environment, such as Compute Engine, Cloud Run, or Cloud Functions, use the built-in service account to authenticate automatically with ADC This is the most secure approach, as you don't need to manually create or manage service account keys" (Google Cloud documentation: https://cloudgooglecom/docs/authentication/production) Options C and D are incorrect because granting an IAM role like "Groups Editor" in Google Cloud does not enable a service account to manage Google Workspace (Cloud Identity) group memberships; domain-wide delegation is required for that Option A uses a service account key, which is less secure than ADC with a resource-attached service account according to Google's recommendations Therefore, option B is the most aligned with Google's recommended practices for securely automating group provisioning using a service account and domain-wide delegation
NEW QUESTION # 174
A company migrated their entire data/center to Google Cloud Platform. It is running thousands of instances across multiple projects managed by different departments. You want to have a historical record of what was running in Google Cloud Platform at any point in time.
What should you do?
- A. Use Security Command Center to view all assets across the organization.
- B. Use Forseti Security to automate inventory snapshots.
- C. Use Stackdriver to create a dashboard across all projects.
- D. Use Resource Manager on the organization level.
Answer: B
Explanation:
Only Forseti security can have both 'past' and 'present' (i.e. historical) records of the resources.
https://forsetisecurity.org/about/
NEW QUESTION # 175
You are a security administrator at your company and are responsible for managing access controls (identification, authentication, and authorization) on Google Cloud. Which Google-recommended best practices should you follow when configuring authentication and authorization? (Choose two.)
- A. Provision users with basic roles using Google's Identity and Access Management (1AM) service.
- B. Provide granular access with predefined roles.
- C. Use Google default encryption.
- D. Manually add users to Google Cloud.
- E. Use SSO/SAML integration with Cloud Identity for user authentication and user lifecycle management.
Answer: B,E
Explanation:
https://cloud.google.com/iam/docs/using-iam-securely#least_privilege Basic roles include thousands of permissions across all Google Cloud services. In production environments, do not grant basic roles unless there is no alternative. Instead, grant the most limited predefined roles or custom roles that meet your needs.
NEW QUESTION # 176
Your organization is developing an application that will have both corporate and public end-users.
You want to centrally manage those customers' identities and authorizations. Corporate end users must access the application by using their corporate user and domain name. What should you do?
- A. Do nothing. Google Workspace identities will allow you to filter personal accounts and disable their access.
- B. Use a customer identity and access management tool (CIAM) like Identity Platform.
- C. Federate the customers' identity provider (IdP) with Workforce Identity Federation in your application's project.
- D. Add the corporate and public end-user domains to domain restricted sharing on the organization.
Answer: B
NEW QUESTION # 177
Your organization operates Virtual Machines (VMs) with only private IPs in the Virtual Private Cloud (VPC) with internet access through Cloud NAT Everyday, you must patch all VMs with critical OS updates and provide summary reports What should you do?
- A. Copy the latest patches to the Cloud Storage bucket. Log in to each VM. download the patches from the bucket, and install them.
- B. Ensure that VM Manager is installed and running on the VMs. In the OS patch management service.
configure the patch jobs to update with critical patches daily. - C. Assign public IPs to VMs. Validate that the egress firewall rules allow any outgoing traffic Log in to each VM. and configure a daily cron job to enable for OS updates at night during low activity periods.
- D. Validate that the egress firewall rules allow any outgoing traffic Log in to each VM and execute OS specific update commands Configure the Cloud Scheduler job to update with critical patches daily for daily updates.
Answer: B
Explanation:
VM Manager is a suite of tools that can be used to manage operating systems for large virtual machine (VM) fleets running Windows and Linux on Compute Engine. It helps drive efficiency through automation and reduces the operational burden of maintaining these VM fleets. VM Manager includes several services such as OS patch management, OS inventory management, and OS configuration management. By using VM Manager, you can apply patches, collect operating system information, and install, remove, or auto-update software packages. The suite provides a high level of control and automation for managing large VM fleets on Google Cloud.
https://cloud.google.com/compute/docs/vm-manager
NEW QUESTION # 178
When working with agents in a support center via online chat, an organization's customers often share pictures of their documents with personally identifiable information (PII). The organization that owns the support center is concerned that the PII is being stored in their databases as part of the regular chat logs they retain for review by internal or external analysts for customer service trend analysis.
Which Google Cloud solution should the organization use to help resolve this concern for the customer while still maintaining data utility?
- A. Use Cloud Key Management Service (KMS) to encrypt the PII data shared by customers before storing it for analysis.
- B. Use Object Lifecycle Management to make sure that all chat records with PII in them are discarded and not saved for analysis.
- C. Use the generalization and bucketing actions of the DLP API solution to redact PII from the texts before storing them for analysis.
- D. Use the image inspection and redaction actions of the DLP API to redact PII from the images before storing them for analysis.
Answer: C
Explanation:
Explanation/Reference:
Reference; https://cloud.google.com/dlp/docs/deidentify-sensitive-data
NEW QUESTION # 179
You control network traffic for a folder in your Google Cloud environment. Your folder includes multiple projects and Virtual Private Cloud (VPC) networks You want to enforce on the folder level that egress connections are limited only to IP range 10.58.5.0/24 and only from the VPC network dev-vpc." You want to minimize implementation and maintenance effort What should you do?
- A. * 1. Attach external IP addresses to the VMs in scope.
* 2. Configure a VPC Firewall rule in "dev-vpc" that allows egress connectivity to IP range 10.58.5.0/24 for all source addresses in this network. - B. * 1. Leave the network configuration of the VMs in scope unchanged.
* 2. Create a new project including a new VPC network "new-vpc."
* 3 Deploy a network appliance in "new-vpc" to filter access requests and only allow egress connections from -dev-vpc" to 10.58.5.0/24. - C. * 1. Attach external IP addresses to the VMs in scope.
* 2. Define and apply a hierarchical firewall policy on folder level to deny all egress connections and to allow egress to IP range 10 58.5.0/24 from network dev-vpc. - D. * 1 Leave the network configuration of the VMs in scope unchanged
* 2 Enable Cloud NAT for dev-vpc" and restrict the target range in Cloud NAT to 10.58.5 0/24.
Answer: C
Explanation:
Explanation
This approach allows you to control network traffic at the folder level. By attaching external IP addresses to the VMs in scope, you can ensure that the VMs have a unique, routable IP address for outbound connections.
Then, by defining and applying a hierarchical firewall policy at the folder level, you can enforce that egress connections are limited to the specified IP range and only from the specified VPC network.
NEW QUESTION # 180
Your company has deployed an artificial intelligence model in a central project. This model has a lot of sensitive intellectual property and must be kept strictly isolated from the internet. You must expose the model endpoint only to a defined list of projects in your organization. What should you do?
- A. Activate Private Google Access in both the model project and in each project that needs to connect to the model. Create a firewall policy to allow connectivity to Private Google Access addresses.
- B. Create a central project to host Shared VPC networks that are provided to all other projects. Centrally administer all firewall rules in this project to grant access to the model.
- C. Within the model project, create an external Application Load Balancer that points to the model endpoint. Create a Cloud Armor policy to restrict IP addresses to Google Cloud.B. Within the model project, create an internal Application Load Balancer that points to the model endpoint. Expose this load balancer with Private Service Connect to a configured list of projects.
Answer: A
Explanation:
The requirements necessitate a private, cross-project service-to-service connection with explicit authorization-a capability perfectly addressed by Private Service Connect (PSC).
Internal Load Balancer: Ensures the service is isolated from the internet (Layer 7 Load Balancer for HTTP/S ML endpoint).
Private Service Connect (PSC): Allows a service (the model endpoint, exposed via the internal load balancer) in one VPC/project (producer) to be securely consumed by other VPCs/projects (consumers) using an internal IP address.
Defined List of Projects: PSC enables Explicit authorization, allowing the producer to define the allowed list of consumers that can establish a connection, directly meeting the granular restriction requirement.
Extracts:
"Private Service Connect provides... Explicit authorization. Private Service Connect provides an authorization model that gives consumers and producers granular control." (Source 2.4)
"Private Service Connect backends let Google Cloud load balancers send traffic through Private Service Connect to reach published services... Placing a load balancer in front of a managed service provides the consumer with more visibility and control..." (Source 2.4)
"Publish services by using Private Service Connect... Select the internal load balancer that hosts the service that you want to publish." (Source 2.3)
NEW QUESTION # 181
Your organization recently activated the Security Command Center (SCC) standard tier. There are a few Cloud Storage buckets that were accidentally made accessible to the public. You need to investigate the impact of the incident and remediate it.
What should you do?
- A. 1. Change permissions to limit access for authorized users.
2. Enforce a VPC Service Controls perimeter around all the production projects to immediately stop any unauthorized access.
3. Review the administrator activity audit logs to report on any unauthorized access. - B. 1. Change the bucket permissions to limit access.
2. Query the bucket's usage logs to report on unauthorized access to the data.
3. Enforce the organization policy storage.publicAccessPrevention to avoid regressions. - C. 1. Remove the Identity and Access Management (IAM) granting access to all Users from the buckets.
2. Apply the organization policy storage.uniformBucketLevelAccess to prevent regressions.
3. Query the data access logs to report on unauthorized access. - D. 1. Change bucket permissions to limit access.
2. Query the data access audit logs for any unauthorized access to the buckets.
3. After the misconfiguration is corrected, mute the finding in the Security Command Center.
Answer: B
Explanation:
https://cloud.google.com/storage/docs/access-logs#should-you-use
https://cloud.google.com/storage/docs/org-policy-constraints#public-access-prevention
NEW QUESTION # 182
You have the following resource hierarchy. There is an organization policy at each node in the hierarchy as shown. Which load balancer types are denied in VPC A?
- A. INTERNAL_TCP_UDP, INTERNAL_HTTP_HTTPS is denied in accordance with the folder's policy.
- B. All load balancer types are denied in accordance with the global node's policy.
- C. EXTERNAL_TCP_PROXY, EXTERNAL_SSL_PROXY, INTERNAL_TCP_UDP, andINTERNAL_HTTP_HTTPS are denied in accordance with the folder and project's policies.
- D. EXTERNAL_TCP_PROXY, EXTERNAL_SSL_PROXY are denied in accordance with the project's policy.
Answer: C
Explanation:
Understanding Organization Policies:
Organization policies are rules that can be set at different levels of the resource hierarchy in GCP to enforce governance and compliance.
These policies can be set at the organization node, folders, and projects, and they are inherited down the hierarchy unless explicitly overridden.
Hierarchy and Policy Inheritance:
The provided resource hierarchy has an organization node (Example.com), folders (Folder 1 and Folder 2), and a project (Project 2) under Folder 2 with a specific VPC (VPC A).
Each node in the hierarchy can have its own policies, and these policies are inherited by child nodes unless overridden.
Analyzing the Policies in the Hierarchy:
Organization Node Policy:
json
Copy code
{ "constraint": "constraints/compute.restrictLoadBalancerCreationForTypes", "listPolicy": { "allValues":
"DENY" } }
This policy at the organization node denies all load balancer types.
Folder 2 Policy:
json
Copy code
{ "constraint": "constraints/compute.restrictLoadBalancerCreationForTypes", "listPolicy": { "deniedValues":
["INTERNAL_TCP_UDP", "INTERNAL_HTTP_HTTPS"] } }
This policy at Folder 2 denies the creation of INTERNAL_TCP_UDP and INTERNAL_HTTP_HTTPS load balancers.
Project 2 Policy:
json
Copy code
{ "constraint": "constraints/compute.restrictLoadBalancerCreationForTypes", "listPolicy": { "deniedValues":
["EXTERNAL_TCP_PROXY", "EXTERNAL_SSL_PROXY"] } }
This policy at Project 2 denies the creation of EXTERNAL_TCP_PROXY and EXTERNAL_SSL_PROXY load balancers.
Policy Application to VPC A:
Since policies are inherited, VPC A (which is within Project 2 under Folder 2) will be affected by the policies of both Folder 2 and Project 2.
Combining the denied values from both Folder 2 and Project 2:
From Folder 2: INTERNAL_TCP_UDP, INTERNAL_HTTP_HTTPS
From Project 2: EXTERNAL_TCP_PROXY, EXTERNAL_SSL_PROXY
Conclusion:
VPC A will have the following load balancer types denied: INTERNAL_TCP_UDP, INTERNAL_HTTP_HTTPS, EXTERNAL_TCP_PROXY, EXTERNAL_SSL_PROXY.
References:
GCP Documentation on Organization Policies
GCP Documentation on Constraints and List Policies
NEW QUESTION # 183
A customer implements Cloud Identity-Aware Proxy for their ERP system hosted on Compute Engine. Their security team wants to add a security layer so that the ERP systems only accept traffic from Cloud Identity- Aware Proxy.
What should the customer do to meet these requirements?
- A. Make sure that the ERP system can validate the identity headers in the HTTP requests.
- B. Make sure that the ERP system can validate the user's unique identifier headers in the HTTP requests.
- C. Make sure that the ERP system can validate the JWT assertion in the HTTP requests.
- D. Make sure that the ERP system can validate the x-forwarded-for headers in the HTTP requests.
Answer: C
Explanation:
Explanation/Reference:
NEW QUESTION # 184
You are developing a new application that uses exclusively Compute Engine VMs. Once a day, this application will execute five different batch jobs. Each of the batch jobs requires a dedicated set of permissions on Google Cloud resources outside of your application. You need to design a secure access concept for the batch jobs that adheres to the least-privilege principle.
What should you do?
- A. 1. Create a general service account "g-sa" to orchestrate the batch jobs.
2. Create one service account per batch job 'b-sa-[1-5]'. Grant only the permissions required to run the individual batch jobs to the service accounts and generate service account keys for each of these service accounts.
3. Store the service account keys in Secret Manager. Grant g-sa access to Secret Manager and run the batch jobs with the permissions of b-sa-[1-5]. - B. 1. Create a general service account "g-sa" to orchestrate the batch jobs.
2. Create one service account per batch job "b-sa-[1-5]", and grant only the permissions required to run the individual batch jobs to the service accounts.
3. Grant the Service Account Token Creator role to g-sa. Use g-sa to obtain short-lived access tokens for b-sa-[1-5] and to execute the batch jobs with the permissions of b-sa-[1-5]. - C. 1. Create a workload identity pool and configure workload identity pool providers for each batch job.
2. Assign the workload identity user role to each of the identities configured in the providers.
3. Create one service account per batch job "b-sa-[1-5]", and grant only the permissions required to run the individual batch jobs to the service accounts.
4. Generate credential configuration files for each of the providers. Use these files to execute the batch jobs with the permissions of b-sa-[1-5]. - D. 1. Create a general service account "g-sa" to execute the batch jobs.
2. Grant the permissions required to execute the batch jobs to g-sa.
3. Execute the batch jobs with the permissions granted to g-sa.
Answer: B
Explanation:
This approach adheres to the principle of least privilege by ensuring that each batch job has only the permissions it needs to run. The general service account "g-sa" is used to orchestrate the batch jobs, and the Service Account Token Creator role allows it to obtain short-lived access tokens for the batch job service accounts "b-sa-[1-5]". This setup allows the batch jobs to be executed with the permissions of the respective service accounts.
NEW QUESTION # 185
You need to follow Google-recommended practices to leverage envelope encryption and encrypt data at the application layer.
What should you do?
- A. Generate a new data encryption key (DEK) in Cloud KMS to encrypt the data, and generate a key encryption key (KEK) locally to encrypt the key. Store both the encrypted data and the encrypted DEK.
- B. Generate a new data encryption key (DEK) in Cloud KMS to encrypt the data, and generate a key encryption key (KEK) locally to encrypt the key. Store both the encrypted data and the KEK.
- C. Generate a data encryption key (DEK) locally to encrypt the data, and generate a new key encryption key (KEK) in Cloud KMS to encrypt the DEK. Store both the encrypted data and the KEK.
- D. Generate a data encryption key (DEK) locally to encrypt the data, and generate a new key encryption key (KEK) in Cloud KMS to encrypt the DEK. Store both the encrypted data and the encrypted DEK.
Answer: D
Explanation:
Reference:
https://cloud.google.com/kms/docs/envelope-encryption
NEW QUESTION # 186
You are designing a new governance model for your organization's secrets that are stored in Secret Manager.
Currently, secrets for Production and Non-Production applications are stored and accessed using service accounts. Your proposed solution must:
Provide granular access to secrets
Give you control over the rotation schedules for the encryption keys that wrap your secrets Maintain environment separation Provide ease of management Which approach should you take?
- A. 1. Use separate Google Cloud projects to store Production and Non-Production secrets.2. Enforce access control to secrets using project-level identity and Access Management (IAM) bindings.3. Use customer-managed encryption keys to encrypt secrets.
- B. 1. Use a single Google Cloud project to store both Production and Non-Production secrets.2. Enforce access control to secrets using project-level Identity and Access Management (IAM) bindings.3. Use customer-managed encryption keys to encrypt secrets.
- C. 1. Use separate Google Cloud projects to store Production and Non-Production secrets.2. Enforce access control to secrets using secret-level Identity and Access Management (IAM) bindings.3. Use Google-managed encryption keys to encrypt secrets.
- D. 1. Use a single Google Cloud project to store both Production and Non-Production secrets.2. Enforce access control to secrets using secret-level Identity and Access Management (IAM) bindings.3. Use Google-managed encryption keys to encrypt secrets.
Answer: A
Explanation:
Provide granular access to secrets: 2.Enforce access control to secrets using project-level identity and Access Management (IAM) bindings. Give you control over the rotation schedules for the encryption keys that wrap your secrets: 3. Use customer-managed encryption keys to encrypt secrets. Maintain environment separation:
1. Use separate Google Cloud projects to store Production and Non-Production secrets.
NEW QUESTION # 187
An application running on a Compute Engine instance needs to read data from a Cloud Storage bucket. Your team does not allow Cloud Storage buckets to be globally readable and wants to ensure the principle of least privilege.
Which option meets the requirement of your team?
- A. Use a service account with read-only access to the Cloud Storage bucket, and store the credentials to the service account in the config of the application on the Compute Engine instance.
- B. Create a Cloud Storage ACL that allows read-only access from the Compute Engine instance's IP address and allows the application to read from the bucket without credentials.
- C. Encrypt the data in the Cloud Storage bucket using Cloud KMS, and allow the application to decrypt the data with the KMS key.
- D. Use a service account with read-only access to the Cloud Storage bucket to retrieve the credentials from the instance metadata.
Answer: D
Explanation:
If the environment variable GOOGLE_APPLICATION_CREDENTIALS is set, ADC uses the service account key or configuration file that the variable points to. If the environment variable GOOGLE_APPLICATION_CREDENTIALS isn't set, ADC uses the service account that is attached to the resource that is running your code. https://cloud.google.com/docs/authentication
/production#passing_the_path_to_the_service_account_key_in_code
NEW QUESTION # 188
You need to provide a corporate user account in Google Cloud for each of your developers and operational staff who need direct access to GCP resources. Corporate policy requires you to maintain the user identity in a third-party identity management provider and leverage single sign-on. You learn that a significant number of users are using their corporate domain email addresses for personal Google accounts, and you need to follow Google recommended practices to convert existing unmanaged users to managed accounts.
Which two actions should you take? (Choose two.)
- A. Use the Google Admin console to view which managed users are using a personal account for their recovery email.
- B. Use the Transfer Tool for Unmanaged Users (TTUU) to find users with conflicting accounts and ask them to transfer their personal Google accounts.
- C. Use Google Cloud Directory Sync to synchronize your local identity management system to Cloud Identity.
- D. Send an email to all of your employees and ask those users with corporate email addresses for personal Google accounts to delete the personal accounts immediately.
- E. Add users to your managed Google account and force users to change the email addresses associated with their personal accounts.
Answer: A,D
Explanation:
Explanation/Reference:
NEW QUESTION # 189
You want to evaluate GCP for PCI compliance. You need to identify Google's inherent controls.
Which document should you review to find the information?
- A. PCI DSS Requirements and Security Assessment Procedures
- B. PCI SSC Cloud Computing Guidelines
- C. Product documentation for Compute Engine
- D. Google Cloud Platform: Customer Responsibility Matrix
Answer: D
Explanation:
To evaluate Google Cloud Platform (GCP) for PCI compliance and identify Google's inherent controls, you should review the "Google Cloud Platform: Customer Responsibility Matrix". This document provides detailed information about the shared responsibility model, outlining the security controls managed by Google and those that are the responsibility of the customer.
Steps to access and use the document:
* Access the Document:
* Go to the Google Cloud compliance resource center.
* Locate the "Customer Responsibility Matrix" for PCI DSS compliance.
* Review Inherent Controls:
* The document lists various controls and specifies whether they are managed by Google, the customer, or both.
* It covers different aspects such as infrastructure security, data protection, and compliance requirements.
* Analyze PCI Compliance:
* Use the matrix to understand which PCI DSS requirements are inherently addressed by Google Cloud.
* Identify the controls you need to implement and manage as a customer to ensure full compliance.
By reviewing this document, you can gain a comprehensive understanding of the inherent controls provided by Google Cloud and the responsibilities you must fulfill to achieve PCI compliance.
Google Cloud Compliance Documentation
PCI DSS Compliance on Google Cloud
NEW QUESTION # 190
Your company is developing a new application for your organization The application consists of two Cloud Run services, service A and service B Service A provides a web-based user front-end Service B provides back-end services that are called by service A You need to set up identity and access management for the application Your solution should follow the principle of least privilege What should you do?
- A. Create a new service account with the permissions to run service A and service B Require authentication for service B Permit only the new service account to call the backend
- B. Create two separate service accounts Grant one service account the permissions to execute service A, and grant the other service account the permissions to execute service B Require authentication for service B Permit only the service account for service A to call the back-end
- C. Create three separate service accounts Grant one service account the permissions to execute service A Grant the second service account the permissions to run service B Grant the third service account the permissions to communicate between both services A and B Require authentication for service B Call the back-end by authenticating with a service account key for the third service account
- D. Use the Compute Engine default service account to run service A and service B Require authentication for service B Permit only the default service account to call the backend
Answer: B
Explanation:
The problem describes an application with two Cloud Run services (Service A - frontend, Service B - backend) and requires setting up IAM with the principle of least privilege Service A calls Service B Principle of Least Privilege: This principle dictates that each entity (in this case, a Cloud Run service) should only have the minimum permissions necessary to perform its function Separate Service Accounts for Separate Services: To adhere to the principle of least privilege, it's best practice to assign a unique service account to each distinct service or component This ensures that a compromise of one service account does not grant excessive permissions across other services Service A needs permissions to run itself and to invoke Service B Service B only needs permissions to run itselfExtract Reference: "Assign a service account to a Cloud Run service The service account acts as the identity for your service and determines what permissions your revisions have when executing requests It is a best practice to grant each service account only the permissions that are required to run the specific service (principle of least privilege)" (Google Cloud documentation: https://cloudgooglecom/run/docs/configuring/service-accounts) Authentication for Cloud Run Services: When one Cloud Run service (caller) needs to invoke another Cloud Run service (callee), the caller must be authorized to do so This is typically achieved by assigning the roles/runinvoker role on the callee service to the caller's service accountExtract Reference: "To allow a service to invoke another service, grant the roles/runinvoker role on the called service to the caller's service account" (Google Cloud documentation: https://cloudgooglecom/run/docs/securing/service-to-service) Let's evaluate the options:
A Create a new service account with the permissions to run service A and service B Require authentication for service B Permit only the new service account to call the backend This violates the principle of least privilege by giving a single service account permissions for both services If that service account were compromised, both services would be affected B Create two separate service accounts Grant one service account the permissions to execute service A, and grant the other service account the permissions to execute service B Require authentication for service B Permit only the service account for service A to call the back-end This aligns perfectly with least privilege Service A gets its own identity, Service B gets its own identity Service A's service account is then granted runinvoker permissions on Service B, allowing it to call the backend while Service B requires authentication This is the recommended approach C Use the Compute Engine default service account to run service A and service B Require authentication for service B Permit only the default service account to call the backend The Compute Engine default service account often has broad permissions (eg, editor role in its project) Using it violates the principle of least privilege and is generally discouraged for production applications due to the potential for excessive permissions D Create three separate service accounts Grant one service account the permissions to execute service A Grant the second service account the permissions to run service B Grant the third service account the permissions to communicate between both services A and B Require authentication for service B Call the back-end by authenticating with a service account key for the third service account This introduces unnecessary complexity with a third service account just for communication More critically, using a service account key for authentication is generally discouraged in Cloud Run environments where ADC (Application Default Credentials) can be used, as managing keys securely becomes an operational overhead and security risk Cloud Run services automatically use their attached service accounts for authentication when making calls to other Google Cloud services, including other Cloud Run services Therefore, option B is the best solution, adhering to the principle of least privilege and Google Cloud best practices for Cloud Run service-to-service authentication
NEW QUESTION # 191
A customer needs to prevent attackers from hijacking their domain/IP and redirecting users to a malicious site through a man-in-the-middle attack.
Which solution should this customer use?
- A. VPC Flow Logs
- B. DNS Security Extensions
- C. Cloud Identity-Aware Proxy
- D. Cloud Armor
Answer: B
Explanation:
DNSSEC - use a DNS registrar that supports DNSSEC, and enable it. DNSSEC digitally signs DNS communication, making it more difficult (but not impossible) for hackers to intercept and spoof.
Domain Name System Security Extensions (DNSSEC) adds security to the Domain Name System (DNS) protocol by enabling DNS responses to be validated. Having a trustworthy Domain Name System (DNS) that translates a domain name like www.example.com into its associated IP address is an increasingly important building block of today's web-based applications. Attackers can hijack this process of domain/IP lookup and redirect users to a malicious site through DNS hijacking and man-in-the-middle attacks. DNSSEC helps mitigate the risk of such attacks by cryptographically signing DNS records. As a result, it prevents attackers from issuing fake DNS responses that may misdirect browsers to nefarious websites.
https://cloud.google.com/blog/products/gcp/dnssec-now-available-in-cloud-dns
NEW QUESTION # 192
Your organization uses BigQuery to process highly sensitive, structured datasets. Following the "need to know" principle, you need to create the Identity and Access Management (IAM) design to meet the needs of these users:
* Business user must access curated reports.
* Data engineer: must administrate the data lifecycle in the platform.
* Security operator: must review user activity on the data platform.
What should you do?
- A. Generate a CSV data file based on the business user's needs, and send the data to their email addresses.
- B. Configure data access log for BigQuery services, and grant Project Viewer role to security operators.
- C. Set row-based access control based on the "region" column, and filter the record from the United States for data engineers.
- D. Create curated tables in a separate dataset and assign the role roles/bigquery.dataViewer.
Answer: D
Explanation:
This option directly addresses the needs of the business user who must access curated reports. By creating curated tables in a separate dataset, you can control access to specific data. Assigning the roles/bigquery.dataViewer role allows the business user to view the data in BigQuery.
NEW QUESTION # 193
You are exporting application logs to Cloud Storage. You encounter an error message that the log sinks don't support uniform bucket-level access policies. How should you resolve this error?
- A. Update your sink with the correct bucket destination.
- B. Add the roles/logging.logWriter Identity and Access Management (IAM) role to the bucket for the log sink identity.
- C. Change the access control model for the bucket
- D. Add the roles/logging.bucketWriter Identity and Access Management (IAM) role to the bucket for the log sink identity.
Answer: C
NEW QUESTION # 194
You are setting up a CI/CD pipeline to deploy containerized applications to your production clusters on Google Kubernetes Engine (GKE). You need to prevent containers with known vulnerabilities from being deployed. You have the following requirements for your solution:
Must be cloud-native
Must be cost-efficient
Minimize operational overhead
How should you accomplish this? (Choose two.)
- A. Deploy Jenkins on GKE and configure a CI/CD pipeline to deploy your containers to Container Registry. Add a step to validate your container images before deploying your container to the cluster.
- B. Use a cron job on a Compute Engine instance to scan your existing repositories for known vulnerabilities and raise an alert if a non-compliant container image is found.
- C. Create a Cloud Build pipeline that will monitor changes to your container templates in a Cloud Source Repositories repository. Add a step to analyze Container Analysis results before allowing the build to continue.
- D. In your CI/CD pipeline, add an attestation on your container image when no vulnerabilities have been found. Use a Binary Authorization policy to block deployments of containers with no attestation in your cluster.
- E. Use a Cloud Function triggered by log events in Google Cloud's operations suite to automatically scan your container images in Container Registry.
Answer: C,D
Explanation:
* A. Create a Cloud Build pipeline that will monitor changes to your container templates in a Cloud Source Repositories repository. Add a step to analyze Container Analysis results before allowing the build to continue:
* Use Cloud Build to automate your CI/CD pipeline.
* Integrate Container Analysis to scan container images for vulnerabilities during the build process.
* If vulnerabilities are found, configure the build to fail, preventing deployment of insecure containers.
* E. In your CI/CD pipeline, add an attestation on your container image when no vulnerabilities have been found. Use a Binary Authorization policy to block deployments of containers with no attestation in your cluster:
* Use Binary Authorization to enforce deploy-time security policies.
* Configure your CI/CD pipeline to generate attestations for container images that pass vulnerability scans.
* Binary Authorization will then block deployments of any containers without valid attestations, ensuring only secure images are deployed.
References:
* Cloud Build Overview
* Container Analysis
* Binary Authorization
NEW QUESTION # 195
An organization is moving applications to Google Cloud while maintaining a few mission-critical applications on-premises. The organization must transfer the data at a bandwidth of at least 50 Gbps. What should they use to ensure secure continued connectivity between sites?
- A. Dedicated Interconnect
- B. Partner Interconnect
- C. Cloud Router
- D. Cloud VPN
Answer: A
Explanation:
https://cloud.google.com/network-connectivity/docs/interconnect/concepts/overview
NEW QUESTION # 196
Your application is deployed as a highly available cross-region solution behind a global external HTTP(S) load balancer. You notice significant spikes in traffic from multiple IP addresses but it is unknown whether the IPs are malicious. You are concerned about your application's availability. You want to limit traffic from these clients over a specified time interval.
What should you do?
- A. Configure a throttle action by using Google Cloud Armor to limit the number of requests per client over a specified time interval.
- B. Configure a deny action by using Google Cloud Armor to deny the clients that issued too many requests over the specified time interval.
- C. Configure a rate_based_ban action by using Google Cloud Armor and set the ban_duration_sec parameter to the specified time interval.
- D. Configure a firewall rule in your VPC to throttle traffic from the identified IP addresses.
Answer: C
Explanation:
To handle significant traffic spikes and potentially malicious IPs, you can use Google Cloud Armor to configure rate-based bans. This approach allows you to automatically ban clients that exceed a predefined request rate, protecting your application from potential denial-of-service attacks.
* Access Google Cloud Console: Log in to your Google Cloud Console.
* Navigate to Google Cloud Armor: Go to the "Security" section and select "Google Cloud Armor".
* Create Security Policy: Create a new security policy or edit an existing one. Add a new rule to the policy.
* Configure Rate-Based Ban: Set the action to rate_based_ban. Define the rate limit (e.g., requests per second) and set the ban_duration_sec parameter to the desired time interval.
* Apply the Policy: Apply the security policy to your backend service or load balancer.
* Monitor and Adjust: Monitor the traffic patterns and adjust the rate limits and ban durations as necessary to balance security and availability.
References:
* Google Cloud Armor Documentation
* Rate Limiting with Cloud Armor
NEW QUESTION # 197
......
Latest Professional-Cloud-Security-Engineer Exam Dumps Google Exam from Training: https://vce4exams.practicevce.com/Google/Professional-Cloud-Security-Engineer-practice-exam-dumps.html