Professional-Cloud-Security-Engineer Exam Dumps – Our Features

You recently joined the networking team supporting your company's Google Cloud implementation. You are tasked with familiarizing yourself with the firewall rules configuration and providing recommendations based on your networking and Google Cloud experience. What product should you recommend to detect firewall rules that are overlapped by attributes from other firewall rules with higher or equal priority?

• Security Command Center
• Firewall Rules Logging
• VPC Flow Logs
• Firewall Insights

Your organization is transitioning to Google Cloud You want to ensure that only trusted container images are deployed on Google Kubernetes Engine (GKE) clusters in a project. The containers must be deployed from a centrally managed. Container Registry and signed by a trusted authority.What should you do?Choose 2 answers

• Configure the Binary Authorization policy with respective attestations for the project.
• Create a custom organization policy constraint to enforce Binary Authorization for Google Kubernetes Engine (GKE).
• Enable Container Threat Detection in the Security Command Center (SCC) for the project.
• Configure the trusted image organization policy constraint for the project.
• Enable Pod Security standards and set them to Restricted.

You are in charge of creating a new Google Cloud organization for your company. Which two actions should you take when creating the super administrator accounts? (Choose two.)

• Create an access level in the Google Admin console to prevent super admin from logging in to Google Cloud.
• Disable any Identity and Access Management (1AM) roles for super admin at the organization level in the Google Cloud Console.
• Use a physical token to secure the super admin credentials with multi-factor authentication (MFA).
• Use a private connection to create the super admin accounts to avoid sending your credentials over the Internet.
• Provide non-privileged identities to the super admin users for their day-to-day activities.

A company has redundant mail servers in different Google Cloud Platform regions and wants to route customers to the nearest mail server based on location.How should the company accomplish this?

• Configure TCP Proxy Load Balancing as a global load balancing service listening on port 995.
• Create a Network Load Balancer to listen on TCP port 995 with a forwarding rule to forward traffic based on location.
• Use Cross-Region Load Balancing with an HTTP(S) load balancer to route traffic to the nearest region.
• Use Cloud CDN to route the mail traffic to the closest origin mail server based on client IP address.

You have been tasked with implementing external web application protection against common web application attacks for a public application on Google Cloud. You want to validate these policy changes before they are enforced. What service should you use?

• Google Cloud Armor's preconfigured rules in preview mode
• Prepopulated VPC firewall rules in monitor mode
• The inherent protections of Google Front End (GFE)
• Cloud Load Balancing firewall rules
• VPC Service Controls in dry run mode

Your organization s record data exists in Cloud Storage. You must retain all record data for at least seven years This policy must be permanent.What should you do?

• * 1 Identify buckets with record data * 2 Apply a retention policy and set it to retain for seven years * 3 Monitor the bucket by using log-based alerts to ensure that no modifications to the retention policy occurs
• * 1 Identify buckets with record data * 2 Apply a retention policy and set it to retain for seven years * 3 Remove any Identity and Access Management (IAM) roles that contain the storage buckets update permission
• * 1 Identify buckets with record data * 2 Enable the bucket policy only to ensure that data is retained * 3 Enable bucket lock
• * 1 Identify buckets with record data * 2 Apply a retention policy and set it to retain for seven years * 3 Enable bucket lock

A customer terminates an engineer and needs to make sure the engineer's Google account is automatically deprovisioned.What should the customer do?

• Use the Cloud SDK with their directory service to remove their IAM permissions in Cloud Identity.
• Use the Cloud SDK with their directory service to provision and deprovision users from Cloud Identity.
• Configure Cloud Directory Sync with their directory service to provision and deprovision users from Cloud Identity.
• Configure Cloud Directory Sync with their directory service to remove their IAM permissions in Cloud Identity.

A customer needs to prevent attackers from hijacking their domain/IP and redirecting users to a malicious site through a man-in-the-middle attack.Which solution should this customer use?

• VPC Flow Logs
• Cloud Armor
• DNS Security Extensions
• Cloud Identity-Aware Proxy

You have an application where the frontend is deployed on a managed instance group in subnet A and the data layer is stored on a mysql Compute Engine virtual machine (VM) in subnet B on the same VPC. Subnet A and Subnet B hold several other Compute Engine VMs. You only want to allow thee application frontend to access the data in the application's mysql instance on port 3306.What should you do?

• Configure an ingress firewall rule that allows communication from the src IP range of subnet A to the tag 'data-tag' that is applied to the mysql Compute Engine VM on port 3306.
• Configure an ingress firewall rule that allows communication from the frontend's unique service account to the unique service account of the mysql Compute Engine VM on port 3306.
• Configure a network tag 'fe-tag' to be applied to all instances in subnet A and a network tag 'data-tag' to be applied to all instances in subnet B. Then configure an egress firewall rule that allows communication from Compute Engine VMs tagged with data-tag to destination Compute Engine VMs tagged fe-tag.
• Configure a network tag 'fe-tag' to be applied to all instances in subnet A and a network tag 'data-tag' to be applied to all instances in subnet B. Then configure an ingress firewall rule that allows communication from Compute Engine VMs tagged with fe-tag to destination Compute Engine VMs tagged with data-tag.

A customer has an analytics workload running on Compute Engine that should have limited internet access.Your team created an egress firewall rule to deny (priority 1000) all traffic to the internet.The Compute Engine instances now need to reach out to the public repository to get security updates. What should your team do?

• Create an egress firewall rule to allow traffic to the CIDR range of the repository with a priority greater than 1000.
• Create an egress firewall rule to allow traffic to the CIDR range of the repository with a priority less than 1000.
• Create an egress firewall rule to allow traffic to the hostname of the repository with a priority greater than 1000.
• Create an egress firewall rule to allow traffic to the hostname of the repository with a priority less than 1000.