Question 1

You are responsible for managing your company's identities in Google Cloud. Your company enforces 2-Step Verification (2SV) for all users. You need to reset a user's access, but the user lost their second factor for 2SV. You want to minimize risk. What should you do?

Options :

A : On the Google Admin console, select the appropriate user account, and generate a backup code to allow the user to sign in. Ask the user to update their second factor.

B : On the Google Admin console, temporarily disable the 2SV requirements for all users. Ask the user to log in and add their new second factor to their account. Re-enable the 2SV requirement for all users.

C : On the Google Admin console, select the appropriate user account, and temporarily disable 2SV for this account. Ask the user to update their second factor, and then re-enable 2SV for this account.

D : On the Google Admin console, use a super administrator account to reset the user account-s credentials. Ask the user to update their credentials after their first login.

Answer: A

Question 2

A company is running workloads in a dedicated server room. They must only be accessed from within theprivate company network. You need to connect to these workloads from Compute Engine instances within aGoogle Cloud Platform project.Which two approaches can you take to meet the requirements? (Choose two.)

Options :

A : Configure the project with Cloud VPN.

B : Configure the project with Shared VPC.

C : Configure the project with Cloud Interconnect.

D : Configure the project with VPC peering.

E : Configure all Compute Engine instances with Private Access.

Answer: A,C

Question 3

An online legal service company is considering moving its data storage to Google Cloud Platform. They want to ensure maximum control over the encryption process of their data stored at rest. What technique should the company use?

Options :

A : Utilize Cloud Storage as a federated source of data.

B : CSEK refers to encryption keys that are provided by the customer.

C : Employ a Cloud HSM for enhanced security.

D : CMEK (Customer Managed Encryption Keys).

Answer: D

Question 4

Your organization is building a real-time recommendation engine using ML models that process live user activity data stored in BigQuery and Cloud Storage. Each new model developed is saved to Artifact Registry. This new system deploys models to Google Kubernetes Engine and uses Pub/Sub for message queues. Recent industry news has been reporting attacks exploiting ML model supply chains. You need to enhance the security in this serverless architecture, specifically against risks to the development and deployment pipeline. What should you do?

Options :

A : Limit external libraries and dependencies that are used for the ML models as much as possible. Continuously rotate encryption keys that are used to access the user data from BigQuery and Cloud Storage.

B : Enable container image vulnerability scanning during development and pre-deployment. Enforce Binary Authorization on images deployed from Artifact Registry to your continuous integration and continuous deployment (CI/CD) pipeline.

C : Thoroughly sanitize all training data prior to model development to reduce risk of poisoning attacks. Use IAM for authorization, and apply role-based restrictions to code repositories and cloud services.

D : Develop strict firewall rules to limit external traffic to Cloud Run instances. Integrate intrusion detection systems (IDS) for real-time anomaly detection on Pub/Sub message flows.

Answer: B

Question 5

You are the security admin of your company. You have 3,000 objects in your Cloud Storage bucket. You do not want to manage access to each object individually. You also do not want the uploader of an object to always have full control of the object. However, you want to use Cloud Audit Logs to manage access to your bucket. What should you do?

Options :

A : Set up an ACL with OWNER permission to a scope of allUsers.

B : Set up an ACL with READER permission to a scope of allUsers.

C : Set up a default bucket ACL and manage access for users using IAM

D : Set up Uniform bucket-level access on the Cloud Storage bucket and manage access for users using IAM.

Answer: D

Confidently Practice Online with Free Professional-Cloud-Security-Engineer Exam Cram

Buying Options: