Question 1

You are on your company's development team. You noticed that your web application hosted in staging on GKE dynamically includes user data in web pages without first properly validating the inputted data. This could allow an attacker to execute gibberish commands and display arbitrary content in a victim user's browser in a production environment. How should you prevent and fix this vulnerability?

Options :

A : Use Cloud IAP based on IP address or end-user device attributes to prevent and fix the vulnerability.

B : Set up an HTTPS load balancer, and then use Cloud Armor for the production environment to prevent the potential XSS attack.

C : Use Web Security Scanner to validate the usage of an outdated library in the code, and then use a secured version of the included library.

D : Use Web Security Scanner in staging to simulate an XSS injection attack, and then use a templating system that supports contextual auto-escaping.

Answer: D

Question 2

As a virtual interior design service company, we want to use Google Cloud Platform (GCP) for certain IT workloads. We already use a well-established directory service to manage user identities and lifecycle management, which must remain the `source of truth` directory for identities. What GCP solution can we use to meet our requirements?

Options :

A : SAML (Security Assertion Markup Language) is a protocol used for exchanging authentication and authorization data between parties, particularly between an identity provider and a service provider.

B : Identity and Access Management (IAM) in Google Cloud is known as Cloud Identity.

C : Pub/Sub is a messaging service provided by Google Cloud.

D : GCDS stands for Google Cloud Directory Sync.

Answer: D

Question 3

A customer’s company has multiple business units. Each business unit operates independently, and each has their own engineering group. Your team wants visibility into all projects created within the company and wants to organize their Google Cloud Platform (GCP) projects based on different business units. Each business unit also requires separate sets of IAM permissions. Which strategy should you use to meet these needs?

Options :

A : Create an organization node, and assign folders for each business unit.

B : Establish standalone projects for each business unit, using gmail.com accounts.

C : Assign GCP resources in a project, with a label identifying which business unit owns the resource.

D : Assign GCP resources in a VPC for each business unit to separate network access.

Answer: A

Question 4

In developing a secure environment for an online grocery delivery service company, what are the two essential components to include in building a secure container image using Google Cloud Services?

Options :

A : Make sure that the app is not executed as PID 1.

B : For the application, it is recommended to utilize public container images as the base image and incorporate multiple container image layers to conceal confidential data.

C : Eliminate any superfluous tools that are not required by the application.

D : Create a container for a single application.

Answer: C,D

Question 5

Your company must follow industry specific regulations. Therefore, you need to enforce customer-managed encryption keys (CMEK) for all new Cloud Storage resources in the organization called org1. What command should you execute?

Options :

A : • organization policy: constraints/gcp.restrictStorageNonCraekServices• binding at: orgl• policy type: deny• policy value: storage.gcogleapis.com

B : • organization policy: constraints/gcp.restrictHonCmekServices• binding at: orgl• policy type: deny• policy value: storage.googleapis.com

C : • organization policy:constraints/gcp.restrictStorageNonCraekServices• binding at: orgl• policy type: allow• policy value: all supported services

D : • organization policy: constramts/gcp.restrictNonCmekServices• binding at: orgl• policy type: allow• policy value: storage.googleapis.com

Answer: D

Confidently Practice Online with Free Professional-Cloud-Security-Engineer Exam Cram

Buying Options: