Question 1

As a food delivery company, your service is hosted on Compute Engine, and clients can access it on port 587. What form of Load Balancing on Google Cloud should you use to balance traffic between instances of the service while ensuring that the connection is secured by TLS and terminated by the Load Balancer?

Options :

A : Load balancing using TCP Proxy.

B : Load balancing for HTTP and HTTPS traffic.

C : Load balancing for network traffic

D : Load balancing with SSL Proxy

Answer: D

Question 2

You are a member of your company's security team. You have been asked to reduce your Linux bastion host external attack surface by removing all public IP addresses. Site Reliability Engineers (SREs) require access to the bastion host from public locations so they can access the internal VPC while off-site. How should you enable this access?

Options :

A : Implement Cloud VPN for the region where the bastion host lives.

B : Implement OS Login with 2-step verification for the bastion host.

C : Implement Identity-Aware Proxy TCP forwarding for the bastion host.

D : Implement Google Cloud Armor in front of the bastion host.

Answer: C

Question 3

An online legal service company is considering moving its data storage to Google Cloud Platform. They want to ensure maximum control over the encryption process of their data stored at rest. What technique should the company use?

Options :

A : Utilize Cloud Storage as a federated source of data.

B : CSEK refers to encryption keys that are provided by the customer.

C : Employ a Cloud HSM for enhanced security.

D : CMEK (Customer Managed Encryption Keys).

Answer: D

Question 4

You have just created a new log bucket to replace the _Default log bucket. You want to route all log entries that are currently routed to the _Default log bucket to this new log bucket in the most efficient manner. What should you do?

Options :

A : Create a user-defined sink with inclusion filters copied from the _Default sink. Select the new log bucket as the sink destination.

B : Create exclusion filters for the _Default sink to prevent it from receiving new logs. Create a userdefined sink, and select the new log bucket as the sink destination.

C : Disable the _Default sink. Create a user-defined sink and select the new log bucket as the sink destination.

D : Edit the _Default sink, and select the new log bucket as the sink destination.

Answer: D

Question 5

A customer’s company has multiple business units. Each business unit operates independently, and each has their own engineering group. Your team wants visibility into all projects created within the company and wants to organize their Google Cloud Platform (GCP) projects based on different business units. Each business unit also requires separate sets of IAM permissions. Which strategy should you use to meet these needs?

Options :

A : Create an organization node, and assign folders for each business unit.

B : Establish standalone projects for each business unit, using gmail.com accounts.

C : Assign GCP resources in a project, with a label identifying which business unit owns the resource.

D : Assign GCP resources in a VPC for each business unit to separate network access.

Answer: A

Confidently Practice Online with Free Professional-Cloud-Security-Engineer Exam Cram

Buying Options: