Study with Google : Professional-Cloud-Security-Engineer Exam Torrent as your best preparation materials

You are setting up Cloud Identity for your company's Google Cloud organization. User accounts will be provisioned from Microsoft Entra ID through Directory Sync, and there will be single sign-on through Entra ID. You need to secure the super administrator accounts for the organization. Your solution must follow the principle of least privilege and implement strong authentication. What should you do?

• A. Create dedicated accounts for super administrators. Ensure that 2-step verification is enforced for the super administrator accounts in Entra ID.
• B. Create accounts that combine the organization administrators and the super administrator privileges.Enforce Google 2-step verification for the super administrator accounts.
• C. Create dedicated accounts for super administrators. Enforce Google 2-step verification for the super administrator accounts.
• D. Create accounts that combine the organization administrator and the super administrator privileges.
  Ensure that 2-step verification is enforced for the super administrator accounts in Entra ID.

Your organization has implemented synchronization and SAML federation between Cloud Identity and Microsoft Active Directory. You want to reduce the risk of Google Cloud user accounts being compromised.
What should you do?

• A. Create an Active Directory domain password policy with strong password settings, and configure post- SSO (single sign-on) 2-Step Verification with verification codes via text or phone call in the Google Admin console.
• B. Create an Active Directory domain password policy with strong password settings, and configure post- SSO (single sign-on) 2-Step Verification with security keys in the Google Admin console.
• C. Create a Cloud Identity password policy with strong password settings, and configure 2-Step Verification with verification codes via text or phone call in the Google Admin console.
• D. Create a Cloud Identity password policy with strong password settings, and configure 2-Step Verification with security keys in the Google Admin console.

Which two implied firewall rules are defined on a VPC network? (Choose two.)

• A. A rule that allows all inbound port 80 connections
• B. A rule that blocks all inbound port 25 connections
• C. A rule that denies all inbound connections
• D. A rule that allows all outbound connections
• E. A rule that blocks all outbound connections

You are a member of the security team at an organization. Your team has a single GCP project with credit card payment processing systems alongside web applications and data processing systems. You want to reduce the scope of systems subject to PCI audit standards.
What should you do?

• A. Move the cardholder data environment into a separate GCP project.
• B. Use only applications certified compliant with PA-DSS.
• C. Use multi-factor authentication for admin access to the web application.
• D. Use VPN for all connections between your office and cloud environments.

An organization's typical network and security review consists of analyzing application transit routes, request handling, and firewall rules. They want to enable their developer teams to deploy new applications without the overhead of this full review.
How should you advise this organization?

• A. Use Forseti with Firewall filters to catch any unwanted configurations in production.
• B. Mandate use of infrastructure as code and provide static analysis in the CI/CD pipelines to enforce policies.
• C. Route all VPC traffic through customer-managed routers to detect malicious patterns in production.
• D. All production applications will run on-premises. Allow developers free rein in GCP as their dev and QA platforms.