Study with Google : Professional-Cloud-Security-Engineer Exam Torrent as your best preparation materials

Your organization has established a highly sensitive project within a VPC Service Controls perimeter. You need to ensure that only users meeting specific contextual requirements-such as having a company-managed device, a specific location, and a valid user identity-can access resources within this perimeter. You want to evaluate the impact of this change without blocking legitimate access. What should you do?

• A. Use the VPC Service Control Violation dashboard to identify the impact of details about access denials by service perimeters.
• B. Establish a Context-Aware Access policy that specifies the required contextual attributes, and associate the policy with the VPC Service Controls perimeter in dry run mode.
• C. Configure a VPC Service Controls perimeter in dry run mode, and enforce strict network segmentation using firewall rules. Use multi-factor authentication (MFA) for user verification.
• D. Use Cloud Audit Logs to monitor user access to the project resources.11 Use post-incident analysis to identify unauthorized access attempts.

Your organization previously stored files in Cloud Storage by using Google Managed Encryption Keys (GMEK). but has recently updated the internal policy to require Customer Managed Encryption Keys (CMEK). You need to re-encrypt the files quickly and efficiently with minimal cost.
What should you do?

• A. Encrypt the files locally, and then use gsutil to upload the files to a new bucket.
• B. Change the encryption type on the bucket to CMEK, and rewrite the objects
• C. Copy the files to a new bucket with CMEK enabled in a secondary region
• D. Reupload the files to the same Cloud Storage bucket specifying a key file by using gsutil.

You are a security engineer at a finance company. Your organization plans to store data on Google Cloud, but your leadership team is worried about the security of their highly sensitive data Specifically, your company is concerned about internal Google employees' ability to access your company's data on Google Cloud. What solution should you propose?

• A. Enable Access Transparency logs with Access Approval requests for Google employees.
• B. Enable Admin activity logs to monitor access to resources.
• C. Use Google's Identity and Access Management (IAM) service to manage access controls on Google Cloud.
• D. Use customer-managed encryption keys.

You manage one of your organization's Google Cloud projects (Project A). AVPC Service Control (SC) perimeter is blocking API access requests to this project including Pub/Sub. A resource running under a service account in another project (Project B) needs to collect messages from a Pub/Sub topic in your project Project B is not included in a VPC SC perimeter. You need to provide access from Project B to the Pub/Sub topic in Project A using the principle of least Privilege.
What should you do?

• A. Remove the Pub/Sub API from the list of restricted services in the perimeter configuration for Project A.
• B. Create a perimeter bridge between Project A and Project B to allow the required communication between both projects.
• C. Create an access level that allows a developer in Project B to subscribe to the Pub/Sub topic that is located in Project A.
• D. Configure an ingress policy for the perimeter in Project A and allow access for the service account in Project B to collect messages.

Your team needs to make sure that their backend database can only be accessed by the frontend application and no other instances on the network.
How should your team design this network?

• A. Create a different subnet for the frontend application and database to ensure network isolation.
• B. Create an ingress firewall rule to allow access only from the application to the database using firewall tags.
• C. Create two VPC networks, and connect the two networks using VPC peering to ensure network isolation.
• D. Create two VPC networks, and connect the two networks using Cloud VPN gateways to ensure network isolation.