Google Professional Cloud Security Engineer Google Cloud Certified – Professional Cloud Security Engineer Online Training
Google Professional Cloud Security Engineer Online Training
The questions for Professional Cloud Security Engineer were last updated at Feb 10,2025.
- Exam Code: Professional Cloud Security Engineer
- Exam Name: Google Cloud Certified - Professional Cloud Security Engineer
- Certification Provider: Google
- Latest update: Feb 10,2025
A customer’s company has multiple business units. Each business unit operates independently, and each has their own engineering group. Your team wants visibility into all projects created within the company and wants to organize their Google Cloud Platform (GCP) projects based on different business units. Each business unit also requires separate sets of IAM permissions.
Which strategy should you use to meet these needs?
- A . Create an organization node, and assign folders for each business unit.
- B . Establish standalone projects for each business unit, using gmail.com accounts.
- C . Assign GCP resources in a project, with a label identifying which business unit owns the resource.
- D . Assign GCP resources in a VPC for each business unit to separate network access.
A company has redundant mail servers in different Google Cloud Platform regions and wants to route customers to the nearest mail server based on location.
How should the company accomplish this?
- A . Configure TCP Proxy Load Balancing as a global load balancing service listening on port 995.
- B . Create a Network Load Balancer to listen on TCP port 995 with a forwarding rule to forward traffic based on location.
- C . Use Cross-Region Load Balancing with an HTTP(S) load balancer to route traffic to the nearest region.
- D . Use Cloud CDN to route the mail traffic to the closest origin mail server based on client IP address.
Your team sets up a Shared VPC Network where project co-vpc-prod is the host project. Your team has configured the firewall rules, subnets, and VPN gateway on the host project. They need to enable Engineering Group A to attach a Compute Engine instance to only the 10.1.1.0/24 subnet.
What should your team grant to Engineering Group A to meet this requirement?
- A . Compute Network User Role at the host project level.
- B . Compute Network User Role at the subnet level.
- C . Compute Shared VPC Admin Role at the host project level.
- D . Compute Shared VPC Admin Role at the service project level.
A company migrated their entire data/center to Google Cloud Platform. It is running thousands of instances across multiple projects managed by different departments. You want to have a historical record of what was running in Google Cloud Platform at any point in time.
What should you do?
- A . Use Resource Manager on the organization level.
- B . Use Forseti Security to automate inventory snapshots.
- C . Use Stackdriver to create a dashboard across all projects.
- D . Use Security Command Center to view all assets across the organization.
An organization is starting to move its infrastructure from its on-premises environment to Google Cloud Platform (GCP). The first step the organization wants to take is to migrate its current data backup and disaster recovery solutions to GCP for later analysis. The organization’s production environment will remain on- premises for an indefinite time. The organization wants a scalable and cost-efficient solution.
Which GCP solution should the organization use?
- A . BigQuery using a data pipeline job with continuous updates
- B . Cloud Storage using a scheduled task and gsutil
- C . Compute Engine Virtual Machines using Persistent Disk
- D . Cloud Datastore using regularly scheduled batch upload jobs
You are creating an internal App Engine application that needs to access a user’s Google Drive on the user’s behalf. Your company does not want to rely on the current user’s credentials. It also wants to follow Google- recommended practices.
What should you do?
- A . Create a new Service account, and give all application users the role of Service Account User.
- B . Create a new Service account, and add all application users to a Google Group. Give this group the role of Service Account User.
- C . Use a dedicated G Suite Admin account, and authenticate the application’s operations with these G Suite credentials.
- D . Create a new service account, and grant it G Suite domain-wide delegation. Have the application use it to impersonate the user.
A customer wants to move their sensitive workloads to a Compute Engine-based cluster using Managed Instance Groups (MIGs). The jobs are bursty and must be completed quickly. They have a requirement to be able to manage and rotate the encryption keys.
Which boot disk encryption solution should you use on the cluster to meet this customer’s requirements?
- A . Customer-supplied encryption keys (CSEK)
- B . Customer-managed encryption keys (CMEK) using Cloud Key Management Service (KMS)
- C . Encryption by default
- D . Pre-encrypting files before transferring to Google Cloud Platform (GCP) for analysis
Your company is using Cloud Dataproc for its Spark and Hadoop jobs. You want to be able to create, rotate, and destroy symmetric encryption keys used for the persistent disks used by Cloud Dataproc. Keys can be stored in the cloud.
What should you do?
- A . Use the Cloud Key Management Service to manage the data encryption key (DEK).
- B . Use the Cloud Key Management Service to manage the key encryption key (KEK).
- C . Use customer-supplied encryption keys to manage the data encryption key (DEK).
- D . Use customer-supplied encryption keys to manage the key encryption key (KEK).
You are a member of the security team at an organization. Your team has a single GCP project with credit card payment processing systems alongside web applications and data processing systems. You want to reduce the scope of systems subject to PCI audit standards.
What should you do?
- A . Use multi-factor authentication for admin access to the web application.
- B . Use only applications certified compliant with PA-DSS.
- C . Move the cardholder data environment into a separate GCP project.
- D . Use VPN for all connections between your office and cloud environments.
A retail customer allows users to upload comments and product reviews. The customer needs to make sure the text does not include sensitive data before the comments or reviews are published.
Which Google Cloud Service should be used to achieve this?
- A . Cloud Key Management Service
- B . Cloud Data Loss Prevention API
- C . BigQuery
- D . Cloud Security Scanner
Latest Professional Cloud Security Engineer Dumps Valid Version with 93 Q&As
Latest And Valid Q&A | Instant Download | Once Fail, Full Refund
