Professional-Cloud-Security-Engineer無料問題集「Google Cloud Certified

質問 1

You are a consultant for an organization that is considering migrating their data from its private cloud to Google Cloud. The organization's compliance team is not familiar with Google Cloud and needs guidance on how compliance requirements will be met on Google Cloud. One specific compliance requirement isfor customer data at rest to reside within specific geographic boundaries. Which option should you recommend for the organization to meet their data residency requirements on Google Cloud?

（A）Access control lists

（B）Geolocation access controls

（C）Shielded VM instances

（D）Organization Policy Service constraints

（E）Google Cloud Armor

正解：D 解答を投票する

解説: (JPNTest メンバーにのみ表示されます)

質問 2

You manage a mission-critical workload for your organization, which is in a highly regulated industry The workload uses Compute Engine VMs to analyze and process the sensitive data after it is uploaded to Cloud Storage from the endpomt computers. Your compliance team has detected that this workload does not meet the data protection requirements for sensitive data. You need to meet these requirements;
* Manage the data encryption key (DEK) outside the Google Cloud boundary.
* Maintain full control of encryption keys through a third-party provider.
* Encrypt the sensitive data before uploading it to Cloud Storage
* Decrypt the sensitive data during processing in the Compute Engine VMs
* Encrypt the sensitive data in memory while in use in the Compute Engine VMs What should you do?
Choose 2 answers

（A）Configure Customer Managed Encryption Keys to encrypt the sensitive data before it is uploaded to Cloud Storage, and decrypt the sensitive data after it is downloaded into your VMs.

（B）Create Confidential VMs to access the sensitive data.

（C）Configure Cloud External Key Manager to encrypt the sensitive data before it is uploaded to Cloud Storage and decrypt the sensitive data after it is downloaded into your VMs

（D）Create a VPC Service Controls service perimeter across your existing Compute Engine VMs and Cloud Storage buckets

（E）Migrate the Compute Engine VMs to Confidential VMs to access the sensitive data.

正解：B、C 解答を投票する

解説: (JPNTest メンバーにのみ表示されます)

質問 3

Your company is concerned about unauthorized parties gaming access to the Google Cloud environment by using a fake login page. You must implement a solution to protect against person-in-the-middle attacks.
Which security measure should you use?

（A）Google prompt

（B）Text message or phone call code

（C）Security key

（D）Google Authenticator application

正解：C 解答を投票する

解説: (JPNTest メンバーにのみ表示されます)

質問 4

You need to enforce a security policy in your Google Cloud organization that prevents users from exposing objects in their buckets externally. There are currently no buckets in your organization. Which solution should you implement proactively to achieve this goal with the least operational overhead?

（A）Enable theconstraints/storage.uniformBucketLevelAccessconstraint at the organization level.

（B）Enable theconstraints/storage.publicAccessPreventionconstraint at the organization level.

（C）Create a VPC Service Controls perimeter that protects the storage.googleapis.com service in your projects that contains buckets. Add any new project that contains a bucket to the perimeter.

（D）Create an hourly cron job to run a Cloud Function that finds public buckets and makes them private.

正解：B 解答を投票する

解説: (JPNTest メンバーにのみ表示されます)

質問 5

A company is deploying their application on Google Cloud Platform. Company policy requires long-term data to be stored using a solution that can automatically replicate data over at least two geographic places.
Which Storage solution are they allowed to use?

（A）Cloud Bigtable

（B）Cloud BigQuery

（C）Compute Engine Persistent Disk

（D）Compute Engine SSD Disk

正解：B 解答を投票する

解説: (JPNTest メンバーにのみ表示されます)

質問 6

You have noticed an increased number of phishing attacks across your enterprise user accounts. You want to implement the Google 2-Step Verification (2SV) option that uses a cryptographic signature to authenticate a user and verify the URL of the login page. Which Google 2SV option should you use?

（A）Google prompt

（B）Cloud HSM keys

（C）Titan Security Keys

（D）Google Authenticator app

正解：C 解答を投票する

解説: (JPNTest メンバーにのみ表示されます)

質問 7

A customer wants to deploy a large number of 3-tier web applications on Compute Engine.
How should the customer ensure authenticated network separation between the different tiers of the application?

（A）Run each tier with a different Service Account (SA), and use SA-based firewall rules.

（B）Run each tier in its own subnet, and use subnet-based firewall rules.

（C）Run each tier with its own VM tags, and use tag-based firewall rules.

（D）Run each tier in its own Project, and segregate using Project labels.

正解：A 解答を投票する

解説: (JPNTest メンバーにのみ表示されます)

質問 8

Which Google Cloud service should you use to enforce access control policies for applications and resources?

（A）Cloud NAT

（B）Shielded VMs

（C）Identity-Aware Proxy

（D）Google Cloud Armor

正解：C 解答を投票する

解説: (JPNTest メンバーにのみ表示されます)

質問 9

A customer wants to move their sensitive workloads to a Compute Engine-based cluster using Managed Instance Groups (MIGs). The jobs are bursty and must be completed quickly. They have a requirement to be able to manage and rotate the encryption keys.
Which boot disk encryption solution should you use on the cluster to meet this customer's requirements?

（A）Customer-managed encryption keys (CMEK) using Cloud Key Management Service (KMS)

（B）Customer-supplied encryption keys (CSEK)

（C）Encryption by default

（D）Pre-encrypting files before transferring to Google Cloud Platform (GCP) for analysis

正解：A 解答を投票する

解説: (JPNTest メンバーにのみ表示されます)

質問 10

You are the security admin of your company. Your development team creates multiple GCP projects under the
"implementation" folder for several dev, staging, and production workloads. You want to prevent data exfiltration by malicious insiders or compromised code by setting up a security perimeter. However, you do not want to restrict communication between the projects.
What should you do?

（A）Use an infrastructure-as-code software tool to set up a single service perimeter and to deploy a Cloud Function that monitors the "implementation" folder via Stackdriver and Cloud Pub/Sub. When the function notices that a new project is added to the folder, it executes Terraform to add the new project to the associated perimeter.

（B）Use a Shared VPC to enable communication between all projects, and use firewall rules to prevent data exfiltration.

（C）Create access levels in Access Context Manager to prevent data exfiltration, and use a shared VPC for communication between projects.

（D）Use an infrastructure-as-code software tool to set up three different service perimeters for dev, staging, and prod and to deploy a Cloud Function that monitors the "implementation" folder via Stackdriver and Cloud Pub/Sub. When the function notices that a new project is added to the folder, it executes Terraform to add the new project to the respective perimeter.

正解：A 解答を投票する

解説: (JPNTest メンバーにのみ表示されます)

質問 11

You are deploying regulated workloads on Google Cloud. The regulation has data residency and data access requirements. It also requires that support is provided from the same geographical location as where the data resides.
What should you do?

（A）Enable Access Transparency Logging.

（B）Deploy Assured Workloads.

（C）Deploy resources only to regions permitted by data residency requirements

（D）Use Data Access logging and Access Transparency logging to confirm that no users are accessing data from another region.

正解：B 解答を投票する

解説: (JPNTest メンバーにのみ表示されます)

質問 12

Your organization wants to protect all workloads that run on Compute Engine VM to ensure that the instances weren't compromised by boot-level or kernel-level malware. Also, you need to ensure that data in use on the VM cannot be read by the underlying host system by using a hardware-based solution.
What should you do?

（A）*1 Use secure hardened images from the Google Cloud Marketplace
*2 When deploying the images activate the Confidential Computing option
*3 Enforce the use of the correct images and Confidential Computing by using organization policies

（B）* 1 Use Google Shielded VM including secure boot Virtual Trusted Platform Module (vTPM) and integrity monitoring
*2 Activate Confidential Computing
*3 Enforce these actions by using organization policies

（C）*1 Use Google Shielded VM including secure boot Virtual Trusted Platform Module (vTPM) and integrity monitoring
*2 Create a Cloud Run function to check for the VM settings generate metrics and run the function regularly

（D）*1 Activate Virtual Machine Threat Detection in Security Command Center (SCO Premium
*2 Monitor the findings in SCC

正解：B 解答を投票する

質問 13

Your organization wants to be continuously evaluated against CIS Google Cloud Computing Foundations Benchmark v1 3 0 (CIS Google Cloud Foundation 1 3). Some of the controls are irrelevant to your organization and must be disregarded in evaluation. You need to create an automated system or process to ensure that only the relevant controls are evaluated.
What should you do?

（A）Activate Security Command Center (SCC) Premium Create a rule to mute the security findings in SCC sothey are not evaluated.

（B）Download all findings from Security Command Center (SCC) to a CSV file Mark the findings that are part ofCIS Google Cloud Foundation 1 3 in the file Ignore the entries that are irrelevant and out of scope for thecompany.

（C）Mark all security findings that are irrelevant with a tag and a value that indicates a security exception Selectall marked findings and mute them on the console every time they appear Activate Security CommandCenter (SCC) Premium.

（D）Ask an external audit company to provide independent reports including needed CIS benchmarks. In thescope of the audit clarify that some of the controls are not needed and must be disregarded.

正解：A 解答を投票する

質問 14

Your team needs to configure their Google Cloud Platform (GCP) environment so they can centralize the control over networking resources like firewall rules, subnets, and routes. They also have an on-premises environment where resources need access back to the GCP resources through a private VPN connection. The networking resources will need to be controlled by the network security team.
Which type of networking design should your team use to meet these requirements?

（A）Grant Compute Admin role to the networking team for each engineering project

（B）Cloud VPN Gateway between all engineering projects using a hub and spoke model

（C）VPC peering between all engineering projects using a hub and spoke model

（D）Shared VPC Network with a host project and service projects

正解：D 解答を投票する

質問 15

Your organization wants to be General Data Protection Regulation (GDPR) compliant You want to ensure that your DevOps teams can only create Google Cloud resources in the Europe regions.
What should you do?

（A）Use Identity-Aware Proxy (IAP) with Access Context Manager to restrict the location of Google Cloud resources.

（B）Use the org policy constraint Google Cloud Platform - Resource Location Restriction" on your Google Cloud organization node.

（C）Use the org policy constraint "Restrict Resource Service Usage'* on your Google Cloud organization node.

（D）Use Identity and Access Management (1AM) custom roles to ensure that your DevOps team can only create resources in the Europe regions

正解：C 解答を投票する

解説: (JPNTest メンバーにのみ表示されます)

質問 16

You have been tasked with implementing external web application protection against common web application attacks for a public application on Google Cloud. You want to validate these policy changes before they are enforced. What service should you use?

（A）VPC Service Controls in dry run mode

（B）Prepopulated VPC firewall rules in monitor mode

（C）Cloud Load Balancing firewall rules

（D）The inherent protections of Google Front End (GFE)

（E）Google Cloud Armor's preconfigured rules in preview mode

正解：E 解答を投票する

質問 17

You are troubleshooting access denied errors between Compute Engine instances connected to a Shared VPC and BigQuery datasets. The datasets reside in a project protected by a VPC Service Controls perimeter. What should you do?

（A）Add the host project containing the Shared VPC to the service perimeter.

（B）Add the service project where the Compute Engine instances reside to the service perimeter.

（C）Create a perimeter bridge between the service project where the Compute Engine instances reside and the perimeter that contains the protected BigQuery datasets.

（D）Create a service perimeter between the service project where the Compute Engine instances reside and the host project that contains the Shared VPC.

正解：A 解答を投票する

解説: (JPNTest メンバーにのみ表示されます)

Professional-Cloud-Security-Engineer 無料問題集「Google Cloud Certified - Professional Cloud Security Engineer」

弊社を連絡する

関連リンク

トップ試験