Professional-Cloud-Security-Engineer無料問題集「Google Cloud Certified

質問 1

An organization's security and risk management teams are concerned about where their responsibility lies for certain production workloads they are running in Google Cloud Platform (GCP), and where Google's responsibility lies. They are mostly running workloads using Google Cloud's Platform-as-a-Service (PaaS) offerings, including App Engine primarily.
Which one of these areas in the technology stack would they need to focus on as their primary responsibility when using App Engine?

（A）Manage the latest updates and security patches for the Guest OS

（B）Configuring and monitoring VPC Flow Logs

（C）Encrypting all stored data

（D）Defending against XSS and SQLi attacks

正解：D 解答を投票する

解説: (JPNTest メンバーにのみ表示されます)

質問 2

You manage a mission-critical workload for your organization, which is in a highly regulated industry The workload uses Compute Engine VMs to analyze and process the sensitive data after it is uploaded to Cloud Storage from the endpomt computers. Your compliance team has detected that this workload does not meet the data protection requirements for sensitive data. You need to meet these requirements;
* Manage the data encryption key (DEK) outside the Google Cloud boundary.
* Maintain full control of encryption keys through a third-party provider.
* Encrypt the sensitive data before uploading it to Cloud Storage
* Decrypt the sensitive data during processing in the Compute Engine VMs
* Encrypt the sensitive data in memory while in use in the Compute Engine VMs What should you do?
Choose 2 answers

（A）Configure Customer Managed Encryption Keys to encrypt the sensitive data before it is uploaded to Cloud Storage, and decrypt the sensitive data after it is downloaded into your VMs.

（B）Create Confidential VMs to access the sensitive data.

（C）Configure Cloud External Key Manager to encrypt the sensitive data before it is uploaded to Cloud Storage and decrypt the sensitive data after it is downloaded into your VMs

（D）Create a VPC Service Controls service perimeter across your existing Compute Engine VMs and Cloud Storage buckets

（E）Migrate the Compute Engine VMs to Confidential VMs to access the sensitive data.

正解：B、C 解答を投票する

解説: (JPNTest メンバーにのみ表示されます)

質問 3

You have a highly sensitive BigQuery workload that contains personally identifiable information (Pll) that you want to ensure is not accessible from the internet. To prevent data exfiltration only requests from authorized IP addresses are allowed to query your BigQuery tables.
What should you do?

（A）Use service perimeter and create an access level based on the authorized source IP address as thecondition.

（B）Use Google Cloud Armor security policies defining an allowlist of authorized IP addresses at the globalHTTPS load balancer.

（C）Use the Restrict allowed Google Cloud APIs and services organization policy constraint along with Cloud Data Loss Prevention (DLP).

（D）Use the Restrict Resource service usage organization policy constraint along with Cloud Data Loss Prevention (DLP).

正解：A 解答を投票する

質問 4

Your team needs to configure their Google Cloud Platform (GCP) environment so they can centralize the control over networking resources like firewall rules, subnets, and routes. They also have an on-premises environment where resources need access back to the GCP resources through a private VPN connection. The networking resources will need to be controlled by the network security team.
Which type of networking design should your team use to meet these requirements?

（A）Grant Compute Admin role to the networking team for each engineering project

（B）Cloud VPN Gateway between all engineering projects using a hub and spoke model

（C）VPC peering between all engineering projects using a hub and spoke model

（D）Shared VPC Network with a host project and service projects

正解：D 解答を投票する

質問 5

Your team sets up a Shared VPC Network where project co-vpc-prod is the host project. Your team has configured the firewall rules, subnets, and VPN gateway on the host project. They need to enable Engineering Group A to attach a Compute Engine instance to only the 10.1.1.0/24 subnet.
What should your team grant to Engineering Group A to meet this requirement?

（A）Compute Shared VPC Admin Role at the service project level.

（B）Compute Network User Role at the host project level.

（C）Compute Shared VPC Admin Role at the host project level.

（D）Compute Network User Role at the subnet level.

正解：D 解答を投票する

解説: (JPNTest メンバーにのみ表示されます)

質問 6

Your company is concerned about unauthorized parties gaming access to the Google Cloud environment by using a fake login page. You must implement a solution to protect against person-in-the-middle attacks.
Which security measure should you use?

（A）Google prompt

（B）Text message or phone call code

（C）Security key

（D）Google Authenticator application

正解：C 解答を投票する

解説: (JPNTest メンバーにのみ表示されます)

質問 7

Your organization acquired a new workload. The Web and Application (App) servers will be running on Compute Engine in a newly created custom VPC. You are responsible for configuring a secure network communication solution that meets the following requirements:
Only allows communication between the Web and App tiers.
Enforces consistent network security when autoscaling the Web and App tiers.
Prevents Compute Engine Instance Admins from altering network traffic.
What should you do?

（A）1. Re-deploy the Web and App servers with instance templates configured with respective network tags.
2. Create an allow VPC firewall rule that specifies the target/source with respective network tags.

（B）1. Configure all running Web and App servers with respective service accounts.
2. Create an allow VPC firewall rule that specifies the target/source with respective service accounts.

（C）1. Re-deploy the Web and App servers with instance templates configured with respective service accounts.
2. Create an allow VPC firewall rule that specifies the target/source with respective service accounts.

（D）1. Configure all running Web and App servers with respective network tags.
2. Create an allow VPC firewall rule that specifies the target/source with respective network tags.

正解：C 解答を投票する

解説: (JPNTest メンバーにのみ表示されます)

質問 8

A customer needs to launch a 3-tier internal web application on Google Cloud Platform (GCP). The customer's internal compliance requirements dictate that end-user access may only be allowed if the traffic seems to originate from a specific known good CIDR. The customer accepts the risk that their application will only have SYN flood DDoS protection. They want to use GCP's native SYN flood protection.
Which product should be used to meet these requirements?

（A）Cloud Identity and Access Management

（B）Cloud Armor

（C）Cloud CDN

（D）VPC Firewall Rules

正解：B 解答を投票する

質問 9

You are using Security Command Center (SCC) to protect your workloads and receive alerts for suspected security breaches at your company. You need to detect cryptocurrency mining software.
Which SCC service should you use?

（A）Virtual Machine Threat Detection

（B）Container Threat Detection

（C）Rapid Vulnerability Detection

（D）Web Security Scanner

正解：A 解答を投票する

質問 10

You control network traffic for a folder in your Google Cloud environment. Your folder includes multiple projects and Virtual Private Cloud (VPC) networks You want to enforce on the folder level that egress connections are limited only to IP range 10.58.5.0/24 and only from the VPC network dev-vpc." You want to minimize implementation and maintenance effort What should you do?

（A）* 1 Leave the network configuration of the VMs in scope unchanged
* 2 Enable Cloud NAT for dev-vpc" and restrict the target range in Cloud NAT to 10.58.5 0/24.

（B）* 1. Attach external IP addresses to the VMs in scope.
* 2. Define and apply a hierarchical firewall policy on folder level to deny all egress connections and to allow egress to IP range 10 58.5.0/24 from network dev-vpc.

（C）* 1. Attach external IP addresses to the VMs in scope.
* 2. Configure a VPC Firewall rule in "dev-vpc" that allows egress connectivity to IP range 10.58.5.0/24 for all source addresses in this network.

（D）* 1. Leave the network configuration of the VMs in scope unchanged.
* 2. Create a new project including a new VPC network "new-vpc."
* 3 Deploy a network appliance in "new-vpc" to filter access requests and only allow egress connections from -dev-vpc" to 10.58.5.0/24.

正解：B 解答を投票する

解説: (JPNTest メンバーにのみ表示されます)

質問 11

As adoption of the Cloud Data Loss Prevention (DLP) API grows within the company, you need to optimize usage to reduce cost. DLP target data is stored in Cloud Storage and BigQuery. The location and region are identified as a suffix in the resource name.
Which cost reduction options should you recommend?

（A）Set appropriate rowsLimit value on BigQuery data hosted outside the US and set appropriate bytesLimitPerFile value on multiregional Cloud Storage buckets.

（B）Set appropriate rowsLimit value on BigQuery data hosted outside the US, and minimize transformation units on multiregional Cloud Storage buckets.

（C）Use FindingLimits and TimespanContfig to sample data and minimize transformation units.

（D）Use rowsLimit and bytesLimitPerFile to sample data and use CloudStorageRegexFileSet to limit scans.

正解：D 解答を投票する

解説: (JPNTest メンバーにのみ表示されます)

質問 12

You need to enable VPC Service Controls and allow changes to perimeters in existing environments without preventing access to resources. Which VPC Service Controls mode should you use?

（A）Enforced

（B）Native

（C）Cloud Run

（D）Dry run

正解：D 解答を投票する

質問 13

A customer wants to move their sensitive workloads to a Compute Engine-based cluster using Managed Instance Groups (MIGs). The jobs are bursty and must be completed quickly. They have a requirement to be able to manage and rotate the encryption keys.
Which boot disk encryption solution should you use on the cluster to meet this customer's requirements?

（A）Customer-managed encryption keys (CMEK) using Cloud Key Management Service (KMS)

（B）Customer-supplied encryption keys (CSEK)

（C）Encryption by default

（D）Pre-encrypting files before transferring to Google Cloud Platform (GCP) for analysis

正解：A 解答を投票する

解説: (JPNTest メンバーにのみ表示されます)

質問 14

You are the security admin of your company. Your development team creates multiple GCP projects under the
"implementation" folder for several dev, staging, and production workloads. You want to prevent data exfiltration by malicious insiders or compromised code by setting up a security perimeter. However, you do not want to restrict communication between the projects.
What should you do?

（A）Use an infrastructure-as-code software tool to set up a single service perimeter and to deploy a Cloud Function that monitors the "implementation" folder via Stackdriver and Cloud Pub/Sub. When the function notices that a new project is added to the folder, it executes Terraform to add the new project to the associated perimeter.

（B）Use a Shared VPC to enable communication between all projects, and use firewall rules to prevent data exfiltration.

（C）Create access levels in Access Context Manager to prevent data exfiltration, and use a shared VPC for communication between projects.

（D）Use an infrastructure-as-code software tool to set up three different service perimeters for dev, staging, and prod and to deploy a Cloud Function that monitors the "implementation" folder via Stackdriver and Cloud Pub/Sub. When the function notices that a new project is added to the folder, it executes Terraform to add the new project to the respective perimeter.

正解：A 解答を投票する

解説: (JPNTest メンバーにのみ表示されます)

質問 15

Your security team wants to implement a defense-in-depth approach to protect sensitive data stored in a Cloud Storage bucket. Your team has the following requirements:
The Cloud Storage bucket in Project A can only be readable from Project B.
The Cloud Storage bucket in Project A cannot be accessed from outside the network.
Data in the Cloud Storage bucket cannot be copied to an external Cloud Storage bucket.
What should the security team do?

（A）Enable domain restricted sharing in an organization policy, and enable uniform bucket-level access on the Cloud Storage bucket.

（B）Enable VPC Service Controls, create a perimeter around Projects A and B. and include the Cloud Storage API in the Service Perimeter configuration.

（C）Enable VPC Peering between Project A and B's networks with strict firewall rules that allow communication between the networks.

（D）Enable Private Access in both Project A and B's networks with strict firewall rules that allow communication between the networks.

正解：B 解答を投票する

解説: (JPNTest メンバーにのみ表示されます)

質問 16

Your team uses a service account to authenticate data transfers from a given Compute Engine virtual machine instance of to a specified Cloud Storage bucket. An engineer accidentally deletes the service account, which breaks application functionality. You want to recover the application as quickly as possible without compromising security.
What should you do?

（A）Temporarily disable authentication on the Cloud Storage bucket.

（B）Create a new service account with the same name as the deleted service account.

（C）Update the permissions of another existing service account and supply those credentials to the applications.

（D）Use the undelete command to recover the deleted service account.

正解：D 解答を投票する

解説: (JPNTest メンバーにのみ表示されます)

質問 17

An employer wants to track how bonus compensations have changed over time to identify employee outliers and correct earning disparities. This task must be performed without exposing the sensitive compensation data for any individual and must be reversible to identify the outlier.
Which Cloud Data Loss Prevention API technique should you use to accomplish this?

（A）CryptoReplaceFfxFpeConfig

（B）CryptoHashConfig

（C）Redaction

（D）Generalization

正解：A 解答を投票する

解説: (JPNTest メンバーにのみ表示されます)

質問 18

Your organization recently activated the Security Command Center {SCO standard tier. There are a few Cloud Storage buckets that were accidentally made accessible to the public. You need to investigate the impact of the incident and remediate it.
What should you do?

（A）*1 Remove the Identity and Access Management (IAM) granting access to allusers from the buckets
*2 Apply the organization policy storage. unifromBucketLevelAccess to prevent regressions
*3 Query the data access logs to report on unauthorized access

（B）*1 Change the bucket permissions to limit access
*2 Query the buckets usage logs to report on unauthorized access to the data
*3 Enforce the organization policy storage.publicAccessPrevention to avoid regressions

（C）*1 Change bucket permissions to limit access
*2 Query the data access audit logs for any unauthorized access to the buckets
*3 After the misconfiguration is corrected mute the finding in the Security Command Center

（D）*1 Change permissions to limit access for authorized users
*2 Enforce a VPC Service Controls perimeter around all the production projects to immediately stop any unauthorized access
*3 Review the administrator activity audit logs to report on any unauthorized access

正解：C 解答を投票する

質問 19

A customer's internal security team must manage its own encryption keys for encrypting data on Cloud Storage and decides to use customer-supplied encryption keys (CSEK).
How should the team complete this task?

（A）Upload the encryption key to a Cloud Storage bucket, and then upload the object to the same bucket.

（B）Use the gsutil command line tool to upload the object to Cloud Storage, and specify the location of the encryption key.

（C）Generate an encryption key in the Google Cloud Platform Console, and upload an object to Cloud Storage using the specified key.

（D）Encrypt the object, then use the gsutil command line tool or the Google Cloud Platform Console to upload the object to Cloud Storage.

正解：B 解答を投票する

解説: (JPNTest メンバーにのみ表示されます)

質問 20

You are onboarding new users into Cloud Identity and discover that some users have created consumer user accounts using the corporate domain name. How should you manage these consumer user accounts with Cloud Identity?

（A）Use the transfer tool for unmanaged user accounts.

（B）Configure single sign-on using a customer's third-party provider.

（C）Create a new managed user account for each consumer user account.

（D）Use Google Cloud Directory Sync to convert the unmanaged user accounts.

正解：A 解答を投票する

解説: (JPNTest メンバーにのみ表示されます)

Professional-Cloud-Security-Engineer 無料問題集「Google Cloud Certified - Professional Cloud Security Engineer」

弊社を連絡する

関連リンク

トップ試験