Professional-Cloud-Security-Engineer無料問題集「Google Cloud Certified

質問 1

Your organization operates Virtual Machines (VMs) with only private IPs in the Virtual Private Cloud (VPC) with internet access through Cloud NAT. Everyday, you must patch all VMs with critical OS updates and provide summary reports.
What should you do?

（A）Validate that the egress firewall rules allow any outgoing traffic. Log in to each VM and execute OS specific update commands. Configure the Cloud Scheduler job to update with critical patches daily for daily updates.

（B）Assign public IPs to VMs. Validate that the egress firewall rules allow any outgoing traffic. Log in to each VM, and configure a daily cron job to enable for OS updates at night during low activity periods.

（C）Copy the latest patches to the Cloud Storage bucket. Log in to each VM, download the patches from the bucket, and install them.

（D）Ensure that VM Manager is installed and running on the VMs. In the OS patch management service, configure the patch jobs to update with critical patches dally.

正解：D 解答を投票する

解説: (JPNTest メンバーにのみ表示されます)

質問 2

You need to follow Google-recommended practices to leverage envelope encryption and encrypt data at the application layer.
What should you do?

（A）Generate a data encryption key (DEK) locally to encrypt the data, and generate a new key encryption key (KEK) in Cloud KMS to encrypt the DEK. Store both the encrypted data and the KEK.

（B）Generate a new data encryption key (DEK) in Cloud KMS to encrypt the data, and generate a key encryption key (KEK) locally to encrypt the key. Store both the encrypted data and the encrypted DEK.

（C）Generate a new data encryption key (DEK) in Cloud KMS to encrypt the data, and generate a key encryption key (KEK) locally to encrypt the key. Store both the encrypted data and the KEK.

（D）Generate a data encryption key (DEK) locally to encrypt the data, and generate a new key encryption key (KEK) in Cloud KMS to encrypt the DEK. Store both the encrypted data and the encrypted DEK.

正解：D 解答を投票する

解説: (JPNTest メンバーにのみ表示されます)

質問 3

You need to set up a Cloud interconnect connection between your company's on-premises data center and VPC host network. You want to make sure that on- premises applications can only access Google APIs over the Cloud Interconnect and not through the public internet. You are required to only use APIs that are supported by VPC Service Controls to mitigate against exfiltration risk to non-supported APIs. How should you configure the network?

（A）Enable Private Google Access on the regional subnets and global dynamic routing mode.

（B）Use private.googleapis.com to access Google APIs using a set of IP addresses only routable from within Google Cloud, which are advertised as routes over the connection.

（C）Use restricted googleapis.com to access Google APIs using a set of IP addresses only routable from within Google Cloud, which are advertised as routes over the Cloud Interconnect connection.

（D）Set up a Private Service Connect endpoint IP address with the API bundle of "all-apis", which is advertised as a route over the Cloud interconnect connection.

正解：C 解答を投票する

解説: (JPNTest メンバーにのみ表示されます)

質問 4

A customer needs an alternative to storing their plain text secrets in their source-code management (SCM) system.
How should the customer achieve this using Google Cloud Platform?

（A）Encrypt the secrets with a Customer-Managed Encryption Key (CMEK), and store them in Cloud Storage.

（B）Deploy the SCM to a Compute Engine VM with local SSDs, and enable preemptible VMs.

（C）Use Cloud Source Repositories, and store secrets in Cloud SQL.

（D）Run the Cloud Data Loss Prevention API to scan the secrets, and store them in Cloud SQL.

正解：A 解答を投票する

質問 5

You are developing an application that runs on a Compute Engine VM. The application needs to access data stored in Cloud Storage buckets in other Google Cloud projects. The required access to the buckets is variable. You need to provide access to these resources while following Google- recommended practices. What should you do?

（A）Create a group and assign IAM bindings to the group for each bucket that the application needs to access. Assign the VM's service account to the group.

（B）Limit the VMs access to the Cloud Storage buckets by setting the relevant access scope of the VM.

（C）Create IAM bindings for the VM's service account and the required buckets that allow appropriate access to the data stored in the buckets.

（D）Grant the VM's service account access to the required buckets by using domain-wide delegation.

正解：C 解答を投票する

解説: (JPNTest メンバーにのみ表示されます)

質問 6

You have the following resource hierarchy. There is an organization policy at each node in the hierarchy as shown. Which load balancer types are denied in VPCA?

（A）EXTERNAL_TCP_PROXY, EXTERNAL_SSL_PROXY, INTERNAL_TCP_UDP, andINTERNAL_HTTP_HTTPS are denied in accordance with the folder and project's policies.

（B）INTERNAL_TCP_UDP, INTERNAL_HTTP_HTTPS is denied in accordance with the folder's policy.

（C）All load balancer types are denied in accordance with the global node's policy.

（D）EXTERNAL_TCP_PROXY, EXTERNAL_SSL_PROXY are denied in accordance with the project's policy.

正解：C 解答を投票する

解説: (JPNTest メンバーにのみ表示されます)

質問 7

When creating a secure container image, which two items should you incorporate into the build if possible? (Choose two.)

（A）Ensure that the app does not run as PID 1.

（B）Use many container image layers to hide sensitive information.

（C）Remove any unnecessary tools not needed by the app.

（D）Use public container images as a base image for the app.

（E）Package a single app as a container.

正解：C、E 解答を投票する

解説: (JPNTest メンバーにのみ表示されます)

質問 8

A company is backing up application logs to a Cloud Storage bucket shared with both analysts and the administrator. Analysts should only have access to logs that do not contain any personally identifiable information (PII). Log files containing PII should be stored in another bucket that is only accessible by the administrator.
What should you do?

（A）On the bucket shared with both the analysts and the administrator, configure a Cloud Storage Trigger that is only triggered when PII data is uploaded. Use Cloud Functions to capture the trigger and delete such files.

（B）Upload the logs to both the shared bucket and the bucket only accessible by the administrator.
Create a job trigger using the Cloud Data Loss Prevention API. Configure the trigger to delete any files from the shared bucket that contain PII.

（C）Use Cloud Pub/Sub and Cloud Functions to trigger a Data Loss Prevention scan every time a file is uploaded to the shared bucket. If the scan detects PII, have the function move into a Cloud Storage bucket only accessible by the administrator.

（D）On the bucket shared with both the analysts and the administrator, configure Object Lifecycle Management to delete objects that contain any PII.

正解：C 解答を投票する

解説: (JPNTest メンバーにのみ表示されます)

質問 9

The security operations team needs access to the security-related logs for all projects in their organization. They have the following requirements:
- Follow the least privilege model by having only view access to logs.
- Have access to Admin Activity logs.
- Have access to Data Access logs.
- Have access to Access Transparency logs.
Which Identity and Access Management (IAM) role should the security operations team be granted?

（A）roles/logging.admin

（B）roles/logging.viewer

（C）roles/viewer

（D）roles/logging.privateLogViewer

正解：D 解答を投票する

解説: (JPNTest メンバーにのみ表示されます)

質問 10

Your organization is migrating business critical applications to Google Cloud across multiple projects. You only have the required IAM permission at the Google Cloud organization level. You want to grant project access to support engineers from two partner organizations using their existing identity provider (IdP) credentials. What should you do?

（A）Sync user identities from their existing IdPs to Cloud Identity by using Google Cloud Directory Sync (GCDS).

（B）Create two single sign-on (SSO) profiles for the internal and partner IdPs by using SSO for Cloud Identity.

（C）Create two workforce identity pools for the partner IdPs.

（D）Create users manually by using the Google Cloud console. Assign the users to groups.

正解：C 解答を投票する

質問 11

You want to limit the images that can be used as the source for boot disks. These images will be stored in a dedicated project.
What should you do?

（A）In Resource Manager, edit the project permissions for the trusted project. Add the organization as member with the role: Compute Image User.

（B）Use the Organization Policy Service to create a compute.trustedimageProjects constraint on the organization level. List the trusted projects as the exceptions in a deny operation.

（C）Use the Organization Policy Service to create a compute.trustedimageProjects constraint on the organization level. List the trusted project as the whitelist in an allow operation.

（D）In Resource Manager, edit the organization permissions. Add the project ID as member with the role:Compute Image User.

正解：C 解答を投票する

解説: (JPNTest メンバーにのみ表示されます)

質問 12

A customer wants to grant access to their application running on Compute Engine to write only to a specific Cloud Storage bucket. How should you grant access?

（A）Create a service account for the application, and grant Cloud Storage Object Creator permissions to the project.

（B）Create a service account for the application, and grant Cloud Storage Object Creator permissions at the bucket level.

（C）Create a user account, authenticate with the application, and grant Google Storage Admin permissions at the bucket level.

（D）Create a user account, authenticate with the application, and grant Google Storage Admin permissions at the project leve

正解：B 解答を投票する

解説: (JPNTest メンバーにのみ表示されます)

質問 13

Your EU-based organization stores both Personally Identifiable Information (PII) and non-PII data in Cloud Storage buckets across multiple Google Cloud regions. EU data privacy laws require that the PII data must not be stored outside of the EU. To help meet this compliance requirement, you want to detect if Cloud Storage buckets outside of the EU contain healthcare data. What should you do?

（A）Create a Sensitive Data Protection job. Specify the infoType of data to be detected and run the job across all Google Cloud Storage buckets.

（B）Create a log sink with a filter on resourceLocation.currentLocations. Trigger an alert if a log message appears with a non- EUcountry.

（C）Activate Security Command Center Premium. Use compliance monitoring to detect resources that do not follow the applicable healthcare regulation.

（D）Enforce the gcp.resourceLocations organization policy and add "EU" in a custom rule that only applies on resources with the tag "healthcare".

正解：A 解答を投票する

質問 14

You are working with a client that is concerned about control of their encryption keys for sensitive data. The client does not want to store encryption keys at rest in the same cloud service provider (CSP) as the data that the keys are encrypting. Which Google Cloud encryption solutions should you recommend to this client? (Choose two.)

（A）Cloud External Key Manager

（B）Customer-supplied encryption keys.

（C）Customer-managed encryption keys

（D）Google default encryption

（E）Secret Manager

正解：A、B 解答を投票する

質問 15

Your organization hosts a sensitive web application in Google Cloud. To protect the web application, you've set up a virtual private cloud (VPC) with dedicated subnets for the application's frontend and backend components. You must implement security controls to restrict incoming traffic, protect against web-based attacks, and monitor internal traffic. What should you do?

（A）Configure Cloud Intrusion Detection System (Cloud IDS) to monitor incoming connections, deploy Identity-Aware Proxy (IAP) to block common web attacks, and deploy Google Cloud Armor to detect internal traffic anomalies.

（B）Configure Cloud Firewall to permit allow-listed traffic only, deploy Google Cloud Armor with predefined rules for blocking common web attacks, and deploy Cloud Intrusion Detection System (IDS) to detect internal traffic anomalies.

（C）Configure Cloud DNS to secure incoming traffic, deploy Cloud Intrusion Detection System (Cloud IDS) to detect common web attacks, and deploy Google Cloud Armor to detect internal traffic anomalies.

（D）Configure Google Cloud Armor to allow incoming connections, configure DNS Security Extensions (DNSSEC) on Cloud DNS to secure against common web attacks, and deploy Cloud Intrusion Detection System (Cloud IDS) to detect internal traffic anomalies.

正解：B 解答を投票する

質問 16

Your company conducts clinical trials and needs to analyze the results of a recent study that are stored in BigQuery. The interval when the medicine was taken contains start and stop dates. The interval data is critical to the analysis, but specific dates may identify a particular batch and introduce bias. You need to obfuscate the start and end dates for each row and preserve the interval data.
What should you do?

（A）Use date shifting with the context set to the unique ID of the test subject.

（B）Extract the date using TimePartConfig from each date field and append a random month and year.

（C）Use the FFX mode of format preserving encryption (FPE) and maintain data consistency.

（D）Use bucketing to shift values to a predetermined date based on the initial value.

正解：A 解答を投票する

解説: (JPNTest メンバーにのみ表示されます)

質問 17

Your security team uses encryption keys to ensure confidentiality of user data. You want to establish a process to reduce the impact of a potentially compromised symmetric encryption key in Cloud Key Management Service (Cloud KMS).
Which steps should your team take before an incident occurs? (Choose two.)

（A）Disable and revoke access to compromised keys.

（B）Limit the number of messages encrypted with each key version.

（C）Manually rotate key versions on an ad hoc schedule.

（D）Disable the Cloud KMS API.

（E）Enable automatic key version rotation on a regular schedule.

正解：B、E 解答を投票する

解説: (JPNTest メンバーにのみ表示されます)

Professional-Cloud-Security-Engineer 無料問題集「Google Cloud Certified - Professional Cloud Security Engineer」

弊社を連絡する

関連リンク

トップ試験