Professional-Cloud-Security-Engineer 無料問題集「Google Cloud Certified - Professional Cloud Security Engineer」

（A）Use SSO/SAML integration with Cloud Identity for user authentication and user lifecycle management.

（B）Provide granular access with predefined roles.

（C）Provision users with basic roles using Google's Identity and Access Management (1AM) service.

（D）Manually add users to Google Cloud.

（E）Use Google default encryption.

（A）VPC Flow logs

（B）System Event logs

（C）Admin Activity logs

（D）Agent logs

（E）Data Access logs

（A）Enable project-level data access logs for BigQuery. Cloud Storage, and Cloud SQL. Configure log sinks to export these logs to Security Command Center to identify unauthorized access attempts.

（B）Grant project-level group permissions by using specific Cloud IAM roles. Use BigQuery authorized views. Cloud Storage uniform bucket-level access, and Cloud SQL database roles.

（C）Use VPC Service Controls to create security perimeters around the projects for BigQuery. Cloud Storage, and Cloud SQL services. restricting access based on the network origin of the requests.

（D）Configure an access level to control access to the Google Cloud console for users managing these data services. Require multi-factor authentication for all access attempts.

（A）A rule that allows all outbound connections

（B）A rule that blocks all outbound connections

（C）A rule that blocks all inbound port 25 connections

（D）A rule that allows all inbound port 80 connections

（E）A rule that denies all inbound connections

（A）Private Google Access

（B）Public IP

（C）IAM Network User Role

（D）IP Forwarding

（E）Static routes

（A）Enable Access Transparency Logging.

（B）Deploy Assured Workloads.

（C）Deploy resources only to regions permitted by data residency requirements

（D）Use Data Access logging and Access Transparency logging to confirm that no users are accessing data from another region.

（A）Build a connector for the SIEM to query for all logs in real time from the GCP RESTful JSON APIs.

（B）Configure Organizational Log Sinks to export logs to a Cloud Pub/Sub Topic, which will be sent to the SIEM via Dataflow.

（C）Send all logs to the SIEM system via an existing protocol such as syslog.

（D）Configure every project to export all their logs to a common BigQuery DataSet, which will be queried by the SIEM system.

（A）Make sure that the Compute Engine cluster is running on a separate subnet.

（B）Avoid assigning public IP addresses to the Compute Engine cluster.

（C）Configure Private Google Access on the Compute Engine subnet

（D）Turn off IP forwarding on the Compute Engine instances in the cluster.

（E）Configure a Cloud NAT gateway.

（A）Generate a data encryption key (DEK) locally to encrypt the data, and generate a new key encryption key (KEK) in Cloud KMS to encrypt the DEK. Store both the encrypted data and the KEK.

（B）Generate a new data encryption key (DEK) in Cloud KMS to encrypt the data, and generate a key encryption key (KEK) locally to encrypt the key. Store both the encrypted data and the encrypted DEK.

（C）Generate a new data encryption key (DEK) in Cloud KMS to encrypt the data, and generate a key encryption key (KEK) locally to encrypt the key. Store both the encrypted data and the KEK.

（D）Generate a data encryption key (DEK) locally to encrypt the data, and generate a new key encryption key (KEK) in Cloud KMS to encrypt the DEK. Store both the encrypted data and the encrypted DEK.

（A）Cloud Identity

（B）Google Cloud Directory Sync (GCDS)

（C）Pub/Sub

（D）Security Assertion Markup Language (SAML)

（A）Temporarily disable authentication on the Cloud Storage bucket.

（B）Create a new service account with the same name as the deleted service account.

（C）Update the permissions of another existing service account and supply those credentials to the applications.

（D）Use the undelete command to recover the deleted service account.

（A）Use a service account with read-only access to the Cloud Storage bucket to retrieve the credentials from the instance metadata.

（B）Use a service account with read-only access to the Cloud Storage bucket, and store the credentials to the service account in the config of the application on the Compute Engine instance.

（C）Create a Cloud Storage ACL that allows read-only access from the Compute Engine instance's IP address and allows the application to read from the bucket without credentials.

（D）Encrypt the data in the Cloud Storage bucket using Cloud KMS, and allow the application to decrypt the data with the KMS key.

（A）Encrypt non-sensitive data and sensitive data with Cloud External Key Manager.

（B）Encrypt non-sensitive data and sensitive data with Cloud Key Management Service

（C）Encrypt non-sensitive data with Google default encryption, and encrypt sensitive data with Cloud External Key Manager.

（D）Encrypt non-sensitive data with Google default encryption, and encrypt sensitive data with Cloud Key Management Service.

（A）Route all on-premises traffic to Google Cloud through a dedicated or Partner interconnect to a VPC with Private Google Access enabled.

（B）Enforce a security policy that mandates all applications to encrypt data with a Cloud Key Management.
Service (KMS) key before you send it over the network.

（C）Set up VPC peering between the hosts on-premises and the VPC through the internet.

（D）Route all on-premises traffic to Google Cloud through an IPsec VPN tunnel to a VPC with Private Google Access enabled.