Free Google Professional-Cloud-Security-Engineer Exam Questions

Question 1

A patch for a vulnerability has been released and a DevOps team in a healthcare technology company needs to update their running containers in Google Kubernetes Engine (GKE). What steps should the DevOps team take to accomplish this task?

A : Confirm whether auto-upgrade is turned on; if enabled, Google will handle node upgrades within a GKE cluster.

B : Set up the containers to automatically upgrade when the base image becomes available in the Container Registry.

C : Apply a patch or update the application code, construct a new image, and deploy it again.

D : Utilize Puppet or Chef to deploy the necessary patch to the container that's currently running.

Answer: C

Question 2

Your organization needs to allow public web applications to upload files to a Cloud Storage bucket. You need to design a secure access mechanism that adheres to the principle of least privilege. What should you do?

A : Create a service account with write access to the Cloud Storage bucket. Distribute the service account key to the external web applications.

B : Implement a proxy service that authenticates the external web applications and then uploads the files to the Cloud Storage bucket on their behalf using a service account key

C : Grant the external web applications direct access to the Cloud Storage bucket by adding their IP addresses to the bucket's access control list (ACL)

D : Generate short-lived credentials in Workload Identity Federation for each upload request. Grant temporary and scoped access to the Cloud Storage bucket

Answer: D

Question 3

Your organization needs to allow public web applications to upload files to a Cloud Storage bucket. You need to design a secure access mechanism that adheres to the principle of least privilege. What should you do?

A : Create a service account with write access to the Cloud Storage bucket. Distribute the service account key to the external web applications.

B : Implement a proxy service that authenticates the external web applications and then uploads the files to the Cloud Storage bucket on their behalf using a service account key

C : Grant the external web applications direct access to the Cloud Storage bucket by adding their IP addresses to the bucket's access control list (ACL)

D : Generate short-lived credentials in Workload Identity Federation for each upload request. Grant temporary and scoped access to the Cloud Storage bucket

Answer: D

Question 4

Your organization must comply with the regulation to keep instance logging data within Europe. Yourworkloads will be hosted in the Netherlands in region europe-west4 in a new project. You must configureCloud Logging to keep your data in the country.What should you do?

A : Configure the organization policy constraint gcp.resourceLocations to europe-west4.

B : Set the logging storage region to eurcpe-west4 by using the gcloud CLI logging settings update.

C : Create a new tog bucket in europe-west4. and redirect the _Def auit bucKet to the new bucket.

D : Configure log sink to export all logs into a Cloud Storage bucket in europe-west4.

Answer: D

Question 5

The CISO of your highly regulated organization has mandated that all AI applications running in production must be based on Google first-party models. Your security team has now implemented the Model Garden's organization policy meant to centrally control access and user actions on these approved models at the production folder level. However, it appears that someone has overwritten the policy. This has allowed developers to access third-party models on a particular production project. You need to resolve the issue with a solution that prevents a repeat occurrence. What should you do?

A : Withdraw the Organization Policy Administrator role from all non-security team principals at the organization level

B : Withdraw the Organization Policy Administrator role from all non-security team principals at the production folder level

C : Implement a security posture based on the secure_ai_extended template to notify the security team of any policy changes at the organization level

D : Implement a security posture based on the secure_ai_extended template to notify the security team of any policy changes at the production folder level

Answer: A