Nach der Bezahlung geht es ohne Wartezeit los: Ihre Professional-Cloud-Security-Engineer Lernmaterialien von Fast2test stehen sofort zum Download bereit und erreichen Sie zusätzlich innerhalb einer Minute per E-Mail. So starten Sie noch heute mit Ihrer Vorbereitung auf die Google Cloud Certified - Professional Cloud Security Engineer.

Google Professional-Cloud-Security-Engineer Prüfungsübersicht:

Google Professional-Cloud-Security-Engineer Prüfungsthemen:

FAQ: Alles Wichtige zur Google Professional-Cloud-Security-Engineer Zertifizierungsprüfung

Google Cloud Certified - Professional Cloud Security Engineer Professional-Cloud-Security-Engineer Prüfungsfragen mit Lösungen

Frage #1

You are the security admin of your company. Your development team creates multiple GCP projects under the "implementation" folder for several dev, staging, and production workloads. You want to prevent data exfiltration by malicious insiders or compromised code by setting up a security perimeter. However, you do not want to restrict communication between the projects.
What should you do?

A. Create access levels in Access Context Manager to prevent data exfiltration, and use a shared VPC for communication between projects.
B. Use an infrastructure-as-code software tool to set up a single service perimeter and to deploy a Cloud Function that monitors the "implementation" folder via Stackdriver and Cloud Pub/Sub. When the function notices that a new project is added to the folder, it executes Terraform to add the new project to the associated perimeter.
C. Use a Shared VPC to enable communication between all projects, and use firewall rules to prevent data exfiltration.
D. Use an infrastructure-as-code software tool to set up three different service perimeters for dev, staging, and prod and to deploy a Cloud Function that monitors the "implementation" folder via Stackdriver and Cloud Pub/Sub. When the function notices that a new project is added to the folder, it executes Terraform to add the new project to the respective perimeter.

Frage #2

A security audit uncovered several inconsistencies in your project's Identity and Access Management (IAM) configuration. Some service accounts have overly permissive roles, and a few external collaborators have more access than necessary. You need to gain detailed visibility into changes to IAM policies, user activity, service account behavior, and access to sensitive projects. What should you do?

A. Enable the metrics explorer in Cloud Monitoring to follow the service account authentication events and build alerts linked on it.
B. Configure Google Cloud Functions to be triggered by changes to IAM policies. Analyze changes by using the policy simulator, send alerts upon risky modifications, and store event details.
C. Use Cloud Audit Logs. Create log export sinks to send these logs to a security information and event management (SIEM) solution for correlation with other event sources.
D. Deploy the OS Config Management agent to your VMs. Use OS Config Management to create patch management jobs and monitor system modifications.

Frage #3

Your company is using Cloud Dataproc for its Spark and Hadoop jobs. You want to be able to create, rotate, and destroy symmetric encryption keys used for the persistent disks used by Cloud Dataproc. Keys can be stored in the cloud.
What should you do?

A. Use the Cloud Key Management Service to manage the data encryption key (DEK).
B. Use customer-supplied encryption keys to manage the key encryption key (KEK).
C. Use customer-supplied encryption keys to manage the data encryption key (DEK).
D. Use the Cloud Key Management Service to manage the key encryption key (KEK).

Frage #4

A company has redundant mail servers in different Google Cloud Platform regions and wants to route customers to the nearest mail server based on location.
How should the company accomplish this?

A. Create a Network Load Balancer to listen on TCP port 995 with a forwarding rule to forward traffic basedon location.
B. Use Cloud CDN to route the mail traffic to the closest origin mail server based on client IP address.
C. Configure TCP Proxy Load Balancing as a global load balancing service listening on port 995.
D. Use Cross-Region Load Balancing with an HTTP(S) load balancer to route traffic to the nearest region.

Frage #5

Your company requires the security and network engineering teams to identify all network anomalies and be able to capture payloads within VPCs. Which method should you use?

A. Enable VPC Flow Logs on the subnet.
B. Monitor and analyze Cloud Audit Logs.
C. Define an organization policy constraint.
D. Configure packet mirroring policies.

Fragen und Antworten: