Question #: 65

A customer has an analytics workload running on Compute Engine that should have limited internet
access.

Your team created an egress firewall rule to deny (priority 1000) all traffic to the internet.

The Compute Engine instances now need to reach out to the public repository to get security updates.

What should your team do?

A. Create an egress firewall rule to allow traffic to the CIDR range of the repository with a priority greater
than 1000.

B. Create an egress firewall rule to allow traffic to the CIDR range of the repository with a priority less
than 1000.

C. Create an egress firewall rule to allow traffic to the hostname of the repository with a priority greater
than 1000.

D. Create an egress firewall rule to allow traffic to the hostname of the repository with a priority less
than 1000.

Question #: 66

You want data on Compute Engine disks to be encrypted at rest with keys managed by Cloud Key
Management Service (KMS). Cloud Identity and Access

Management (IAM) permissions to these keys must be managed in a grouped way because the
permissions should be the same for all keys.

What should you do?

A. Create a single KeyRing for all persistent disks and all Keys in this KeyRing. Manage the IAM
permissions at the Key level.

B. Create a single KeyRing for all persistent disks and all Keys in this KeyRing. Manage the IAM
permissions at the KeyRing level.

C. Create a KeyRing per persistent disk, with each KeyRing containing a single Key. Manage the IAM
permissions at the Key level.

D. Create a KeyRing per persistent disk, with each KeyRing containing a single Key. Manage the IAM
permissions at the KeyRing level.
Question #: 67

A company is backing up application logs to a Cloud Storage bucket shared with both analysts and the
administrator. Analysts should only have access to logs that do not contain any personally identifiable
information (PII). Log files containing PII should be stored in another bucket that is only accessible by the
administrator.

What should you do?

A. Use Cloud Pub/Sub and Cloud Functions to trigger a Data Loss Prevention scan every time a file is
uploaded to the shared bucket. If the scan detects PII, have the function move into a Cloud Storage
bucket only accessible by the administrator.

B. Upload the logs to both the shared bucket and the bucket only accessible by the administrator. Create
a job trigger using the Cloud Data Loss Prevention API. Configure the trigger to delete any files from the
shared bucket that contain PII.

C. On the bucket shared with both the analysts and the administrator, configure Object Lifecycle
Management to delete objects that contain any PII.

D. On the bucket shared with both the analysts and the administrator, configure a Cloud Storage Trigger
that is only triggered when PII data is uploaded. Use Cloud Functions to capture the trigger and delete
such files.

Question #: 68

A customer terminates an engineer and needs to make sure the engineer's Google account is
automatically deprovisioned.

What should the customer do?

A. Use the Cloud SDK with their directory service to remove their IAM permissions in Cloud Identity.

B. Use the Cloud SDK with their directory service to provision and deprovision users from Cloud Identity.

C. Configure Cloud Directory Sync with their directory service to provision and deprovision users from
Cloud Identity.

D. Configure Cloud Directory Sync with their directory service to remove their IAM permissions in Cloud
Identity.

Question #: 69

An organization is evaluating the use of Google Cloud Platform (GCP) for certain IT workloads. A well-
established directory service is used to manage user identities and lifecycle management. This directory
service must continue for the organization to use as the ‫ג‬€source of truth‫ג‬€ directory for identities.

Which solution meets the organization's requirements?

A. Google Cloud Directory Sync (GCDS)

B. Cloud Identity

C. Security Assertion Markup Language (SAML)

D. Pub/Sub

Actual exam question from Google's Professional Cloud Security Engineer

Question #: 70

Which international compliance standard provides guidelines for information security controls applicable
to the provision and use of cloud services?

A. ISO 27001

B. ISO 27002

C. ISO 27017

D. ISO 27018

Question #: 71

You will create a new Service Account that should be able to list the Compute Engine instances in the
project. You want to follow Google-recommended practices.

What should you do?

A. Create an Instance Template, and allow the Service Account Read Only access for the Compute Engine
Access Scope.

B. Create a custom role with the permission [Link] and grant the Service Account this
role.

C. Give the Service Account the role of Compute Viewer, and use the new Service Account for all
instances.

D. Give the Service Account the role of Project Viewer, and use the new Service Account for all instances.
Question #: 73

An organization is starting to move its infrastructure from its on-premises environment to Google Cloud
Platform (GCP). The first step the organization wants to take is to migrate its ongoing data backup and
disaster recovery solutions to GCP. The organization's on-premises production environment is going to be
the next phase for migration to GCP. Stable networking connectivity between the on-premises
environment and GCP is also being implemented.

Which GCP solution should the organization use?

A. BigQuery using a data pipeline job with continuous updates via Cloud VPN

B. Cloud Storage using a scheduled task and gsutil via Cloud Interconnect

C. Compute Engines Virtual Machines using Persistent Disk via Cloud Interconnect

D. Cloud Datastore using regularly scheduled batch upload jobs via Cloud VPN

Question #: 74

Topic #: 1

[All Professional Cloud Security Engineer Questions]

What are the steps to encrypt data using envelope encryption?

A.

✑ Generate a data encryption key (DEK) locally.

✑ Use a key encryption key (KEK) to wrap the DEK.

✑ Encrypt data with the KEK.

✑ Store the encrypted data and the wrapped KEK.

B.

✑ Generate a key encryption key (KEK) locally.

✑ Use the KEK to generate a data encryption key (DEK).

✑ Encrypt data with the DEK.

✑ Store the encrypted data and the wrapped DEK.

C.

✑ Generate a data encryption key (DEK) locally.

✑ Encrypt data with the DEK.

✑ Use a key encryption key (KEK) to wrap the DEK.

✑ Store the encrypted data and the wrapped DEK.

D.

✑ Generate a key encryption key (KEK) locally.

✑ Generate a data encryption key (DEK) locally.

✑ Encrypt data with the KEK.

Store the encrypted data and the wrapped DEK.

Question #: 75

A customer wants to make it convenient for their mobile workforce to access a CRM web interface that is
hosted on Google Cloud Platform (GCP). The CRM can only be accessed by someone on the corporate
network. The customer wants to make it available over the internet. Your team requires an
authentication layer in front of the application that supports two-factor authentication

Which GCP product should the customer implement to meet these requirements?

A. Cloud Identity-Aware Proxy

B. Cloud Armor

C. Cloud Endpoints

D. Cloud VPN

Question #: 76

One instance in your VPC is configured to run with a private IP address only. You want to ensure that
even if this instance is deleted, its current private IP address will not be automatically assigned to a
different instance.

In the GCP Console, what should you do?

A. Assign a public IP address to the instance.

B. Assign a new reserved internal IP address to the instance.

C. Change the instance's current internal IP address to static.

D. Add custom metadata to the instance with key internal-address and value reserved.

Question #: 77

Last week, a company deployed a new App Engine application that writes logs to BigQuery. No other
workloads are running in the project. You need to validate that all data written to BigQuery was done
using the App Engine Default Service Account.

What should you do?

A. 1. Use StackDriver Logging and filter on BigQuery Insert Jobs. 2. Click on the email address in line with
the App Engine Default Service Account in the authentication field. 3. Click Hide Matching Entries. 4.
Make sure the resulting list is empty.

B. 1. Use StackDriver Logging and filter on BigQuery Insert Jobs. 2. Click on the email address in line with
the App Engine Default Service Account in the authentication field. 3. Click Show Matching Entries. 4.
Make sure the resulting list is empty.

C. 1. In BigQuery, select the related dataset. 2. Make sure the App Engine Default Service Account is the
only account that can write to the dataset.

D. 1. Go to the IAM section on the project. 2. Validate that the App Engine Default Service Account is the
only account that has a role that can write to BigQuery.

Question #: 78

Your team wants to limit users with administrative privileges at the organization level.

Which two roles should your team restrict? (Choose two.)

A. Organization Administrator

B. Super Admin

C. GKE Cluster Admin

D. Compute Admin

E. Organization Role Viewer

Question #: 79

An organization's security and risk management teams are concerned about where their responsibility
lies for certain production workloads they are running in

Google Cloud Platform (GCP), and where Google's responsibility lies. They are mostly running workloads
using Google Cloud's Platform-as-a-Service (PaaS) offerings, including App Engine primarily.

Which one of these areas in the technology stack would they need to focus on as their primary
responsibility when using App Engine?

A. Configuring and monitoring VPC Flow Logs

B. Defending against XSS and SQLi attacks

C. Manage the latest updates and security patches for the Guest OS

D. Encrypting all stored data

Question #: 81

A customer is running an analytics workload on Google Cloud Platform (GCP) where Compute Engine
instances are accessing data stored on Cloud Storage.

Your team wants to make sure that this workload will not be able to access, or be accessed from, the
internet.

Which two strategies should your team use to meet these requirements? (Choose two.)

A. Configure Private Google Access on the Compute Engine subnet

B. Avoid assigning public IP addresses to the Compute Engine cluster.

C. Make sure that the Compute Engine cluster is running on a separate subnet.

D. Turn off IP forwarding on the Compute Engine instances in the cluster.

E. Configure a Cloud NAT gateway.

Question #: 82

A customer wants to run a batch processing system on VMs and store the output files in a Cloud Storage
bucket. The networking and security teams have decided that no VMs may reach the public internet.
How should this be accomplished?

A. Create a firewall rule to block internet traffic from the VM.

B. Provision a NAT Gateway to access the Cloud Storage API endpoint.

C. Enable Private Google Access on the VPC.

D. Mount a Cloud Storage bucket as a local filesystem on every VM.

Question #: 83

As adoption of the Cloud Data Loss Prevention (DLP) API grows within the company, you need to
optimize usage to reduce cost. DLP target data is stored in

Cloud Storage and BigQuery. The location and region are identified as a suffix in the resource name.

Which cost reduction options should you recommend?

A. Set appropriate rowsLimit value on BigQuery data hosted outside the US and set appropriate
bytesLimitPerFile value on multiregional Cloud Storage buckets.

B. Set appropriate rowsLimit value on BigQuery data hosted outside the US, and minimize
transformation units on multiregional Cloud Storage buckets.

C. Use rowsLimit and bytesLimitPerFile to sample data and use CloudStorageRegexFileSet to limit scans.

D. Use FindingLimits and TimespanContfig to sample data and minimize transformation units.

Question #: 84

Your team uses a service account to authenticate data transfers from a given Compute Engine virtual
machine instance of to a specified Cloud Storage bucket. An engineer accidentally deletes the service
account, which breaks application functionality. You want to recover the application as quickly as
possible without compromising security.

What should you do?

A. Temporarily disable authentication on the Cloud Storage bucket.

B. Use the undelete command to recover the deleted service account.

C. Create a new service account with the same name as the deleted service account.

D. Update the permissions of another existing service account and supply those credentials to the
applications.

Question #: 85

You are the Security Admin in your company. You want to synchronize all security groups that have an
email address from your LDAP directory in Cloud IAM.

What should you do?

A. Configure Google Cloud Directory Sync to sync security groups using LDAP search rules that have ‫ג‬
€user email address‫ג‬€ as the attribute to facilitate one-way sync.

B. Configure Google Cloud Directory Sync to sync security groups using LDAP search rules that have ‫ג‬
€user email address‫ג‬€ as the attribute to facilitate bidirectional sync.

C. Use a management tool to sync the subset based on the email address attribute. Create a group in the
Google domain. A group created in a Google domain will automatically have an explicit Google Cloud
Identity and Access Management (IAM) role.

D. Use a management tool to sync the subset based on group object class attribute. Create a group in the
Google domain. A group created in a Google domain will automatically have an explicit Google Cloud
Identity and Access Management (IAM) role.

Question #: 86

You are part of a security team investigating a compromised service account key. You need to audit
which new resources were created by the service account.

What should you do?

A. Query Data Access logs.

B. Query Admin Activity logs.

C. Query Access Transparency logs.

D. Query Stackdriver Monitoring Workspace.

Question #: 87

You have an application where the frontend is deployed on a managed instance group in subnet A and
the data layer is stored on a mysql Compute Engine virtual machine (VM) in subnet B on the same VPC.
Subnet A and Subnet B hold several other Compute Engine VMs. You only want to allow the application
frontend to access the data in the application's mysql instance on port 3306.

What should you do?

A. Configure an ingress firewall rule that allows communication from the src IP range of subnet A to the
tag "data-tag" that is applied to the mysql Compute Engine VM on port 3306.

B. Configure an ingress firewall rule that allows communication from the frontend's unique service
account to the unique service account of the mysql Compute Engine VM on port 3306.

C. Configure a network tag "fe-tag" to be applied to all instances in subnet A and a network tag "data-
tag" to be applied to all instances in subnet B. Then configure an egress firewall rule that allows
communication from Compute Engine VMs tagged with data-tag to destination Compute Engine VMs
tagged fe- tag.

D. Configure a network tag "fe-tag" to be applied to all instances in subnet A and a network tag "data-
tag" to be applied to all instances in subnet B. Then configure an ingress firewall rule that allows
communication from Compute Engine VMs tagged with fe-tag to destination Compute Engine VMs
tagged with data-tag.

Question #: 88

Your company operates an application instance group that is currently deployed behind a Google Cloud
load balancer in us-central-1 and is configured to use the

Standard Tier network. The infrastructure team wants to expand to a second Google Cloud region, us-
east-2. You need to set up a single external IP address to distribute new requests to the instance groups
in both regions.

What should you do?

A. Change the load balancer backend configuration to use network endpoint groups instead of instance
groups.

B. Change the load balancer frontend configuration to use the Premium Tier network, and add the new
instance group.

C. Create a new load balancer in us-east-2 using the Standard Tier network, and assign a static external IP
address.

D. Create a Cloud VPN connection between the two regions, and enable Google Private Access.
Question #: 89

You are the security admin of your company. You have 3,000 objects in your Cloud Storage bucket. You
do not want to manage access to each object individually.

You also do not want the uploader of an object to always have full control of the object. However, you
want to use Cloud Audit Logs to manage access to your bucket.

What should you do?

A. Set up an ACL with OWNER permission to a scope of allUsers.

B. Set up an ACL with READER permission to a scope of allUsers.

C. Set up a default bucket ACL and manage access for users using IAM.

D. Set up Uniform bucket-level access on the Cloud Storage bucket and manage access for users using
IAM.

Question #: 91

Topic #: 1

[All Professional Cloud Security Engineer Questions]

You need to provide a corporate user account in Google Cloud for each of your developers and
operational staff who need direct access to GCP resources.

Corporate policy requires you to maintain the user identity in a third-party identity management
provider and leverage single sign-on. You learn that a significant number of users are using their
corporate domain email addresses for personal Google accounts, and you need to follow Google
recommended practices to convert existing unmanaged users to managed accounts.

Which two actions should you take? (Choose two.)

A. Use Google Cloud Directory Sync to synchronize your local identity management system to Cloud
Identity.

B. Use the Google Admin console to view which managed users are using a personal account for their
recovery email.

C. Add users to your managed Google account and force users to change the email addresses associated
with their personal accounts.

D. Use the Transfer Tool for Unmanaged Users (TTUU) to find users with conflicting accounts and ask
them to transfer their personal Google accounts.
E. Send an email to all of your employees and ask those users with corporate email addresses for
personal Google accounts to delete the personal accounts immediately.

Question #: 92

You are on your company's development team. You noticed that your web application hosted in staging
on GKE dynamically includes user data in web pages without first properly validating the inputted data.
This could allow an attacker to execute gibberish commands and display arbitrary content in a victim
user's browser in a production environment.

How should you prevent and fix this vulnerability?

A. Use Cloud IAP based on IP address or end-user device attributes to prevent and fix the vulnerability.

B. Set up an HTTPS load balancer, and then use Cloud Armor for the production environment to prevent
the potential XSS attack.

C. Use Web Security Scanner to validate the usage of an outdated library in the code, and then use a
secured version of the included library.

D. Use Web Security Scanner in staging to simulate an XSS injection attack, and then use a templating
system that supports contextual auto-escaping.

Question #: 93

You are part of a security team that wants to ensure that a Cloud Storage bucket in Project A can only be
readable from Project B. You also want to ensure that data in the Cloud Storage bucket cannot be
accessed from or copied to Cloud Storage buckets outside the network, even if the user has the correct
credentials.

What should you do?

A. Enable VPC Service Controls, create a perimeter with Project A and B, and include Cloud Storage
service.

B. Enable Domain Restricted Sharing Organization Policy and Bucket Policy Only on the Cloud Storage
bucket.

C. Enable Private Access in Project A and B networks with strict firewall rules to allow communication
between the networks.

D. Enable VPC Peering between Project A and B networks with strict firewall rules to allow
communication between the networks.
Question #: 95

You are a Security Administrator at your organization. You need to restrict service account creation
capability within production environments. You want to accomplish this centrally across the organization.
What should you do?

A. Use Identity and Access Management (IAM) to restrict access of all users and service accounts that
have access to the production environment.

B. Use organization policy constraints/[Link] boolean to disable the

creation of new service accounts.

C. Use organization policy constraints/[Link] boolean to disable the

creation of new service accounts.

D. Use organization policy constraints/[Link] boolean to disable the

creation of new service accounts.

Question #: 96

You are the project owner for a regulated workload that runs in a project you own and manage as an
Identity and Access Management (IAM) admin. For an upcoming audit, you need to provide access
reviews evidence. Which tool should you use?

A. Policy Troubleshooter

B. Policy Analyzer

C. IAM Recommender

D. Policy Simulator

Question #: 98

You have been tasked with implementing external web application protection against common web
application attacks for a public application on Google Cloud.

You want to validate these policy changes before they are enforced. What service should you use?

A. Google Cloud Armor's preconfigured rules in preview mode

B. Prepopulated VPC firewall rules in monitor mode

C. The inherent protections of Google Front End (GFE)

D. Cloud Load Balancing firewall rules

E. VPC Service Controls in dry run mode

Question #: 99

You are asked to recommend a solution to store and retrieve sensitive configuration data from an
application that runs on Compute Engine. Which option should you recommend?

A. Cloud Key Management Service

B. Compute Engine guest attributes

C. Compute Engine custom metadata

D. Secret Manager

Question #: 103

[All Professional Cloud Security Engineer Questions]

You are designing a new governance model for your organization's secrets that are stored in Secret
Manager. Currently, secrets for Production and Non-

Production applications are stored and accessed using service accounts. Your proposed solution must:

✑ Provide granular access to secrets

✑ Give you control over the rotation schedules for the encryption keys that wrap your secrets

✑ Maintain environment separation

✑ Provide ease of management

Which approach should you take?

A. 1. Use separate Google Cloud projects to store Production and Non-Production secrets. 2. Enforce
access control to secrets using project-level identity and Access Management (IAM) bindings. 3. Use
customer-managed encryption keys to encrypt secrets.

B. 1. Use a single Google Cloud project to store both Production and Non-Production secrets. 2. Enforce
access control to secrets using secret-level Identity and Access Management (IAM) bindings. 3. Use
Google-managed encryption keys to encrypt secrets.
C. 1. Use separate Google Cloud projects to store Production and Non-Production secrets. 2. Enforce
access control to secrets using secret-level Identity and Access Management (IAM) bindings. 3. Use
Google-managed encryption keys to encrypt secrets.

D. 1. Use a single Google Cloud project to store both Production and Non-Production secrets. 2. Enforce
access control to secrets using project-level Identity and Access Management (IAM) bindings. 3. Use
customer-managed encryption keys to encrypt secrets.

Question #: 106

You work for a large organization where each business unit has thousands of users. You need to delegate
management of access control permissions to each business unit. You have the following requirements:

✑ Each business unit manages access controls for their own projects.

Each business unit manages access control permissions at scale.

✑ Business units cannot access other business units' projects.

✑ Users lose their access if they move to a different business unit or leave the company.

✑ Users and access control permissions are managed by the on-premises directory service.

What should you do? (Choose two.)

A. Use VPC Service Controls to create perimeters around each business unit's project.

B. Organize projects in folders, and assign permissions to Google groups at the folder level.

C. Group business units based on Organization Units (OUs) and manage permissions based on OUs

D. Create a project naming convention, and use Google's IAM Conditions to manage access based on the
prefix of project names.

E. Use Google Cloud Directory Sync to synchronize users and group memberships in Cloud Identity.

Question #: 107

Your organization recently deployed a new application on Google Kubernetes Engine. You need to deploy
a solution to protect the application. The solution has the following requirements:

✑ Scans must run at least once per week

✑ Must be able to detect cross-site scripting vulnerabilities

✑ Must be able to authenticate using Google accounts

Which solution should you use?

A. Google Cloud Armor

B. Web Security Scanner

C. Security Health Analytics

D. Container Threat Detection

Question #: 108

An organization is moving applications to Google Cloud while maintaining a few mission-critical

applications on-premises. The organization must transfer the data at a bandwidth of at least 50 Gbps.
What should they use to ensure secure continued connectivity between sites?

A. Dedicated Interconnect

B. Cloud Router

C. Cloud VPN

D. Partner Interconnect

Question #: 109

Your organization has had a few recent DDoS attacks. You need to authenticate responses to domain
name lookups. Which Google Cloud service should you use?

A. Cloud DNS with DNSSEC

B. Cloud NAT

C. HTTP(S) Load Balancing

D. Google Cloud Armor

Actual exam question from Google's Professional Cloud Security Engineer

Question #: 110
Your Security team believes that a former employee of your company gained unauthorized access to
Google Cloud resources some time in the past 2 months by using a service account key. You need to
confirm the unauthorized access and determine the user activity. What should you do?

A. Use Security Health Analytics to determine user activity.

B. Use the Cloud Monitoring console to filter audit logs by user.

C. Use the Cloud Data Loss Prevention API to query logs in Cloud Storage.

D. Use the Logs Explorer to search for user activity.

Question #: 111

Your company requires the security and network engineering teams to identify all network anomalies
within and across VPCs, internal traffic from VMs to VMs, traffic between end locations on the internet
and VMs, and traffic between VMs to Google Cloud services in production. Which method should you
use?

A. Define an organization policy constraint.

B. Configure packet mirroring policies.

C. Enable VPC Flow Logs on the subnet.

D. Monitor and analyze Cloud Audit Logs.

Question #: 113

You are troubleshooting access denied errors between Compute Engine instances connected to a Shared
VPC and BigQuery datasets. The datasets reside in a project protected by a VPC Service Controls
perimeter. What should you do?

A. Add the host project containing the Shared VPC to the service perimeter.

B. Add the service project where the Compute Engine instances reside to the service perimeter.

C. Create a service perimeter between the service project where the Compute Engine instances reside
and the host project that contains the Shared VPC.

D. Create a perimeter bridge between the service project where the Compute Engine instances reside
and the perimeter that contains the protected BigQuery datasets.
Question #: 114

You recently joined the networking team supporting your company's Google Cloud implementation. You
are tasked with familiarizing yourself with the firewall rules configuration and providing
recommendations based on your networking and Google Cloud experience. What product should you
recommend to detect firewall rules that are overlapped by attributes from other firewall rules with
higher or equal priority?

A. Security Command Center

B. Firewall Rules Logging

C. VPC Flow Logs

D. Firewall Insights

Question #: 115

The security operations team needs access to the security-related logs for all projects in their
organization. They have the following requirements:

✑ Follow the least privilege model by having only view access to logs.

✑ Have access to Admin Activity logs.

✑ Have access to Data Access logs.

✑ Have access to Access Transparency logs.

Which Identity and Access Management (IAM) role should the security operations team be granted?

A. roles/[Link]

B. roles/[Link]

C. roles/viewer

D. roles/[Link]

Question #: 116

You are exporting application logs to Cloud Storage. You encounter an error message that the log sinks
don't support uniform bucket-level access policies. How should you resolve this error?

A. Change the access control model for the bucket

B. Update your sink with the correct bucket destination.

C. Add the roles/[Link] Identity and Access Management (IAM) role to the bucket for the log
sink identity.

D. Add the roles/[Link] Identity and Access Management (IAM) role to the bucket for the
log sink identity.

Question #: 117

You plan to deploy your cloud infrastructure using a CI/CD cluster hosted on Compute Engine. You want
to minimize the risk of its credentials being stolen by a third party. What should you do?

A. Create a dedicated Cloud Identity user account for the cluster. Use a strong self-hosted vault solution
to store the user's temporary credentials.

B. Create a dedicated Cloud Identity user account for the cluster. Enable the
constraints/[Link] organization policy at the project level.

C. Create a custom service account for the cluster Enable the

constraints/[Link] organization policy at the project level

D. Create a custom service account for the cluster Enable the

constraints/[Link] organization policy at the project level.

Question #: 119

You are a member of your company's security team. You have been asked to reduce your Linux bastion
host external attack surface by removing all public IP addresses. Site Reliability Engineers (SREs) require
access to the bastion host from public locations so they can access the internal VPC while off-site. How
should you enable this access?

A. Implement Cloud VPN for the region where the bastion host lives.

B. Implement OS Login with 2-step verification for the bastion host.

C. Implement Identity-Aware Proxy TCP forwarding for the bastion host.

D. Implement Google Cloud Armor in front of the bastion host.

Question #: 120
You need to enable VPC Service Controls and allow changes to perimeters in existing environments
without preventing access to resources. Which VPC Service

Controls mode should you use?

A. Cloud Run

B. Native

C. Enforced

D. Dry run

Question #: 121

You manage your organization's Security Operations Center (SOC). You currently monitor and detect
network traffic anomalies in your Google Cloud VPCs based on packet header information. However, you
want the capability to explore network flows and their payload to aid investigations. Which Google Cloud
product should you use?

A. Marketplace IDS

B. VPC Flow Logs

C. VPC Service Controls logs

D. Packet Mirroring

E. Google Cloud Armor Deep Packet Inspection

Question #: 122

Your organization acquired a new workload. The Web and Application (App) servers will be running on
Compute Engine in a newly created custom VPC. You are responsible for configuring a secure network
communication solution that meets the following requirements:

✑ Only allows communication between the Web and App tiers.

✑ Enforces consistent network security when autoscaling the Web and App tiers.

✑ Prevents Compute Engine Instance Admins from altering network traffic.

What should you do?

A. 1. Configure all running Web and App servers with respective network tags. 2. Create an allow VPC
firewall rule that specifies the target/source with respective network tags.

B. 1. Configure all running Web and App servers with respective service accounts. 2. Create an allow VPC
firewall rule that specifies the target/source with respective service accounts.

C. 1. Re-deploy the Web and App servers with instance templates configured with respective network
tags. 2. Create an allow VPC firewall rule that specifies the target/source with respective network tags.

D. 1. Re-deploy the Web and App servers with instance templates configured with respective service
accounts. 2. Create an allow VPC firewall rule that specifies the target/source with respective service
accounts.

Question #: 124

You are working with protected health information (PHI) for an electronic health record system. The
privacy officer is concerned that sensitive data is stored in the analytics system. You are tasked with
anonymizing the sensitive data in a way that is not reversible. Also, the anonymized data should not
preserve the character set and length. Which Google Cloud solution should you use?

A. Cloud Data Loss Prevention with deterministic encryption using AES-SIV

B. Cloud Data Loss Prevention with format-preserving encryption

C. Cloud Data Loss Prevention with cryptographic hashing

D. Cloud Data Loss Prevention with Cloud Key Management Service wrapped cryptographic keys

Question #: 127

You want to prevent users from accidentally deleting a Shared VPC host project. Which organization-level
policy constraint should you enable?

A. [Link]

B. [Link]

C. [Link]

D. [Link]

Question #: 129

You are a security administrator at your company. Per Google-recommended best practices, you
implemented the domain restricted sharing organization policy to allow only required domains to access
your projects. An engineering team is now reporting that users at an external partner outside your
organization domain cannot be granted access to the resources in a project. How should you make an
exception for your partner's domain while following the stated best practices?

A. Turn off the domain restriction sharing organization policy. Set the policy value to "Allow All."

B. Turn off the domain restricted sharing organization policy. Provide the external partners with the
required permissions using Google's Identity and Access Management (IAM) service.

C. Turn off the domain restricted sharing organization policy. Add each partner's Google Workspace
customer ID to a Google group, add the Google group as an exception under the organization policy, and
then turn the policy back on.

D. Turn off the domain restricted sharing organization policy. Set the policy value to "Custom." Add each
external partner's Cloud Identity or Google Workspace customer ID as an exception under the
organization policy, and then turn the policy back on

Question #: 130

You plan to use a Google Cloud Armor policy to prevent common attacks such as cross-site scripting (XSS)
and SQL injection (SQLi) from reaching your web application's backend. What are two requirements for
using Google Cloud Armor security policies? (Choose two.)

A. The load balancer must be an external SSL proxy load balancer.

B. Google Cloud Armor Policy rules can only match on Layer 7 (L7) attributes.

C. The load balancer must use the Premium Network Service Tier.

D. The backend service's load balancing scheme must be EXTERNAL.

E. The load balancer must be an external HTTP(S) load balancer.

Question #: 131

You perform a security assessment on a customer architecture and discover that multiple VMs have
public IP addresses. After providing a recommendation to remove the public IP addresses, you are told
those VMs need to communicate to external sites as part of the customer's typical operations. What
should you recommend to reduce the need for public IP addresses in your customer's VMs?

A. Google Cloud Armor

B. Cloud NAT
C. Cloud Router

D. Cloud VPN

Question #: 133

Your company's Chief Information Security Officer (CISO) creates a requirement that business data must
be stored in specific locations due to regulatory requirements that affect the company's global expansion
plans. After working on the details to implement this requirement, you determine the following:

✑ The services in scope are included in the Google Cloud Data Residency Terms.

✑ The business data remains within specific locations under the same organization.

✑ The folder structure can contain multiple data residency locations.

You plan to use the Resource Location Restriction organization policy constraint. At which level in the
resource hierarchy should you set the constraint?

A. Folder

B. Resource

C. Project

D. Organization

Question #: 134

You need to set up a Cloud interconnect connection between your company's on-premises data center
and VPC host network. You want to make sure that on- premises applications can only access Google
APIs over the Cloud Interconnect and not through the public internet. You are required to only use APIs
that are supported by VPC Service Controls to mitigate against exfiltration risk to non-supported APIs.
How should you configure the network?

A. Enable Private Google Access on the regional subnets and global dynamic routing mode.

B. Set up a Private Service Connect endpoint IP address with the API bundle of "all-apis", which is
advertised as a route over the Cloud interconnect connection.

C. Use [Link] to access Google APIs using a set of IP addresses only routable from
within Google Cloud, which are advertised as routes over the connection.

D. Use restricted [Link] to access Google APIs using a set of IP addresses only routable from
within Google Cloud, which are advertised as routes over the Cloud Interconnect connection.