Professional-Cloud-Security-Engineer PDF Pass Leader, Professional-Cloud-Security-Engineer Latest Real Test
Valid Professional-Cloud-Security-Engineer Test Answers & Professional-Cloud-Security-Engineer Exam PDF
Google Professional-Cloud-Security-Engineer certification is an excellent way for professionals to demonstrate their expertise in cloud security engineering and to enhance their career prospects. With the increasing adoption of cloud technologies, the demand for certified cloud security professionals is only going to increase, making this certification more valuable than ever before.
NEW QUESTION # 22
You work for an organization in a regulated industry that has strict data protection requirements. The organization backs up their data in the cloud. To comply with data privacy regulations, this data can only be stored for a specific length of time and must be deleted after this specific period.
You want to automate the compliance with this regulation while minimizing storage costs. What should you do?
- A. Store the data in a Cloud Bigtable table, and set an expiration time on the column families.
- B. Store the data in a Cloud Storage bucket, and configure the bucket's Object Lifecycle Management feature.
- C. Store the data in a persistent disk, and delete the disk at expiration time.
- D. Store the data in a BigQuery table, and set the table's expiration time.
Answer: B
Explanation:
Explanation
To miminize costs, it's always GCS even though BQ comes as a close 2nd. But, since the question did not specify what kind of data it is (raw files vs tabular data), it is safe to assume GCS is the preferred option with LifeCycle enablement.
NEW QUESTION # 23
You are consulting with a client that requires end-to-end encryption of application data (including data in transit, data in use, and data at rest) within Google Cloud.
Which options should you utilize to accomplish this? (Choose two.)
- A. External Key Manager
- B. Customer-supplied encryption keys
- C. Client-side encryption
- D. Confidential Computing and Istio
- E. Hardware Security Module
Answer: C,D
Explanation:
Google Cloud customers with additional requirements for encryption of data over WAN can choose to implement further protections for data as it moves from a user to an application, or virtual machine to virtual machine. These protections include IPSec tunnels, Gmail S/MIME, managed SSL certificates, and Istio.
https://cloud.google.com/docs/security/encryption-in-transit
NEW QUESTION # 24
You are using Security Command Center (SCC) to protect your workloads and receive alerts for suspected security breaches at your company. You need to detect cryptocurrency mining software.
Which SCC service should you use?
- A. Web Security Scanner
- B. Rapid Vulnerability Detection
- C. Virtual Machine Threat Detection
- D. Container Threat Detection
Answer: C
Explanation:
https://cloud.google.com/security-command-center/docs/concepts-vm-threat-detection- overview#overview
NEW QUESTION # 25
In order to meet PCI DSS requirements, a customer wants to ensure that all outbound traffic is authorized.
Which two cloud offerings meet this requirement without additional compensating controls?
(Choose two.)
- A. Compute Engine
- B. Cloud Functions
- C. Cloud Storage
- D. Google Kubernetes Engine
- E. App Engine
Answer: A,E
Explanation:
https://cloud.google.com/solutions/pci-dss-compliance-in-gcp
NEW QUESTION # 26
An engineering team is launching a web application that will be public on the internet. The web application is hosted in multiple GCP regions and will be directed to the respective backend based on the URL request.
Your team wants to avoid exposing the application directly on the internet and wants to deny traffic from a specific list of malicious IP addresses Which solution should your team implement to meet these requirements?
- A. Network Load Balancing
- B. SSL Proxy Load Balancing
- C. Cloud Armor
- D. NAT Gateway
Answer: C
Explanation:
The Cloud armor able to directed user traffic to an external HTTP(S) load balancer enters the PoP closest to the user in Premium Tier.
https://cloud.google.com/armor/docs/security-policy-overview#edge-security
NEW QUESTION # 27
Your team uses a service account to authenticate data transfers from a given Compute Engine virtual machine instance of to a specified Cloud Storage bucket. An engineer accidentally deletes the service account, which breaks application functionality. You want to recover the application as quickly as possible without compromising security.
What should you do?
- A. Create a new service account with the same name as the deleted service account.
- B. Temporarily disable authentication on the Cloud Storage bucket.
- C. Use the undelete command to recover the deleted service account.
- D. Update the permissions of another existing service account and supply those credentials to the applications.
Answer: C
Explanation:
* Objective: Quickly recover a deleted service account used for data transfers.
* Solution: Use the undelete command available in the gcloud command-line tool to recover the service account.
* Steps:
* Step 1: Open the Cloud Shell in the Google Cloud Console.
* Step 2: Run the following command to list the deleted service accounts:
gcloud iam service-accounts list --filter="deleted: true"
* Step 3: Identify the name and ID of the deleted service account.
* Step 4: Use the undelete command to recover the service account:
gcloud iam service-accounts undelete [SERVICE_ACCOUNT_ID]
* Step 5: Verify that the service account has been restored and reassign any necessary permissions.
By using the undelete command, you can quickly restore the service account and resume application functionality without compromising security.
References:
* Restoring a Deleted Service Account
* gcloud iam service-accounts undelete
NEW QUESTION # 28
A patch for a vulnerability has been released, and a DevOps team needs to update their running containers in Google Kubernetes Engine (GKE).
How should the DevOps team accomplish this?
- A. Use Puppet or Chef to push out the patch to the running container.
- B. Update the application code or apply a patch, build a new image, and redeploy it.
- C. Verify that auto upgrade is enabled; if so, Google will upgrade the nodes in a GKE cluster.
- D. Configure containers to automatically upgrade when the base image is available in Container Registry.
Answer: B
Explanation:
When a vulnerability patch is released for a running container in Google Kubernetes Engine (GKE), the recommended approach is to update the application code or apply the patch directly to the codebase. Then, a new container image should be built incorporating these changes. After building the new image, it should be deployed to replace the running containers. This method ensures that the containers run the updated, secure code.
Steps:
Update Application Code: Modify the application code or dependencies to incorporate the vulnerability patch.
Build New Image: Use a tool like Docker to build a new container image with the updated code.
Push New Image: Push the new container image to the Container Registry.
Update Deployments: Update the Kubernetes deployment to use the new image. This can be done by modifying the image tag in the deployment YAML file.
Redeploy Containers: Apply the updated deployment configuration using kubectl apply -f <deployment-file>.
yaml, which will redeploy the containers with the new image.
References:
Google Cloud: Container security
Kubernetes: Updating an application
NEW QUESTION # 29
A customer wants to move their sensitive workloads to a Compute Engine-based cluster using Managed Instance Groups (MIGs). The jobs are bursty and must be completed quickly. They have a requirement to be able to manage and rotate the encryption keys.
Which boot disk encryption solution should you use on the cluster to meet this customer's requirements?
- A. Encryption by default
- B. Pre-encrypting files before transferring to Google Cloud Platform (GCP) for analysis
- C. Customer-supplied encryption keys (CSEK)
- D. Customer-managed encryption keys (CMEK) using Cloud Key Management Service (KMS)
Answer: D
Explanation:
For managing and rotating encryption keys in a Compute Engine-based cluster using Managed Instance Groups (MIGs), Customer-Managed Encryption Keys (CMEK) with Cloud KMS is the appropriate solution.
Set Up Cloud KMS:
Go to the Cloud Console and navigate to Security > Cryptographic Keys.
Create a keyring and a key.
Create and Use CMEK:
While creating or updating a Compute Engine instance, specify the CMEK key.
Example command:
gcloud compute instances create example-instance \ --image-family=debian-9 \ --image-project=debian-cloud
\ --boot-disk-kms-key=projects/[PROJECT_ID]/locations/global/keyRings/[KEY_RING]/cryptoKeys/[KEY] Rotate Keys:
Rotate keys periodically using Cloud KMS by creating new key versions and updating the instances to use the new key versions.
Customer-Managed Encryption Keys (CMEK)
Using Customer-Managed Encryption Keys
NEW QUESTION # 30
What are the steps to encrypt data using envelope encryption?
- A. Generate a data encryption key (DEK) locally.
Encrypt data with the DEK.
Use a key encryption key (KEK) to wrap the DEK. Store the encrypted data and the wrapped DEK. - B. Generate a key encryption key (KEK) locally.
Generate a data encryption key (DEK) locally. Encrypt data with the KEK.
Store the encrypted data and the wrapped DEK. - C. Generate a key encryption key (KEK) locally.
Use the KEK to generate a data encryption key (DEK). Encrypt data with the DEK.
Store the encrypted data and the wrapped DEK. - D. Generate a data encryption key (DEK) locally.
Use a key encryption key (KEK) to wrap the DEK. Encrypt data with the KEK.
Store the encrypted data and the wrapped KEK.
Answer: A
NEW QUESTION # 31
Your company has deployed an artificial intelligence model in a central project. This model has a lot of sensitive intellectual property and must be kept strictly isolated from the internet. You must expose the model endpoint only to a defined list of projects in your organization. What should you do?
- A. Within the model project, create an external Application Load Balancer that points to the model endpoint. Create a Cloud Armor policy to restrict IP addresses to Google Cloud.
- B. Activate Private Google Access in both the model project and in each project that needs to connect to the model. Create a firewall policy to allow connectivity to Private Google Access addresses.
- C. Create a central project to host Shared VPC networks that are provided to all other projects. Centrally administer all firewall rules in this project to grant access to the model.
- D. Within the model project, create an internal Application Load Balancer that points to the model endpoint. Expose this load balancer with Private Service Connect to a configured list of projects.
Answer: D
Explanation:
To share a service (like an AI model) across project boundaries privately and securely-without complex VPC peering or exposing it to the internet-Private Service Connect (PSC) is the recommended solution.14 According to Google Cloud Documentation (Private Service Connect for Vertex AI/Custom Services):
"Private Service Connect allows a service producer to expose a service (via an Internal Load Balancer) to service consumers in other VPC networks or projects.15 The producer creates a Service Attachment that points to the load balancer.16 The consumer creates a PSC Endpoint in their own VPC. Traffic stays entirely within the Google backbone, and the producer can maintain an 'Allowlist' of Project IDs that are permitted to connect." Why this fits the requirements:
* Isolation: The model remains in its own project and is not reachable via the internet (Option C is out).
* Granular Control: PSC allows you to explicitly list which Project IDs can access the service attachment (Option A).17
* Scalability: It avoids the "transitive peering" and "IP overlap" limitations often found in Shared VPC or Peering architectures (Option B).
Reference:
Google Cloud Documentation: "Private Service Connect overview" (https://cloud.google.com/vpc/docs
/private-service-connect).
Vertex AI Documentation: "Using Private Service Connect for online inference" (https://cloud.google.com
/vertex-ai/docs/predictions/private-service-connect).
NEW QUESTION # 32
You need to follow Google-recommended practices to leverage envelope encryption and encrypt data at the application layer.
What should you do?
- A. Generate a data encryption key (DEK) locally to encrypt the data, and generate a new key encryption key (KEK) in Cloud KMS to encrypt the DEK. Store both the encrypted data and the KEK.
- B. Generate a new data encryption key (DEK) in Cloud KMS to encrypt the data, and generate a key encryption key (KEK) locally to encrypt the key. Store both the encrypted data and the KEK.
- C. Generate a data encryption key (DEK) locally to encrypt the data, and generate a new key encryption key (KEK) in Cloud KMS to encrypt the DEK. Store both the encrypted data and the encrypted DEK.
- D. Generate a new data encryption key (DEK) in Cloud KMS to encrypt the data, and generate a key encryption key (KEK) locally to encrypt the key. Store both the encrypted data and the encrypted DEK.
Answer: C
Explanation:
The process of encrypting data is to generate a DEK locally, encrypt data with the DEK, use a KEK to wrap the DEK, and then store the encrypted data and the wrapped DEK. The KEK never leaves Cloud KMS.
NEW QUESTION # 33
You need to implement an encryption-at-rest strategy that protects sensitive data and reduces key management complexity for non-sensitive dat a. Your solution has the following requirements:
Schedule key rotation for sensitive data.
Control which region the encryption keys for sensitive data are stored in.
Minimize the latency to access encryption keys for both sensitive and non-sensitive data.
What should you do?
- A. Encrypt non-sensitive data and sensitive data with Cloud Key Management Service.
- B. Encrypt non-sensitive data with Google default encryption, and encrypt sensitive data with Cloud External Key Manager.
- C. Encrypt non-sensitive data and sensitive data with Cloud External Key Manager.
- D. Encrypt non-sensitive data with Google default encryption, and encrypt sensitive data with Cloud Key Management Service.
Answer: D
Explanation:
Encrypt non-sensitive data with Google default encryption:
Google Cloud automatically encrypts data at rest using AES-256 by default. This minimizes key management complexity for non-sensitive data as it is handled entirely by Google.
No additional setup is required for default encryption, ensuring low latency access to the encrypted data.
Encrypt sensitive data with Cloud Key Management Service (Cloud KMS):
Cloud KMS allows you to create and manage cryptographic keys in a centralized cloud service.
To meet the requirement of scheduling key rotation, configure Cloud KMS to automatically rotate keys on a regular schedule (e.g., every 90 days).
Control the region where the keys are stored by selecting the appropriate key ring location during key creation. This ensures compliance with data residency requirements.
Cloud KMS provides low-latency access to keys, ensuring minimal impact on data access performance.
Reference:
Cloud Key Management Service Documentation
Encryption at Rest in Google Cloud
NEW QUESTION # 34
You plan to use a Google Cloud Armor policy to prevent common attacks such as cross-site scripting (XSS) and SQL injection (SQLi) from reaching your web application's backend. What are two requirements for using Google Cloud Armor security policies? (Choose two.)
- A. Google Cloud Armor Policy rules can only match on Layer 7 (L7) attributes.
- B. The load balancer must be an external HTTP(S) load balancer.
- C. The load balancer must use the Premium Network Service Tier.
- D. The backend service's load balancing scheme must be EXTERNAL.
- E. The load balancer must be an external SSL proxy load balancer.
Answer: B,D
Explanation:
These are the requirements for using Google Cloud Armor security policies:
The load balancer must be an external HTTP(S) load balancer, TCP proxy load balancer, or SSL proxy load balancer.
The backend service's load balancing scheme must be EXTERNAL.
The backend service's protocol must be one of HTTP, HTTPS, HTTP/2, TCP, or SSL.
https://cloud.google.com/armor/docs/security-policy-overview
NEW QUESTION # 35
Your team needs to prevent users from creating projects in the organization. Only the DevOps team should be allowed to create projects on behalf of the requester.
Which two tasks should your team perform to handle this request? (Choose two.)
- A. Grant the Project Editor role at the organizational level to a designated group of users.
- B. Create an Organization Policy constraint, and apply it at the organizational level.
- C. Grant the billing account creator role to the designated DevOps team.
- D. Remove all users from the Project Creator role at the organizational level.
- E. Add a designated group of users to the Project Creator role at the organizational level.
Answer: D,E
Explanation:
* Objective: Prevent users from creating projects while allowing only the DevOps team to create projects.
* Solution: Modify IAM roles and permissions.
* Steps:
* Step 1: Open the Google Cloud Console.
* Step 2: Navigate to the IAM & Admin page.
* Step 3: At the organizational level, find and remove all users from the Project Creator role.
* Step 4: Create or identify a group for the DevOps team.
* Step 5: Assign the Project Creator role to the DevOps team group at the organizational level.
By removing all users from the Project Creator role and granting it only to the DevOps team, you ensure that only the designated team can create projects.
References:
* GCP IAM Documentation
* Project Creator Role
NEW QUESTION # 36
For compliance reasons, an organization needs to ensure that in-scope PCI Kubernetes Pods reside on "in-scope" Nodes only. These Nodes can only contain the "in-scope" Pods.
How should the organization achieve this objective?
- A. Run all in-scope Pods in the namespace "in-scope-pci".
- B. Place a taint on the Nodes with the label inscope: true and effect NoSchedule and a toleration to match in the Pod configuration.
- C. Add a nodeSelector field to the pod configuration to only use the Nodes labeled inscope: true.
- D. Create a node pool with the label inscope: true and a Pod Security Policy that only allows the Pods to run on Nodes with that label.
Answer: C
Explanation:
https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#nodeselector
NEW QUESTION # 37
A company has been running their application on Compute Engine. A bug in the application allowed a malicious user to repeatedly execute a script that results in the Compute Engine instance crashing. Although the bug has been fixed, you want to get notified in case this hack re-occurs.
What should you do?
- A. Log every execution of the script to Stackdriver Logging. Create a User-defined metric in Stackdriver Logging on the logs, and create a Stackdriver Dashboard displaying the metric.
- B. Create an Alerting Policy in Stackdriver using a Process Health condition, checking that the number of executions of the script remains below the desired threshold. Enable notifications.
- C. Log every execution of the script to Stackdriver Logging. Configure BigQuery as a log sink, and create a BigQuery scheduled query to count the number of executions in a specific timeframe.
- D. Create an Alerting Policy in Stackdriver using the CPU usage metric. Set the threshold to 80% to be notified when the CPU usage goes above this 80%.
Answer: B
Explanation:
To monitor and get notified in case the script causing the Compute Engine instance to crash is executed again, you should create an Alerting Policy in Stackdriver (now known as Google Cloud Monitoring). The Process Health condition can be set to monitor the number of executions of the script and ensure it remains below the desired threshold. By enabling notifications, you will be alerted if this threshold is exceeded.
Step-by-Step:
* Log Script Executions: Ensure that the script execution is logged.
* Create a User-Defined Metric: Go to Google Cloud Console > Logging > Logs-based Metrics, and create a new user-defined metric that counts the number of times the script executes.
* Set Up Alerting Policy:
* Navigate to Google Cloud Console > Monitoring > Alerting.
* Click on "Create Policy".
* Add a condition and select "Logs-based Metric".
* Configure the condition to trigger when the number of script executions exceeds the threshold.
* Configure Notifications: Add notification channels (email, SMS, etc.) to the alerting policy.
* Save and Test: Save the policy and test to ensure notifications are received when the script is executed beyond the threshold.
Google Cloud Logging User-defined Metrics
Google Cloud Monitoring Alerting Policies
NEW QUESTION # 38
You manage one of your organization's Google Cloud projects (Project A). AVPC Service Control (SC) perimeter is blocking API access requests to this project including Pub/Sub. A resource running under a service account in another project (Project B) needs to collect messages from a Pub/Sub topic in your project Project B is not included in a VPC SC perimeter. You need to provide access from Project B to the Pub/Sub topic in Project A using the principle of least Privilege.
What should you do?
- A. Configure an ingress policy for the perimeter in Project A and allow access for the service account in Project B to collect messages.
- B. Create an access level that allows a developer in Project B to subscribe to the Pub/Sub topic that is located in Project A.
- C. Create a perimeter bridge between Project A and Project B to allow the required communication between both projects.
- D. Remove the Pub/Sub API from the list of restricted services in the perimeter configuration for Project A.
Answer: A
Explanation:
When dealing with VPC Service Controls (VPC SC), it's important to ensure that only authorized resources can access sensitive data and services. To allow a resource in Project B to access Pub/Sub in Project A without compromising security, you should configure an ingress policy for the service perimeter in Project A.
* Identify the Service Account: Determine the service account in Project B that requires access to the Pub/Sub topic in Project A.
* Configure Ingress Policy:
* Go to the Google Cloud Console.
* Navigate to Security > VPC Service Controls.
* Select the service perimeter for Project A.
* Add an ingress rule specifying the service account from Project B and allowing it access to the necessary Pub/Sub resources.
* Define Conditions: Ensure that the ingress policy adheres to the principle of least privilege, granting only the necessary permissions to collect messages from the Pub/Sub topic.
* Save and Apply: Save the policy and apply the changes to enforce the new access controls.
This approach maintains the security boundaries set by VPC SC while enabling the required access from Project B to Project A.
References:
* VPC Service Controls Documentation
* Configuring Ingress Policies
NEW QUESTION # 39
You want to limit the images that can be used as the source for boot disks. These images will be stored in a dedicated project.
What should you do?
- A. In Resource Manager, edit the organization permissions. Add the project ID as member with the role: Compute Image User.
- B. Use the Organization Policy Service to create a compute.trustedimageProjects constraint on the organization level. List the trusted projects as the exceptions in a deny operation.
- C. Use the Organization Policy Service to create a compute.trustedimageProjects constraint on the organization level. List the trusted project as the whitelist in an allow operation.
- D. In Resource Manager, edit the project permissions for the trusted project. Add the organization as member with the role: Compute Image User.
Answer: B
NEW QUESTION # 40
Your organization processes sensitive health information. You want to ensure that data is encrypted while in use by the virtual machines (VMs). You must create a policy that is enforced across the entire organization.
What should you do?
- A. Implement an organization policy that ensures all VM resources created across your organization are Confidential VM instances.
- B. Implement an organization policy that ensures that all VM resources created across your organization use customer-managed encryption keys (CMEK) protection.
- C. No action is necessary because Google encrypts data while it is in use by default.
- D. Implement an organization policy that ensures that all VM resources created across your organization use Cloud External Key Manager (EKM) protection.
Answer: A
Explanation:
Confidential VMs offer memory encryption to secure data while it is "in use". They use AMD's Secure Encrypted Virtualization (SEV) feature to ensure that data remains encrypted when processed. This would help to meet the requirement of encrypting sensitive health information at rest in transit and while in use by the VMs.
NEW QUESTION # 41
You need to create a VPC that enables your security team to control network resources such as firewall rules.
How should you configure the network to allow for separation of duties for network resources?
- A. Set up multiple VPC networks, and set up multi-NIC virtual appliances to connect the networks.
- B. Set up VPC Network Peering, and allow developers to peer their network with a Shared VPC.
- C. Set up a Shared VPC where the security team manages the firewall rules, and share the network with developers via service projects.
- D. Set up a VPC in a project. Assign the Compute Network Admin role to the security team, and assign the Compute Admin role to the developers.
Answer: C
NEW QUESTION # 42
You are working with a client who plans to migrate their data to Google Cloud. You are responsible for recommending an encryption service to manage their encrypted keys. You have the following requirements:
* The master key must be rotated at least once every 45 days.
* The solution that stores the master key must be FIPS 140-2 Level 3 validated.
* The master key must be stored in multiple regions within the US for redundancy.
Which solution meets these requirements?
- A. Customer-managed encryption keys with Cloud Key Management Service
- B. Customer-supplied encryption keys
- C. Customer-managed encryption keys with Cloud HSM
- D. Google-managed encryption keys
Answer: C
Explanation:
To meet the requirements of rotating the master key every 45 days, achieving FIPS 140-2 Level 3 validation, and ensuring the master key is stored redundantly in multiple US regions, you should use Customer-managed encryption keys with Cloud HSM. Here's how:
* Set Up Cloud HSM:
* Deploy Cloud HSM in your Google Cloud environment. Cloud HSM provides a hardware-based key management solution that meets FIPS 140-2 Level 3 compliance.
* Create and Manage Keys:
* Create your encryption keys in Cloud HSM. These keys can be managed and rotated per your policy requirements.
* Key Rotation:
* Set up a key rotation schedule to rotate the master key every 45 days. Cloud HSM allows you to automate this process.
* Geographic Redundancy:
* Ensure that your Cloud HSM configuration spans multiple regions within the US to achieve redundancy. This will ensure that your keys are available even if a particular region experiences an outage.
* Compliance:
* Cloud HSM's FIPS 140-2 Level 3 validation ensures that your encryption keys are managed in a secure and compliant manner.
Benefits:
* Security and Compliance: Meets stringent compliance requirements.
* Automated Management: Simplifies key management and rotation.
* Redundancy: Ensures high availability of keys across multiple regions.
References
* Cloud HSM Documentation
* Key Management with Cloud KMS and Cloud HSM
NEW QUESTION # 43
A customer terminates an engineer and needs to make sure the engineer's Google account is automatically deprovisioned.
What should the customer do?
- A. Use the Cloud SDK with their directory service to remove their IAM permissions in Cloud Identity.
- B. Use the Cloud SDK with their directory service to provision and deprovision users from Cloud Identity.
- C. Configure Cloud Directory Sync with their directory service to remove their IAM permissions in Cloud Identity.
- D. Configure Cloud Directory Sync with their directory service to provision and deprovision users from Cloud Identity.
Answer: D
Explanation:
https://cloud.google.com/identity/solutions/automate-user-
provisioning#cloud_identity_automated_provisioning
Cloud Identity has a catalog of automated provisioning connectors, which act as a bridge between Cloud Identity and third-party cloud apps.
NEW QUESTION # 44
Your team maintains 1PB of sensitive data within BigOuery that contains personally identifiable information (PII). You need to provide access to this dataset to another team within your organization for analysis purposes. You must share the BigQuery dataset with the other team while protecting the PII. What should you do?
- A. Implement data pseudonymization techniques to replace the PII fields with non-identifiable values.
Grant the other team access to the pseudonymized dataset. - B. Export the BigQuery dataset to Cloud Storage. Create a VPC Service Control perimeter and allow only their team's project access to the bucket.
- C. Create a filtered copy of the dataset and replace the sensitive data with hash values in a separate project. Grant the other team access to this new project.
- D. Utilize BigQuery's row-level access policies to mask PII columns based on the other team's user identities.
Answer: D
Explanation:
https://cloud.google.com/bigquery/docs/row-level-security-intro?hl=es-
419#filter_row_data_based_on_region
NEW QUESTION # 45
Your organization wants to be compliant with the General Data Protection Regulation (GDPR) on Google Cloud. You must implement data residency and operational sovereignty in the EU.
What should you do? (Choose two.)
- A. Limit Google personnel access based on predefined attributes such as their citizenship or geographic location by using Key Access Justifications.
- B. Limit the physical location of a new resource with the Organization Policy Service "resource locations constraint."
- C. Use VPC Flow Logs to monitor intra-VPC and inter-VPC traffic in the EU.
- D. Use identity federation to limit access to Google Cloud resources from non-EU entities.
- E. Use Cloud IDS to get east-west and north-south traffic visibility in the EU to monitor intra-VPC and inter-VPC communication.
Answer: A,B
Explanation:
https://cloud.google.com/architecture/framework/security/data-residency- sovereignty#manage_your_operational_sovereignty
NEW QUESTION # 46
......
Professional-Cloud-Security-Engineer Dumps Ensure Your Passing: https://www.freepdfdump.top/Professional-Cloud-Security-Engineer-valid-torrent.html
Professional-Cloud-Security-Engineer exam dumps and online Test Engine: https://drive.google.com/open?id=1CF5qUxZmccDCCQvwubvHgKChKz7h-om4
