Google Cloud Certified - Professional Cloud Security Engineer Professional-Cloud-Security-Engineer Exam Questions with Experts Answers Updated Recently

A.  

Explain the development of custom network firewalls around the image classification service for deep intrusion detection and prevention. Describe vulnerability scanning tools for known vulnerabilities.

B.  

Explain Google's shared responsibility model. Focus the configuration review on Identity and Access Management (IAM) permissions, secure data upload/download procedures, and monitoring logs for any potential malicious activity.

C.  

Explain that using platform-as-a-service (PaaS) transfers security concerns to Google. Describe the need for strict API usage limits to protect against unexpected usage and billing spikes.

D.  

Explain the security aspects of the code that transforms user-uploaded images using Google's service. Define Cloud IAM for fine-grained access control within the development team.

A.  

Employ organization-level firewall rules to block all traffic to Cloud Storage. Create exceptions for specific service accounts used by the storage team within their project.

B.  

Implement VPC Service Controls by establishing an organization-wide service perimeter with all projects. Configure ingress and egress rules to restrict access to Cloud Storage based on IP address ranges.

C.  

Use Context-Aware Access. Create an access level that defines the required context. Apply it as an organization policy specifically at the project level, restricting access to Cloud Storage based on that context.

D.  

Use Identity and Access Management (IAM) roles at the project level within the storage team's project. Grant the storage team granular permissions on the project's Cloud Storage resources.

A.  

Remove all users from the Project Creator role at the organizational level.

B.  

Create an Organization Policy constraint, and apply it at the organizational level.

C.  

Grant the Project Editor role at the organizational level to a designated group of users.

D.  

Add a designated group of users to the Project Creator role at the organizational level.

E.  

Grant the billing account creator role to the designated DevOps team.

A.  

Use Cloud Storage as a federated Data Source.

B.  

Use a Cloud Hardware Security Module (Cloud HSM).

C.  

Customer-managed encryption keys (CMEK).

D.  

Customer-supplied encryption keys (CSEK).