[2026] Google Cloud Certified - Professional Cloud Security Engineer - Professional-Cloud-Security-Engineer 무료 시험 문제

문제1

Your company's storage team manages all product images within a specific Google Cloud project. To maintain control, you must isolate access to Cloud Storage for this project, allowing the storage team to manage restrictions at the project level. They must be restricted to using corporate computers. What should you do?

A. Employ organization-level firewall rules to block all traffic to Cloud Storage. Create exceptions for specific service accounts used by the storage team within their project.

B. Implement VPC Service Controls by establishing an organization-wide service perimeter with all projects. Configure ingress and egress rules to restrict access to Cloud Storage based on IP address ranges.

C. Use Context-Aware Access. Create an access level that defines the required context. Apply it as an organization policy specifically at the project level, restricting access to Cloud Storage based on that context.

D. Use Identity and Access Management (IAM) roles at the project level within the storage team's project.Grant the storage team granular permissions on the project's Cloud Storage resources.

정답: C

설명: (Fast2test 회원만 볼 수 있음)

문제2

You are a member of the security team at an organization. Your team has a single GCP project with credit card payment processing systems alongside web applications and data processing systems. You want to reduce the scope of systems subject to PCI audit standards.
What should you do?

A. Move the cardholder data environment into a separate GCP project.

B. Use VPN for all connections between your office and cloud environments.

C. Use only applications certified compliant with PA-DSS.

D. Use multi-factor authentication for admin access to the web application.

정답: A

설명: (Fast2test 회원만 볼 수 있음)

문제3

Your company is deploying a three-tier web application-web, application, and database-on Google Cloud.
You need to configure network isolation between tiers to minimize the attack surface. The web tier needs to be accessible from the public internet, the application tier should only be accessible from the web tier, and the database tier should only be accessible from the application tier. Your solution must follow Google- recommended practices. What should you do?

A. Create three subnets within the VPC, one for each tier. Create firewall rules that allow traffic on specific ports on each subnet. Use network tags or service accounts on the VMs to apply the firewall rules.

B. Create three separate VPC networks, one for each tier. Configure VPC Network Peering between the web and application VPCs, and between the application and database VPCs. Use firewall rules to control the traffic.

C. Create three subnets within the VPC, one for each tier. Enable Private Google Access on each subnet.Create a single firewall rule allowing all traffic between the subnets.

D. Create a single subnet for all tiers. Create firewall rules that allow all traffic between instances within the same subnet. Use application-level security to prevent unauthorized access.

정답: A

설명: (Fast2test 회원만 볼 수 있음)

문제4

Your company has deployed an artificial intelligence model in a central project. This model has a lot of sensitive intellectual property and must be kept strictly isolated from the internet. You must expose the model endpoint only to a defined list of projects in your organization. What should you do?

A. Create a central project to host Shared VPC networks that are provided to all other projects. Centrally administer all firewall rules in this project to grant access to the model.

B. Within the model project, create an external Application Load Balancer that points to the model endpoint. Create a Cloud Armor policy to restrict IP addresses to Google Cloud.B. Within the model project, create an internal Application Load Balancer that points to the model endpoint. Expose this load balancer with Private Service Connect to a configured list of projects.

C. Activate Private Google Access in both the model project and in each project that needs to connect to the model. Create a firewall policy to allow connectivity to Private Google Access addresses.

정답: C

설명: (Fast2test 회원만 볼 수 있음)

문제5

Your Google Cloud environment has one organization node, one folder named Apps." and several projects within that folder The organizational node enforces the constraints/iam.allowedPolicyMemberDomains organization policy, which allows members from the terramearth.com organization The "Apps" folder enforces the constraints/iam.allowedPolicyMemberDomains organization policy, which allows members from the flowlogistic.com organization. It also has the inheritFromParent: false property.
You attempt to grant access to a project in the Apps folder to the user [email protected].
What is the result of your action and why?

A. The action fails because a constraints/iam.allowedPolicyMemberDomains organization policy is in place and only members from the flowlogistic.com organization are allowed.

B. The action succeeds and the new member is successfully added to the project's Identity and Access Management (1AM) policy because all policies are inherited by underlying folders and projects.

C. The action succeeds because members from both organizations, terramearth. com or flowlogistic.com, are allowed on projects in the "Apps" folder

D. The action fails because a constraints/iam.allowedPolicyMemberDomains organization policy mustbe defined on the current project to deactivate the constraint temporarily.

정답: A

설명: (Fast2test 회원만 볼 수 있음)

문제6

You are migrating an application into the cloud The application will need to read data from a Cloud Storage bucket. Due to local regulatory requirements, you need to hold the key material used for encryption fully under your control and you require a valid rationale for accessing the key material.
What should you do?

A. Generate a key in your on-premises environment and store it in a Hardware Security Module (HSM) that is managed on-premises Use this key as an external key in the Cloud Key Management Service (KMS). Activate Key Access Justifications (KAJ) and set the external key system to reject unauthorized accesses.

B. Encrypt the data in the Cloud Storage bucket by using Customer Managed Encryption Keys backed by a Cloud Hardware Security Module (HSM). Enable data access logs.

C. Encrypt the data in the Cloud Storage bucket by using Customer Managed Encryption Keys. Configure an 1AM deny policy for unauthorized groups

D. Generate a key in your on-premises environment to encrypt the data before you upload the data to the Cloud Storage bucket Upload the key to the Cloud Key Management Service (KMS). Activate Key Access Justifications (KAJ) and have the external key system reject unauthorized accesses.

정답: A

설명: (Fast2test 회원만 볼 수 있음)

문제7

You need to connect your organization's on-premises network with an existing Google Cloud environment that includes one Shared VPC with two subnets named Production and Non-Production. You are required to:
Use a private transport link.
Configure access to Google Cloud APIs through private API endpoints originating from on-premises environments.
Ensure that Google Cloud APIs are only consumed via VPC Service Controls.
What should you do?

A. 1. Set up a Direct Peering link between the on-premises environment and Google Cloud.2. Configure private access for both VPC subnets.

B. 1. Set up a Cloud VPN link between the on-premises environment and Google Cloud.2. Configure private access using the restricted googleapis.com domains in on-premises DNS configurations.

C. 1. Set up a Dedicated Interconnect link between the on-premises environment and Google Cloud.2.Configure private access using the restricted.googleapis.com domains in on-premises DNS configurations.

D. 1. Set up a Partner Interconnect link between the on-premises environment and Google Cloud.2.
Configure private access using the private.googleapis.com domains in on-premises DNS configurations.

정답: C

설명: (Fast2test 회원만 볼 수 있음)

문제8

Your team uses a service account to authenticate data transfers from a given Compute Engine virtual machine instance of to a specified Cloud Storage bucket. An engineer accidentally deletes the service account, which breaks application functionality. You want to recover the application as quickly as possible without compromising security.
What should you do?

A. Use the undelete command to recover the deleted service account.

B. Temporarily disable authentication on the Cloud Storage bucket.

C. Update the permissions of another existing service account and supply those credentials to the applications.

D. Create a new service account with the same name as the deleted service account.

정답: A

설명: (Fast2test 회원만 볼 수 있음)

문제9

You are a consultant for an organization that is considering migrating their data from its private cloud to Google Cloud. The organization's compliance team is not familiar with Google Cloud and needs guidance on how compliance requirements will be met on Google Cloud. One specific compliance requirement is for customer data at rest to reside within specific geographic boundaries. Which option should you recommend for the organization to meet their data residency requirements on Google Cloud?

A. Google Cloud Armor

B. Organization Policy Service constraints

C. Access control lists

D. Geolocation access controls

E. Shielded VM instances

정답: B

설명: (Fast2test 회원만 볼 수 있음)

문제10

Your company's detection and response team requires break-glass access to the Google Cloud organization in the event of a security investigation. At the end of each day, all security group membership is removed. You need to automate user provisioning to a Cloud Identity security group. You have created a service account to provision group memberships. Your solution must follow Google-recommended practices and comply with the principle of least privilege. What should you do?

A. In Google Workspace, grant the Groups Editor role to the service account, enable the Cloud Identity API, and use Application Default Credentials with the resource-attached service account.

B. In Google Workspace, grant the service account client ID access to the scope, https://www.googleapis.
com/auth/admin.directory.group, by using domain-wide delegation, and use a service account key.

C. In Google Workspace, grant the service account client ID access to the scope, https://www.googleapis.
com/auth/admin.directory.group, by using domain-wide delegation. Use Application Default Credentials with the resource-attached service account.

D. In Google Workspace, grant the Groups Editor role to the service account. Enable the Cloud Identity API. Use a service account key.

정답: C

설명: (Fast2test 회원만 볼 수 있음)

Google Cloud Certified - Professional Cloud Security Engineer - Professional-Cloud-Security-Engineer무료 덤프문제 풀어보기

우리와 연락하기

유용한 링크

최신 업데이트