QUESTION: 77

Last week, a company deployed a new App Engine application that writes logs to BigQuery. No other workloads are running in the project. You need to validate that all data written to BigQuery was done using the App Engine Default Service Account.

What should you do?

1. Use StackDriver Logging and filter on BigQuery Insert Jobs.
2. Click on the email address in line with the App Engine Default Service Account in the authentication field.
3. Click Hide Matching Entries.
4. Make sure the resulting list is empty.
1. Use StackDriver Logging and filter on BigQuery Insert Jobs.
2. Click on the email address in line with the App Engine Default Service Account in the authentication field.
3. Click Show Matching Entries.
4. Make sure the resulting list is empty.
1. In BigQuery, select the related dataset.
2. Make sure the App Engine Default Service Account is the only account that can write to the dataset.
1. Go to the IAM section on the project.

2. Validate that the App Engine Default Service Account is the only account that has a role that can write to BigQuery.

Answer(s): A

Reveal Solution Next Question

QUESTION: 78

Your team wants to limit users with administrative privileges at the organization level.

Which two roles should your team restrict? (Choose two.)

Organization Administrator
Super Admin
GKE Cluster Admin
Compute Admin
Organization Role Viewer

Answer(s): A,B

Reference:

https://cloud.google.com/resource-manager/docs/creating-managing-organization

Reveal Solution Next Question

QUESTION: 79

An organization's security and risk management teams are concerned about where their responsibility lies for certain production workloads they are running in Google Cloud Platform (GCP), and where Google's responsibility lies. They are mostly running workloads using Google Cloud's Platform-as-a-Service (PaaS) offerings, including App Engine primarily.

Which one of these areas in the technology stack would they need to focus on as their primary responsibility when using App Engine?

Configuring and monitoring VPC Flow Logs
Defending against XSS and SQLi attacks
Manage the latest updates and security patches for the Guest OS
Encrypting all stored data

Answer(s): B

Explanation:

in PaaS the customer is responsible for web app security, deployment, usage, access policy, and content. https://cloud.google.com/architecture/framework/security/shared-responsibility-shared- fate

Reveal Solution Next Question

QUESTION: 80

An engineering team is launching a web application that will be public on the internet. The web application is hosted in multiple GCP regions and will be directed to the respective backend based on the URL request.

Your team wants to avoid exposing the application directly on the internet and wants to deny traffic from a specific list of malicious IP addresses

Which solution should your team implement to meet these requirements?

Cloud Armor
Network Load Balancing
SSL Proxy Load Balancing
NAT Gateway

Answer(s): A

Explanation:

https://cloud.google.com/armor/docs/security-policy-overview#edge-security

Reference:

https://cloud.google.com/armor/docs/security-policy-concepts

Reveal Solution Next Question

Free Professional Cloud Security Engineer Exam Braindumps (page: 21)

QUESTION: 77

QUESTION: 78

Reference:

QUESTION: 79

Explanation:

QUESTION: 80

Explanation:

Reference:

Exam Discussions & Posts