Free PROFESSIONAL CLOUD SECURITY ENGINEER Exam braindumps download (PROFESSIONAL CLOUD SECURITY ENGINEER exam dumps Free)

QUESTION: 61

A customer wants to deploy a large number of 3-tier web applications on Compute Engine.

How should the customer ensure authenticated network separation between the different tiers of the application?

Run each tier in its own Project, and segregate using Project labels.
Run each tier with a different Service Account (SA), and use SA-based firewall rules.
Run each tier in its own subnet, and use subnet-based firewall rules.
Run each tier with its own VM tags, and use tag-based firewall rules.

Answer(s): B

Show Answer Next Question

QUESTION: 62

A manager wants to start retaining security event logs for 2 years while minimizing costs. You write a filter to select the appropriate log entries.

Where should you export the logs?

BigQuery datasets
Cloud Storage buckets
StackDriver logging
Cloud Pub/Sub topics

Answer(s): B

Reference:

https://cloud.google.com/logging/docs/exclusions

Show Answer Next Question

QUESTION: 63

For compliance reasons, an organization needs to ensure that in-scope PCI Kubernetes Pods reside on "in- scope" Nodes only. These Nodes can only contain the "in-scope" Pods.

How should the organization achieve this objective?

Add a nodeSelector field to the pod configuration to only use the Nodes labeled inscope: true.
Create a node pool with the label inscope: true and a Pod Security Policy that only allows the Pods to run on Nodes with that label.
Place a taint on the Nodes with the label inscope: true and effect NoSchedule and a toleration to match in the Pod configuration.
Run all in-scope Pods in the namespace "in-scope-pci".

Answer(s): C

Show Answer Next Question

QUESTION: 64

In an effort for your company messaging app to comply with FIPS 140-2, a decision was made to use GCP compute and network services. The messaging app architecture includes a Managed Instance Group (MIG) that controls a cluster of Compute Engine instances. The instances use Local SSDs for data caching and UDP for instance-to-instance communications. The app development team is willing to make any changes necessary to comply with the standard.

Which options should you recommend to meet the requirements?

Encrypt all cache storage and VM-to-VM communication using the BoringCrypto module.
Set Disk Encryption on the Instance Template used by the MIG to customer-managed key and use BoringSSL for all data transit between instances.
Change the app instance-to-instance communications from UDP to TCP and enable BoringSSL on clients' TLS connections.
Set Disk Encryption on the Instance Template used by the MIG to Google-managed Key and use BoringSSL library on all instance-to-instance communications.

Answer(s): A

Show Answer Next Question

QUESTION: 65

A customer has an analytics workload running on Compute Engine that should have limited internet access.

Your team created an egress firewall rule to deny (priority 1000) all traffic to the internet.

The Compute Engine instances now need to reach out to the public repository to get security updates.

What should your team do?

Create an egress firewall rule to allow traffic to the CIDR range of the repository with a priority greater than 1000.
Create an egress firewall rule to allow traffic to the CIDR range of the repository with a priority less than 1000.
Create an egress firewall rule to allow traffic to the hostname of the repository with a priority greater than 1000.
Create an egress firewall rule to allow traffic to the hostname of the repository with a priority less than 1000.

Answer(s): B

Show Answer Next Question

Free PROFESSIONAL CLOUD SECURITY ENGINEER Exam Braindumps Professional Cloud Security Engineer Questions 61–65 (page: 14)

QUESTION: 61

QUESTION: 62

Reference:

QUESTION: 63

QUESTION: 64

QUESTION: 65

Free PROFESSIONAL CLOUD SECURITY ENGINEER Exam Braindumps
Professional Cloud Security Engineer Questions 61–65 (page: 14)