support@Free-Braindumps.com
Register Login
Cisco
CompTIA
ISC
EC-Council
EXIN
Fortinet
ITIL
Juniper
Microsoft
VMware
Avaya
SAP
Google
NVIDIA
Salesforce
Amazon
Palo Alto Networks
ISC2
CrowdStrike
Anthropic
All Vendors
  1. Home
  2. Exams
  3. Google
  4. PROFESSIONAL CLOUD SECURITY ENGINEER

Free PROFESSIONAL CLOUD SECURITY ENGINEER Exam Braindumps
Professional Cloud Security Engineer Questions 81–85 (page: 18)

Updated On: 10-Feb-2026
Page 18 of 74
PDF with 376 Questions

A customer is running an analytics workload on Google Cloud Platform (GCP) where Compute Engine instances are accessing data stored on Cloud Storage. Your team wants to make sure that this workload will not be able to access, or be accessed from, the internet.

Which two strategies should your team use to meet these requirements? (Choose two.)

  1. Configure Private Google Access on the Compute Engine subnet
  2. Avoid assigning public IP addresses to the Compute Engine cluster.
  3. Make sure that the Compute Engine cluster is running on a separate subnet.
  4. Turn off IP forwarding on the Compute Engine instances in the cluster.
  5. Configure a Cloud NAT gateway.

Answer(s): A,B



A customer wants to run a batch processing system on VMs and store the output files in a Cloud Storage bucket. The networking and security teams have decided that no VMs may reach the public internet.

How should this be accomplished?

  1. Create a firewall rule to block internet traffic from the VM.
  2. Provision a NAT Gateway to access the Cloud Storage API endpoint.
  3. Enable Private Google Access.
  4. Mount a Cloud Storage bucket as a local filesystem on every VM.

Answer(s): C



As adoption of the Cloud Data Loss Prevention (Cloud DLP) API grows within your company, you need to optimize usage to reduce cost. Cloud DLP target data is stored in Cloud Storage and BigQuery. The location and region are identified as a suffix in the resource name.

Which cost reduction options should you recommend?

  1. Set appropriate rowsLimit value on BigQuery data hosted outside the US and set appropriate bytesLimitPerFile value on multiregional Cloud Storage buckets.
  2. Set appropriate rowsLimit value on BigQuery data hosted outside the US, and minimize transformation units on multiregional Cloud Storage buckets.
  3. Use rowsLimit and bytesLimitPerFile to sample data and use CloudStorageRegexFileSet to limit scans.
  4. Use FindingLimits and TimespanContfig to sample data and minimize transformation units.

Answer(s): C


Reference:

https://cloud.google.com/dlp/docs/reference/rest/v2/InspectJobConfig



Your team uses a service account to authenticate data transfers from a given Compute Engine virtual machine instance of to a specified Cloud Storage bucket. An engineer accidentally deletes the service account, which breaks application functionality. You want to recover the application as quickly as possible without compromising security.

What should you do?

  1. Temporarily disable authentication on the Cloud Storage bucket.
  2. Use the undelete command to recover the deleted service account.
  3. Create a new service account with the same name as the deleted service account.
  4. Update the permissions of another existing service account and supply those credentials to the applications.

Answer(s): B


Reference:

https://cloud.google.com/iam/docs/creating-managing-service- accounts#undeleting_a_service_account



You are the Security Admin in your company. You want to synchronize all security groups that have an email address from your LDAP directory in Cloud IAM.

What should you do?

  1. Configure Google Cloud Directory Sync to sync security groups using LDAP search rules that have "user email address" as the attribute to facilitate one-way sync.
  2. Configure Google Cloud Directory Sync to sync security groups using LDAP search rules that have "user email address" as the attribute to facilitate bidirectional sync.
  3. Use a management tool to sync the subset based on the email address attribute. Create a group in the Google domain. A group created in a Google domain will automatically have an explicit Google Cloud Identity and Access Management (IAM) role.
  4. Use a management tool to sync the subset based on group object class attribute. Create a group in the Google domain. A group created in a Google domain will automatically have an explicit Google Cloud Identity and Access Management (IAM) role.

Answer(s): A



  PDF
Viewing page 18 of 74
Viewing questions 86 - 90 out of 376 questions


Post your Comments and Discuss Google PROFESSIONAL CLOUD SECURITY ENGINEER exam prep with other Community members:

AI Tutor AI Tutor 👋 I’m here to help!