support@Free-Braindumps.com
Register Login
Cisco
CompTIA
ISC
EC-Council
EXIN
Fortinet
ITIL
Juniper
Microsoft
VMware
Avaya
SAP
Google
NVIDIA
Salesforce
Amazon
Palo Alto Networks
ISC2
CrowdStrike
Anthropic
All Vendors
  1. Home
  2. Exams
  3. Google
  4. PROFESSIONAL CLOUD SECURITY ENGINEER

Free PROFESSIONAL CLOUD SECURITY ENGINEER Exam Braindumps
Professional Cloud Security Engineer Questions 86–90 (page: 19)

Updated On: 10-Feb-2026
Page 19 of 74
PDF with 376 Questions

You are part of a security team investigating a compromised service account key. You need to audit which new resources were created by the service account.

What should you do?

  1. Query Data Access logs.
  2. Query Admin Activity logs.
  3. Query Access Transparency logs.
  4. Query Stackdriver Monitoring Workspace.

Answer(s): B


Reference:

https://cloud.google.com/iam/docs/audit-logging/examples-service-accounts



You have an application where the frontend is deployed on a managed instance group in subnet A and the data layer is stored on a mysql Compute Engine virtual machine (VM) in subnet B on the same VPC. Subnet A and Subnet B hold several other Compute Engine VMs. You only want to allow the application frontend to access the data in the application's mysql instance on port 3306.

What should you do?

  1. Configure an ingress firewall rule that allows communication from the src IP range of subnet A to the tag "data-tag" that is applied to the mysql Compute Engine VM on port 3306.
  2. Configure an ingress firewall rule that allows communication from the frontend's unique service account to the unique service account of the mysql Compute Engine VM on port 3306.
  3. Configure a network tag "fe-tag" to be applied to all instances in subnet A and a network tag "data-tag" to be applied to all instances in subnet B. Then configure an egress firewall rule that allows communication from Compute Engine VMs tagged with data-tag to destination Compute Engine VMs tagged fe-tag.
  4. Configure a network tag "fe-tag" to be applied to all instances in subnet A and a network tag "data-tag" to be applied to all instances in subnet B. Then configure an ingress firewall rule that allows communication from Compute Engine VMs tagged with fe-tag to destination Compute Engine VMs tagged with data-tag.

Answer(s): B



Your company operates an application instance group that is currently deployed behind a Google Cloud load balancer in us-central-1 and is configured to use the Standard Tier network. The infrastructure team wants to expand to a second Google Cloud region, us-east-2. You need to set up a single external IP address to distribute new requests to the instance groups in both regions.

What should you do?

  1. Change the load balancer backend configuration to use network endpoint groups instead of instance groups.
  2. Change the load balancer frontend configuration to use the Premium Tier network, and add the new instance group.
  3. Create a new load balancer in us-east-2 using the Standard Tier network, and assign a static external IP address.
  4. Create a Cloud VPN connection between the two regions, and enable Google Private Access.

Answer(s): B



You are the security admin of your company. You have 3,000 objects in your Cloud Storage bucket. You do not want to manage access to each object individually. You also do not want the uploader of an object to always have full control of the object. However, you want to use Cloud Audit Logs to manage access to your bucket.

What should you do?

  1. Set up an ACL with OWNER permission to a scope of allUsers.
  2. Set up an ACL with READER permission to a scope of allUsers.
  3. Set up a default bucket ACL and manage access for users using IAM.
  4. Set up Uniform bucket-level access on the Cloud Storage bucket and manage access for users using IAM.

Answer(s): A


Reference:

https://cloud.google.com/storage/docs/access-control/lists



You are the security admin of your company. Your development team creates multiple GCP projects under the "implementation" folder for several dev, staging, and production workloads. You want to prevent data exfiltration by malicious insiders or compromised code by setting up a security perimeter. However, you do not want to restrict communication between the projects.

What should you do?

  1. Use a Shared VPC to enable communication between all projects, and use firewall rules to prevent data exfiltration.
  2. Create access levels in Access Context Manager to prevent data exfiltration, and use a shared VPC for communication between projects.
  3. Use an infrastructure-as-code software tool to set up a single service perimeter and to deploy a Cloud Function that monitors the "implementation" folder via Stackdriver and Cloud Pub/Sub.
    When the function notices that a new project is added to the folder, it executes Terraform to add the new project to the associated perimeter.
  4. Use an infrastructure-as-code software tool to set up three different service perimeters for dev, staging, and prod and to deploy a Cloud Function that monitors the "implementation" folder via Stackdriver and Cloud Pub/Sub.
    When the function notices that a new project is added to the folder, it executes Terraform to add the new project to the respective perimeter.

Answer(s): C



  PDF
Viewing page 19 of 74
Viewing questions 91 - 95 out of 376 questions


Post your Comments and Discuss Google PROFESSIONAL CLOUD SECURITY ENGINEER exam prep with other Community members:

AI Tutor AI Tutor 👋 I’m here to help!