support@Free-Braindumps.com
Register Login
Cisco
CompTIA
ISC
EC-Council
EXIN
Fortinet
ITIL
Juniper
Microsoft
VMware
Avaya
SAP
Google
NVIDIA
Salesforce
Amazon
Palo Alto Networks
ISC2
CrowdStrike
Anthropic
All Vendors
  1. Home
  2. Exams
  3. Google
  4. PROFESSIONAL CLOUD SECURITY ENGINEER

Free PROFESSIONAL CLOUD SECURITY ENGINEER Exam Braindumps
Professional Cloud Security Engineer Questions 96–100 (page: 21)

Updated On: 10-Feb-2026
Page 21 of 74
PDF with 376 Questions

You are the project owner for a regulated workload that runs in a project you own and manage as an Identity and Access Management (IAM) admin. For an upcoming audit, you need to provide access reviews evidence.
Which tool should you use?

  1. Policy Troubleshooter
  2. Policy Analyzer
  3. IAM Recommender
  4. Policy Simulator

Answer(s): B



Your organization has implemented synchronization and SAML federation between Cloud Identity and Microsoft Active Directory. You want to reduce the risk of Google Cloud user accounts being compromised.
What should you do?

  1. Create a Cloud Identity password policy with strong password settings, and configure 2-Step Verification with security keys in the Google Admin console.
  2. Create a Cloud Identity password policy with strong password settings, and configure 2-Step Verification with verification codes via text or phone call in the Google Admin console.
  3. Create an Active Directory domain password policy with strong password settings, and configure post-SSO (single sign-on) 2-Step Verification with security keys in the Google Admin console.
  4. Create an Active Directory domain password policy with strong password settings, and configure post-SSO (single sign-on) 2-Step Verification with verification codes via text or phone call in the Google Admin console.

Answer(s): C



You have been tasked with implementing external web application protection against common web application attacks for a public application on Google Cloud. You want to validate these policy changes before they are enforced.
What service should you use?

  1. Google Cloud Armor's preconfigured rules in preview mode
  2. Prepopulated VPC firewall rules in monitor mode
  3. The inherent protections of Google Front End (GFE)
  4. Cloud Load Balancing firewall rules
  5. VPC Service Controls in dry run mode

Answer(s): A


Reference:

https://cloud.google.com/architecture/owasp-top-ten-mitigation



You are asked to recommend a solution to store and retrieve sensitive configuration data from an application that runs on Compute Engine.
Which option should you recommend?

  1. Cloud Key Management Service
  2. Compute Engine guest attributes
  3. Compute Engine custom metadata
  4. Secret Manager

Answer(s): D


Reference:

https://www.freecodecamp.org/news/google-cloud-platform-from-zero-to-hero/



You need to implement an encryption at-rest strategy that reduces key management complexity for non- sensitive data and protects sensitive data while providing the flexibility of controlling the key residency and rotation schedule. FIPS 140-2 L1 compliance is required for all data types.
What should you do?

  1. Encrypt non-sensitive data and sensitive data with Cloud External Key Manager.
  2. Encrypt non-sensitive data and sensitive data with Cloud Key Management Service
  3. Encrypt non-sensitive data with Google default encryption, and encrypt sensitive data with Cloud External Key Manager.
  4. Encrypt non-sensitive data with Google default encryption, and encrypt sensitive data with Cloud Key Management Service.

Answer(s): D



  PDF
Viewing page 21 of 74
Viewing questions 101 - 105 out of 376 questions


Post your Comments and Discuss Google PROFESSIONAL CLOUD SECURITY ENGINEER exam prep with other Community members:

AI Tutor AI Tutor 👋 I’m here to help!