support@Free-Braindumps.com
Register Login
Cisco
CompTIA
ISC
EC-Council
EXIN
Fortinet
ITIL
Juniper
Microsoft
VMware
Avaya
SAP
Google
NVIDIA
Salesforce
Amazon
Palo Alto Networks
ISC2
CrowdStrike
Anthropic
All Vendors
  1. Home
  2. Exams
  3. Google
  4. PROFESSIONAL CLOUD SECURITY ENGINEER

Free PROFESSIONAL CLOUD SECURITY ENGINEER Exam Braindumps
Professional Cloud Security Engineer Questions 121–125 (page: 26)

Updated On: 10-Feb-2026
Page 26 of 74
PDF with 376 Questions

You manage your organization's Security Operations Center (SOC). You currently monitor and detect network traffic anomalies in your Google Cloud VPCs based on packet header information. However, you want the capability to explore network flows and their payload to aid investigations.
Which Google Cloud product should you use?

  1. Marketplace IDS
  2. VPC Flow Logs
  3. VPC Service Controls logs
  4. Packet Mirroring
  5. Google Cloud Armor Deep Packet Inspection

Answer(s): D


Reference:

https://aws.amazon.com/blogs/aws/new-vpc-traffic-mirroring/



Your organization acquired a new workload. The Web and Application (App) servers will be running on Compute Engine in a newly created custom VPC. You are responsible for configuring a secure network communication solution that meets the following requirements:

Only allows communication between the Web and App tiers.

Enforces consistent network security when autoscaling the Web and App tiers.

Prevents Compute Engine Instance Admins from altering network traffic.

What should you do?

  1. 1. Configure all running Web and App servers with respective network tags.
    2. Create an allow VPC firewall rule that specifies the target/source with respective network tags.
  2. 1. Configure all running Web and App servers with respective service accounts.
    2. Create an allow VPC firewall rule that specifies the target/source with respective service accounts.
  3. 1. Re-deploy the Web and App servers with instance templates configured with respective network tags.
    2. Create an allow VPC firewall rule that specifies the target/source with respective network tags.
  4. 1. Re-deploy the Web and App servers with instance templates configured with respective service accounts.
    2. Create an allow VPC firewall rule that specifies the target/source with respective service accounts.

Answer(s): D



You need to connect your organization's on-premises network with an existing Google Cloud environment that includes one Shared VPC with two subnets named Production and Non-Production. You are required to:

Use a private transport link.

Configure access to Google Cloud APIs through private API endpoints originating from on-premises environments.
Ensure that Google Cloud APIs are only consumed via VPC Service Controls.

What should you do?

  1. 1. Set up a Cloud VPN link between the on-premises environment and Google Cloud.
    2. Configure private access using the restricted.googleapis.com domains in on-premises DNS configurations.
  2. 1. Set up a Partner Interconnect link between the on-premises environment and Google Cloud.
    2. Configure private access using the private.googleapis.com domains in on-premises DNS configurations.
  3. 1. Set up a Direct Peering link between the on-premises environment and Google Cloud.
    2. Configure private access for both VPC subnets.
  4. 1. Set up a Dedicated Interconnect link between the on-premises environment and Google Cloud.
    2. Configure private access using the restricted.googleapis.com domains in on-premises DNS configurations.

Answer(s): D



You are working with protected health information (PHI) for an electronic health record system. The privacy officer is concerned that sensitive data is stored in the analytics system. You are tasked with anonymizing the sensitive data in a way that is not reversible. Also, the anonymized data should not preserve the character set and length.
Which Google Cloud solution should you use?

  1. Cloud Data Loss Prevention with deterministic encryption using AES-SIV
  2. Cloud Data Loss Prevention with format-preserving encryption
  3. Cloud Data Loss Prevention with cryptographic hashing
  4. Cloud Data Loss Prevention with Cloud Key Management Service wrapped cryptographic keys

Answer(s): C


Reference:

https://cloud.google.com/dlp/docs/pseudonymization



You are setting up a CI/CD pipeline to deploy containerized applications to your production clusters on Google Kubernetes Engine (GKE). You need to prevent containers with known vulnerabilities from being deployed. You have the following requirements for your solution:

Must be cloud-native

Must be cost-efficient

Minimize operational overhead

How should you accomplish this? (Choose two.)

  1. Create a Cloud Build pipeline that will monitor changes to your container templates in a Cloud Source Repositories repository. Add a step to analyze Container Analysis results before allowing the build to continue.
  2. Use a Cloud Function triggered by log events in Google Cloud's operations suite to automatically scan your container images in Container Registry.
  3. Use a cron job on a Compute Engine instance to scan your existing repositories for known vulnerabilities and raise an alert if a non-compliant container image is found.
  4. Deploy Jenkins on GKE and configure a CI/CD pipeline to deploy your containers to Container Registry. Add a step to validate your container images before deploying your container to the cluster.
  5. In your CI/CD pipeline, add an attestation on your container image when no vulnerabilities have been found.
    Use a Binary Authorization policy to block deployments of containers with no attestation in your cluster.

Answer(s): A,E


Reference:

https://cloud.google.com/architecture/prep-kubernetes-engine-for-prod



  PDF
Viewing page 26 of 74
Viewing questions 126 - 130 out of 376 questions


Post your Comments and Discuss Google PROFESSIONAL CLOUD SECURITY ENGINEER exam prep with other Community members:

AI Tutor AI Tutor 👋 I’m here to help!