You perform a security assessment on a customer architecture and discover that multiple VMs have public IP addresses. After providing a recommendation to remove the public IP addresses, you are told those VMs need to communicate to external sites as part of the customer's typical operations. What should you recommend to reduce the need for public IP addresses in your customer's VMs?
Answer(s): B
You are tasked with exporting and auditing security logs for login activity events for Google Cloud console and API calls that modify configurations to Google Cloud resources. Your export must meet the following requirements:Export related logs for all projects in the Google Cloud organization.Export logs in near real-time to an external SIEM.What should you do? (Choose two.)
Answer(s): B,C
Your company's Chief Information Security Officer (CISO) creates a requirement that business data must be stored in specific locations due to regulatory requirements that affect the company's global expansion plans. After working on the details to implement this requirement, you determine the following:The services in scope are included in the Google Cloud Data Residency Terms.The business data remains within specific locations under the same organization.The folder structure can contain multiple data residency locations.You plan to use the Resource Location Restriction organization policy constraint. At which level in the resource hierarchy should you set the constraint?
Answer(s): C
You need to set up a Cloud interconnect connection between your company's on-premises data center and VPC host network. You want to make sure that on-premises applications can only access Google APIs over the Cloud Interconnect and not through the public internet. You are required to only use APIs that are supported by VPC Service Controls to mitigate against exfiltration risk to non-supported APIs. How should you configure the network?
Answer(s): D
https://cloud.google.com/network-connectivity/docs/interconnect/concepts/overview
You need to implement an encryption-at-rest strategy that protects sensitive data and reduces key management complexity for non-sensitive data. Your solution has the following requirements:Schedule key rotation for sensitive data.Control which region the encryption keys for sensitive data are stored in.Minimize the latency to access encryption keys for both sensitive and non-sensitive data.What should you do?
Post your Comments and Discuss Google PROFESSIONAL CLOUD SECURITY ENGINEER exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the PROFESSIONAL CLOUD SECURITY ENGINEER content, but please register or login to continue.