support@Free-Braindumps.com
Register Login
Cisco
CompTIA
ISC
EC-Council
EXIN
Fortinet
ITIL
Juniper
Microsoft
VMware
Avaya
SAP
Google
NVIDIA
Salesforce
Amazon
Palo Alto Networks
ISC2
CrowdStrike
Anthropic
All Vendors
  1. Home
  2. Exams
  3. Google
  4. PROFESSIONAL CLOUD SECURITY ENGINEER

Free PROFESSIONAL CLOUD SECURITY ENGINEER Exam Braindumps
Professional Cloud Security Engineer Questions 146–150 (page: 31)

Updated On: 10-Feb-2026
Page 31 of 74
PDF with 376 Questions

Your security team wants to reduce the risk of user-managed keys being mismanaged and compromised. To achieve this, you need to prevent developers from creating user-managed service account keys for projects in their organization. How should you enforce this?

  1. Configure Secret Manager to manage service account keys.
  2. Enable an organization policy to disable service accounts from being created.
  3. Enable an organization policy to prevent service account keys from being created.
  4. Remove the iam.serviceAccounts.getAccessToken permission from users.

Answer(s): C



You are responsible for managing your company's identities in Google Cloud. Your company enforces 2-Step Verification (2SV) for all users. You need to reset a user's access, but the user lost their second factor for 2SV.
You want to minimize risk.
What should you do?

  1. On the Google Admin console, select the appropriate user account, and generate a backup code to allow the user to sign in. Ask the user to update their second factor.
  2. On the Google Admin console, temporarily disable the 2SV requirements for all users. Ask the user to log in and add their new second factor to their account. Re-enable the 2SV requirement for all users.
  3. On the Google Admin console, select the appropriate user account, and temporarily disable 2SV for this account. Ask the user to update their second factor, and then re-enable 2SV for this account.
  4. On the Google Admin console, use a super administrator account to reset the user account's credentials.
    Ask the user to update their credentials after their first login.

Answer(s): A



Which Google Cloud service should you use to enforce access control policies for applications and resources?

  1. Identity-Aware Proxy
  2. Cloud NAT
  3. Google Cloud Armor
  4. Shielded VMs

Answer(s): A



You want to update your existing VPC Service Controls perimeter with a new access level. You need to avoid breaking the existing perimeter with this change, and ensure the least disruptions to users while minimizing overhead.
What should you do?

  1. Create an exact replica of your existing perimeter. Add your new access level to the replica. Update the original perimeter after the access level has been vetted.
  2. Update your perimeter with a new access level that never matches. Update the new access level to match your desired state one condition at a time to avoid being overly permissive.
  3. Enable the dry run mode on your perimeter. Add your new access level to the perimeter configuration.
    Update the perimeter configuration after the access level has been vetted.
  4. Enable the dry run mode on your perimeter. Add your new access level to the perimeter dry run configuration. Update the perimeter configuration after the access level has been vetted.

Answer(s): D



Your organization's Google Cloud VMs are deployed via an instance template that configures them with a public IP address in order to host web services for external users. The VMs reside in a service project that is attached to a host (VPC) project containing one custom Shared VPC for the VMs. You have been asked to reduce the exposure of the VMs to the internet while continuing to service external users. You have already recreated the instance template without a public IP address configuration to launch the managed instance group (MIG).
What should you do?

  1. Deploy a Cloud NAT Gateway in the service project for the MIG.
  2. Deploy a Cloud NAT Gateway in the host (VPC) project for the MIG.
  3. Deploy an external HTTP(S) load balancer in the service project with the MIG as a backend.
  4. Deploy an external HTTP(S) load balancer in the host (VPC) project with the MIG as a backend.

Answer(s): C



  PDF
Viewing page 31 of 74
Viewing questions 151 - 155 out of 376 questions


Post your Comments and Discuss Google PROFESSIONAL CLOUD SECURITY ENGINEER exam prep with other Community members:

AI Tutor AI Tutor 👋 I’m here to help!