support@Free-Braindumps.com
Register Login
Cisco
CompTIA
ISC
EC-Council
EXIN
Fortinet
ITIL
Juniper
Microsoft
VMware
Avaya
SAP
Google
NVIDIA
Salesforce
Amazon
Palo Alto Networks
ISC2
CrowdStrike
Anthropic
All Vendors
  1. Home
  2. Exams
  3. Google
  4. PROFESSIONAL CLOUD SECURITY ENGINEER

Free PROFESSIONAL CLOUD SECURITY ENGINEER Exam Braindumps
Professional Cloud Security Engineer Questions 151–155 (page: 32)

Updated On: 10-Feb-2026
Page 32 of 74
PDF with 376 Questions

Your privacy team uses crypto-shredding (deleting encryption keys) as a strategy to delete personally identifiable information (PII). You need to implement this practice on Google Cloud while still utilizing the majority of the platform's services and minimizing operational overhead.
What should you do?

  1. Use client-side encryption before sending data to Google Cloud, and delete encryption keys on-premises.
  2. Use Cloud External Key Manager to delete specific encryption keys.
  3. Use customer-managed encryption keys to delete specific encryption keys.
  4. Use Google default encryption to delete specific encryption keys.

Answer(s): C



You need to centralize your team's logs for production projects. You want your team to be able to search and analyze the logs using Logs Explorer.
What should you do?

  1. Enable Cloud Monitoring workspace, and add the production projects to be monitored.
  2. Use Logs Explorer at the organization level and filter for production project logs.
  3. Create an aggregate org sink at the parent folder of the production projects, and set the destination to a Cloud Storage bucket.
  4. Create an aggregate org sink at the parent folder of the production projects, and set the destination to a logs bucket.

Answer(s): D



You need to use Cloud External Key Manager to create an encryption key to encrypt specific BigQuery data at rest in Google Cloud.
Which steps should you do first?

  1. 1. Create or use an existing key with a unique uniform resource identifier (URI) in your Google Cloud project.
    2. Grant your Google Cloud project access to a supported external key management partner system.
  2. 1. Create or use an existing key with a unique uniform resource identifier (URI) in Cloud Key Management Service (Cloud KMS).
    2. In Cloud KMS, grant your Google Cloud project access to use the key.
  3. 1. Create or use an existing key with a unique uniform resource identifier (URI) in a supported external key management partner system.
    2. In the external key management partner system, grant access for this key to use your Google Cloud project.
  4. 1. Create an external key with a unique uniform resource identifier (URI) in Cloud Key Management Service (Cloud KMS).
    2. In Cloud KMS, grant your Google Cloud project access to use the key.

Answer(s): C



Your company's cloud security policy dictates that VM instances should not have an external IP address. You need to identify the Google Cloud service that will allow VM instances without external IP addresses to connect to the internet to update the VMs.
Which service should you use?

  1. Identity Aware-Proxy
  2. Cloud NAT
  3. TCP/UDP Load Balancing
  4. Cloud DNS

Answer(s): B



You want to make sure that your organization's Cloud Storage buckets cannot have data publicly available to the internet. You want to enforce this across all Cloud Storage buckets.
What should you do?

  1. Remove Owner roles from end users, and configure Cloud Data Loss Prevention.
  2. Remove Owner roles from end users, and enforce domain restricted sharing in an organization policy.
  3. Configure uniform bucket-level access, and enforce domain restricted sharing in an organization policy.
  4. Remove *.setIamPolicy permissions from all roles, and enforce domain restricted sharing in an organization policy.

Answer(s): C



  PDF
Viewing page 32 of 74
Viewing questions 156 - 160 out of 376 questions


Post your Comments and Discuss Google PROFESSIONAL CLOUD SECURITY ENGINEER exam prep with other Community members:

AI Tutor AI Tutor 👋 I’m here to help!