support@Free-Braindumps.com
Register Login
Cisco
CompTIA
ISC
EC-Council
EXIN
Fortinet
ITIL
Juniper
Microsoft
VMware
Avaya
SAP
Google
NVIDIA
Salesforce
Amazon
Palo Alto Networks
ISC2
CrowdStrike
Anthropic
All Vendors
  1. Home
  2. Exams
  3. Google
  4. PROFESSIONAL CLOUD SECURITY ENGINEER

Free PROFESSIONAL CLOUD SECURITY ENGINEER Exam Braindumps
Professional Cloud Security Engineer Questions 186–190 (page: 39)

Updated On: 10-Feb-2026
Page 39 of 74
PDF with 376 Questions

You have stored company approved compute images in a single Google Cloud project that is used as an image repository. This project is protected with VPC Service Controls and exists in the perimeter along with other projects in your organization. This lets other projects deploy images from the image repository project. A team requires deploying a third-party disk image that is stored in an external Google Cloud organization. You need to grant read access to the disk image so that it can be deployed into the perimeter.

What should you do?

  1. Allow the external project by using the organizational policy, constraints/ compute.trustedImageProjects.
  2. 1. Update the perimeter.
    2. Configure the egressTo field to include the external Google Cloud project number as an allowed resource and the serviceName to compute.googleapis.com.
    3. Configure the egressFrom field to set identityType to ANY_IDENTITY.
  3. 1. Update the perimeter.
    2. Configure the ingressFrom field to set identityType to ANY_IDENTITY.
    3. Configure the ingressTo field to include the external Google Cloud project number as an allowed resource and the serviceName to compute.googleapis.com.
  4. 1. Update the perimeter.
    2. Configure the egressTo field to set identityType to ANY_IDENTITY.
    3. Configure the egressFrom field to include the external Google Cloud project number as an allowed resource and the serviceName to compute.googleapis.com.

Answer(s): B



A service account key has been publicly exposed on multiple public code repositories. After reviewing the logs, you notice that the keys were used to generate short-lived credentials. You need to immediately remove access with the service account.

What should you do?

  1. Delete the compromised service account.
  2. Disable the compromised service account key.
  3. Wait until the service account credentials expire automatically.
  4. Rotate the compromised service account key.

Answer(s): A



A company is using Google Kubernetes Engine (GKE) with container images of a mission-critical application. The company wants to scan the images for known security issues and securely share the report with the security team without exposing them outside Google Cloud.

What should you do?

  1. 1. Enable Container Threat Detection in the Security Command Center Premium tier.
    2. Upgrade all clusters that are not on a supported version of GKE to the latest possible GKE version.
    3. View and share the results from the Security Command Center.
  2. 1. Use an open source tool in Cloud Build to scan the images.
    2. Upload reports to publicly accessible buckets in Cloud Storage by using gsutil.
    3. Share the scan report link with your security department.
  3. 1. Enable vulnerability scanning in the Artifact Registry settings.
    2. Use Cloud Build to build the images.
    3. Push the images to the Artifact Registry for automatic scanning.
    4. View the reports in the Artifact Registry.
  4. 1. Get a GitHub subscription.
    2. Build the images in Cloud Build and store them in GitHub for automatic scanning.
    3. Download the report from GitHub and share with the Security Team.

Answer(s): C



Your application is deployed as a highly available, cross-region solution behind a global external HTTP(S) load balancer. You notice significant spikes in traffic from multiple IP addresses, but it is unknown whether the IPs are malicious. You are concerned about your application's availability. You want to limit traffic from these clients over a specified time interval.

What should you do?

  1. Configure a throttle action by using Google Cloud Armor to limit the number of requests per client over a specified time interval.
  2. Configure a rate_based_ban action by using Google Cloud Armor and set the ban_duration_sec parameter to the specified lime interval.
  3. Configure a firewall rule in your VPC to throttle traffic from the identified IP addresses.
  4. Configure a deny action by using Google Cloud Armor to deny the clients that issued too many requests over the specified time interval.

Answer(s): A



Your organization is using Active Directory and wants to configure Security Assertion Markup Language (SAML). You must set up and enforce single sign-on (SSO) for all users.

What should you do?

  1. 1. Create a new SAML profile.
    2. Populate the sign-in and sign-out page URLs.
    3. Upload the X.509 certificate.
    4. Configure Entity ID and ACS URL in your IdP.
  2. 1. Configure prerequisites for OpenID Connect (OIDC) in your Active Directory (AD) tenant.
    2. Verify the AD domain.
    3. Decide which users should use SAML.
    4. Assign the pre-configured profile to the select organizational units (OUs) and groups.
  3. 1. Create a new SAML profile.
    2. Upload the X.509 certificate.
    3. Enable the change password URL.
    4. Configure Entity ID and ACS URL in your IdP.
  4. 1. Manage SAML profile assignments.
    2. Enable OpenID Connect (OIDC) in your Active Directory (AD) tenant.
    3. Verify the domain.

Answer(s): A



  PDF
Viewing page 39 of 74
Viewing questions 191 - 195 out of 376 questions


Post your Comments and Discuss Google PROFESSIONAL CLOUD SECURITY ENGINEER exam prep with other Community members:

AI Tutor AI Tutor 👋 I’m here to help!