support@Free-Braindumps.com
Register Login
Cisco
CompTIA
ISC
EC-Council
EXIN
Fortinet
ITIL
Juniper
Microsoft
VMware
Avaya
SAP
Google
NVIDIA
Salesforce
Amazon
Palo Alto Networks
ISC2
CrowdStrike
Anthropic
All Vendors
  1. Home
  2. Exams
  3. Google
  4. PROFESSIONAL CLOUD SECURITY ENGINEER

Free PROFESSIONAL CLOUD SECURITY ENGINEER Exam Braindumps
Professional Cloud Security Engineer Questions 21–25 (page: 6)

Updated On: 10-Feb-2026
Page 6 of 74
PDF with 376 Questions

In order to meet PCI DSS requirements, a customer wants to ensure that all outbound traffic is authorized.

Which two cloud offerings meet this requirement without additional compensating controls? (Choose two.)

  1. App Engine
  2. Cloud Functions
  3. Compute Engine
  4. Google Kubernetes Engine
  5. Cloud Storage

Answer(s): C,D


Reference:

https://cloud.google.com/solutions/pci-dss-compliance-in-gcp



A website design company recently migrated all customer sites to App Engine. Some sites are still in progress and should only be visible to customers and company employees from any location.

Which solution will restrict access to the in-progress sites?

  1. Upload an .htaccess file containing the customer and employee user accounts to App Engine.
  2. Create an App Engine firewall rule that allows access from the customer and employee networks and denies all other traffic.
  3. Enable Cloud Identity-Aware Proxy (IAP), and allow access to a Google Group that contains the customer and employee user accounts.
  4. Use Cloud VPN to create a VPN connection between the relevant on-premises networks and the company's GCP Virtual Private Cloud (VPC) network.

Answer(s): C



When working with agents in the support center via online chat, your organization's customers often share pictures of their documents with personally identifiable information (PII). Your leadership team is concerned that this PII is being stored as part of the regular chat logs, which are reviewed by internal or external analysts for customer service trends.

You want to resolve this concern while still maintaining data utility.
What should you do?

  1. Use Cloud Key Management Service to encrypt PII shared by customers before storing it for analysis.
  2. Use Object Lifecycle Management to make sure that all chat records containing PII are discarded and not saved for analysis.
  3. Use the image inspection and redaction actions of the DLP API to redact PII from the images before storing them for analysis.
  4. Use the generalization and bucketing actions of the DLP API solution to redact PII from the texts before storing them for analysis.

Answer(s): C


Reference:

https://cloud.google.com/dlp/docs/deidentify-sensitive-data



A company's application is deployed with a user-managed Service Account key. You want to use Google- recommended practices to rotate the key.

What should you do?

  1. Open Cloud Shell and run gcloud iam service-accounts enable-auto-rotate --iam- account=IAM_ACCOUNT.
  2. Open Cloud Shell and run gcloud iam service-accounts keys rotate --iam- account=IAM_ACCOUNT --key=NEW_KEY.
  3. Create a new key, and use the new key in the application. Delete the old key from the Service Account.
  4. Create a new key, and use the new key in the application. Store the old key on the system as a backup key.

Answer(s): C


Reference:

https://cloud.google.com/iam/docs/understanding-service-accounts



Your team needs to configure their Google Cloud Platform (GCP) environment so they can centralize the control over networking resources like firewall rules, subnets, and routes. They also have an on-premises environment where resources need access back to the GCP resources through a private VPN connection. The networking resources will need to be controlled by the network security team.

Which type of networking design should your team use to meet these requirements?

  1. Shared VPC Network with a host project and service projects
  2. Grant Compute Admin role to the networking team for each engineering project
  3. VPC peering between all engineering projects using a hub and spoke model
  4. Cloud VPN Gateway between all engineering projects using a hub and spoke model

Answer(s): A


Reference:

https://cloud.google.com/docs/enterprise/best-practices-for-enterprise- organizations#centralize_network_control



  PDF
Viewing page 6 of 74
Viewing questions 26 - 30 out of 376 questions


Post your Comments and Discuss Google PROFESSIONAL CLOUD SECURITY ENGINEER exam prep with other Community members:

AI Tutor AI Tutor 👋 I’m here to help!