QUESTION: 21

In order to meet PCI DSS requirements, a customer wants to ensure that all outbound traffic is authorized.

Which two cloud offerings meet this requirement without additional compensating controls? (Choose two.)

App Engine
Cloud Functions
Compute Engine
Google Kubernetes Engine
Cloud Storage

Answer(s): C,D

Explanation:

App Engine ingress firewall rules are available, but egress rules are not currently available. Per requirements 1.2.1 and 1.3.4, you must ensure that all outbound traffic is authorized. SAQ A-EP and SAQ Dtype merchants must provide compensating controls or use a different Google Cloud product. Compute Engine and GKE are the preferred alternatives. https://cloud.google.com/solutions/pci-dss- compliance-in-gcp

Reveal Solution Next Question

QUESTION: 22

A website design company recently migrated all customer sites to App Engine. Some sites are still in progress and should only be visible to customers and company employees from any location.

Which solution will restrict access to the in-progress sites?

Upload an .htaccess file containing the customer and employee user accounts to App Engine.
Create an App Engine firewall rule that allows access from the customer and employee networks and denies all other traffic.
Enable Cloud Identity-Aware Proxy (IAP), and allow access to a Google Group that contains the customer and employee user accounts.
Use Cloud VPN to create a VPN connection between the relevant on-premises networks and the company's GCP Virtual Private Cloud (VPC) network.

Answer(s): C

Explanation:

https://cloud.google.com/iap/docs/concepts-overview#when_to_use_iap

Reveal Solution Next Question

QUESTION: 23

When working with agents in a support center via online chat, an organization's customers often share pictures of their documents with personally identifiable information (PII). The organization that owns the support center is concerned that the PII is being stored in their databases as part of the regular chat logs they retain for review by internal or external analysts for customer service trend analysis.

Which Google Cloud solution should the organization use to help resolve this concern for the customer while still maintaining data utility?

Use Cloud Key Management Service (KMS) to encrypt the PII data shared by customers before storing it for analysis.
Use Object Lifecycle Management to make sure that all chat records with PII in them are discarded and not saved for analysis.
Use the image inspection and redaction actions of the DLP API to redact PII from the images before storing them for analysis.
Use the generalization and bucketing actions of the DLP API solution to redact PII from the texts before storing them for analysis.

Answer(s): C

Explanation:

https://cloud.google.com/dlp/docs/concepts-image-redaction

Reveal Solution Next Question

QUESTION: 24

A company's application is deployed with a user-managed Service Account key. You want to use Google- recommended practices to rotate the key.

What should you do?

Open Cloud Shell and run gcloud iam service-accounts enable-auto-rotate --iam- account=IAM_ACCOUNT.
Open Cloud Shell and run gcloud iam service-accounts keys rotate --iam- account=IAM_ACCOUNT --key=NEW_KEY.
Create a new key, and use the new key in the application. Delete the old key from the Service Account.
Create a new key, and use the new key in the application. Store the old key on the system as a backup key.

Answer(s): C

Explanation:

You can rotate a key by creating a new key, updating applications to use the new key, and deleting the old key. Use the serviceAccount.keys.create() method and serviceAccount.keys.delete() method together to automate the rotation.

Reference:

https://cloud.google.com/iam/docs/understanding-service-accounts

Reveal Solution Next Question

Free Professional Cloud Security Engineer Exam Braindumps (page: 7)

QUESTION: 21

Explanation:

QUESTION: 22

Explanation:

QUESTION: 23

Explanation:

QUESTION: 24

Explanation:

Reference:

Professional Cloud Security Engineer Exam Discussions & Posts