QUESTION: 31

An organization is starting to move its infrastructure from its on-premises environment to Google Cloud Platform (GCP). The first step the organization wants to take is to migrate its current data backup and disaster recovery solutions to GCP for later analysis. The organization's production environment will remain on-premises for an indefinite time. The organization wants a scalable and cost-efficient solution.

Which GCP solution should the organization use?

BigQuery using a data pipeline job with continuous updates
Cloud Storage using a scheduled task and gsutil
Compute Engine Virtual Machines using Persistent Disk
Cloud Datastore using regularly scheduled batch upload jobs

Answer(s): B

Show Answer Next Question

QUESTION: 32

You are creating an internal App Engine application that needs to access a user's Google Drive on the user's behalf. Your company does not want to rely on the current user's credentials. It also wants to follow Google- recommended practices.

What should you do?

Create a new Service account, and give all application users the role of Service Account User.
Create a new Service account, and add all application users to a Google Group. Give this group the role of Service Account User.
Use a dedicated G Suite Admin account, and authenticate the application's operations with these G Suite credentials.
Create a new service account, and grant it G Suite domain-wide delegation. Have the application use it to impersonate the user.

Answer(s): D

Show Answer Next Question

QUESTION: 33

A customer wants to move their sensitive workloads to a Compute Engine-based cluster using Managed Instance Groups (MIGs). The jobs are bursty and must be completed quickly. They have a requirement to be able to control the key lifecycle.

Which boot disk encryption solution should you use on the cluster to meet this customer's requirements?

Customer-supplied encryption keys (CSEK)
Customer-managed encryption keys (CMEK) using Cloud Key Management Service (KMS)
Encryption by default
Pre-encrypting files before transferring to Google Cloud Platform (GCP) for analysis

Answer(s): B

Reference:

https://cloud.google.com/kubernetes-engine/docs/how-to/dynamic-provisioning-cmek

Show Answer Next Question

QUESTION: 34

Your company is using Cloud Dataproc for its Spark and Hadoop jobs. You want to be able to create, rotate, and destroy symmetric encryption keys used for the persistent disks used by Cloud Dataproc. Keys can be stored in the cloud.

What should you do?

Use the Cloud Key Management Service to manage the data encryption key (DEK).
Use the Cloud Key Management Service to manage the key encryption key (KEK).
Use customer-supplied encryption keys to manage the data encryption key (DEK).
Use customer-supplied encryption keys to manage the key encryption key (KEK).

Answer(s): B

Show Answer Next Question

QUESTION: 35

You are a member of the security team at an organization. Your team has a single GCP project with credit card payment processing systems alongside web applications and data processing systems. You want to reduce the scope of systems subject to PCI audit standards.

What should you do?

Use multi-factor authentication for admin access to the web application.
Use only applications certified compliant with PA-DSS.
Move the cardholder data environment into a separate GCP project.
Use VPN for all connections between your office and cloud environments.

Answer(s): C

Show Answer Next Question

Free Google PROFESSIONAL-CLOUD-SECURITY-ENGINEER Exam Questions (page: 8)

QUESTION: 31

QUESTION: 32

QUESTION: 33

Reference:

QUESTION: 34

QUESTION: 35

PROFESSIONAL-CLOUD-SECURITY-ENGINEER Exam Discussions & Posts