最新的Google Cloud Certified - Professional Cloud Security Engineer - Professional-Cloud-Security-Engineer免費考試真題
問題1
An organization is evaluating the use of Google Cloud Platform (GCP) for certain IT workloads. A well- established directory service is used to manage user identities and lifecycle management. This directory service must continue for the organization to use as the "source of truth" directory for identities.
Which solution meets the organization's requirements?
Which solution meets the organization's requirements?
正確答案: B
說明：（僅 VCESoft 成員可見）
問題2
You need to implement an encryption-at-rest strategy that protects sensitive data and reduces key management complexity for non-sensitive dat a. Your solution has the following requirements:
Schedule key rotation for sensitive data.
Control which region the encryption keys for sensitive data are stored in.
Minimize the latency to access encryption keys for both sensitive and non-sensitive data.
What should you do?
Schedule key rotation for sensitive data.
Control which region the encryption keys for sensitive data are stored in.
Minimize the latency to access encryption keys for both sensitive and non-sensitive data.
What should you do?
正確答案: C
說明：（僅 VCESoft 成員可見）
問題3
Your organization has on-premises hosts that need to access Google Cloud APIs You must enforce private connectivity between these hosts minimize costs and optimize for operational efficiency What should you do?
正確答案: B
說明：（僅 VCESoft 成員可見）
問題4
Your company recently published a security policy to minimize the usage of service account keys. On-premises Windows-based applications are interacting with Google Cloud APIs. You need to implement Workload Identity Federation (WIF) with your identity provider on-premises.
What should you do?
What should you do?
正確答案: B
說明：（僅 VCESoft 成員可見）
問題5
Your organization is deploying a serverless web application on Cloud Run that must be publicly accessible over HTTPS To meet security requirements, you need to terminate TLS at the edge, apply threat mitigation, and prepare for geo-based access restrictions What should you do?
正確答案: A
說明：（僅 VCESoft 成員可見）
問題6
Your Google Cloud environment has one organization node, one folder named Apps." and several projects within that folder The organizational node enforces the constraints/iam.allowedPolicyMemberDomains organization policy, which allows members from the terramearth.com organization The "Apps" folder enforces the constraints/iam.allowedPolicyMemberDomains organization policy, which allows members from the flowlogistic.com organization. It also has the inheritFromParent: false property.
You attempt to grant access to a project in the Apps folder to the user [email protected].
What is the result of your action and why?
You attempt to grant access to a project in the Apps folder to the user [email protected].
What is the result of your action and why?
正確答案: A
說明：（僅 VCESoft 成員可見）
問題7
A customer is running an analytics workload on Google Cloud Platform (GCP) where Compute Engine instances are accessing data stored on Cloud Storage. Your team wants to make sure that this workload will not be able to access, or be accessed from, the internet.
Which two strategies should your team use to meet these requirements? (Choose two.)
Which two strategies should your team use to meet these requirements? (Choose two.)
正確答案: A,C
說明：（僅 VCESoft 成員可見）
問題8
Your financial services company has an audit requirement under a strict regulatory framework that requires comprehensive, immutable audit trails for all administrative and data access activity that ensures that data is kept for seven years Your current logging is fragmented across individual projects You need to establish a centralized, tamper-proof, long-term logging solution accessible for audits What should you do?
正確答案: D
說明：（僅 VCESoft 成員可見）
問題9
Your team wants to limit users with administrative privileges at the organization level.
Which two roles should your team restrict? (Choose two.)
Which two roles should your team restrict? (Choose two.)
正確答案: C,D
說明：（僅 VCESoft 成員可見）
問題10
You must ensure that the keys used for at-rest encryption of your data are compliant with your organization's security controls. One security control mandates that keys get rotated every 90 days. You must implement an effective detection strategy to validate if keys are rotated as required. What should you do?
正確答案: C
問題11
A customer needs to launch a 3-tier internal web application on Google Cloud Platform (GCP). The customer's internal compliance requirements dictate that end-user access may only be allowed if the traffic seems to originate from a specific known good CIDR. The customer accepts the risk that their application will only have SYN flood DDoS protection. They want to use GCP's native SYN flood protection.
Which product should be used to meet these requirements?
Which product should be used to meet these requirements?
正確答案: A
說明：（僅 VCESoft 成員可見）
問題12
Your organization hosts a financial services application running on Compute Engine instances for a third-party company. The third-party company's servers that will consume the application also run on Compute Engine in a separate Google Cloud organization. You need to configure a secure network connection between the Compute Engine instances. You have the following requirements:
The network connection must be encrypted.
The communication between servers must be over private IP addresses.
What should you do?
The network connection must be encrypted.
The communication between servers must be over private IP addresses.
What should you do?
正確答案: C
說明：（僅 VCESoft 成員可見）
問題13
A customer needs an alternative to storing their plain text secrets in their source-code management (SCM) system.
How should the customer achieve this using Google Cloud Platform?
How should the customer achieve this using Google Cloud Platform?
正確答案: B
說明：（僅 VCESoft 成員可見）
問題14
You are a security administrator at your company and are responsible for managing access controls (identification, authentication, and authorization) on Google Cloud. Which Google-recommended best practices should you follow when configuring authentication and authorization? (Choose two.)
正確答案: A,E
說明：（僅 VCESoft 成員可見）
問題15
Your organization has had a few recent DDoS attacks. You need to authenticate responses to domain name lookups. Which Google Cloud service should you use?
正確答案: A
說明：（僅 VCESoft 成員可見）
問題16
Your organization acquired a new workload. The Web and Application (App) servers will be running on Compute Engine in a newly created custom VPC. You are responsible for configuring a secure network communication solution that meets the following requirements:
Only allows communication between the Web and App tiers.
Enforces consistent network security when autoscaling the Web and App tiers.
Prevents Compute Engine Instance Admins from altering network traffic.
What should you do?
Only allows communication between the Web and App tiers.
Enforces consistent network security when autoscaling the Web and App tiers.
Prevents Compute Engine Instance Admins from altering network traffic.
What should you do?
正確答案: D
說明：（僅 VCESoft 成員可見）
問題17
A customer wants to deploy a large number of 3-tier web applications on Compute Engine.
How should the customer ensure authenticated network separation between the different tiers of the application?
How should the customer ensure authenticated network separation between the different tiers of the application?
正確答案: A
說明：（僅 VCESoft 成員可見）
問題18
You are part of a security team investigating a compromised service account key. You need to audit which new resources were created by the service account.
What should you do?
What should you do?
正確答案: B
說明：（僅 VCESoft 成員可見）
