Professional-Cloud-Security-Engineer問題集、Google実際の試験問題

質問 1

You have numerous private virtual machines on Google Cloud. You occasionally need to manage the servers through Secure Socket Shell (SSH) from a remote location. You want to configure remote access to the servers in a manner that optimizes security and cost efficiency.
What should you do?

A. Create a site-to-site VPN from your corporate network to Google Cloud.

B. Create a jump host instance with public IP Manage the instances by connecting through the jump host.

C. Create a firewall rule to allow access from the Identity-Aware Proxy (IAP) IP range Grant the role of an IAP- secured Tunnel User to the administrators.

D. Configure server instances with public IP addresses Create a firewall rule to only allow traffic from your corporate IPs.

正解: C

解説: (PassTest メンバーにのみ表示されます)

質問 2

Your organization has 3 TB of information in BigQuery and Cloud SQL. You need to develop a cost- effective, scalable, and secure strategy to anonymize the personally identifiable information (PII) that exists today. What should you do?

A. Inspect a representative sample of the data in BigQuery and Cloud SQL to identify PII. Based on this analysis, develop a custom script to anonymize the identified PII.

B. Export all 3TB of data from BigQuery and Cloud SQL to Cloud Storage. Use Cloud Sensitive Data Protection to anonymize the exported data. Re-import the anonymized data back into BigQuery and Cloud SQL.

C. Scan your BigQuery and Cloud SQL data using the Cloud DLP data profiling feature. Use the data profiling results to create a de-identification strategy with either Cloud Sensitive Data Protection's de- identification templates or custom configurations.

D. Create a new BigQuery dataset and Cloud SQL instance. Copy a small subset of the data to these new locations. Use Cloud Data Loss Prevention API to scan this subset for PII. Based on the results, create a custom anonymization script and apply the script to the entire 3 TB dataset in the original locations.

正解: C

解説: (PassTest メンバーにのみ表示されます)

質問 3

You manage your organization's Security Operations Center (SOC). You currently monitor and detect network traffic anomalies in your VPCs based on network logs. However, you want to explore your environment using network payloads and headers. Which Google Cloud product should you use?

A. Cloud IDS

B. VPC Flow Logs

C. Packet Mirroring

D. VPC Service Controls logs

E. Google Cloud Armor

正解: C

解説: (PassTest メンバーにのみ表示されます)

質問 4

You are designing a new governance model for your organization's secrets that are stored in Secret Manager.
Currently, secrets for Production and Non-Production applications are stored and accessed using service accounts. Your proposed solution must:
Provide granular access to secrets
Give you control over the rotation schedules for the encryption keys that wrap your secrets Maintain environment separation Provide ease of management Which approach should you take?

A. 1. Use a single Google Cloud project to store both Production and Non-Production secrets.2. Enforce access control to secrets using project-level Identity and Access Management (IAM) bindings.3. Use customer-managed encryption keys to encrypt secrets.

B. 1. Use separate Google Cloud projects to store Production and Non-Production secrets.2. Enforce access control to secrets using project-level identity and Access Management (IAM) bindings.3. Use customer-managed encryption keys to encrypt secrets.

C. 1. Use separate Google Cloud projects to store Production and Non-Production secrets.2. Enforce access control to secrets using secret-level Identity and Access Management (IAM) bindings.3. Use Google-managed encryption keys to encrypt secrets.

D. 1. Use a single Google Cloud project to store both Production and Non-Production secrets.2. Enforce access control to secrets using secret-level Identity and Access Management (IAM) bindings.3. Use Google-managed encryption keys to encrypt secrets.

正解: B

解説: (PassTest メンバーにのみ表示されます)

質問 5

You are responsible for protecting highly sensitive data in BigQuery. Your operations teams need access to this data, but given privacy regulations, you want to ensure that they cannot read the sensitive fields such as email addresses and first names. These specific sensitive fields should only be available on a need-to-know basis to the HR team. What should you do?

A. Perform tokenization for Pseudonymization with the DLP API and store that data in BigQuery for later use.

B. Perform data redaction with the DLP API and store that data in BigQuery for later use.

C. Perform data masking with the DLP API and store that data in BigQuery for later use.

D. Perform data inspection with the DLP API and store that data in BigQuery for later use.

正解: A

解説: (PassTest メンバーにのみ表示されます)

質問 6

You are working with a network engineer at your company who is extending a large BigQuery-based data analytics application. Currently, all of the data for that application is ingested from on-premises applications over a Dedicated Interconnect connection with a 20Gbps capacity. You need to onboard a data source on Microsoft Azure that requires a daily ingestion of approximately 250 TB of data. You need to ensure that the data gets transferred securely and efficiently. What should you do?

A. Establish a Cross-Cloud Interconnect connection between Microsoft Azure and Google Cloud.
Configure a network route over this connection to transfer the data.

B. Set up a SFTP server with a public IP address that runs on a VM in your Google Cloud project. Connect from Microsoft Azure to this server.

C. Use the existing Dedicated Interconnect connection through the on-premises network and establish connectivity to Microsoft Azure.

D. Establish a VPN connection with the Microsoft Azure subscription where the source application is running. Transfer the data through the VPN connection.

正解: A

解説: (PassTest メンバーにのみ表示されます)

質問 7

Your company's cloud security policy dictates that VM instances should not have an external IP address. You need to identify the Google Cloud service that will allow VM instances without external IP addresses to connect to the internet to update the VMs. Which service should you use?

A. TCP/UDP Load Balancing

B. Identity Aware-Proxy

C. Cloud DNS

D. Cloud NAT

正解: D

解説: (PassTest メンバーにのみ表示されます)

質問 8

A customer wants to make it convenient for their mobile workforce to access a CRM web interface that is hosted on Google Cloud Platform (GCP). The CRM can only be accessed by someone on the corporate network. The customer wants to make it available over the internet. Your team requires an authentication layer in front of the application that supports two-factor authentication Which GCP product should the customer implement to meet these requirements?

A. Cloud Endpoints

B. Cloud VPN

C. Cloud Armor

D. Cloud Identity-Aware Proxy

正解: D

解説: (PassTest メンバーにのみ表示されます)

質問 9

A customer wants to run a batch processing system on VMs and store the output files in a Cloud Storage bucket. The networking and security teams have decided that no VMs may reach the public internet.
How should this be accomplished?

A. Provision a NAT Gateway to access the Cloud Storage API endpoint.

B. Create a firewall rule to block internet traffic from the VM.

C. Enable Private Google Access on the VPC.

D. Mount a Cloud Storage bucket as a local filesystem on every VM.

正解: C

解説: (PassTest メンバーにのみ表示されます)

質問 10

You need to set up a Cloud interconnect connection between your company's on-premises data center and VPC host network. You want to make sure that on-premises applications can only access Google APIs over the Cloud Interconnect and not through the public internet. You are required to only use APIs that are supported by VPC Service Controls to mitigate against exfiltration risk to non-supported APIs. How should you configure the network?

A. Use private.googleapis.com to access Google APIs using a set of IP addresses only routable from within Google Cloud, which are advertised as routes over the connection.

B. Use restricted googleapis.com to access Google APIs using a set of IP addresses only routable from within Google Cloud, which are advertised as routes over the Cloud Interconnect connection.

C. Set up a Private Service Connect endpoint IP address with the API bundle of "all-apis", which is advertised as a route over the Cloud interconnect connection.

D. Enable Private Google Access on the regional subnets and global dynamic routing mode.

正解: B

解説: (PassTest メンバーにのみ表示されます)

質問 11

The CISO of your highly regulated organization has mandated that all AI applications running in production must be based on Google first-party models. Your security team has now implemented the Model Garden's organization policy meant to centrally control access and user actions on these approved models at the production folder level. However, it appears that someone has overwritten the policy. This has allowed developers to access third-party models on a particular production project. You need to resolve the issue with a solution that prevents a repeat occurrence. What should you do?

A. Implement a security posture based on the secure_ai_extended template to notify the security team of any policy changes at the organization level.

B. Withdraw the Organization Policy Administrator role from all non-security team principals at the production folder level.

C. Implement a security posture based on the secure_ai_extended template to notify the security team of any policy changes at the production folder level.

D. Withdraw the Organization Policy Administrator role from all non-security team principals at the organization level.

正解: D

解説: (PassTest メンバーにのみ表示されます)

質問 12

You have been tasked with configuring Security Command Center for your organization's Google Cloud environment. Your security team needs to receive alerts of potential crypto mining in the organization's compute environment and alerts for common Google Cloud misconfigurations that impact security. Which Security Command Center features should you use to configure these alerts? (Choose two.)

A. Cloud Data Loss Prevention

B. Security Health Analytics

C. Container Threat Detection

D. Event Threat Detection

E. Google Cloud Armor

正解: B,D

解説: (PassTest メンバーにのみ表示されます)

質問 13

Your company is deploying a new application on GKE. The application handles sensitive customer data and is subject to strict data residency requirements. You need to ensure that the data is stored only within the europe-west4 region. What should you do?

A. Train the development team on the data residency requirements, and use code reviews to ensure that all resources are deployed to europe-west4.

B. Use an organizational policy to restrict resource locations to europe-west4 for the project containing the GKE cluster.

C. Create a GKE cluster in europe-west4. Use a custom admission controller in GKE that validates the region of all deployed resources against a predefined allowed list.

D. Create a GKE cluster in europe-west4. Configure a network policy to block all traffic to and from other regions. Use Kubernetes role-based access control (RBAC) to limit access to the cluster.

正解: B

解説: (PassTest メンバーにのみ表示されます)

質問 14

Your organization wants to publish yearly reports of your website usage analytics. You must ensure that no data with personally identifiable information (PII) is published by using the Cloud Data Loss Prevention (Cloud DLP) API. Data integrity must be preserved. What should you do?

A. Detect all PII in storage by using the Cloud DLP API. Create a cloud function to delete the PII.

B. Encrypt the PII from the report by using the Cloud DLP API.

C. Discover and transform PII data in your reports by using the Cloud DLP API.

D. Discover and quarantine your PII data in your storage by using the Cloud DLP API.

正解: C

解説: (PassTest メンバーにのみ表示されます)

Google Cloud Certified - Professional Cloud Security Engineer - Professional-Cloud-Security-Engineer 模擬練習