Professional Cloud Security Engineer Practice Test
Professional Cloud Security Engineer Practice Test practice questions, page 15 of 15, with answer review and explanations.
Question 71
You will create a new Service Account that should be able to list the Compute Engine instances in the project. You want to follow Google-recommended practices. What should you do?
Create an Instance Template, and allow the Service Account Read Only access for the Compute Engine Access Scope.
Create a custom role with the permission compute.instances.list and grant the Service Account this role.
Give the Service Account the role of Compute Viewer, and use the new Service Account for all instances.
Give the Service Account the role of Project Viewer, and use the new Service Account for all instances.
Question 72
In a shared security responsibility model for IaaS, which two layers of the stack does the customer share responsibility for? (Choose two.)
Hardware
Network Security
Storage Encryption
Access Policies
Boot
Question 73
An organization is starting to move its infrastructure from its on-premises environment to Google Cloud Platform (GCP). The first step the organization wants to take is to migrate its ongoing data backup and disaster recovery solutions to GCP. The organization's on-premises production environment is going to be the next phase for migration to GCP. Stable networking connectivity between the on-premises environment and GCP is also being implemented. Which GCP solution should the organization use?
BigQuery using a data pipeline job with continuous updates via Cloud VPN
Cloud Storage using a scheduled task and gsutil via Cloud Interconnect
Compute Engines Virtual Machines using Persistent Disk via Cloud Interconnect
Cloud Datastore using regularly scheduled batch upload jobs via Cloud VPN
Question 74
What are the steps to encrypt data using envelope encryption? A. ✑ Generate a data encryption key (DEK) locally. ✑ Use a key encryption key (KEK) to wrap the DEK. ✑ Encrypt data with the KEK. ✑ Store the encrypted data and the wrapped KEK. B. ✑ Generate a key encryption key (KEK) locally. ✑ Use the KEK to generate a data encryption key (DEK). ✑ Encrypt data with the DEK. ✑ Store the encrypted data and the wrapped DEK. C. ✑ Generate a data encryption key (DEK) locally. ✑ Encrypt data with the DEK. ✑ Use a key encryption key (KEK) to wrap the DEK. ✑ Store the encrypted data and the wrapped DEK. D. ✑ Generate a key encryption key (KEK) locally. ✑ Generate a data encryption key (DEK) locally. ✑ Encrypt data with the KEK. Store the encrypted data and the wrapped DEK.
Question 75
A customer wants to make it convenient for their mobile workforce to access a CRM web interface that is hosted on Google Cloud Platform (GCP). The CRM can only be accessed by someone on the corporate network. The customer wants to make it available over the internet. Your team requires an authentication layer in front of the application that supports two-factor authentication Which GCP product should the customer implement to meet these requirements?