At ValidExamDumps, we consistently monitor updates to the Google Professional-Cloud-Security-Engineer exam questions by Google. Whenever our team identifies changes in the exam questions, objectives, focus areas or requirements, We immediately update our exam questions for both PDF and online practice exams. This commitment ensures our customers always have access to the most current and accurate questions. By preparing with these up to date and 100% exam domain coverage questions, our customers can successfully pass the Google Professional Cloud Security Engineer exam on their first attempt without needing additional materials or study guides.
Other certification materials providers often include outdated or removed questions by Google in their Professional-Cloud-Security-Engineer exam. These outdated questions lead to customers failing their Google Professional Cloud Security Engineer exam. In contrast, we ensure our questions bank includes only precise and up-to-date questions. Our main priority is your success in the Google Professional-Cloud-Security-Engineer exam, not profiting from selling obsolete exam questions in PDF or Online Practice Test.
You are part of a security team investigating a compromised service account key. You need to audit which new resources were created by the service account.
What should you do?
Admin activity logs are always created to log entries for API calls or other actions that modify the configuration or metadata of resources. For example, these logs record when users create VM instances or change Identity and Access Management permissions.
Your company requires the security and network engineering teams to identify all network anomalies within and across VPCs, internal traffic from VMs to VMs, traffic between end locations on the internet and VMs, and traffic between VMs to Google Cloud services in production. Which method should you use?
Your team sets up a Shared VPC Network where project co-vpc-prod is the host project. Your team has configured the firewall rules, subnets, and VPN gateway on the host project. They need to enable Engineering Group A to attach a Compute Engine instance to only the 10.1.1.0/24 subnet.
What should your team grant to Engineering Group A to meet this requirement?
To enable Engineering Group A to attach a Compute Engine instance to a specific subnet (10.1.1.0/24) in a Shared VPC, you should grant the Compute Network User Role at the subnet level. This role allows users to use the subnetwork for their instances without giving them broader permissions at the project level.
Step-by-Step:
Identify the Subnet: Locate the subnet (10.1.1.0/24) in the host project.
Grant Role:
Navigate to the GCP Console > VPC network > VPC networks.
Select the Shared VPC host project and locate the specific subnet.
Click on 'Edit' and go to the 'IAM & Admin' section.
Assign the 'Compute Network User' role to Engineering Group A at the subnet level.
Verification: Ensure that Engineering Group A can now attach Compute Engine instances to the specified subnet.
Shared VPC Overview
Compute Network User Role
In an effort for your company messaging app to comply with FIPS 140-2, a decision was made to use GCP compute and network services. The messaging app architecture includes a Managed Instance Group (MIG) that controls a cluster of Compute Engine instances. The instances use Local SSDs for data caching and UDP for instance-to-instance communications. The app development team is willing to make any changes necessary to comply with the standard
Which options should you recommend to meet the requirements?
To comply with FIPS 140-2 for the messaging app, you need to ensure that both data at rest and data in transit are encrypted according to the standard. Using customer-managed encryption keys (CMEK) ensures that you have control over the encryption keys, and BoringSSL is a library that meets FIPS 140-2 standards for encrypting data in transit.
Steps:
Encrypt Local SSDs: Modify the instance template for the Managed Instance Group (MIG) to use customer-managed encryption keys (CMEK) for encrypting Local SSDs.
Enable BoringSSL: Update the application to use the BoringSSL library for all instance-to-instance communication to ensure that all data in transit is encrypted according to FIPS 140-2 standards.
Google Cloud: Customer-managed encryption keys (CMEK)
BoringSSL documentation
An organization receives an increasing number of phishing emails.
Which method should be used to protect employee credentials in this situation?
https://cloud.google.com/blog/products/g-suite/7-ways-admins-can-help-secure-accounts-against-phishing-g-suite
https://www.duocircle.com/content/email-security-services/email-security-in-cryptography#:~:text=Customer%20Login-,Email%20Security%20In%20Cryptography%20Is%20One%20Of%20The%20Most,Measures%20To%20Prevent%20Phishing%20Attempts&text=Cybercriminals%20love%20emails%20the%20most,networks%20all%20over%20the%20world.
