Google Professional-Cloud-Security-Engineer Valid Test : Google Cloud Certified - Professional Cloud Security Engineer Exam

For compliance reasons, an organization needs to ensure that in-scope PCI Kubernetes Pods reside on "in- scope" Nodes only. These Nodes can only contain the "in-scope" Pods.
How should the organization achieve this objective?

• A. Create a node pool with the label inscope: true and a Pod Security Policy that only allows the Pods to run on Nodes with that label.
• B. Run all in-scope Pods in the namespace "in-scope-pci".
• C. Add a nodeSelector field to the pod configuration to only use the Nodes labeled inscope: true.
• D. Place a taint on the Nodes with the label inscope: true and effect NoSchedule and a toleration to match in the Pod configuration.

You need to enforce a security policy in your Google Cloud organization that prevents users from exposing objects in their buckets externally. There are currently no buckets in your organization. Which solution should you implement proactively to achieve this goal with the least operational overhead?

• A. Create a VPC Service Controls perimeter that protects the storage.googleapis.com service in your projects that contains buckets. Add any new project that contains a bucket to the perimeter.
• B. Enable the constraints/storage.uniformBucketLevelAccess constraint at the organization level.
• C. Enable the constraints/storage.publicAccessPrevention constraint at the organization level.
• D. Create an hourly cron job to run a Cloud Function that finds public buckets and makes them private.

You are a security administrator at your company. Per Google-recommended best practices, you implemented the domain restricted sharing organization policy to allow only required domains to access your projects. An engineering team is now reporting that users at an external partner outside your organization domain cannot be granted access to the resources in a project. How should you make an exception for your partner's domain while following the stated best practices?

• A. Turn off the domain restricted sharing organization policy. Add each partner's Google Workspace customer ID to a Google group, add the Google group as an exception under the organization policy, and then turn the policy back on.
• B. Turn off the domain restricted sharing organization policy. Set the policy value to "Custom." Add each external partner's Cloud Identity or Google Workspace customer ID as an exception under the organization policy, and then turn the policy back on.
• C. Turn off the domain restriction sharing organization policy. Set the policy value to "Allow All."
• D. Turn off the domain restricted sharing organization policy. Provide the external partners with the required permissions using Google's Identity and Access Management (IAM) service.

You discovered that sensitive personally identifiable information (PII) is being ingested to your Google Cloud environment in the daily ETL process from an on-premises environment to your BigQuery datasets. You need to redact this data to obfuscate the PII, but need to re-identify it for data analytics purposes. Which components should you use in your solution? (Choose two.)

• A. Cloud Data Loss Prevention with automatic text redaction
• B. Cloud Data Loss Prevention with cryptographic hashing
• C. Cloud Key Management Service
• D. Cloud Data Loss Prevention with deterministic encryption using AES-SIV
• E. Secret Manager

Your organization strives to be a market leader in software innovation. You provided a large number of Google Cloud environments so developers can test the integration of Gemini in Vertex AI into their existing applications or create new projects. Your organization has 200 developers and a five-person security team.
You must prevent and detect proper security policies across the Google Cloud environments. What should you do? (Choose 2 answers)

• A. Publish internal policies and clear guidelines to securely develop applications.
• B. Apply a predefined AI-recommended security posture template for Gemini in Vertex AI in Security Command Center Enterprise or Premium tiers.
• C. Use Cloud Logging to create log filters to detect misconfigurations. Trigger Cloud Run functions to remediate misconfigurations.
• D. Implement the least privileged access Identity and Access Management roles to prevent misconfigurations.
• E. Apply organization policy constraints. Detect and monitor drifts by using Security Health Analytics.