Professional-Cloud-Security-Engineer 試験問題を無料オンラインアクセス

You work for a large organization that recently implemented a 100GB Cloud Interconnect connection between your Google Cloud and your on-premises edge router. While routinely checking the connectivity, you noticed that the connection is operational but there is an error message that indicates MACsec is operationally down. You need to resolve this error. What should you do?

• A.Ensure that the active pre-shared key matches on both the on-premises and Google edge routers.
• B.Ensure that the Cloud Interconnect connection supports MACsec.
• C.Ensure that the active pre-shared key created for MACsec is not expired on both the on-premises and Google edge routers.
• D.Ensure that the on-premises router is not down.

Your financial services company is migrating its operations to Google Cloud. You are implementing a centralized logging strategy to meet strict regulatory compliance requirements. Your company's Google Cloud organization has a dedicated folder for all production projects. All audit logs, including Data Access logs from all current and future projects within this production folder, must be securely collected and stored in a central BigQuery dataset for long-term retention and analysis. To prevent duplicate log storage and to enforce centralized control, you need to implement a logging solution that intercepts and overrides any project-level log sinks for these audit logs, to ensure that logs are not inadvertently routed elsewhere. What should you do?

• A.Create an intercepting aggregated log sink at the production folder level with the central BigQuery dataset as the destination. Configure an inclusion filter for the necessary audit logs. Grant the appropriate IAM permissions to the sink's writer_identity on the BigQuery dataset.
• B.Create an aggregated log sink at the organization level with a destination of the central BigQuery dataset and a filter for all audit logs. Use the --include-children flag and configure a log view for the production folder.
• C.Create an aggregated log sink at the production folder level with a destination of the central BigQuery dataset. Configure an inclusion filter for all audit and Data Access logs. Grant the Logs Bucket Writer role to the sink's service account on the production folder.
• D.Create a log sink in each production project to route audit logs to the central BigQuery dataset. Set the writer_identity field of each sink to a service account with BigQuery Data Editor permissions on the central dataset.

You manage one of your organization's Google Cloud projects (Project A). AVPC Service Control (SC) perimeter is blocking API access requests to this project including Pub/Sub. A resource running under a service account in another project (Project B) needs to collect messages from a Pub/Sub topic in your project Project B is not included in a VPC SC perimeter. You need to provide access from Project B to the Pub/Sub topic in Project A using the principle of least Privilege.
What should you do?

• A.Create a perimeter bridge between Project A and Project B to allow the required communication between both projects.
• B.Remove the Pub/Sub API from the list of restricted services in the perimeter configuration for Project A.
• C.Create an access level that allows a developer in Project B to subscribe to the Pub/Sub topic that is located in Project A.
• D.Configure an ingress policy for the perimeter in Project A and allow access for the service account in Project B to collect messages.

In a shared security responsibility model for IaaS, which two layers of the stack does the customer share responsibility for? (Choose two.)

• A.Storage Encryption
• B.Network Security
• C.Hardware
• D.Boot
• E.Access Policies

You're developing the incident response plan for your company. You need to define the access strategy that your DevOps team will use when reviewing and investigating a deployment issue in your Google Cloud environment. There are two main requirements:
Least-privilege access must be enforced at all times.
The DevOps team must be able to access the required resources only during the deployment issue.
How should you grant access while following Google-recommended best practices?

• A.Create a custom 1AM role with limited list/view permissions, and assign it to the DevOps team.
• B.Create a service account, and grant it limited list/view permissions. Give the Service Account User Role on this service account to the DevOps team.
• C.Assign the Project Viewer Identity and Access Management (1AM) role to the DevOps team.
• D.Create a service account, and grant it the Project Owner 1AM role. Give the Service Account User Role on this service account to the DevOps team.