Choose Professional-Cloud-Security-Engineer most accurate study material

You have stored company approved compute images in a single Google Cloud project that is used as an image repository. This project is protected with VPC Service Controls and exists in the perimeter along with other projects in your organization. This lets other projects deploy images from the image repository project.
A team requires deploying a third-party disk image that is stored in an external Google Cloud organization.
You need to grant read access to the disk image so that it can be deployed into the perimeter.
What should you do?

• A. * Allow the external project by using the organizational policyconstraints/compute.
  trustedlmageProjects.
• B. * 1 Update the perimeter* 2 Configure the ingressFrcm field to set identityType to an-y_identity.* 3 Configure the ingressTo field to include the external Google Cloud project number as an allowed resource and the serviceName to compute.googleapis -com.
• C. * 1 Update the perimeter* 2 Configure the egressTo field to set identity Type to any_identity.* 3 Configure the egressFrom field to include the external Google Cloud project number as an allowed resource and the serviceName to compute. googleapis. com.
• D. * 1 Update the perimeter* 2 Configure the egressTo field to include the external Google Cloud project number as an allowed resource and the serviceName to compute. googleapis. com.* 3 Configure the egressFrom field to set identity Type to any_idestity.

You want to update your existing VPC Service Controls perimeter with a new access level. You need to avoid breaking the existing perimeter with this change, and ensure the least disruptions to users while minimizing overhead. What should you do?

• A. Enable the dry run mode on your perimeter. Add your new access level to the perimeter dry run configuration. Update the perimeter configuration after the access level has been vetted.
• B. Update your perimeter with a new access level that never matches. Update the new access level to match your desired state one condition at a time to avoid being overly permissive.
• C. Create an exact replica of your existing perimeter. Add your new access level to the replica. Update the original perimeter after the access level has been vetted.
• D. Enable the dry run mode on your perimeter. Add your new access level to the perimeter configuration.
  Update the perimeter configuration after the access level has been vetted.

Your organization relies heavily on virtual machines (VMs) in Compute Engine. Due to team growth and resource demands. VM sprawl is becoming problematic. Maintaining consistent security hardening and timely package updates poses an increasing challenge. You need to centralize VM image management and automate the enforcement of security baselines throughout the virtual machine lifecycle. What should you do?

• A. Use VM Manager to automatically distribute and apply patches to VMs across your projects. Integrate VM Manager with hardened. organization-standard VM images stored in a central repository.
• B. Configure the sole-tenancy feature in Compute Engine for all projects. Set up custom organization policies in Policy Controller to restrict the operating systems and image sources that teams are allowed to use.
• C. Activate Security Command Center Enterprise. Use VM discovery and posture management features to monitor hardening state and trigger automatic responses upon detection of issues.B. Create a Cloud Build trigger to build a pipeline that generates hardened VM images. Run vulnerability scans in the pipeline, and store images with passing scans in a registry. Use instance templates pointing to this registry.

Your Security team believes that a former employee of your company gained unauthorized access to Google Cloud resources some time in the past 2 months by using a service account key. You need to confirm the unauthorized access and determine the user activity. What should you do?

• A. Use the Cloud Monitoring console to filter audit logs by user.
• B. Use the Logs Explorer to search for user activity.
• C. Use the Cloud Data Loss Prevention API to query logs in Cloud Storage.
• D. Use Security Health Analytics to determine user activity.

Your organization is implementing a Zero Trust security model and using Chrome Enterprise Premium. The company is interested in governing access to sensitive data stored in Cloud Storage. You need to configure access controls that ensure only authorized users on managed devices can access this data, regardless of their network location. Access should be restricted based on the device's security posture. This requires up-to-date operating system patches and antivirus software. What should you do?

• A. Grant access to specific users to the VPC Service Controls to create a perimeter to access the Cloud Storage buckets. Configure Identity-Aware Proxy (IAP) to authenticate users before they can access the data.1
• B. Configure IAM conditions based on IP address ranges. Require users to connect through a VPN.
  Implement endpoint verification software on user devices to check for basic compliance.
• C. Use Cloud Firewall rules to restrict access to the Cloud Storage buckets based on the source IP addresses. Require users to authenticate with a multi-factor authentication method.
• D. Create an access level in Access Context Manager that requires a device policy. Create a Context- Aware Access policy using this access level. Apply the policy to the VPC Service Controls perimeter that includes the Cloud Storage buckets.