Professional-Cloud-Security-Engineer 무료 덤프문제 온라인 액세스

A customer needs to launch a 3-tier internal web application on Google Cloud Platform (GCP). The customer' s internal compliance requirements dictate that end-user access may only be allowed if the traffic seems to originate from a specific known good CIDR. The customer accepts the risk that their application will only have SYN flood DDoS protection. They want to use GCP's native SYN flood protection.
Which product should be used to meet these requirements?

• A.VPC Firewall Rules
• B.Cloud Identity and Access Management
• C.Cloud Armor
• D.Cloud CDN

An office manager at your small startup company is responsible for matching payments to invoices and creating billing alerts. For compliance reasons, the office manager is only permitted to have the Identity and Access Management (IAM) permissions necessary for these tasks. Which two IAM roles should the office manager have? (Choose two.)

• A.Billing Account Viewer
• B.Billing Account User
• C.Project Creator
• D.Billing Account Costs Manager
• E.Organization Administrator

Which two security characteristics are related to the use of VPC peering to connect two VPC networks?
(Choose two.)

• A.Non-transitive peered networks; where only directly peered networks can communicate
• B.Ability to peer networks that belong to different Google Cloud Platform organizations
• C.Ability to share specific subnets across peered networks
• D.Firewall rules that can be created with a tag from one peered network to another peered network
• E.Central management of routes, firewalls, and VPNs for peered networks

Your organization enforces a custom organization policy that disables the use of Compute Engine VM instances with external IP addresses. However, a regulated business unit requires an exception to temporarily use external IPs for a third-party audit process. The regulated business workload must comply with least privilege principles and minimize policy drift. You need to ensure secure policy management and proper handling. What should you do?

• A.Create an IAM custom role with permissions to bypass organization policies. Assign the custom role to the regulated business team for the specific project.
• B.Modify the custom organization policy at the organization level to allow external IPs for all projects.Configure VPC firewall rules to restrict egress traffic except for the regulated business workload.
• C.Create a folder. Apply the restrictive organization policy for non-regulated business workloads in the folder. Place the regulated business workload in that folder.
• D.Apply the custom organization policy at the organization level to restrict external IPs. Move the regulated business workload to a separate folder. Override the policy at that folder level.

You are implementing data protection by design and in accordance with GDPR requirements. As part of design reviews, you are told that you need to manage the encryption key for a solution that includes workloads for Compute Engine, Google Kubernetes Engine, Cloud Storage, BigQuery, and Pub/Sub. Which option should you choose for this implementation?

• A.Google default encryption
• B.Cloud External Key Manager
• C.Customer-supplied encryption keys
• D.Customer-managed encryption keys