Professional-Cloud-Security-Engineer試験無料問題集「Google Cloud Certified - Professional Cloud Security Engineer 認定」

A. Automate a security scanner that verifies that no common vulnerabilities and exposures (CVEs) are presentin your trusted image repository.

B. Implement an organization policy constraint that enables the Shielded VM service on all projects to enforcethe trusted image repository usage.

C. Implement an organization policy to enforce that boot disks can only be created from images that come fromthe trusted image project.

D. Create a Cloud Function that is automatically triggered when a new virtual machine is created from thetrusted image repository Verify that the image is not deprecated.

A. Store the data in a BigQuery table, and set the table's expiration time.

B. Store the data in a Cloud Bigtable table, and set an expiration time on the column families.

C. Store the data in a Cloud Storage bucket, and configure the bucket's Object Lifecycle Management feature.

D. Store the data in a persistent disk, and delete the disk at expiration time.

A. 1. Create a workload identity pool and configure workload identity pool providers for each batch job
* 2 Assign the workload identity user role to each of the identities configured in the providers.
* 3. Create one service account per batch job Mb-sa-[1-5]". and grant only the permissions required to run the individual batch jobs to the service accounts
* 4 Generate credential configuration files for each of the providers Use these files to execute the batch jobs with the permissions of b-sa-[1-5].

B. 1. Create a general service account "g-sa" to orchestrate the batch jobs.
* 2. Create one service account per batch job Mb-sa-[1-5]," and grant only the permissions required to run the individual batch jobs to the service accounts.
* 3. Grant the Service Account Token Creator role to g-sa Use g-sa to obtain short-lived access tokens for b-sa-[1-5] and to execute the batch jobs with the permissions of b-sa-[1-5].

C. 1. Create a general service account **g-sa" to execute the batch jobs.
* 2 Grant the permissions required to execute the batch jobs to g-sa.
* 3. Execute the batch jobs with the permissions granted to g-sa

D. * 1. Create a general service account "g-sa" to orchestrate the batch jobs.
* 2 Create one service account per batch job 'b-sa-[1-5)\ Grant only the permissions required to run the individual batch jobs to the service accounts and generate service account keys for each of these service accounts
* 3. Store the service account keys in Secret Manager. Grant g-sa access to Secret Manager and run the batch jobs with the permissions of b-sa-[1-5].

A. Configure single sign-on using a customer's third-party provider.

B. Create a new managed user account for each consumer user account.

C. Use Google Cloud Directory Sync to convert the unmanaged user accounts.

D. Use the transfer tool for unmanaged user accounts.

A. Identity-Aware Proxy

B. Cloud NAT

C. Google Cloud Armor

D. Shielded VMs

A. 1. Configure prerequisites for OpenID Connect (OIDC) in your Active Directory (AD) tenant
* 2. Verify the AD domain.
* 3. Decide which users should use SAML.
* 4. Assign the pre-configured profile to the select organizational units (OUs) and groups.

B. 1. Create a new SAML profile.
* 2. Upload the X.509 certificate.
* 3. Enable the change password URL.
* 4. Configure Entity ID and ACS URL in your IdP.

C. 1. Manage SAML profile assignments.
* 2. Enable OpenID Connect (OIDC) in your Active Directory (AD) tenant.
* 3. Verify the domain.

D. 1- Create a new SAML profile.
* 2. Populate the sign-in and sign-out page URLs.
* 3. Upload the X.509 certificate.
* 4. Configure Entity ID and ACS URL in your IdP

A. Set up an organization policy to only permit public IPs for the front-end Compute Engine instances.

B. Remove the Editor role and grant the Compute Admin IAM role to the engineers.

C. Set up a VPC network with two subnets: one with public IPs and one without public IPs.

D. Enable Private Access on the VPC network in the production project.

A. Cloud Load Balancing firewall rules

B. VPC Service Controls in dry run mode

C. Google Cloud Armor's preconfigured rules in preview mode

D. Prepopulated VPC firewall rules in monitor mode

E. The inherent protections of Google Front End (GFE)

A. Store the data in a single BigQuery table and set the appropriate table expiration time.

B. Store the data in a single Persistent Disk, and delete the disk at expiration time.

C. Store the data in a Cloud Storage bucket, and configure the bucket's Object Lifecycle Management feature.

D. Store the data in a single BigTable table and set an expiration time on the column families.

A. Create a single KeyRing for all persistent disks and all Keys in this KeyRing. Manage the IAM permissions at the Key level.

B. Create a single KeyRing for all persistent disks and all Keys in this KeyRing. Manage the IAM permissions at the KeyRing level.

C. Create a KeyRing per persistent disk, with each KeyRing containing a single Key. Manage the IAM permissions at the Key level.

D. Create a KeyRing per persistent disk, with each KeyRing containing a single Key. Manage the IAM permissions at the KeyRing level.

A. 1. Create an external key with a unique uniform resource identifier (URI) in Cloud Key Management Service (Cloud KMS).
2. In Cloud KMS, grant your Google Cloud project access to use the key.

B. 1. Create or use an existing key with a unique uniform resource identifier (URI) in Cloud Key Management Service (Cloud KMS).
2. In Cloud KMS, grant your Google Cloud project access to use the key.

C. 1. Create or use an existing key with a unique uniform resource identifier (URI) in a supported external key management partner system.
2. In the external key management partner system, grant access for this key to use your Google Cloud project.

D. 1. Create or use an existing key with a unique uniform resource identifier (URI) in your Google Cloud project.
2. Grant your Google Cloud project access to a supported external key management partner system.

A. Organization Policy Administrator

B. Security Reviewer

C. Organization Role Administrator

D. Organization Administrator

A. VPC peering between all engineering projects using a hub and spoke model

B. Grant Compute Admin role to the networking team for each engineering project

C. Shared VPC Network with a host project and service projects

D. Cloud VPN Gateway between all engineering projects using a hub and spoke model

A. Set the minimum length for passwords to be 6 characters.

B. Set the minimum length for passwords to be 8 characters.

C. Set the minimum length for passwords to be 12 characters.

D. Set the minimum length for passwords to be 10 characters.