Professional-Cloud-Security-Engineer試験無料問題集「Google Cloud Certified - Professional Cloud Security Engineer 認定」

A. Create a Cloud Identity password policy with strong password settings, and configure 2-Step Verification with security keys in the Google Admin console.

B. Create an Active Directory domain password policy with strong password settings, and configure post-SSO (single sign-on) 2-Step Verification with verification codes via text or phone call in the Google Admin console.

C. Create an Active Directory domain password policy with strong password settings, and configure post-SSO (single sign-on) 2-Step Verification with security keys in the Google Admin console.

D. Create a Cloud Identity password policy with strong password settings, and configure 2-Step Verification with verification codes via text or phone call in the Google Admin console.

A. Deploy a Cloud NAT Gateway in the host (VPC) project for the MIG.

B. Deploy an external HTTP(S) load balancer in the service project with the MIG as a backend.

C. Deploy a Cloud NAT Gateway in the service project for the MIG.

D. Deploy an external HTTP(S) load balancer in the host (VPC) project with the MIG as a backend.

A. BigQuery using a data pipeline job with continuous updates

B. Compute Engine Virtual Machines using Persistent Disk

C. Cloud Storage using a scheduled task and gsutil

D. Cloud Datastore using regularly scheduled batch upload jobs

A. Create a dedicated Cloud Identity user account for the cluster. Use a strong self-hosted vault solution to store the user's temporary credentials.

B. Create a custom service account for the cluster Enable the constraints/iam.allowServiceAccountCredentialLifetimeExtension organization policy at the project level.

C. Create a custom service account for the cluster Enable the
constraints/iam.disableServiceAccountKeyCreation organization policy at the project level.

D. Create a dedicated Cloud Identity user account for the cluster. Enable the constraints/iam.disableServiceAccountCreation organization policy at the project level.

A. Ability to share specific subnets across peered networks

B. Firewall rules that can be created with a tag from one peered network to another peered network

C. Non-transitive peered networks; where only directly peered networks can communicate

D. Central management of routes, firewalls, and VPNs for peered networks

E. Ability to peer networks that belong to different Google Cloud Platform organizations

A. Change the app instance-to-instance communications from UDP to TCP and enable BoringSSL on clients' TLS connections.

B. Encrypt all cache storage and VM-to-VM communication using the BoringCrypto module.

C. Set Disk Encryption on the Instance Template used by the MIG to Google-managed Key and use BoringSSL library on all instance-to-instance communications.

D. Set Disk Encryption on the Instance Template used by the MIG to customer-managed key and use BoringSSL for all data transit between instances.

A. In Resource Manager, edit the project permissions for the trusted project. Add the organization as member with the role: Compute Image User.

B. Use the Organization Policy Service to create a compute.trustedimageProjects constraint on the organization level. List the trusted project as the whitelist in an allow operation.

C. Use the Organization Policy Service to create a compute.trustedimageProjects constraint on the organization level. List the trusted projects as the exceptions in a deny operation.

D. In Resource Manager, edit the organization permissions. Add the project ID as member with the role:Compute Image User.

A. A strict password policy

B. Captcha on login pages

C. Encrypted emails

D. Multifactor Authentication

A. Generalization

B. CryptoReplaceFfxFpeConfig

C. Redaction

D. CryptoHashConfig

A. Enable Firewall Rules Logging on the latest rules that were changed. Use Logs Explorer to analyze whether the rules are working correctly.

B. Connect to a bastion host in your VPC. Use a network traffic analyzer to determine at which point your requests are being blocked.

C. Enable VPC Flow Logs in your VPC. Use Logs Explorer to analyze whether the rules are working correctly.

D. In a pre-production environment, disable all firewall rules individually to determine which one is blocking user traffic.

A. Assign the Project Viewer Identity and Access Management (1AM) role to the DevOps team.

B. Create a custom 1AM role with limited list/view permissions, and assign it to the DevOps team.

C. Create a service account, and grant it limited list/view permissions. Give the Service Account User Role on this service account to the DevOps team.

D. Create a service account, and grant it the Project Owner 1AM role. Give the Service Account User Role on this service account to the DevOps team.

A. Configure server instances with public IP addresses Create a firewall rule to only allow traffic from yourcorporate IPs.

B. Create a jump host instance with public IP Manage the instances by connecting through the jump host.

C. Create a site-to-site VPN from your corporate network to Google Cloud.

D. Create a firewall rule to allow access from the Identity-Aware Proxy (IAP) IP range Grant the role of an IAP-secured Tunnel User to the administrators.

A. Configure a Cloud VPN connection between your organization's VPC network and the third party's that is controlled by VPC firewall rules.

B. Configure an Apigee proxy that exposes your Compute Engine-hosted application as an API, and is encrypted with TLS which allows access only to the third party.

C. Configure a VPC peering connection between your organization's VPC network and the third party's that is controlled by VPC firewall rules.

D. Configure a VPC Service Controls perimeter around your Compute Engine instances, and provide access to the third party via an access level.