Prepare Smarter for the Professional-Cloud-Security-Engineer Exam
Build your exam confidence with flexible preparation resources designed around the latest Professional-Cloud-Security-Engineer exam objectives. Practice at your own pace using PDF questions, online exam simulations, or desktop practice software.
Your company’s new CEO recently sold two of the company’s divisions. Your Director asks you to help migrate the Google Cloud projects associated with those divisions to a new organization node. Which preparation steps are necessary before this migration occurs? (Choose two.)
Correct Answer: C, E
To prepare for migrating Google Cloud projects to a new organization node, it ' s crucial to ensure that the projects ' current configurations and dependencies are appropriately managed. The two necessary preparation steps are:
Identify inherited Identity and Access Management (IAM) roles on projects to be migrated (C):
Projects inherit IAM roles from their parent resources. Identifying these roles is essential to understand the permissions and access levels that users have on the projects. This will help in ensuring that after migration, the appropriate roles and permissions are applied correctly.
Remove the specific migration projects from any VPC Service Controls perimeters and bridges (E):
VPC Service Controls provide security boundaries around your Google Cloud resources to mitigate data exfiltration risks. Before migrating the projects, they need to be removed from any existing VPC Service Controls perimeters and bridges to prevent any disruption in access or network communication. After migration, the projects can be added back to the necessary perimeters.
References
Google Cloud IAM documentation
VPC Service Controls documentation
You manage one of your organization ' s Google Cloud projects (Project A). AVPC Service Control (SC) perimeter is blocking API access requests to this project including Pub/Sub. A resource running under a service account in another project (Project B) needs to collect messages from a Pub/Sub topic in your project Project B is not included in a VPC SC perimeter. You need to provide access from Project B to the Pub/Sub topic in Project A using the principle of least
Privilege.
What should you do?
Correct Answer: A
When dealing with VPC Service Controls (VPC SC), it ' s important to ensure that only authorized resources can access sensitive data and services. To allow a resource in Project B to access Pub/Sub in Project A without compromising security, you should configure an ingress policy for the service perimeter in Project A.
Identify the Service Account: Determine the service account in Project B that requires access to the Pub/Sub topic in Project A.
Configure Ingress Policy:
Go to the Google Cloud Console.
Navigate to Security > VPC Service Controls.
Select the service perimeter for Project A.
Add an ingress rule specifying the service account from Project B and allowing it access to the necessary Pub/Sub resources.
Define Conditions: Ensure that the ingress policy adheres to the principle of least privilege, granting only the necessary permissions to collect messages from the Pub/Sub topic.
Save and Apply: Save the policy and apply the changes to enforce the new access controls.
This approach maintains the security boundaries set by VPC SC while enabling the required access from Project B to Project A.
VPC Service Controls Documentation
Configuring Ingress Policies
You have stored company approved compute images in a single Google Cloud project that is used as an image repository. This project is protected with VPC Service Controls and exists in the perimeter along with other projects in your organization. This lets other projects deploy images from the image repository project. A team requires deploying a third-party disk image that is stored in an external Google Cloud organization. You need to grant read access to the disk image so that it can be deployed into the perimeter.
What should you do?
Correct Answer: A
To grant read access to a third-party disk image stored in an external Google Cloud organization so it can be deployed into a VPC Service Controls perimeter, you need to update the service perimeter to allow egress traffic from your projects to the external project.
Update the Service Perimeter:
Go to the Google Cloud Console, navigate to Security > VPC Service Controls.
Select the appropriate service perimeter that includes your image repository project.
Configure Egress Policy:
Within the perimeter settings, configure the egressTo field to allow traffic to the external project.
Set the identityType to ANY_IDENTITY to permit any principal to access the external project for this specific egress rule.
Specify External Project and Service:
In the egressFrom field, include the external Google Cloud project number as an allowed resource.
Set the serviceName to compute.googleapis.com to specifically allow access to the Compute Engine service in the external project.
This configuration permits your internal projects to read the disk image from the external project while maintaining the security boundaries established by the service perimeter.
VPC Service Controls Documentation
Configuring Service Perimeters
You want to set up a secure, internal network within Google Cloud for database servers. The servers must not have any direct communication with the public internet. What should you do?
Correct Answer: B
To ensure servers do not have any direct communication with the public internet, they must be configured without a public IP address.
VPC and Private Subnet: A Virtual Private Cloud (VPC) network provides the isolated, internal network structure. A subnet is the logical partition within the VPC.
Private IP Address: Assigning only a private IP address to the database servers ensures they can only communicate internally within the VPC (or connected on-premises networks) and cannot directly connect to or be connected from the public internet.
Extracts:
" Resources in a VPC network can be assigned two types of IP addresses: internal (private) and external (public). If a VM is not assigned an external IP address, it can only communicate internally with other resources in the VPC network... " (Source 6.1)
Option A and C involve assigning a public IP address, which violates the " no direct communication with the public internet " rule. Option D uses NAT to provide outbound internet connectivity, which also violates the requirement.
Your company conducts clinical trials and needs to analyze the results of a recent study that are stored in BigQuery. The interval when the medicine was taken contains start and stop dates The interval data is critical to the analysis, but specific dates may identify a particular batch and introduce bias You need to obfuscate the start and end dates for each row and preserve the interval data.
What should you do?
Correct Answer: A
" Date shifting techniques randomly shift a set of dates but preserve the sequence and duration of a period of time. Shifting dates is usually done in context to an individual or an entity. That is, each individual ' s dates are shifted by an amount of time that is unique to that individual. "