Skip to main content
ITPrepCerts
Login
Exams Free Samples About Contact
Login Create an account

Professional-Cloud-Security-Engineer Professional Cloud Security Engineer

  • Google
  • 5 free sample questions

About this exam

Professional-Cloud-Security-Engineer is the Google exam Professional Cloud Security Engineer. Paid practice material for this exam is not available yet, but you can try its free sample questions.

Exam code
Professional-Cloud-Security-Engineer
Vendor
Google
Practice questions
Not available yet
Free sample questions
5
Question bank last updated
Not available yet

Try 2 sample questions

Taken from the free sample set for Professional-Cloud-Security-Engineer.

Question 1 (choose 2)

Your company’s new CEO recently sold two of the company’s divisions. Your Director asks you to help migrate the Google Cloud projects associated with those divisions to a new organization node. Which preparation steps are necessary before this migration occurs? (Choose two.)

  1. Option A:

    Remove all project-level custom Identity and Access Management (1AM) roles.

  2. Option B:

    Disallow inheritance of organization policies.

  3. Option C:

    Identify inherited Identity and Access Management (1AM) roles on projects to be migrated.

  4. Option D:

    Create a new folder for all projects to be migrated.

  5. Option E:

    Remove the specific migration projects from any VPC Service Controls perimeters and bridges.

Show answer and explanation

Correct answer: C, E

To prepare for migrating Google Cloud projects to a new organization node, it ' s crucial to ensure that the projects ' current configurations and dependencies are appropriately managed. The two necessary preparation steps are:

Identify inherited Identity and Access Management (IAM) roles on projects to be migrated (C):

Projects inherit IAM roles from their parent resources. Identifying these roles is essential to understand the permissions and access levels that users have on the projects. This will help in ensuring that after migration, the appropriate roles and permissions are applied correctly.

Remove the specific migration projects from any VPC Service Controls perimeters and bridges (E):

VPC Service Controls provide security boundaries around your Google Cloud resources to mitigate data exfiltration risks. Before migrating the projects, they need to be removed from any existing VPC Service Controls perimeters and bridges to prevent any disruption in access or network communication. After migration, the projects can be added back to the necessary perimeters.

References

Google Cloud IAM documentation

VPC Service Controls documentation

Question 2

You manage one of your organization ' s Google Cloud projects (Project A). AVPC Service Control (SC) perimeter is blocking API access requests to this project including Pub/Sub. A resource running under a service account in another project (Project B) needs to collect messages from a Pub/Sub topic in your project Project B is not included in a VPC SC perimeter. You need to provide access from Project B to the Pub/Sub topic in Project A using the principle of least

Privilege.

What should you do?

  1. Option A:

    Configure an ingress policy for the perimeter in Project A and allow access for the service account in Project B to collect messages.

  2. Option B:

    Create an access level that allows a developer in Project B to subscribe to the Pub/Sub topic that is located in Project A.

  3. Option C:

    Create a perimeter bridge between Project A and Project B to allow the required communication between both projects.

  4. Option D:

    Remove the Pub/Sub API from the list of restricted services in the perimeter configuration for Project A.

Show answer and explanation

Correct answer: A

When dealing with VPC Service Controls (VPC SC), it ' s important to ensure that only authorized resources can access sensitive data and services. To allow a resource in Project B to access Pub/Sub in Project A without compromising security, you should configure an ingress policy for the service perimeter in Project A.

Identify the Service Account: Determine the service account in Project B that requires access to the Pub/Sub topic in Project A.

Configure Ingress Policy:

Go to the Google Cloud Console.

Navigate to Security > VPC Service Controls.

Select the service perimeter for Project A.

Add an ingress rule specifying the service account from Project B and allowing it access to the necessary Pub/Sub resources.

Define Conditions: Ensure that the ingress policy adheres to the principle of least privilege, granting only the necessary permissions to collect messages from the Pub/Sub topic.

Save and Apply: Save the policy and apply the changes to enforce the new access controls.

This approach maintains the security boundaries set by VPC SC while enabling the required access from Project B to Project A.

VPC Service Controls Documentation

Configuring Ingress Policies

See all 5 free sample questions