File Info
| Exam | Professional Cloud Security Engineer |
| Number | Professional-Cloud-Security-Engineer |
| File Name | Google.Professional-Cloud-Security-Engineer.VCEplus.2024-08-23.140q.tqb |
| Size | 747 KB |
| Posted | Aug 23, 2024 |
| Download | Google.Professional-Cloud-Security-Engineer.VCEplus.2024-08-23.140q.tqb |
How to open VCEX & EXAM Files?
Files with VCEX & EXAM extensions can be opened by ProfExam Simulator.
Coupon: MASTEREXAM
With discount: 20%
Demo Questions
Question 1
A customer needs to launch a 3-tier internal web application on Google Cloud Platform (GCP). The customer's internal compliance requirements dictate that end-user access may only be allowed if the traffic seems to originate from a specific known good CIDR. The customer accepts the risk that their application will only have SYN flood DDoS protection. They want to use GCP's native SYN flood protection.
Which product should be used to meet these requirements?
- Cloud Armor
- VPC Firewall Rules
- Cloud Identity and Access Management
- Cloud CDN
Correct answer: A
Question 2
A company is running workloads in a dedicated server room. They must only be accessed from within the private company network. You need to connect to these workloads from Compute Engine instances within a Google Cloud Platform project.
Which two approaches can you take to meet the requirements? (Choose two.)
- Configure the project with Cloud VPN.
- Configure the project with Shared VPC.
- Configure the project with Cloud Interconnect.
- Configure the project with VPC peering.
- Configure all Compute Engine instances with Private Access.
Correct answer: AC
Explanation:
A) IPsec VPN tunels: https://cloud.google.com/network-connectivity/docs/vpn/concepts/overviewInterconnect https://cloud.google.com/network-connectivity/docs/interconnect/concepts/dedicated-overview A) IPsec VPN tunels: https://cloud.google.com/network-connectivity/docs/vpn/concepts/overview
Interconnect https://cloud.google.com/network-connectivity/docs/interconnect/concepts/dedicated-overview
Question 3
A customer implements Cloud Identity-Aware Proxy for their ERP system hosted on Compute Engine. Their security team wants to add a security layer so that the ERP systems only accept traffic from Cloud Identity- Aware Proxy.
What should the customer do to meet these requirements?
- Make sure that the ERP system can validate the JWT assertion in the HTTP requests.
- Make sure that the ERP system can validate the identity headers in the HTTP requests.
- Make sure that the ERP system can validate the x-forwarded-for headers in the HTTP requests.
- Make sure that the ERP system can validate the user's unique identifier headers in the HTTP requests.
Correct answer: A
Explanation:
Use Cryptographic Verification If there is a risk of IAP being turned off or bypassed, your app can check to make sure the identity information it receives is valid. This uses a third web request header added by IAP, called X-Goog-IAP-JWT-Assertion. The value of the header is a cryptographically signed object that also contains the user identity data. Your application can verify the digital signature and use the data provided in this object to be certain that it was provided by IAP without alteration. Use Cryptographic Verification If there is a risk of IAP being turned off or bypassed, your app can check to make sure the identity information it receives is valid. This uses a third web request header added by IAP, called X-Goog-IAP-JWT-Assertion. The value of the header is a cryptographically signed object that also contains the user identity data. Your application can verify the digital signature and use the data provided in this object to be certain that it was provided by IAP without alteration.
