Google Professional-Cloud-Security-Engineer 問題集

質問 1：
Your organization has had a few recent DDoS attacks. You need to authenticate responses to domain name lookups. Which Google Cloud service should you use?
A. Cloud DNS with DNSSEC
B. Google Cloud Armor
C. HTTP(S) Load Balancing
D. Cloud NAT
正解：A

質問 2：
Your company is concerned about unauthorized parties gaming access to the Google Cloud environment by using a fake login page. You must implement a solution to protect against person-in-the-middle attacks.
Which security measure should you use?
A. Security key
B. Google Authenticator application
C. Google prompt
D. Text message or phone call code
正解：A
解説: (Topexam メンバーにのみ表示されます)

質問 3：
You want to use the gcloud command-line tool to authenticate using a third-party single sign-on (SSO) SAML identity provider. Which options are necessary to ensure that authentication is supported by the third-party identity provider (IdP)? (Choose two.)
A. SSO SAML as a third-party IdP
B. Identity-Aware Proxy
C. Cloud Identity
D. OpenID Connect
E. Identity Platform
正解：A,D
解説: (Topexam メンバーにのみ表示されます)

質問 4：
An employer wants to track how bonus compensations have changed over time to identify employee outliers and correct earning disparities. This task must be performed without exposing the sensitive compensation data for any individual and must be reversible to identify the outlier.
Which Cloud Data Loss Prevention API technique should you use to accomplish this?
A. CryptoReplaceFfxFpeConfig
B. Generalization
C. CryptoHashConfig
D. Redaction
正解：A
解説: (Topexam メンバーにのみ表示されます)

質問 5：
Your organization s record data exists in Cloud Storage. You must retain all record data for at least seven years This policy must be permanent.
What should you do?
A. *1 Identify buckets with record data
*2 Apply a retention policy and set it to retain for seven years
*3 Monitor the bucket by using log-based alerts to ensure that no modifications to the retention policy occurs
B. * 1 Identify buckets with record data
*2 Apply a retention policy and set it to retain for seven years
*3 Enable bucket lock
C. *1 Identify buckets with record data
*2 Enable the bucket policy only to ensure that data is retained
*3 Enable bucket lock
D. *1 Identify buckets with record data
*2 Apply a retention policy and set it to retain for seven years
*3 Remove any Identity and Access Management (IAM) roles that contain the storage buckets update permission
正解：B

質問 6：
An organization is migrating from their current on-premises productivity software systems to G Suite. Some network security controls were in place that were mandated by a regulatory body in their region for their previous on-premises system. The organization's risk team wants to ensure that network security controls are maintained and effective in G Suite. A security architect supporting this migration has been asked to ensure that network security controls are in place as part of the new shared responsibility model between the organization and Google Cloud.
What solution would help meet the requirements?
A. Set up an array of Virtual Private Cloud (VPC) networks to control network security as mandated by the relevant regulation.
B. Ensure that firewall rules are in place to meet the required controls.
C. Network security is a built-in solution and Google's Cloud responsibility for SaaS products like G Suite.
D. Set up Cloud Armor to ensure that network security controls can be managed for G Suite.
正解：C
解説: (Topexam メンバーにのみ表示されます)

質問 7：
An organization is evaluating the use of Google Cloud Platform (GCP) for certain IT workloads. A well- established directory service is used to manage user identities and lifecycle management. This directory service must continue for the organization to use as the "source of truth" directory for identities.
Which solution meets the organization's requirements?
A. Security Assertion Markup Language (SAML)
B. Cloud Identity
C. Google Cloud Directory Sync (GCDS)
D. Pub/Sub
正解：C
解説: (Topexam メンバーにのみ表示されます)

質問 8：
A customer terminates an engineer and needs to make sure the engineer's Google account is automatically deprovisioned.
What should the customer do?
A. Configure Cloud Directory Sync with their directory service to remove their IAM permissions in Cloud Identity.
B. Configure Cloud Directory Sync with their directory service to provision and deprovision users from Cloud Identity.
C. Use the Cloud SDK with their directory service to provision and deprovision users from Cloud Identity.
D. Use the Cloud SDK with their directory service to remove their IAM permissions in Cloud Identity.
正解：B
解説: (Topexam メンバーにのみ表示されます)

質問 9：
Your company is storing sensitive data in Cloud Storage. You want a key generated on-premises to be used in the encryption process.
What should you do?
A. Use customer-supplied encryption keys to manage the data encryption key (DEK).
B. Use the Cloud Key Management Service to manage a data encryption key (DEK).
C. Use the Cloud Key Management Service to manage a key encryption key (KEK).
D. Use customer-supplied encryption keys to manage the key encryption key (KEK).
正解：A
解説: (Topexam メンバーにのみ表示されます)