Professional-Cloud-Security-Engineer試験無料問題集「Google Cloud Certified - Professional Cloud Security Engineer 認定」

A. SSL Proxy

B. TCP/UDP Network

C. Internal TCP/UDP

D. TCP Proxy

A. Create an egress firewall rule to allow traffic to the hostname of the repository with a priority less than
1000.

B. Create an egress firewall rule to allow traffic to the CIDR range of the repository with a priority greater than 1000.

C. Create an egress firewall rule to allow traffic to the hostname of the repository with a priority greater than 1000.

D. Create an egress firewall rule to allow traffic to the CIDR range of the repository with a priority less than 1000.

A. Use Identity and Access Management (IAM) roles at the project level within the storage team's project.Grant the storage team granular permissions on the project's Cloud Storage resources.

B. Use Context-Aware Access. Create an access level that defines the required context. Apply it as an organization policy specifically at the project level, restricting access to Cloud Storage based on that context.

C. Implement VPC Service Controls by establishing an organization-wide service perimeter with all projects. Configure ingress and egress rules to restrict access to Cloud Storage based on IP address ranges.

D. Employ organization-level firewall rules to block all traffic to Cloud Storage. Create exceptions for specific service accounts used by the storage team within their project.

A. Configure a Cloud VPN connection between your organization's VPC network and the third party's that is controlled by VPC firewall rules.

B. Configure an Apigee proxy that exposes your Compute Engine-hosted application as an API, and is encrypted with TLS which allows access only to the third party.

C. Configure a VPC peering connection between your organization's VPC network and the third party's that is controlled by VPC firewall rules.

D. Configure a VPC Service Controls perimeter around your Compute Engine instances, and provide access to the third party via an access level.

A. Audit user activity for suspicious logins by using the audit and investigation tool.

B. Conduct a security awareness training session, and set the password expiration settings to require more frequent updates.

C. Check the Enforce strong password box, and check Enforce password policy at the next sign-in.

D. Check the Enforce strong password box, and set the password expiration to occur more frequently.

A. 1. Set up a Cloud VPN link between the on-premises environment and Google Cloud.2. Configure private access using the restricted googleapis.com domains in on-premises DNS configurations.

B. 1. Set up a Direct Peering link between the on-premises environment and Google Cloud.2. Configure private access for both VPC subnets.

C. 1. Set up a Partner Interconnect link between the on-premises environment and Google Cloud.2.
Configure private access using the private.googleapis.com domains in on-premises DNS configurations.

D. 1. Set up a Dedicated Interconnect link between the on-premises environment and Google Cloud.2.Configure private access using the restricted.googleapis.com domains in on-premises DNS configurations.

A. Set up a workload identity pool with an OpenID Connect (OIDC) service on the name machine Configure a rule to let principals in the pool impersonate the Google Cloud service account.

B. Set up a workload identity pool with your corporate Active Directory Federation Service (ADFS) Let all principals in the pool impersonate the Google Cloud service account.

C. Set up a workload identity pool with an OpenID Connect (OIDC) service on the same machine Let all principals in the pool impersonate the Google Cloud service account.

D. Set up a workload identity pool with your corporate Active Directory Federation Service (ADFS) Configure a rule to let principals in the pool impersonate the Google Cloud service account.

A. Give the Service Account the role of Compute Viewer, and use the new Service Account for all instances.

B. Give the Service Account the role of Project Viewer, and use the new Service Account for all instances.

C. Create a custom role with the permission compute.instances.list and grant the Service Account this role.

D. Create an Instance Template, and allow the Service Account Read Only access for the Compute Engine Access Scope.

A. * 1 Create service accounts for each deployment pipeline* 2 Generate private keys for the service accounts* 3 Securely store the private keys as Kubernetes secrets accessible only by the pods that run the specific deploy pipeline

B. * 1 Create individual service accounts (or each deployment pipeline* 2 Add an identifier for the pipeline in the service account naming convention* 3 Ensure each pipeline runs on dedicated pods* 4 Use workload identity to map a deployment pipeline pod with a service account

C. * 1 Create a dedicated service account for the CI/CD pipelines* 2 Run the deployment pipelines in a dedicated nodes pool in the GKE cluster* 3 Use the service account that you created as identity for the nodes in the pool to authenticate to the Google Cloud APIs

D. * 1 Create two service accounts one for the infrastructure and one for the application deployment* 2 Use workload identities to let the pods run the two pipelines and authenticate with the service accounts* 3 Run the infrastructure and application pipelines in separate namespaces

A. 1. Configure all running Web and App servers with respective network tags.2. Create an allow VPC firewall rule that specifies the target/source with respective network tags.

B. 1. Re-deploy the Web and App servers with instance templates configured with respective service accounts.2. Create an allow VPC firewall rule that specifies the target/source with respective service accounts.

C. 1. Re-deploy the Web and App servers with instance templates configured with respective network tags.
2. Create an allow VPC firewall rule that specifies the target/source with respective network tags.

D. 1. Configure all running Web and App servers with respective service accounts.2. Create an allow VPC firewall rule that specifies the target/source with respective service accounts.