[Q91-Q115] Google Professional-Cloud-Security-Engineer認証された練習解答、必ずあなたを試験合格させる！[2026]

Google Professional-Cloud-Security-Engineer認証された練習解答、必ずあなたを試験合格させる！[2026]

有効な合格方法Google Cloud CertifiedのProfessional-Cloud-Security-Engineer試験問題集

Google Professional-Cloud-Security-Enginer認定試験では、セキュリティ管理、データ保護、アイデンティティとアクセス管理、コンプライアンスと規制、インシデント管理など、クラウドセキュリティに関連するさまざまなトピックを対象としています。この認定試験は、Google Cloud Platform（GCP）と協力し、組織が安全で準拠したクラウド環境を維持できるようにしたい専門家に最適です。

質問 # 91
You are designing a new governance model for your organization's secrets that are stored in Secret Manager.
Currently, secrets for Production and Non-Production applications are stored and accessed using service accounts. Your proposed solution must:
Provide granular access to secrets
Give you control over the rotation schedules for the encryption keys that wrap your secrets Maintain environment separation Provide ease of management Which approach should you take?

A. 1. Use separate Google Cloud projects to store Production and Non-Production secrets.
2. Enforce access control to secrets using project-level identity and Access Management (IAM) bindings.
3. Use customer-managed encryption keys to encrypt secrets.
B. 1. Use separate Google Cloud projects to store Production and Non-Production secrets.
2. Enforce access control to secrets using secret-level Identity and Access Management (IAM) bindings.
3. Use Google-managed encryption keys to encrypt secrets.
C. 1. Use a single Google Cloud project to store both Production and Non-Production secrets.
2. Enforce access control to secrets using project-level Identity and Access Management (IAM) bindings.
3. Use customer-managed encryption keys to encrypt secrets.
D. 1. Use a single Google Cloud project to store both Production and Non-Production secrets.
2. Enforce access control to secrets using secret-level Identity and Access Management (IAM) bindings.
3. Use Google-managed encryption keys to encrypt secrets.

正解：A

解説：
Explanation
Provide granular access to secrets: 2.Enforce access control to secrets using project-level identity and Access Management (IAM) bindings. Give you control over the rotation schedules for the encryption keys that wrap your secrets: 3. Use customer-managed encryption keys to encrypt secrets. Maintain environment separation:
1. Use separate Google Cloud projects to store Production and Non-Production secrets.

質問 # 92
Your company plans to move most of its IT infrastructure to Google Cloud. They want to leverage their existing on-premises Active Directory as an identity provider for Google Cloud. Which two steps should you take to integrate the company's on-premises Active Directory with Google Cloud and configure access management? (Choose two.)

A. Use Cloud Identity SAML integration to provision users and groups to Google Cloud.
B. Use Identity Platform to provision users and groups to Google Cloud.
C. Install Google Cloud Directory Sync and connect it to Active Directory and Cloud Identity.
D. Create Identity and Access Management (1AM) roles with permissions corresponding to each Active Directory group.
E. Create Identity and Access Management (1AM) groups with permissions corresponding to each Active Directory group.

正解：C、E

解説：
https://cloud.google.com/architecture/identity/federating-gcp-with-active-directory-synchronizing-user-accounts?hl=en
https://cloud.google.com/architecture/identity/federating-gcp-with-active-directory-synchronizing-user-accounts?hl=en#deciding_where_to_deploy_gcds

質問 # 93
You are in charge of migrating a legacy application from your company datacenters to GCP before the current maintenance contract expires. You do not know what ports the application is using and no documentation is available for you to check. You want to complete the migration without putting your environment at risk.
What should you do?

A. Refactor the application into a micro-services architecture hosted in Cloud Functions in an isolated project. Disable all traffic from outside your project using Firewall Rules. Use VPC Flow logs to determine what traffic should be allowed for the application to work properly.
B. Refactor the application into a micro-services architecture in a GKE cluster. Disable all traffic from outside the cluster using Firewall Rules. Use VPC Flow logs to determine what traffic should be allowed for the application to work properly.
C. Migrate the application into an isolated project using a "Lift & Shift" approach in a custom network. Disable all traffic within the VPC and look at the Firewall logs to determine what traffic should be allowed for the application to work properly.
D. Migrate the application into an isolated project using a "Lift & Shift" approach. Enable all internal TCP traffic using VPC Firewall rules. Use VPC Flow logs to determine what traffic should be allowed for the application to work properly.

正解：B

質問 # 94
Your organization deploys a large number of containerized applications on Google Kubernetes Engine (GKE). Node updates are currently applied manually. Audit findings show that a critical patch has not been installed due to a missed notification. You need to design a more reliable, cloud-first, and scalable process for node updates. What should you do?

A. Configure node auto-upgrades for node pools in the maintenance windows.
B. Schedule a daily reboot for all nodes to automatically upgrade.
C. Migrate the cluster infrastructure to a self-managed Kubernetes environment for greater control over the patching process.
D. Develop a custom script to continuously check for patch availability, download patches, and apply the patches across all components of the cluster.

正解：A

解説：
To establish a reliable, cloud-native, and scalable process for updating nodes in your GKE clusters, configuring node auto-upgrades within designated maintenance windows is the most effective approach.
Option A: Migrating to a self-managed Kubernetes environment would increase operational overhead and complexity, as your team would be responsible for managing the entire infrastructure, including patching and updates. This contradicts the goal of adopting a cloud-first strategy and does not inherently provide a more reliable update process.
Option B: Developing custom scripts for patch management introduces potential risks and maintenance burdens. Ensuring the reliability, security, and scalability of such scripts can be challenging, and this approach may not align with best practices for managing GKE environments.
Option C: Scheduling daily reboots does not guarantee that nodes will apply the latest patches or updates. Without a mechanism to manage and apply updates, reboots alone are insufficient to maintain node security and compliance.
Option D: Configuring node auto-upgrades ensures that GKE automatically keeps your nodes up-to-date with the latest stable versions, reducing the risk of missed critical patches. By setting maintenance windows, you can control when these upgrades occur, minimizing disruptions to your workloads. This approach leverages GKE's managed services to maintain security and compliance efficiently.
Therefore, Option D is the optimal solution, as it aligns with a cloud-first strategy and leverages GKE's native capabilities to automate and schedule node updates effectively.
Reference:
Auto-upgrading nodes | Google Kubernetes Engine (GKE)
Maintenance windows and exclusions | Google Kubernetes Engine

質問 # 95
You work for a healthcare provider that is expanding into the cloud to store and process sensitive patient data. You must ensure the chosen Google Cloud configuration meets these strict regulatory requirements:
- Data must reside within specific geographic regions.
- Certain administrative actions on patient data require explicit
approval from designated compliance officers.
- Access to patient data must be auditable.
What should you do?

A. Select a standard Google Cloud region. Restrict access to patient data based on user location and job function by using Access Context Manager. Enable both Cloud Audit Logging and Access Transparency.
B. Deploy an Assured Workloads environment in multiple regions for redundancy. Utilize custom IAM roles with granular permissions. Isolate network-level data by using VPC Service Controls.
C. Select multiple standard Google Cloud regions for high availability. Implement Access Control Lists (ACLs) on individual storage objects containing patient data. Enable Cloud Audit Logs.
D. Deploy an Assured Workloads environment in an approved region. Configure Access Approval for sensitive operations on patient data. Enable both Cloud Audit Logs and Access Transparency.

正解：D

解説：
https://cloud.google.com/assured-workloads/docs/overview

質問 # 96
Your company's new CEO recently sold two of the company's divisions. Your Director asks you to help migrate the Google Cloud projects associated with those divisions to a new organization node. Which preparation steps are necessary before this migration occurs? (Choose two.)

A. Remove the specific migration projects from any VPC Service Controls perimeters and bridges.
B. Disallow inheritance of organization policies.
C. Create a new folder for all projects to be migrated.
D. Remove all project-level custom Identity and Access Management (1AM) roles.
E. Identify inherited Identity and Access Management (1AM) roles on projects to be migrated.

正解：C、E

解説：
Explanation
https://cloud.google.com/resource-manager/docs/project-migration#plan_policy When you migrate your project, it will no longer inherit the policies from its current place in the resource hierarchy, and will be subject to the effective policy evaluation at its destination. We recommend making sure that the effective policies at the project's destination match as much as possible the policies that the project had in its source location.
https://cloud.google.com/resource-manager/docs/project-migration#import_export_folders Policy inheritance can cause unintended effects when you are migrating a project, both in the source and destination organization resources. You can mitigate this risk by creating specific folders to hold only projects for export and import, and ensuring that the same policies are inherited by the folders in both organization resources. You can also set permissions on these folders that will be inherited to the projects moved within them, helping to accelerate the project migration process.

質問 # 97
You want to update your existing VPC Service Controls perimeter with a new access level. You need to avoid breaking the existing perimeter with this change, and ensure the least disruptions to users while minimizing overhead. What should you do?

A. Update your perimeter with a new access level that never matches. Update the new access level to match your desired state one condition at a time to avoid being overly permissive.
B. Create an exact replica of your existing perimeter. Add your new access level to the replica. Update the original perimeter after the access level has been vetted.
C. Enable the dry run mode on your perimeter. Add your new access level to the perimeter dry run configuration. Update the perimeter configuration after the access level has been vetted.
D. Enable the dry run mode on your perimeter. Add your new access level to the perimeter configuration.
Update the perimeter configuration after the access level has been vetted.

正解：C

解説：
* Enable Dry Run Mode: Start by enabling the dry run mode for your VPC Service Controls perimeter.
This mode allows you to test changes without actually enforcing them, thus preventing any disruption to your current setup.
* Add Access Level: Add your new access level to the dry run configuration. This way, you can monitor how the new access level would behave and interact with your existing setup without any real impact.
* Vetting Process: Carefully vet the new access level by analyzing logs and monitoring the behavior in the dry run mode. Ensure that the new configuration meets your security and operational requirements.
* Update Perimeter: Once you are confident that the new access level will not disrupt existing services and meets all requirements, update the actual perimeter configuration with the new access level. This approach minimizes risk by allowing you to test changes before they take effect, ensuring seamless updates with minimal disruption. References:
* Google Cloud - Configuring VPC Service Controls
* Google Cloud - Using Dry Run Mode

質問 # 98
An organization's typical network and security review consists of analyzing application transit routes, request handling, and firewall rules. They want to enable their developer teams to deploy new applications without the overhead of this full review.
How should you advise this organization?

A. All production applications will run on-premises. Allow developers free rein in GCP as their dev and QA platforms.
B. Route all VPC traffic through customer-managed routers to detect malicious patterns in production.
C. Mandate use of infrastructure as code and provide static analysis in the CI/CD pipelines to enforce policies.
D. Use Forseti with Firewall filters to catch any unwanted configurations in production.

正解：C

解説：
Explanation
https://cloud.google.com/recommender/docs/tutorial-iac

質問 # 99
You are creating a new infrastructure CI/CD pipeline to deploy hundreds of ephemeral projects in your Google Cloud organization to enable your users to interact with Google Cloud. You want to restrict theuse of the default networks in your organization while following Google-recommended best practices. What should you do?

A. Enable theconstraints/compute.skipDefaultNetworkCreationorganization policy constraint at the organization level.
B. Grant your users the 1AM Owner role at the organization level. Create a VPC Service Controls perimeter around the project that restricts thecompute.googleapis.comAPI.
C. Create a cron job to trigger a daily Cloud Function to automatically delete all default networks for each project.
D. Only allow your users to use your CI/CD pipeline with a predefined set of infrastructure templates they can deploy to skip the creation of the default networks.

正解：A

解説：
Explanation
Enable the constraints/compute.skipDefaultNetworkCreation organization policy constraint at the organization level.
https://cloud.google.com/resource-manager/docs/organization-policy/org-policy-constraints - constraints/compute.skipDefaultNetworkCreation This boolean constraint skips the creation of the default network and related resources during Google Cloud Platform Project resource creation where this constraint is set to True. By default, a default network and supporting resources are automatically created when creating a Project resource.

質問 # 100
An office manager at your small startup company is responsible for matching payments to invoices and creating billing alerts. For compliance reasons, the office manager is only permitted to have the Identity and Access Management (IAM) permissions necessary for these tasks. Which two IAM roles should the office manager have? (Choose two.)

A. Billing Account Costs Manager
B. Project Creator
C. Billing Account Viewer
D. Billing Account User
E. Organization Administrator

正解：A、C

解説：
Explanation
https://cloud.google.com/billing/docs/how-to/billing-access#overview-of-cloud-billing-roles-in-cloud-iam Billing Account Costs Manager (roles/billing.costsManager)
- Manage budgets and view and export cost information of billing accounts (but not pricing information) Billing Account Viewer (roles/billing.viewer)
- View billing account cost information and transactions.

質問 # 101
You will create a new Service Account that should be able to list the Compute Engine instances in the project. You want to follow Google-recommended practices.
What should you do?

A. Give the Service Account the role of Compute Viewer, and use the new Service Account for all instances.
B. Create a custom role with the permission compute.instances.list and grant the Service Account this role.
C. Give the Service Account the role of Project Viewer, and use the new Service Account for all instances.
D. Create an Instance Template, and allow the Service Account Read Only access for the Compute Engine Access Scope.

正解：B

解説：
Objective: Create a Service Account that can list Compute Engine instances in the project following Google-recommended practices.
Solution: Create a custom role and assign it to the Service Account.
Steps:
Step 1: Open the Google Cloud Console.
Step 2: Navigate to the IAM & Admin page and select "Roles".
Step 3: Click on "Create Role" and define a new role with a suitable name and description.
Step 4: Add the permission compute.instances.list to the custom role.
Step 5: Save the custom role.
Step 6: Go to the "Service Accounts" section.
Step 7: Create a new Service Account or select an existing one.
Step 8: Assign the newly created custom role to the Service Account.
By creating a custom role with the specific permission to list Compute Engine instances, you follow the principle of least privilege, which is a recommended security practice.
Reference:
Creating and Managing Custom Roles
Best Practices for IAM

質問 # 102
A company allows every employee to use Google Cloud Platform. Each department has a Google Group, with all department members as group members. If a department member creates a new project, all members of that department should automatically have read-only access to all new project resources. Members of any other department should not have access to the project. You need to configure this behavior.
What should you do to meet these requirements?

A. Create a Project per department under the Organization. For each department's Project, assign the Project Viewer role to the Google Group related to that department.
B. Create a Project per department under the Organization. For each department's Project, assign the Project Browser role to the Google Group related to that department.
C. Create a Folder per department under the Organization. For each department's Folder, assign the Project Viewer role to the Google Group related to that department.
D. Create a Folder per department under the Organization. For each department's Folder, assign the Project Browser role to the Google Group related to that department.

正解：C

解説：
Project Browser has least permissions comparing to Project Viewer. The question is about have read-access to all new project resources.
roles/browser - Read access to browse the hierarchy for a project, including the folder, organization, and IAM policy. This role doesn't include permission to view resources in the project.
https://cloud.google.com/iam/docs/understanding-roles#project-roles

質問 # 103
You need to follow Google-recommended practices to leverage envelope encryption and encrypt data at the application layer.
What should you do?

A. Generate a new data encryption key (DEK) in Cloud KMS to encrypt the data, and generate a key encryption key (KEK) locally to encrypt the key. Store both the encrypted data and the encrypted DEK.
B. Generate a data encryption key (DEK) locally to encrypt the data, and generate a new key encryption key (KEK) in Cloud KMS to encrypt the DEK. Store both the encrypted data and the KEK.
C. Generate a data encryption key (DEK) locally to encrypt the data, and generate a new key encryption key (KEK) in Cloud KMS to encrypt the DEK. Store both the encrypted data and the encrypted DEK.
D. Generate a new data encryption key (DEK) in Cloud KMS to encrypt the data, and generate a key encryption key (KEK) locally to encrypt the key. Store both the encrypted data and the KEK.

正解：C

解説：
Explanation/Reference: https://cloud.google.com/kms/docs/envelope-encryption

質問 # 104
You are setting up a CI/CD pipeline to deploy containerized applications to your production clusters on Google Kubernetes Engine (GKE). You need to prevent containers with known vulnerabilities from being deployed. You have the following requirements for your solution:
Must be cloud-native
Must be cost-efficient
Minimize operational overhead
How should you accomplish this? (Choose two.)

A. Use a Cloud Function triggered by log events in Google Cloud's operations suite to automatically scan your container images in Container Registry.
B. Use a cron job on a Compute Engine instance to scan your existing repositories for known vulnerabilities and raise an alert if a non-compliant container image is found.
C. Deploy Jenkins on GKE and configure a CI/CD pipeline to deploy your containers to Container Registry. Add a step to validate your container images before deploying your container to the cluster.
D. Create a Cloud Build pipeline that will monitor changes to your container templates in a Cloud Source Repositories repository. Add a step to analyze Container Analysis results before allowing the build to continue.
E. In your CI/CD pipeline, add an attestation on your container image when no vulnerabilities have been found. Use a Binary Authorization policy to block deployments of containers with no attestation in your cluster.

正解：D、E

質問 # 105
Which Google Cloud service should you use to enforce access control policies for applications and resources?

A. Identity-Aware Proxy
B. Cloud NAT
C. Shielded VMs
D. Google Cloud Armor

正解：A

解説：
To enforce access control policies for applications and resources in Google Cloud, the recommended service is Identity-Aware Proxy (IAP).
Identity-Aware Proxy (IAP):
IAP allows you to control access to your applications and resources based on the identity of the user and the context of the request. It integrates with IAM to provide fine-grained access control, ensuring that only authorized users can access specific resources.
IAP helps enforce security policies at the application layer, providing an additional layer of protection beyond traditional network-based security measures.
Reference:
Identity-Aware Proxy documentation

質問 # 106
A company is running workloads in a dedicated server room. They must only be accessed from within the private company network. You need to connect to these workloads from Compute Engine instances within a Google Cloud Platform project.
Which two approaches can you take to meet the requirements? (Choose two.)

A. Configure all Compute Engine instances with Private Access.
B. Configure the project with VPC peering.
C. Configure the project with Cloud VPN.
D. Configure the project with Cloud Interconnect.
E. Configure the project with Shared VPC.

正解：C、D

解説：
To connect Compute Engine instances within a Google Cloud Platform project to workloads running in a dedicated server room that can only be accessed from within the private company network, you can use the following approaches:
Cloud VPN: Cloud VPN securely connects your on-premises network to your Google Cloud Virtual Private Cloud (VPC) network through an IPsec VPN connection. This enables secure communication between your GCP instances and your on-premises workloads over the internet.
Cloud Interconnect: Cloud Interconnect provides direct physical connections between your on-premises network and Google's network. It offers higher bandwidth and lower latency compared to Cloud VPN, making it suitable for workloads that require fast and reliable connectivity.
Both Cloud VPN and Cloud Interconnect allow you to securely connect your on-premises environments to Google Cloud, ensuring that the workloads remain within the private company network.
Reference:
Cloud VPN Overview
Cloud Interconnect Overview

質問 # 107
Applications often require access to "secrets" - small pieces of sensitive data at build or run time. The administrator managing these secrets on GCP wants to keep a track of "who did what, where, and when?" within their GCP projects.
Which two log streams would provide the information that the administrator is looking for? (Choose two.)

A. Data Access logs
B. Admin Activity logs
C. Agent logs
D. VPC Flow logs
E. System Event logs

正解：A、B

解説：
To keep track of "who did what, where, and when?" within GCP projects, the administrator should focus on Admin Activity logs and Data Access logs. Here's a detailed explanation of why these two log streams are essential:
Admin Activity Logs:
These logs capture administrative actions performed in your Google Cloud resources. This includes actions like creating, modifying, or deleting resources.
Admin Activity logs provide detailed information about the user who performed the action, the resource that was affected, the action performed, and the timestamp.
Data Access Logs:
These logs capture read and write operations on data within your Google Cloud services. This includes actions like accessing or modifying data stored in databases, storage buckets, etc.
Data Access logs help track the access patterns of users and services to sensitive data, providing insights into who accessed which data and when.
Steps to Enable and Access Logs:
Navigate to the Google Cloud Console.
Go to Logging in the left-hand menu.
Enable Admin Activity and Data Access logs if not already enabled.
Use Logs Explorer to filter and view specific logs based on your requirements.
By monitoring both Admin Activity and Data Access logs, administrators can gain comprehensive visibility into the actions performed on their GCP resources and data, ensuring robust security and compliance tracking.
Reference:
Google Cloud Logging Documentation
Audit Logs Overview

質問 # 108
A retail customer allows users to upload comments and product reviews. The customer needs to make sure the text does not include sensitive data before the comments or reviews are published.
Which Google Cloud Service should be used to achieve this?

A. Cloud Security Scanner
B. Cloud Key Management Service
C. BigQuery
D. Cloud Data Loss Prevention API

正解：A

質問 # 109
A manager wants to start retaining security event logs for 2 years while minimizing costs. You write a filter to select the appropriate log entries.
Where should you export the logs?

A. Cloud Storage buckets
B. StackDriver logging
C. Cloud Pub/Sub topics
D. BigQuery datasets

正解：B

解説：
Explanation/Reference: https://cloud.google.com/logging/docs/exclusions

質問 # 110
A service account key has been publicly exposed on multiple public code repositories. After reviewing the logs, you notice that the keys were used to generate short-lived credentials. You need to immediately remove access with the service account.
What should you do?

A. Rotate the compromised service account key.
B. Wait until the service account credentials expire automatically.
C. Delete the compromised service account.
D. Disable the compromised service account key.

正解：C

解説：
https://cloud.google.com/iam/docs/keys-disable-enable#disabling

質問 # 111
Your organization recently activated the Security Command Center {SCO standard tier. There are a few Cloud Storage buckets that were accidentally made accessible to the public. You need to investigate the impact of the incident and remediate it.
What should you do?

A. * 1 Change bucket permissions to limit access
* 2 Query the data access audit logs for any unauthorized access to the buckets
* 3 After the misconfiguration is corrected mute the finding in the Security Command Center
B. * 1 Change the bucket permissions to limit access
* 2 Query the buckets usage logs to report on unauthorized access to the data
* 3 Enforce the organization policy storage.publicAccessPrevention to avoid regressions
C. * 1 Remove the Identity and Access Management (IAM) granting access to allusers from the buckets
* 2 Apply the organization policy storage. unifromBucketLevelAccess to prevent regressions
* 3 Query the data access logs to report on unauthorized access
D. * 1 Change permissions to limit access for authorized users
* 2 Enforce a VPC Service Controls perimeter around all the production projects to immediately stop any unauthorized access
* 3 Review the administrator activity audit logs to report on any unauthorized access

正解：A

解説：
To investigate and remediate the issue of public access to Cloud Storage buckets, you can follow these steps:
Change Bucket Permissions:
Navigate to the Cloud Storage section in the Google Cloud Console.
For each affected bucket, remove any public access permissions (e.g., removing allUsers or allAuthenticatedUsers from the IAM policy).
Ensure that only authorized users have the necessary permissions to access the buckets.
Query Data Access Audit Logs:
Go to the Logging section in the Google Cloud Console.
Query the audit logs for the affected buckets to identify any unauthorized access. You can use filters to search for access by unauthorized users.
Correct the Misconfiguration:
After correcting the permissions, mute the relevant findings in the Security Command Center to indicate that the issue has been resolved.
This helps in maintaining a clear view of ongoing security issues and ensures the findings are not flagged again unless there's a new occurrence.
By following these steps, you ensure that the buckets are no longer publicly accessible, investigate any potential unauthorized access, and update the Security Command Center status to reflect the resolution of the issue.
Reference:
Cloud Storage IAM Permissions
Viewing Audit Logs
Security Command Center Documentation

質問 # 112
You control network traffic for a folder in your Google Cloud environment. Your folder includes multiple projects and Virtual Private Cloud (VPC) networks You want to enforce on the folder level that egress connections are limited only to IP range 10.58.5.0/24 and only from the VPC network dev-vpc." You want to minimize implementation and maintenance effort What should you do?

A. * 1 Leave the network configuration of the VMs in scope unchanged
* 2 Enable Cloud NAT for dev-vpc" and restrict the target range in Cloud NAT to 10.58.5 0/24.
B. * 1. Attach external IP addresses to the VMs in scope.
* 2. Configure a VPC Firewall rule in "dev-vpc" that allows egress connectivity to IP range 10.58.5.0/24 for all source addresses in this network.
C. * 1. Attach external IP addresses to the VMs in scope.
* 2. Define and apply a hierarchical firewall policy on folder level to deny all egress connections and to allow egress to IP range 10 58.5.0/24 from network dev-vpc.
D. * 1. Leave the network configuration of the VMs in scope unchanged.
* 2. Create a new project including a new VPC network "new-vpc."
* 3 Deploy a network appliance in "new-vpc" to filter access requests and only allow egress connections from -dev-vpc" to 10.58.5.0/24.

正解：C

解説：
Explanation
This approach allows you to control network traffic at the folder level. By attaching external IP addresses to the VMs in scope, you can ensure that the VMs have a unique, routable IP address for outbound connections.
Then, by defining and applying a hierarchical firewall policy at the folder level, you can enforce that egress connections are limited to the specified IP range and only from the specified VPC network.

質問 # 113
You want to prevent users from accidentally deleting a Shared VPC host project. Which organization-level policy constraint should you enable?

A. compute.restrictSharedVpcSubnetworks
B. compute.restrictXpnProjectLienRemoval
C. compute.sharedReservationsOwnerProjects
D. compute.restrictSharedVpcHostProjects

正解：B

解説：
* Enable the compute.restrictXpnProjectLienRemoval organization-level policy constraint:
* This constraint prevents users from removing liens from Shared VPC host projects.
* By enabling this constraint, you ensure that the Shared VPC host project cannot be accidentally deleted, as liens prevent deletion without proper authorization.
* Apply this constraint via the Google Cloud Console or using the gcloud command-line tool.
References:
* Organization Policy Constraints
* Shared VPC

質問 # 114
Your company has been creating users manually in Cloud Identity to provide access to Google Cloud resources. Due to continued growth of the environment, you want to authorize the Google Cloud Directory Sync (GCDS) instance and integrate it with your on-premises LDAP server to onboard hundreds of users.
You are required to:
Replicate user and group lifecycle changes from the on-premises LDAP server in Cloud Identity.
Disable any manually created users in Cloud Identity.
You have already configured the LDAP search attributes to include the users and security groups in scope for Google Cloud. What should you do next to complete this solution?

A. 1. Configure the option to suspend domain users not found in LDAP.2. Set up a recurring GCDS task.
B. 1. Configure the LDAP search attributes to exclude manually created Cloud Identity users not found in LDAP.2. Set up a recurring GCDS task.
C. 1. Configure the LDAP search attributes to exclude manually created Cloud identity users not found in LDAP.2. Run GCDS after user and group lifecycle changes.
D. 1. Configure the option to delete domain users not found in LDAP.2. Run GCDS after user and group lifecycle changes.

正解：A

質問 # 115
......

認定試験では、ネットワークセキュリティ、アプリケーションセキュリティ、データ保護、コンプライアンス、規制、インシデント対応など、クラウドセキュリティに関連する幅広いトピックをカバーしています。試験では、セキュアークラウドソリューションを設計および実装し、セキュリティコントロールを構成し、クラウド環境でセキュリティオペレーションを管理する候補者の能力をテストします。この試験では、セキュリティリスクを分析し、リスク管理戦略を開発する候補者の能力も評価しています。

Google Professional-Cloud-Security-Engineer事前試験練習テストはGoShiken：https://www.goshiken.com/Google/Professional-Cloud-Security-Engineer-mondaishu.html

Professional-Cloud-Security-Engineer練習テスト問題、解答、解釈：https://drive.google.com/open?id=1O2guoseT67B7Nc9DBxWSyBhYjtayh-s7

関するブログ

もっと

Professional-Cloud-Security-Engineer無料問題集