Free Practice Questions for Google Professional-Cloud-Security-Engineer Exam

For managing and rotating encryption keys in a Compute Engine-based cluster using Managed Instance Groups (MIGs), Customer-Managed Encryption Keys (CMEK) with Cloud KMS is the appropriate solution.

Set Up Cloud KMS:

Go to the Cloud Console and navigate to Security > Cryptographic Keys.

Create a keyring and a key.

Create and Use CMEK:

While creating or updating a Compute Engine instance, specify the CMEK key.

Example command:

gcloud compute instances create example-instance \ --image-family=debian-9 \ --image-project=debian-cloud \ --boot-disk-kms-key=projects/[PROJECT_ID]/locations/global/keyRings/[KEY_RING]/cryptoKeys/[KEY]

Rotate Keys:

Rotate keys periodically using Cloud KMS by creating new key versions and updating the instances to use the new key versions.

Customer-Managed Encryption Keys (CMEK)

Using Customer-Managed Encryption Keys

Understanding Unmanaged Users:

Unmanaged users are those who have created Google Cloud accounts using their company email addresses outside of the organization's management (e.g., through GCDS).

Challenge:

The goal is to bring these unmanaged accounts under your company's control without disrupting their existing accounts and access.

Using the Transfer Tool:

Google provides a transfer tool specifically designed to migrate unmanaged users to a managed state.

This tool allows administrators to invite unmanaged users to join the organization's Google Cloud Identity or Google Workspace account.

Steps to Use the Transfer Tool:

Step 1: Access the transfer tool from the Google Admin console.

Step 2: Identify the unmanaged users using their email addresses.

Step 3: Send invitations to these users to transfer their accounts.

Step 4: Users accept the invitations, allowing their accounts to be managed under the organization's domain.

Benefits:

This method ensures a smooth transition for users without losing access to their existing data and services.

It aligns with best practices for managing user accounts in a corporate environment.

Physical Token for MFA: Implement multi-factor authentication (MFA) using physical tokens (such as security keys) for super admin accounts. This adds an extra layer of security to the highest privilege accounts.

Non-Privileged Identities: Provide super admins with separate non-privileged accounts for daily activities. This practice minimizes the risk associated with using highly privileged accounts for routine tasks.

Account Management: Ensure that super admin accounts are only used for tasks requiring elevated privileges, reducing exposure to potential security threats. These measures enhance the security of super admin accounts, protecting your Google Cloud organization from unauthorized access. References:

Google Cloud - Best Practices for Securing Cloud Identity

Google Cloud - Using Security Keys

To identify all principals who can change firewall rules, you need to determine which users or service accounts have permissions that allow them to modify firewall rules in your Google Cloud project. The correct permissions to check for this are compute.firewalls.create and compute.firewalls.delete. These permissions enable a user to create and delete firewall rules, respectively.

The Policy Analyzer tool in Google Cloud allows you to query and analyze IAM policies to identify which principals have specific permissions. By using Policy Analyzer, you can effectively identify all principals with the compute.firewalls.create and compute.firewalls.delete permissions.

Open Policy Analyzer: Go to the Google Cloud Console, navigate to IAM & Admin, and select Policy Analyzer.

Set Up Query: Create a new query specifying the permissions compute.firewalls.create and compute.firewalls.delete.

Run Query: Execute the query to retrieve a list of principals who have these permissions.

Review Results: Analyze the results to identify all users and service accounts with the capability to modify firewall rules.

This method ensures you have a comprehensive list of all principals who can change firewall rules, enhancing your audit and security posture.

Google Cloud Policy Analyzer Documentation

Google Cloud IAM Documentation

To protect your web application from threats like malware by implementing TLS interception for incoming traffic, configuring a Secure Web Proxy with TLS offloading at the load balancer is an effective approach.​

Option A: By configuring a Secure Web Proxy, you can offload TLS traffic at the load balancer, inspect the decrypted traffic for threats such as malware, and then forward the inspected traffic to your web application. This approach ensures that encrypted traffic is securely analyzed without compromising the security of the data in transit.​

Option B: An internal proxy load balancer is designed for distributing traffic within a private network and may not support TLS interception capabilities required for inspecting incoming traffic from external sources.​

Option C: Hierarchical firewall policies in Google Cloud are used to enforce security rules across your organization but do not provide TLS interception capabilities.​

Option D: VPC firewall rules control traffic to and from VM instances based on specified rules but do not have the capability to perform TLS interception or traffic inspection.​

Therefore, Option A is the most suitable solution, as it allows for TLS interception through a Secure Web Proxy, enabling the inspection of incoming encrypted traffic to detect and mitigate threats like malware before the traffic reaches your web application.​

Comprehensive and Detailed Explanation From Exact Extract:

The problem is the detection of secrets (sensitive data patterns) within the environment variables of deployed resources (Cloud Functions) in a timely, automated manner.

Sensitive Data Protection (SDP), formerly Cloud DLP, is the purpose-built Google Cloud service for scanning and classifying sensitive data patterns. It can be configured to scan code, configuration, or environment variables and integrate its findings directly with Security Command Center (SCC).

Extracts:

"Sensitive Data Protection provides highly configurable, automated detection of sensitive data, including API keys, passwords, and other credentials, using both pre-built and custom infoTypes." (Source 8.1)

"SDP can be integrated with Cloud Functions and other resource configurations to scan environment variables or configuration files for secrets. Violations can be automatically routed to Security Command Center as findings." (Source 8.2)

Option D (DAST) scans the application code or running application logic, but the requirement specifies the secrets are in the environment variables, which are part of the configuration/deployment metadata, making SDP the correct detection tool.

Comprehensive and Detailed Explanation From Exact Extract:Layer 7 attacks like XSS and SQL injection are application-level threats that require a Web Application Firewall (WAF) for protection. Google Cloud Armor provides this functionality, integrated with the load balancer.

Cloud Armor: Google Cloud's distributed denial-of-service (DDoS) and WAF service.

WAF Rules: Cloud Armor offers pre-configured OWASP Top 10 rules, which directly defend against XSS, SQL injection, and other common application vulnerabilities.

Deployment: Cloud Armor security policies are applied to a backend service that is behind an external HTTP(S) Load Balancer.

Extracts:

"Cloud Armor WAF capabilities help protect web applications from the OWASP Top 10 vulnerabilities... This includes rulesets specifically designed to detect and mitigate SQL injection (SQLi) and cross-site scripting (XSS) attacks." (Source 4.1)

"Cloud Armor security policies are implemented at the edge of the Google Cloud network, applied to the backend services of an external HTTP(S) Load Balancer." (Source 4.2)

Option A is close but incomplete; WAF rules are implemented via a security policy (Option D). Option B relies on Adaptive Protection, which is primarily for volumetric DDoS and advanced attacks, but the direct protection for known XSS/SQLi signatures comes from explicit WAF rules.

To meet data residency requirements on Google Cloud, the recommended option is to use Organization Policy Service constraints. This service allows you to define and enforce specific constraints across your organization, including constraints related to the geographical location where data is stored.

Organization Policy Service constraints allow administrators to enforce policies that restrict resources to specific locations. For instance, you can set policies to ensure that all storage buckets, databases, and other data resources reside within specific geographic boundaries. This helps in complying with data residency requirements.

References

Organization Policy Service documentation

Google Cloud Data Residency

If a user loses their second factor for 2-Step Verification (2SV), you can help them regain access with minimal risk by generating a backup code.

Generate a Backup Code (A):

In the Google Admin console, navigate to the user's account settings.

Generate a backup code for the user. This code allows them to sign in despite not having access to their usual second factor.

Instruct the user to log in using the backup code and then update their second factor in their account settings.

This method ensures that only the affected user’s access is temporarily adjusted, minimizing risk while maintaining overall security policies.

References

Google Admin console 2-Step Verification documentation