Question 1

You are consulting with a client that requires end-to-end encryption of application data (including data in transit, data in use, and data at rest) within Google Cloud. Which options should you utilize to accomplish this? (Choose two.)

Options :

A : External Key Manager

B : Customer-supplied encryption keys

C : Hardware Security Module

D : Confidential Computing and Istio

E : Client-side encryption

Answer: D,E

Question 2

You run applications on Cloud Run. You already enabled container analysis for vulnerability scanning. However, you are concerned about the lack of control on the applications that are deployed. You must ensure that only trusted container images are deployed on Cloud Run. What should you do? Choose 2 answers

Options :

A : Enable Binary Authorization on the existing Kubernetes cluster.

B :

Set the organization policy constraint constraints/run. allowedBinaryAuthorizationPolicie to the list of allowed Binary Authorization policy names.

C :

Set the organization policy constraint constraints/compute.trustedimageProjects to the list of protects that contain the trusted container images

D : Enable Binary Authorization on the existing Cloud Run service.

E : Use Cloud Run breakglass to deploy an image that meets the Binary Authorization policy by default.

Answer: B,D

Question 3

As a Blockchain-based payment system company, we are migrating to Google Cloud and want to ensure network security controls are maintained. What solution can we implement to ensure effective network security controls as part of the new shared responsibility model between our company and Google Cloud?

Options :

A : Make certain that the necessary controls are met by implementing firewall rules.

B : Configure Cloud Armor to enable centralized management of network security controls for G Suite.

C : Configure a range of Virtual Private Cloud (VPC) networks in compliance with the applicable regulations to manage network security.

D : Google Cloud has a built-in network security solution that is responsible for ensuring the security of SaaS products such as G Suite.

Answer: D

Question 4

You are on your company's development team. You noticed that your web application hosted in staging on GKE dynamically includes user data in web pages without first properly validating the inputted data. This could allow an attacker to execute gibberish commands and display arbitrary content in a victim user's browser in a production environment. How should you prevent and fix this vulnerability?

Options :

A : Use Cloud IAP based on IP address or end-user device attributes to prevent and fix the vulnerability.

B :

Set up an HTTPS load balancer, and then use Cloud Armor for the production environment to prevent the potential XSS attack.

C :

Use Web Security Scanner to validate the usage of an outdated library in the code, and then use a secured version of the included library.

D :

Use Web Security Scanner in staging to simulate an XSS injection attack, and then use a templating system that supports contextual auto-escaping.

Answer: D

Question 5

An employer wants to track how bonus compensations have changed over time to identify employee outliers

and correct earning disparities. This task must be performed without exposing the sensitive compensation data

for any individual and must be reversible to identify the outlier.

Which Cloud Data Loss Prevention API technique should you use to accomplish this?

Options :

A : Generalization

B : Redaction

C : CryptoHashConfig

D : CryptoReplaceFfxFpeConfig

Answer: D