A security engineer needs to ensure that data stored in Cloud Storage meets a compliance requirement for encryption at rest. Which Google Cloud feature directly addresses this technical requirement?

Customer-managed encryption keys (CMEK)

A company must ensure that only authorized users can access a specific set of Cloud Storage buckets, and that all access attempts are logged. They also want to prevent any user from making buckets public. What should they do?

Use a VPC Service Controls perimeter and enable Admin Activity audit logs.

Use firewall rules to restrict access to the buckets and enable System Event audit logs.

Use IAM roles to grant access only to authorized users, enable Data Access audit logs, and set an organization policy to prevent public access.

Use Cloud KMS to encrypt the buckets and enable Access Transparency.

Which organizational policy constraint can be used to enforce that Cloud Storage buckets are not publicly accessible?

iam.disableServiceAccountKeyCreation

Google CloudProfessional Cloud Security Engineer

Domain 5Objective 1

5.1 Adhering to Regulatory and Industry Standards Requirements for the Cloud PROFESSIONAL-CLOUD-SECURITY-ENGINEER Practice Questions (Page 5)

Part of the Supporting compliance requirements domain, which accounts for 11% of the PROFESSIONAL-CLOUD-SECURITY-ENGINEER exam.

28questions here

6free pages

10concepts

11%of the exam

Questions 21–25

21foundation · easy
A security engineer needs to ensure that data stored in Cloud Storage meets a compliance requirement for encryption at rest. Which Google Cloud feature directly addresses this technical requirement?
Select an answer first
22application · medium
A company must ensure that only authorized users can access a specific set of Cloud Storage buckets, and that all access attempts are logged. They also want to prevent any user from making buckets public. What should they do?
Select an answer first
23foundation · easy
A compliance requirement demands that a database tier be isolated from the web tier. Which Google Cloud networking feature should be used to achieve this isolation?
Select an answer first
24foundation · easy
Which Cloud Audit Logs type must be explicitly enabled to capture data access events, such as reading a Cloud Storage object?
Select an answer first
25foundation · easy
Which organizational policy constraint can be used to enforce that Cloud Storage buckets are not publicly accessible?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to PROFESSIONAL-CLOUD-SECURITY-ENGINEER

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Google Cloud. “PROFESSIONAL-CLOUD-SECURITY-ENGINEER” is a trademark of its owner, used for identification only.

5.1 Adhering to Regulatory and Industry Standards Requirements for the Cloud PROFESSIONAL-CLOUD-SECURITY-ENGINEER Practice Questions (Page 5)

Questions 21–25

A security engineer needs to ensure that data stored in Cloud Storage meets a compliance requirement for encryption at rest. Which Google Cloud feature directly addresses this technical requirement?

A company must ensure that only authorized users can access a specific set of Cloud Storage buckets, and that all access attempts are logged. They also want to prevent any user from making buckets public. What should they do?

A compliance requirement demands that a database tier be isolated from the web tier. Which Google Cloud networking feature should be used to achieve this isolation?

Which Cloud Audit Logs type must be explicitly enabled to capture data access events, such as reading a Cloud Storage object?

Which organizational policy constraint can be used to enforce that Cloud Storage buckets are not publicly accessible?

Keep studying — Supporting compliance requirements