4.1 Automating Infrastructure and Application Security PROFESSIONAL-CLOUD-SECURITY-ENGINEER Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which practice is essential when automating container image creation to ensure security updates are applied?

   • APatching the container image at runtime
   • BUsing a single base image for all applications
   • CDisabling security updates to maintain stability
   • DRebuilding images regularly from updated base images
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which Google Cloud service provides automated patch management for Compute Engine VMs?

   • ACloud Functions
   • BOS Patch Management
   • CCompute Engine Autoscaler
   • DCloud Scheduler
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which Google Cloud service provides continuous monitoring and remediation of security misconfigurations across your cloud resources?

   • ACloud Monitoring
   • BCloud Asset Inventory
   • CSecurity Command Center (with Security Health Analytics)
   • DCloud Security Command Center
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A company deploys a critical service to Cloud Run. They want to enforce that only images signed by their CI system can be deployed, and they also want to ensure that images are scanned for vulnerabilities before deployment. However, they have a requirement to allow emergency hotfixes that may not have gone through the full CI pipeline. What should they do?

   • AEnable Binary Authorization with a policy that requires attestations, but allow all images from the CI system to be deployed without scanning.
   • BDisable Binary Authorization for Cloud Run and rely on vulnerability scanning to block deployments.
   • CUse a custom Cloud Run ingress rule that only allows images from a specific registry, and rely on that to ensure security.
   • DEnable Binary Authorization for Cloud Run with a policy that requires attestations. Create a separate attestor for emergency hotfixes that requires a manual approval step, and have the CI system sign images after scanning. For hotfixes, a designated security engineer can create an attestation after manual review.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   When automating VM image creation, what is a key benefit of using a pipeline that builds images from a hardened base image?

   • AIt automatically applies patches to running VMs
   • BIt removes the need for vulnerability scanning
   • CIt ensures that all VMs created from the image have a consistent, known security baseline
   • DIt eliminates the need for runtime patching
   Reveal Solution Discussion Select an answer first