An organization wants to detect when IAM policies on critical projects are changed, and alert the security team. They also want to enforce that certain IAM roles cannot be granted to users outside the organization. What should they implement?

Use Security Health Analytics to detect IAM policy changes and create a custom module to alert.

Use Cloud Asset Inventory to monitor IAM policy changes and trigger alerts via Cloud Monitoring, and create a custom organization policy that restricts the grant of specific roles to external principals.

Use Cloud Audit Logs to monitor IAM policy changes and create a custom organization policy that restricts the grant of specific roles.

Use Cloud Monitoring to watch for IAM policy changes and create a custom organization policy to restrict external principals.

A company has a specific security requirement that all Cloud Storage buckets must have versioning enabled. They want to detect any bucket that does not meet this requirement and be alerted when a new non-compliant bucket is created. What should they implement?

Create a custom organization policy that requires versioning on buckets, and rely on Security Health Analytics to detect non-compliant buckets.

Create a custom module for Security Health Analytics that checks for versioning on buckets, and use Cloud Asset Inventory to monitor for new buckets and trigger alerts.

Use Cloud Audit Logs to monitor bucket creation and check the versioning setting in the log entry.

Use Cloud Monitoring to create a metric that checks bucket versioning and alert on violations.

When configuring Binary Authorization for GKE, what is the primary artifact that is evaluated against the admission policy?

The container image's signature

What is the purpose of a custom organization policy in Google Cloud?

To configure network firewall rules

To enforce organization-specific security constraints on resources

To manage billing and cost controls

Google CloudProfessional Cloud Security Engineer

Domain 4Objective 1

4.1 Automating Infrastructure and Application Security PROFESSIONAL-CLOUD-SECURITY-ENGINEER Practice Questions (Page 3)

Part of the Managing operations domain, which accounts for 19% of the PROFESSIONAL-CLOUD-SECURITY-ENGINEER exam.

25questions here

5free pages

10concepts

19%of the exam

Questions 11–15

11application · medium
An organization wants to detect when IAM policies on critical projects are changed, and alert the security team. They also want to enforce that certain IAM roles cannot be granted to users outside the organization. What should they implement?
Select an answer first
12application · medium
A company has a specific security requirement that all Cloud Storage buckets must have versioning enabled. They want to detect any bucket that does not meet this requirement and be alerted when a new non-compliant bucket is created. What should they implement?
Select an answer first
13foundation · easy
When configuring Binary Authorization for GKE, what is the primary artifact that is evaluated against the admission policy?
Select an answer first
14foundation · easy
What is the purpose of a custom organization policy in Google Cloud?
Select an answer first
15foundation · easy
An organization wants to ensure that only container images signed by their trusted authority can run on their GKE clusters. Which Google Cloud service should they use to enforce this requirement?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to PROFESSIONAL-CLOUD-SECURITY-ENGINEER

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Google Cloud. “PROFESSIONAL-CLOUD-SECURITY-ENGINEER” is a trademark of its owner, used for identification only.