4.1 Automating Infrastructure and Application Security PROFESSIONAL-CLOUD-SECURITY-ENGINEER Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which resource can a custom organization policy be applied to?

   • AOnly to projects
   • BOnly to the organization node
   • CTo the organization, folders, and projects
   • DOnly to individual resources like VMs
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   What is the default behavior of Binary Authorization on Cloud Run if no policy is explicitly defined?

   • AOnly images from the same project are allowed
   • BAll images are allowed
   • COnly images signed by Google are allowed
   • DAll images are blocked
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A team builds a container image for a microservice. They want to automate the creation of a hardened image that includes security updates and has a minimal attack surface. They also want to ensure that only this hardened image is deployed to their GKE cluster. What should they do?

   • AUse a minimal base image and run as non-root, but skip signing and rely on a custom admission controller.
   • BUse a multi-stage Dockerfile that uses a minimal base image, installs only required packages, and runs as a non-root user. In Cloud Build, run a vulnerability scanner and fail the build on critical findings. Then sign the image and enforce Binary Authorization on the cluster.
   • CUse a minimal base image, but do not run a vulnerability scanner. Instead, rely on the GKE cluster's built-in scanning to block deployment.
   • DUse a Dockerfile that starts from a full base image, installs all available packages, and runs as root. Then rely on Binary Authorization to block vulnerable images.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   An organization has a fleet of VMs that must be patched monthly. They want to automate the patching process, but they also want to ensure that the VMs are not rebooted during business hours. They have a requirement to track which VMs have been patched and which have not. What should they implement?

   • AUse a startup script that runs apt-get update and upgrade on every VM boot, and use Cloud Monitoring to track patch status.
   • BUse OS Patch Management to create a patch deployment that runs monthly, with a maintenance window that excludes business hours. Use the patch compliance reporting to track patched and unpatched VMs.
   • CUse Cloud Scheduler to run a gcloud command that patches all VMs at midnight, and use Cloud Logging to track which VMs were patched.
   • DUse a configuration management tool like Ansible to patch VMs, and use Cloud Asset Inventory to track patched VMs.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   A security engineer wants to automatically block a container image from being deployed if it contains a known critical vulnerability. Which Google Cloud service is designed to scan container images for vulnerabilities and can be integrated into a CI/CD pipeline to enforce this policy?

   • ACloud Build
   • BCloud Security Command Center
   • CArtifact Analysis
   • DContainer Registry
   Reveal Solution Discussion Select an answer first