A team wants to enforce that only signed container images can be deployed to their Cloud Run services. Which Google Cloud feature must be enabled to use Binary Authorization with Cloud Run?

Binary Authorization must be enabled for the project or the Cloud Run service

Cloud Run must be configured with a private service endpoint

Binary Authorization is enabled by default for all Cloud Run services

A company uses Compute Engine VMs with a custom hardened image. They want to automate the creation of new images that include the latest security patches, and ensure that existing VMs are updated to the new image. What should they implement?

Use Cloud Deployment Manager to create a new VM image from a source VM that has been patched, and then use a startup script to update all VMs.

Use OS Patch Management to patch existing VMs, and manually create a new image from one of the patched VMs.

Use a Cloud Build pipeline that runs on a schedule to create a new VM image from a source VM that has been patched, and then use an instance template and managed instance group to roll out the new image.

Use a Cloud Scheduler job to run a gcloud command that creates a new image from a snapshot, and then use a startup script to apply the image to VMs.

What is the purpose of a custom module in Security Health Analytics?

To detect organization-specific security issues that are not covered by built-in detectors

To configure network firewall rules

What is a primary goal when automating the creation of hardened container images?

To use the latest base image without checking for vulnerabilities

To include all possible libraries and tools for maximum functionality

To minimize the attack surface by including only necessary components

To ensure the image is as large as possible for faster deployment

Google CloudProfessional Cloud Security Engineer

Domain 4Objective 1

4.1 Automating Infrastructure and Application Security PROFESSIONAL-CLOUD-SECURITY-ENGINEER Practice Questions (Page 5)

Part of the Managing operations domain, which accounts for 19% of the PROFESSIONAL-CLOUD-SECURITY-ENGINEER exam.

25questions here

5free pages

10concepts

19%of the exam

Questions 21–25

21foundation · easy
Which Google Cloud service can be used to detect drift by providing a history of resource configuration changes?
Select an answer first
22foundation · easy
A team wants to enforce that only signed container images can be deployed to their Cloud Run services. Which Google Cloud feature must be enabled to use Binary Authorization with Cloud Run?
Select an answer first
23application · medium
A company uses Compute Engine VMs with a custom hardened image. They want to automate the creation of new images that include the latest security patches, and ensure that existing VMs are updated to the new image. What should they implement?
Select an answer first
24foundation · easy
What is the purpose of a custom module in Security Health Analytics?
Select an answer first
25foundation · easy
What is a primary goal when automating the creation of hardened container images?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to PROFESSIONAL-CLOUD-SECURITY-ENGINEER

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Google Cloud. “PROFESSIONAL-CLOUD-SECURITY-ENGINEER” is a trademark of its owner, used for identification only.