What is the primary purpose of Security Command Center in Google Cloud?

To route logs to external SIEM systems

To manage IAM roles and permissions

To capture network packet payloads

To provide a centralized platform for security findings and posture management

A company must retain security logs for 3 years to meet compliance requirements, but wants to minimize storage costs. Which logging strategy best balances these needs?

Disable logging for non-critical resources to save cost

Export logs to a cold storage bucket with a 3-year retention policy

Store logs only in memory for faster access

Store all logs in the default log bucket with default retention

A security team wants to use Security Command Center to detect misconfigurations in their Google Cloud environment. They also want to receive alerts when new findings are created and be able to track the status of findings over time. Which configuration should they implement?

Use Cloud IDS to detect misconfigurations

Use Cloud Audit Logs to detect misconfigurations

Enable Security Command Center and configure notifications to Pub/Sub for new findings

Enable VPC flow logs and analyze them for misconfigurations

A security analyst receives a Security Command Center finding that a VM has a critical vulnerability. The analyst needs to determine if the vulnerability has been exploited and if there are any indicators of compromise. Which set of actions should the analyst take?

Delete the VM and recreate it from a known-good image

Check the VM's serial console output for login attempts

Review VPC flow logs for suspicious traffic to/from the VM and check Cloud IDS findings for related alerts

Immediately patch the VM and move on

Google CloudProfessional Cloud Security Engineer

Domain 4Objective 2

4.2 Configuring Logging, Monitoring, and Detection PROFESSIONAL-CLOUD-SECURITY-ENGINEER Practice Questions (Page 3)

Part of the Managing operations domain, which accounts for 19% of the PROFESSIONAL-CLOUD-SECURITY-ENGINEER exam.

27questions here

6free pages

8concepts

19%of the exam

Questions 11–15

11foundation · easy
Which network log source in Google Cloud provides metadata about IP traffic flows, such as source/destination IP, ports, and bytes transferred, but does not capture packet payloads?
Select an answer first
12foundation · easy
What is the primary purpose of Security Command Center in Google Cloud?
Select an answer first
13foundation · easy
A company must retain security logs for 3 years to meet compliance requirements, but wants to minimize storage costs. Which logging strategy best balances these needs?
Select an answer first
14expert · hard
A security team wants to use Security Command Center to detect misconfigurations in their Google Cloud environment. They also want to receive alerts when new findings are created and be able to track the status of findings over time. Which configuration should they implement?
Select an answer first
15application · medium
A security analyst receives a Security Command Center finding that a VM has a critical vulnerability. The analyst needs to determine if the vulnerability has been exploited and if there are any indicators of compromise. Which set of actions should the analyst take?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to PROFESSIONAL-CLOUD-SECURITY-ENGINEER

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Google Cloud. “PROFESSIONAL-CLOUD-SECURITY-ENGINEER” is a trademark of its owner, used for identification only.