2.1 Designing and Configuring Perimeter Security PROFESSIONAL-CLOUD-SECURITY-ENGINEER Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   What is the purpose of enabling DNSSEC on a Cloud DNS zone?

   • ATo provide load balancing for DNS queries
   • BTo encrypt DNS queries between clients and resolvers
   • CTo protect against DNS spoofing and cache poisoning
   • DTo filter malicious domains
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A company runs a public web application on a global external HTTPS load balancer. The security team wants to enforce strong encryption by requiring TLS 1.3 and disabling older protocols. They also want to protect the application from DDoS attacks. What should the security engineer configure?

   • AAttach a Google-managed SSL certificate and enable HTTP/2 on the load balancer.
   • BConfigure the backend service to only accept TLS 1.3 connections and rely on the VPC firewall to block DDoS traffic.
   • CCreate an SSL policy that requires TLS 1.3 and attach it to the load balancer's target HTTPS proxy, and enable Google Cloud Armor with a DDoS protection policy.
   • DUse Identity-Aware Proxy (IAP) to enforce TLS 1.3 and enable Cloud NGFW to block DDoS traffic.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Which type of traffic does Secure Web Proxy primarily handle?

   • AOutbound DNS traffic
   • BOutbound HTTP/HTTPS traffic
   • CInbound SMTP traffic
   • DInbound SSH traffic
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A company uses Cloud DNS to manage its public domain. The security team is concerned about DNS spoofing and cache poisoning attacks. They want to ensure that DNS responses are authenticated and that any changes to DNS records are logged. What should the security engineer configure?

   • AUse a private DNS zone with a forwarding policy to an external DNS provider.
   • BConfigure Cloud Armor to protect the DNS server from DDoS attacks.
   • CEnable DNSSEC on the Cloud DNS zone and enable Cloud DNS logging for the zone.
   • DCreate a Cloud NGFW rule to block all inbound DNS traffic to the VPC.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A company exposes a public API that allows users to retrieve sensitive data. The security team wants to prevent unauthorized access and also detect and respond to unusual API usage patterns, such as a sudden spike in requests from a single user. They also want to ensure that only authenticated users can access the API. What should the security engineer implement?

   • AUse API keys with quotas and rate limits, enable Cloud Audit Logs for the API, and set up alerts on log-based metrics for unusual activity.
   • BUse Identity-Aware Proxy (IAP) to require Google accounts and rely on Cloud Armor to block suspicious IPs.
   • CDeploy Secure Web Proxy to filter API requests and block malicious payloads.
   • DCreate Cloud NGFW rules to restrict API access to a specific IP range and enable VPC flow logs.
   Reveal Solution Discussion Select an answer first