2.1 Designing and Configuring Perimeter Security PROFESSIONAL-CLOUD-SECURITY-ENGINEER Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   What is the primary use case for Certificate Authority Service (CAS) in Google Cloud?

   • ATo obtain publicly trusted SSL certificates for public websites
   • BTo encrypt data at rest in Cloud Storage
   • CTo filter network traffic based on certificate attributes
   • DTo create and manage private certificates for internal applications and services
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A company has a hub-and-spoke VPC architecture with a central inspection VPC (hub) and multiple application VPCs (spokes). The security team wants to enforce a policy that blocks all inbound traffic from the internet to the spoke VPCs, except for HTTP/HTTPS traffic that must go through a load balancer in the hub. They also want to inspect the HTTP/HTTPS traffic for threats at the application layer. What should the security engineer configure?

   • AIn each spoke VPC, create firewall rules to allow HTTP/HTTPS from the internet and deny all other traffic.
   • BAttach Google Cloud Armor to the load balancer and rely on VPC firewall rules to block all other inbound traffic.
   • CUse Secure Web Proxy in the hub to filter inbound HTTP/HTTPS traffic and block other traffic.
   • DIn the hub VPC, deploy a Cloud NGFW with layer 7 inspection and configure firewall rules to allow only HTTP/HTTPS from the load balancer to the spokes, with a deny rule for all other inbound internet traffic.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A company has an internal web application that should only be accessible to employees who are members of the 'finance' Google group and who are connecting from a corporate network. The application is behind an internal load balancer. What should the security engineer configure to enforce this access policy?

   • AConfigure the load balancer's URL map to redirect non-finance users to a login page.
   • BEnable Identity-Aware Proxy (IAP) on the load balancer and configure IAM conditions to require membership in the finance group and a specific IP range.
   • CUse Cloud NGFW rules to allow traffic only from the corporate IP range and rely on the application to check group membership.
   • DCreate a Google Cloud Armor policy that blocks all traffic except from the finance group's IP range.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A company is designing a new VPC with a public subnet for web servers and a private subnet for database servers. The web servers need to initiate outbound connections to the internet to download updates, but the database servers must not have any inbound or outbound internet access. The company wants to enforce this with firewall rules. What should the security engineer configure?

   • ACreate a firewall rule allowing egress from the database subnet to the internet and a deny rule for the web subnet, with the allow rule having higher priority.
   • BCreate a Cloud NGFW policy with a rule allowing egress from the web subnet to the internet (0.0.0.0/0) and a deny rule for egress from the database subnet to the internet, with the deny rule having higher priority.
   • CAssign public IP addresses to the database servers and rely on Cloud NAT to provide outbound access.
   • DConfigure Cloud DNS logging and use DNSSEC to prevent DNS-based exfiltration from the database subnet.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Which Google Cloud service is Cloud Armor typically associated with to protect traffic?

   • ACloud VPN
   • BCloud DNS
   • CCloud Load Balancing
   • DCloud Storage
   Reveal Solution Discussion Select an answer first