2.1 Designing and Configuring Perimeter Security PROFESSIONAL-CLOUD-SECURITY-ENGINEER Practice Questions (Page 7)

Questions 31–34

1. 31expert · hard

   A company runs a microservices architecture on Google Kubernetes Engine (GKE) with multiple services communicating over mTLS. The security team wants to use a private CA to issue certificates for these services, but also needs to ensure that certificates can be revoked quickly if a service is compromised. They also want to minimize the operational overhead of managing the CA. What should the security engineer do?

   • AGenerate self-signed certificates for each service and use a script to revoke them by deleting the certificates from the services.
   • BUse Google-managed SSL certificates on the load balancer and rely on GKE's built-in mTLS.
   • CUse Certificate Authority Service to create a private CA, issue certificates to the services, and configure certificate revocation lists (CRLs) with a short validity period.
   • DDeploy a third-party CA on a Compute Engine VM and manage it manually.
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   What is the purpose of enabling Cloud DNS logging?

   • ATo record DNS queries and responses for security analysis and troubleshooting
   • BTo encrypt DNS traffic
   • CTo automatically block malicious domains
   • DTo speed up DNS resolution
   Reveal Solution Discussion Select an answer first
4. 33expert · hard

   A company runs a multi-region web application behind a global external load balancer. The security team wants to protect the application from DDoS attacks and also enforce a security policy that blocks requests from certain countries. They also want to ensure that health checks are not affected by the security policy. What should the security engineer configure?

   • AConfigure the load balancer's SSL policy to require TLS 1.3 and use IP-based allowlists for allowed countries.
   • BAttach a Google Cloud Armor policy to the backend service with geo-blocking rules and a rule to allow Google health check IP ranges.
   • CUse Cloud NGFW to block traffic from specific countries and rely on the load balancer's health checks to be unaffected.
   • DDeploy Secure Web Proxy to filter inbound traffic based on geo and allow health checks.
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   What is the primary purpose of a Cloud Next Generation Firewall (NGFW) rule in Google Cloud?

   • ATo filter traffic based on source, destination, ports, and protocols
   • BTo define which users can access a VM through IAM roles
   • CTo monitor API usage and enforce quotas
   • DTo encrypt data in transit between VMs
   Reveal Solution Discussion Select an answer first