3.1 Protecting Sensitive Data and Preventing Data Loss PROFESSIONAL-CLOUD-SECURITY-ENGINEER Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   An application connects to a Cloud SQL instance using a database user. The application needs to be granted the ability to read and write data in a specific database. What should be configured to grant these permissions?

   • ADatabase user permissions
   • BPrivate IP configuration
   • CIAM roles on the instance
   • DSigned URLs
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A company runs a web application on Compute Engine that connects to a Cloud SQL MySQL instance. The application needs to access the database, but the database should not be exposed to the public internet. The company wants to ensure that only the application's VMs can connect to the database. What should they do?

   • AConfigure the Cloud SQL instance to use a private IP address, and connect from the application VMs using a VPC peering connection.
   • BUse the Cloud SQL Auth proxy on each application VM and connect to the instance using its public IP address.
   • CCreate a firewall rule that allows traffic from the application VMs to the Cloud SQL instance's public IP on port 3306.
   • DKeep the Cloud SQL instance on a public IP but restrict access using authorized networks to only the application VMs' external IP addresses.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   A user needs to temporarily share a private object in a Cloud Storage bucket with an external partner for 24 hours. The partner does not have a Google account. Which method should be used to grant this temporary access?

   • AIAM role on the bucket
   • BObject ACL
   • CBucket ACL
   • DSigned URL
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A company runs a web application on Compute Engine that needs to access a Cloud Storage bucket. The application currently uses a service account key stored in the instance metadata to authenticate. The security team wants to eliminate the use of service account keys and instead use the instance's default service account to access the bucket. What should they do?

   • AUse a Cloud Function to proxy access to the bucket and have the application call the function.
   • BKeep the service account key in the instance metadata but restrict access to the metadata server using firewall rules.
   • CCreate a new service account key and store it in Secret Manager, then have the application retrieve it at runtime.
   • DRemove the service account key from the instance metadata and grant the instance's default service account the appropriate IAM role on the bucket.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   A security engineer needs to control which users can access a specific secret stored in Secret Manager. What should be used to grant this access?

   • AACLs on the secret
   • BSigned URLs
   • CDatabase user permissions
   • DIAM roles on the secret
   Reveal Solution Discussion Select an answer first