Pass with professional Professional-Cloud-Security-Engineer actual quiz materials

Your company wants to determine what products they can build to help customers improve their credit scores depending on their age range. To achieve this, you need to join user information in the company's banking app with customers' credit score data received from a third party. While using this raw data will allow you to complete this task, it exposes sensitive data, which could be propagated into new systems.
This risk needs to be addressed using de-identification and tokenization with Cloud Data Loss Prevention while maintaining the referential integrity across the database. Which cryptographic token format should you use to meet these requirements?

• A. Secure, key-based hashes
• B. Cryptographic hashing
• C. Format-preserving encryption
• D. Deterministic encryption

Your organization is using Vertex AI Workbench Instances. You must ensure that newly deployed instances are automatically kept up-to-date and that users cannot accidentally alter settings in the operating system.
What should you do?

• A. Enable the VM Manager and ensure the corresponding Google Compute Engine instances are added.
• B. Assign the AI Notebooks Runner and AI Notebooks Viewer roles to the users of the AI Workbench Instances.
• C. Enforce the disableRootAccess and requireAutoUpgradeSchedule organization policies for newly deployed instances.
• D. Implement a firewall rule that prevents Secure Shell access to the corresponding Google Compute Engine instances by using tags.

Your organization operates Virtual Machines (VMs) with only private IPs in the Virtual Private Cloud (VPC) with internet access through Cloud NAT Everyday, you must patch all VMs with critical OS updates and provide summary reports What should you do?

• A. Copy the latest patches to the Cloud Storage bucket. Log in to each VM. download the patches from the bucket, and install them.
• B. Ensure that VM Manager is installed and running on the VMs. In the OS patch management service.
  configure the patch jobs to update with critical patches daily.
• C. Assign public IPs to VMs. Validate that the egress firewall rules allow any outgoing traffic Log in to each VM. and configure a daily cron job to enable for OS updates at night during low activity periods.
• D. Validate that the egress firewall rules allow any outgoing traffic Log in to each VM and execute OS specific update commands Configure the Cloud Scheduler job to update with critical patches daily for daily updates.

Users are reporting an outage on your public-facing application that is hosted on Compute Engine. You suspect that a recent change to your firewall rules is responsible. You need to test whether your firewall rules are working properly. What should you do?

• A. Connect to a bastion host in your VPC. Use a network traffic analyzer to determine at which point your requests are being blocked.
• B. Enable VPC Flow Logs in your VPC. Use Logs Explorer to analyze whether the rules are working correctly.
• C. Enable Firewall Rules Logging on the latest rules that were changed. Use Logs Explorer to analyze whether the rules are working correctly.
• D. In a pre-production environment, disable all firewall rules individually to determine which one is blocking user traffic.

You will create a new Service Account that should be able to list the Compute Engine instances in the project.
You want to follow Google-recommended practices.
What should you do?

• A. Give the Service Account the role of Compute Viewer, and use the new Service Account for all instances.
• B. Give the Service Account the role of Project Viewer, and use the new Service Account for all instances.
• C. Create an Instance Template, and allow the Service Account Read Only access for the Compute Engine Access Scope.
• D. Create a custom role with the permission compute.instances.list and grant the Service Account this role.