Google Professional-Cloud-Security-Engineer 問題集

質問 1：
Your organization deploys a large number of containerized applications on Google Kubernetes Engine (GKE). Node updates are currently applied manually. Audit findings show that a critical patch has not been installed due to a missed notification. You need to design a more reliable, cloud-first, and scalable process for node updates. What should you do?
A. Schedule a daily reboot for all nodes to automatically upgrade.
B. Develop a custom script to continuously check for patch availability, download patches, and apply the patches across all components of the cluster.
C. Migrate the cluster infrastructure to a self-managed Kubernetes environment for greater control over the patching process.
D. Configure node auto-upgrades for node pools in the maintenance windows.
正解：D
解説: (Topexam メンバーにのみ表示されます)

質問 2：
Your organization has established a highly sensitive project within a VPC Service Controls perimeter. You need to ensure that only users meeting specific contextual requirements such as having a company-managed device, a specific location, and a valid user identity can access resources within this perimeter. You want to evaluate the impact of this change without blocking legitimate access. What should you do?
A. Establish a Context-Aware Access policy that specifies the required contextual attributes, and associate the policy with the VPC Service Controls perimeter in dry run mode.
B. Use the VPC Service Control Violation dashboard to identify the impact of details about access denials by service perimeters.
C. Configure a VPC Service Controls perimeter in dry run mode, and enforce strict network segmentation using firewall rules. Use multi-factor authentication (MFA) for user verification.
D. Use Cloud Audit Logs to monitor user access to the project resources. Use post-incident analysis to identify unauthorized access attempts.
正解：A
解説: (Topexam メンバーにのみ表示されます)

質問 3：
You run applications on Cloud Run. You already enabled container analysis for vulnerability scanning.
However, you are concerned about the lack of control on the applications that are deployed. You must ensure that only trusted container images are deployed on Cloud Run.
What should you do?
Choose 2 answers
A. Set the organization policy constraint constraints/run. allowedBinaryAuthorizationPolicie tothe list of allowed Binary Authorization policy names.
B. Use Cloud Run breakglass to deploy an image that meets the Binary Authorization policy by default.
C. Enable Binary Authorization on the existing Kubernetes cluster.
D. Set the organization policy constraint constraints/compute.trustedimageProjects to the list ofprotects that contain the trusted container images.
E. Enable Binary Authorization on the existing Cloud Run service.
正解：A,E
解説: (Topexam メンバーにのみ表示されます)

質問 4：
Your organization is worried about recent news headlines regarding application vulnerabilities in production applications that have led to security breaches. You want to automatically scan your deployment pipeline for vulnerabilities and ensure only scanned and verified containers can run in the environment. What should you do?
A. Use gcloud artifacts docker images describe LOCATION-docker.pkg.dev/PROJECT_ID
/REPOSITORY/IMAGE_ID@sha256:HASH --show-package-vulnerability in your CI/CD pipeline, and trigger a pipeline failure for critical vulnerabilities.
B. Enable Binary Authorization and create attestations of scans.
C. Enforce the use of Cloud Code for development so users receive real-time security feedback on vulnerable libraries and dependencies before they check in their code.
D. Use Kubernetes role-based access control (RBAC) as the source of truth for cluster access by granting
"container clusters.get" to limited users. Restrict deployment access by allowing these users to generate a kubeconfig file containing the configuration access to the GKE cluster.
正解：B
解説: (Topexam メンバーにのみ表示されます)

質問 5：
You need to connect your organization's on-premises network with an existing Google Cloud environment that includes one Shared VPC with two subnets named Production and Non-Production. You are required to:
Use a private transport link.
Configure access to Google Cloud APIs through private API endpoints originating from on-premises environments.
Ensure that Google Cloud APIs are only consumed via VPC Service Controls.
What should you do?
A. 1. Set up a Partner Interconnect link between the on-premises environment and Google Cloud.2.
Configure private access using the private.googleapis.com domains in on-premises DNS configurations.
B. 1. Set up a Direct Peering link between the on-premises environment and Google Cloud.2. Configure private access for both VPC subnets.
C. 1. Set up a Cloud VPN link between the on-premises environment and Google Cloud.2. Configure private access using the restricted googleapis.com domains in on-premises DNS configurations.
D. 1. Set up a Dedicated Interconnect link between the on-premises environment and Google Cloud.2.Configure private access using the restricted.googleapis.com domains in on-premises DNS configurations.
正解：D
解説: (Topexam メンバーにのみ表示されます)

質問 6：
A customer is collaborating with another company to build an application on Compute Engine. The customer is building the application tier in their GCP Organization, and the other company is building the storage tier in a different GCP Organization. This is a 3-tier web application. Communication between portions of the application must not traverse the public internet by any means.
Which connectivity option should be implemented?
A. VPC peering
B. Shared VPC
C. Cloud Interconnect
D. Cloud VPN
正解：A
解説: (Topexam メンバーにのみ表示されます)

質問 7：
A DevOps team will create a new container to run on Google Kubernetes Engine. As the application will be internet-facing, they want to minimize the attack surface of the container.
What should they do?
A. Delete non-used versions from Container Registry.
B. Use a Continuous Delivery tool to deploy the application.
C. Build small containers using small base images.
D. Use Cloud Build to build the container images.
正解：C
解説: (Topexam メンバーにのみ表示されます)