Pass the Google Google Cloud Certified Professional-Cloud-Security-Engineer Questions and answers with CertsForce

"To support common use cases like setting a Time to Live (TTL) for objects, retaining noncurrent versions of objects, or "downgrading" storage classes of objects to help manage costs, Cloud Storage offers the Object Lifecycle Management feature. This page describes the feature as well as the options available when using it. To learn how to enable Object Lifecycle Management, and for examples of lifecycle policies, see Managing Lifecycles." https://cloud.google.com/storage/docs/lifecycle

When you use a customer-managed encryption key (CMEK) to secure a Cloud Storage bucket, the key and the bucket must be located in the same region. In this case, the key is in europe-west3 and the bucket is in europe-west1, which is why you’re unable to access the key.

"Date shifting techniques randomly shift a set of dates but preserve the sequence and duration of a period of time. Shifting dates is usually done in context to an individual or an entity. That is, each individual's dates are shifted by an amount of time that is unique to that individual."

To ensure user-uploaded comments and product reviews do not include sensitive data before publication, use the Cloud Data Loss Prevention (DLP) API.

Enable DLP API:

Go to the Cloud Console and navigate to APIs & Services > Library.

Search for "Data Loss Prevention API" and enable it.

Configure DLP API:

Create an inspection template specifying the types of sensitive data to detect.

Set up de-identification templates if you want to redact or mask sensitive data.

Implement DLP in Application:

Use the Google Cloud DLP Client Library for the desired programming language.

Send the text data to the DLP API for inspection before saving or publishing.

from google.cloud import dlp_v2 dlp_client = dlp_v2.DlpServiceClient() parent = f"projects/{project_id}" item = {"value": "User comment text here"} inspect_config = {"info_types": [{"name": "PERSON_NAME"}, {"name": "CREDIT_CARD_NUMBER"}]} response = dlp_client.inspect_content(parent=parent, inspect_config=inspect_config, item=item)

Cloud Data Loss Prevention API Documentation

DLP API Client Libraries

Objective: Synchronize security groups with email addresses from an LDAP directory to Cloud IAM.

Solution: Use Google Cloud Directory Sync (GCDS) to perform one-way synchronization based on LDAP search rules.

Steps:

Step 1: Download and install Google Cloud Directory Sync (GCDS) on a secure server.

Step 2: Configure GCDS with the LDAP server details and authentication.

Step 3: Define LDAP search rules to filter security groups based on the “user email address” attribute.

Step 4: Map LDAP security groups to Google Cloud IAM roles.

Step 5: Set up a synchronization schedule to keep the groups in sync.

Step 6: Perform a test sync to ensure that the configuration is correct.

Step 7: Activate the synchronization to keep the LDAP directory and Cloud IAM in sync.

Using GCDS for one-way synchronization ensures that the security groups in Cloud IAM are consistently updated based on the LDAP directory, maintaining alignment with the organization’s security policies.

Objective: Ensure only front-end Compute Engine instances have public IPs, while others do not.

Solution: Use an organization policy to enforce this requirement.

Steps:

Step 1: Open the Google Cloud Console.

Step 2: Navigate to the Organization Policies page.

Step 3: Create a new policy with the constraint constraints/compute.requireOsLogin (or similar constraint to manage public IPs).

Step 4: Define the conditions to allow public IPs only for the front-end instances.

Step 5: Apply the policy to the organization or specific projects as necessary.

By setting up an organization policy with specific conditions, you can control which instances are allowed to have public IPs based on their role or other attributes.

This PD and bucket data is encrypted using a Google-generated data encryption key (DEK) and key encryption key (KEK). The CMEK feature allows you to create, use, and revoke the key encryption key (KEK). Google still controls the data encryption key (DEK). For more information on Google data encryption keys, see Encryption at Rest. https://cloud.google.com/dataproc/docs/concepts/configuring-clusters/customer-managed-encryption

https://codelabs.developers.google.com/codelabs/encrypt-and-decrypt-data-with-cloud-kms#0

Comprehensive and Detailed Explanation From Exact Extract:

The core requirement is to grant temporary, external users access to your Google Cloud environment while ensuring access control remains managed by their employer's identity provider (IdP). This allows your organization to follow the principle of least privilege and ensures access is revoked automatically when the user leaves the partner company (or is removed from the partner's IdP).

Workforce Identity Federation is the service specifically designed for granting external identities (partners, vendors, customers) access to Google Cloud resources without needing to sync or create managed Google accounts for them.

Extracts:

"Workforce Identity Federation is designed for the scenario where a partner organization needs to access your Google Cloud resources... it lets you use an external IdP to authenticate and authorize access to Google Cloud." (Source 1.1)

"Using Workforce Identity Federation is the most secure and efficient way to give external users access. Because authentication is handled by the external IdP, access is automatically revoked or suspended if the user is deactivated in the partner's IdP." (Source 1.2)

Option C would require your organization to manage the partner identities, violating the requirement for the partner's IdP to control the access lifecycle.