Google Professional-Cloud-Security-Engineer Test Dumps

A.   Add the host project containing the Shared VPC to the service perimeter.

B.   Create an egress firewall rule to allow traffic to the CIDR range of the repository with a priority less than 1000.

Answer DescriptionExplanation:

To allow Compute Engine instances to access public repositories for security updates while an egress firewall rule is in place to deny all internet traffic, you need to create a more specific egress rule that permits traffic to the CIDR range of the repository. The priority of this rule should be lower (i.e., a higher priority number) than the deny rule.

Steps:

Identify the CIDR Range: Determine the CIDR range of the public repository from which the security updates will be fetched. Create Egress Firewall Rule: Create a new egress firewall rule allowing traffic to the identified CIDR range with a priority less than 1000.

Apply Firewall Rule: Use the Google Cloud Console or gcloud command-line tool to apply the new firewall rule.

References:

Google Cloud: Firewall rules
Creating firewall rules

A.   Admin Activity logs


C.   Data Access logs

Answer DescriptionExplanation:

To keep track of "who did what, where, and when?" within GCP projects, the administrator should focus on Admin Activity logs and Data Access logs. Here’s a detailed explanation of why these two log streams are essential:

Admin Activity Logs:

These logs capture administrative actions performed in your Google Cloud resources. This includes actions like creating, modifying, or deleting resources.

Admin Activity logs provide detailed information about the user who performed the action, the resource that was affected, the action performed, and the timestamp.

Data Access Logs:

These logs capture read and write operations on data within your Google Cloud services. This includes actions like accessing or modifying data stored in databases, storage buckets, etc. Data Access logs help track the access patterns of users and services to sensitive data, providing insights into who accessed which data and when.

Steps to Enable and Access Logs:

Navigate to the Google Cloud Console.
Go to Logging in the left-hand menu.
Enable Admin Activity and Data Access logs if not already enabled.
Use Logs Explorer to filter and view specific logs based on your requirements.

By monitoring both Admin Activity and Data Access logs, administrators can gain comprehensive visibility into the actions performed on their GCP resources and data, ensuring robust security and compliance tracking.

References:

Google Cloud Logging Documentation
Audit Logs Overview

D.   Configure workload identity federation to use GitHub as an identity pool provider.

Answer DescriptionExplanation:

Challenge:

Ensuring secure access to Google Cloud resources from GitHub Actions CI/CD pipelines without directly managing service account keys.

Workload Identity Federation:

Allows for the delegation of access to Google Cloud resources based on federated identities, such as those from GitHub.

Benefits:

This approach eliminates the need to manage service account keys, reducing the risk of key leakage. It leverages GitHub's identity provider capabilities to authenticate and authorize access.

Steps to Configure Workload Identity Federation:

Step 1: Create a workload identity pool in Google Cloud.
Step 2: Add GitHub as an identity provider within the pool.
Step 3: Configure the necessary permissions and bindings for the identity pool to allow GitHub Actions to access Google Cloud resources.
Step 4: Update the GitHub Actions workflow to use the identity federation for authentication.

References:

Workload Identity Federation
Configuring Workload Identity Federation with GitHub

D.   Create a new service account, and grant it G Suite domain-wide delegation. Have the application use it to impersonate the user.

Answer DescriptionExplanation:

To access a user's Google Drive on their behalf without relying on the user's credentials and following Google-recommended practices, you should use a service account with domain-wide delegation.

Create a Service Account:

Go to the Cloud Console, navigate to IAM & Admin > Service Accounts.
Click "Create Service Account" and provide necessary details.
Grant Domain-Wide Delegation:
Edit the service account to enable "G Suite Domain-wide Delegation".
Download the JSON key file.

Configure API Access in G Suite:

Go to the Google Admin Console.
Navigate to Security > API Controls > Domain-wide Delegation.
Add a new API client and use the client ID from the service account.
Authorize the necessary API scopes (e.g., https://www.googleapis.com/auth/drive).

Implement in Application:

Use the Google API Client Library for the desired language.
Load the service account credentials and perform user impersonation to access Google Drive.
References:

Domain-wide Delegation of Authority
Using OAuth 2.0 for Server to Server Applications