Professional Cloud Security Engineer Compute Practice Questions

Your team needs to make sure that a Compute Engine instance does not have access to the internet or to any Google APIs or services. Which two settings must remain disabled to meet these requirements? (Choose two.)

Select 2 answers.

• AA. Public IP
• BB. IP Forwarding
• CC. Private Google Access
• DD. Static routes
• EE. IAM Network User Role

Your team sets up a Shared VPC Network where project co-vpc-prod is the host project. Your team has configured the firewall rules, subnets, and VPN gateway on the host project. They need to enable Engineering Group A to attach a Compute Engine instance to only the 10.1.1.0/24 subnet. What should your team grant to Engineering Group A to meet this requirement?

• AA. Compute Network User Role at the host project level.
• BB. Compute Network User Role at the subnet level.
• CC. Compute Shared VPC Admin Role at the host project level.
• DD. Compute Shared VPC Admin Role at the service project level.

A customer has an analytics workload running on Compute Engine that should have limited internet access. Your team created an egress firewall rule to deny (priority 1000) all traffic to the internet. The Compute Engine instances now need to reach out to the public repository to get security updates. What should your team do?

• AA. Create an egress firewall rule to allow traffic to the CIDR range of the repository with a priority greater than 1000.
• BB. Create an egress firewall rule to allow traffic to the CIDR range of the repository with a priority less than 1000.
• CC. Create an egress firewall rule to allow traffic to the hostname of the repository with a priority greater than 1000.
• DD. Create an egress firewall rule to allow traffic to the hostname of the repository with a priority less than 1000.

You will create a new Service Account that should be able to list the Compute Engine instances in the project. You want to follow Google-recommended practices. What should you do?

• AA. Create an Instance Template, and allow the Service Account Read Only access for the Compute Engine Access Scope.
• BB. Create a custom role with the permission compute.instances.list and grant the Service Account this role.
• CC. Give the Service Account the role of Compute Viewer, and use the new Service Account for all instances.
• DD. Give the Service Account the role of Project Viewer, and use the new Service Account for all instances.