Google CloudExpert levelPage 3 of 5

Google Professional Cloud Security Engineer exam dumps: questions 201 to 300 of 500

Page 3 of the free Google Professional Cloud Security Engineer question bank for the Professional Cloud Security Engineer exam. Questions 201 to 300 are listed below, the first 5 in full with answers and explanations. Back to page 1 for the exam overview and FAQ.

Question bank last updated January 2025

Start timed practice exam Questions 201 to 300

Free Google Professional Cloud Security Engineer practice questions

Questions 201 to 205 of 500

Pick an answer before you open the explanation. Each question also has its own page with a permalink.

Google Professional Cloud Security Engineer Question 201

Select 3Google Cloud Platform

You are a Cloud Security Engineer tasked with configuring application layer (Layer 7) inspection for a web application hosted on Google Cloud. The application is fronted by a Cloud Load Balancer, and you want to ensure that only legitimate HTTP traffic is allowed while blocking unauthorized or malicious traffic. Which steps should you take to implement this using Cloud NGFW?

A
Deploy the Cloud NGFW in your Virtual Private Cloud (VPC) and configure it as an ingress firewall to inspect traffic.
B
Enable Layer 7 inspection within the Cloud Load Balancer by enabling HTTP-specific rules.
C
Create a security policy in the Cloud NGFW that includes an application filter to allow HTTP traffic and block unwanted applications.
D
Attach the Cloud NGFW to the backend instances of the load balancer to inspect application traffic.
E
Integrate Cloud NGFW with the Cloud Load Balancer by using a Service Attachment to route traffic through the firewall.

Show answer and explanation

Correct answers: A, C, E

Explanation

To enable application layer (Layer 7) inspection for traffic routed through a Cloud Load Balancer, you need to deploy the Cloud NGFW in your VPC and integrate it with the Load Balancer using a Service Attachment. This setup routes traffic through the NGFW for inspection. Additionally, you must create appropriate security policies in the NGFW, such as application filters, to inspect and control Layer 7 traffic (e.g., HTTP). Simply relying on the Cloud Load Balancer or attaching the NGFW to backend instances is not sufficient for this use case.

A. Correct.
Correct: Deploying the Cloud NGFW in your VPC and configuring it as an ingress firewall is a necessary step to enable application layer inspection for incoming traffic.
B. Incorrect.
Incorrect: While Cloud Load Balancers handle Layer 4/7 traffic, they do not provide in-depth application layer firewall capabilities. This feature must be configured on the Cloud NGFW.
C. Correct.
Correct: Application filters in the Cloud NGFW are essential to allow specific types of Layer 7 traffic (e.g., HTTP) and block other unwanted or malicious traffic.
D. Incorrect.
Incorrect: Cloud NGFW cannot be directly attached to backend instances. Instead, the traffic needs to be routed through the firewall before reaching the backend.
E. Correct.
Correct: Integrating Cloud NGFW with the Cloud Load Balancer using a Service Attachment allows traffic to flow through the firewall for inspection before reaching the backend.

Google Professional Cloud Security Engineer Question 202

Select 3Google Cloud Platform

Your organization is deploying a web application to Google Cloud using Compute Engine instances behind a load balancer. To ensure proper security, you are tasked with setting up application layer (Layer 7) inspection to detect and prevent malicious web requests, such as SQL injection and cross-site scripting (XSS). You decide to use Cloud NGFW. Which steps should you take to configure application layer inspection correctly?

A
Enable Cloud NGFW and configure a Layer 7 rule to inspect HTTP/HTTPS traffic.
B
Integrate Cloud NAT with Cloud NGFW for outgoing traffic inspection.
C
Attach the Cloud NGFW policy to the VPC network where the Compute Engine instances are deployed.
D
Configure a URL filtering profile in Cloud NGFW to block access to malicious or suspicious domains.
E
Enable SSL decryption on Cloud NGFW to inspect encrypted HTTPS traffic.

Show answer and explanation

Correct answers: A, C, E

Explanation

To set up application layer (Layer 7) inspection using Cloud NGFW, you need to configure Layer 7 rules to inspect HTTP/HTTPS traffic, attach the NGFW policy to the relevant VPC network, and enable SSL decryption to inspect encrypted traffic. These steps ensure that malicious payloads embedded in HTTP or HTTPS requests, such as SQL injection or XSS, can be detected and mitigated. Other features, such as URL filtering, may complement the solution but are not sufficient for full Layer 7 inspection.

A. Correct.
Correct. Cloud NGFW supports Layer 7 inspection rules, which are necessary to analyze and filter HTTP/HTTPS traffic for threats like SQL injection and XSS.
B. Incorrect.
Incorrect. While Cloud NAT can be used for outgoing traffic, it is not directly related to setting up Layer 7 inspection on Cloud NGFW.
C. Correct.
Correct. Attaching the Cloud NGFW policy to the correct VPC network is essential to ensure traffic flows through the firewall for inspection.
D. Incorrect.
Incorrect. URL filtering profiles are useful for blocking specific domains but are not sufficient by themselves to configure Layer 7 inspection for web application security.
E. Correct.
Correct. SSL decryption is necessary for Cloud NGFW to inspect encrypted HTTPS traffic at Layer 7, as encrypted traffic must be decrypted for inspection.

Google Professional Cloud Security Engineer Question 203

Select 3Google Cloud Platform

Your organization is deploying a mission-critical web application on Google Cloud. As part of the security architecture, you are tasked with setting up application layer (Layer 7) inspection for HTTP and HTTPS traffic using Cloud NGFW to detect and block malicious activities. Which of the following steps should you take to achieve this?

A
Enable an HTTP/HTTPS-based Layer 7 policy on the Cloud NGFW instance.
B
Configure URL filtering rules to block access to malicious or restricted sites.
C
Set up Cloud Armor policies to handle Layer 7 inspection for the application.
D
Enable the Cloud NGFW Threat Prevention feature to detect and block Layer 7 attacks.
E
Create and attach a Cloud NAT gateway to the Cloud NGFW instance for Layer 7 inspection.

Show answer and explanation

Correct answers: A, B, D

Explanation

To enable application-layer (Layer 7) inspection on Cloud NGFW, you need to configure HTTP/HTTPS-based Layer 7 policies, URL filtering, and enable the Threat Prevention feature. These configurations ensure that malicious activities at the application layer are detected and blocked. Cloud Armor and Cloud NAT serve different purposes and are not directly related to Layer 7 inspection within Cloud NGFW.

A. Correct.
Enabling an HTTP/HTTPS-based Layer 7 policy on the Cloud NGFW instance is a required step to inspect and secure traffic at the application layer.
B. Correct.
Configuring URL filtering rules on the Cloud NGFW helps block access to known malicious sites or restricted domains, enhancing Layer 7 security.
C. Incorrect.
While Cloud Armor provides DDoS protection and WAF capabilities, it is not used for Layer 7 inspection on Cloud NGFW directly.
D. Correct.
The Threat Prevention feature on Cloud NGFW is essential for detecting and blocking application-layer attacks, such as SQL injections or cross-site scripting (XSS).
E. Incorrect.
A Cloud NAT gateway is used for outbound internet access but is not required for application-layer (Layer 7) inspection on Cloud NGFW.

Google Professional Cloud Security Engineer Question 204

Select 2Google Cloud Platform

You are designing a Google Cloud VPC for a multi-tier application. The application consists of a web tier that must be accessible to users on the internet and a database tier that should only be accessible from within the VPC. Which of the following configurations ensures proper IP addressing for this setup?

A
Assign public IP addresses to instances in the web tier and private IP addresses to instances in the database tier.
B
Assign private IP addresses to both the web tier and database tier, and use a Cloud NAT for internet access.
C
Use private IP addresses for the web tier and database tier and configure an external load balancer to expose the web tier to the internet.
D
Assign public IP addresses to both the web tier and the database tier for easier management and connectivity.
E
Assign private IP addresses to the database tier and use a public IP address for the web tier, exposed via an external load balancer.

Show answer and explanation

Correct answers: A, E

Explanation

In Google Cloud, public IP addresses are used to make resources accessible over the internet, while private IP addresses are used for internal communication within a VPC. For a multi-tier application, the web tier typically requires public IPs or an external load balancer to handle internet traffic, while the database tier should use private IPs to remain secure and isolated. Configurations that expose the database tier to the internet or fail to provide internet access to the web tier are incorrect.

A. Correct.
Correct: The web tier needs public IP addresses for internet accessibility, while the database tier should remain isolated within the VPC and use private IP addresses for security.
B. Incorrect.
Incorrect: Using private IP addresses for the web tier without an external load balancer will not make it accessible to internet users.
C. Incorrect.
Incorrect: While private IP addresses improve security, an external load balancer alone cannot expose the web tier to the internet without public IPs.
D. Incorrect.
Incorrect: Assigning public IP addresses to both tiers compromises the security of the database and is not a best practice for securing sensitive data.
E. Correct.
Correct: This setup ensures that the database tier remains private for security, while the web tier is exposed to the internet via an external load balancer using a public IP.

Google Professional Cloud Security Engineer Question 205

Select 1Google Cloud Platform

You are setting up a Virtual Private Cloud (VPC) network in Google Cloud for a new web application. The application will have a front-end web server and a back-end database server. The web server must be accessible from the internet, while the database server should only be accessible internally within the VPC. Which of the following IP address configurations should you use to meet these requirements?

A
Assign a public IP address to the web server and a private IP address to the database server.
B
Assign a private IP address to both the web server and the database server.
C
Assign a public IP address to both the web server and the database server.
D
Assign a private IP address to the web server and configure Cloud NAT for internet access.
E
Assign a public IP address to the database server and a private IP address to the web server.

Show answer and explanation

Correct answer: A

Explanation

When designing a secure and functional VPC network in Google Cloud, it is important to use public IP addresses only for resources that need to be accessible from the internet, such as a front-end web server. Private IP addresses should be used for internal resources, such as a back-end database server, to restrict access and enhance security. This ensures that publicly accessible resources are minimized and sensitive resources remain internal.

A. Correct.
This is the correct configuration because the web server needs a public IP to be accessible from the internet, while the database server should remain internal with a private IP address for security.
B. Incorrect.
This is incorrect because the web server would not be accessible from the internet without a public IP address.
C. Incorrect.
This is incorrect because assigning a public IP to the database server would expose it to the internet, which is not secure or necessary.
D. Incorrect.
This is incorrect because assigning only a private IP to the web server and relying on Cloud NAT would not make it accessible from the internet.
E. Incorrect.
This is incorrect because the database server does not need a public IP address and exposing it to the internet would pose a security risk.

Timed practice exam

Take a Google Professional Cloud Security Engineer practice test under exam conditions

60 questions in 120 minutes, drawn from this bank, with a score report and a per-question review when you finish.

Start timed exam

Google Professional Cloud Security Engineer practice questions 201 to 300 of 500

Every question has a page with the answer and explanation. Numbers are stable, so you can bookmark or share them. The bank is split into 5 pages of up to 100 questions.

More Google Cloud exam dumps

All Google Cloud exams

374 questions

Google Associate Cloud Engineer exam dumps

Associate Cloud Engineer

258 questions

Google Professional Cloud Database Engineer exam dumps

Professional Cloud Database Engineer

266 questions

Google Professional Cloud DevOps Engineer exam dumps

Professional Cloud DevOps Engineer

480 questions

Google Professional Cloud Developer exam dumps

Professional Cloud Developer

789 questions

Google Professional Cloud Network Engineer exam dumps

Professional Cloud Network Engineer

278 questions

Google Professional Data Engineer exam dumps

Professional Data Engineer

521 questions

Google Professional Machine Learning Engineer exam dumps

Professional Machine Learning Engineer