Google Professional Cloud Security Engineer Question 387
Select 4Google Cloud PlatformYour organization is deploying a critical application on Google Cloud. To ensure infrastructure and application security, you need to automate security configurations and enforce compliance policies across all environments. Which of the following solutions would you implement to achieve this?
- A
Use Google Cloud Deployment Manager to define infrastructure as code and enforce security configurations.
- B
Integrate Google Cloud Security Command Center (SCC) to continuously monitor and detect vulnerabilities.
- C
Leverage Binary Authorization to enforce deployment of only trusted container images.
- D
Manually configure IAM roles and permissions for each environment to prevent unauthorized access.
- E
Use Forseti Security to scan and enforce policy compliance across resources.
Show answer and explanation
Correct answers: A, B, C, E
Explanation
To automate infrastructure and application security in Google Cloud, you should use tools like Deployment Manager to enforce security configurations as code, SCC for continuous monitoring, Binary Authorization for trusted container deployments, and Forseti Security for policy enforcement. Manual processes are not recommended due to their lack of scalability and risk of human error.
- A. Correct.
Google Cloud Deployment Manager allows you to define infrastructure as code, enabling consistent and automated configuration of security settings.
- B. Correct.
Google Cloud Security Command Center helps monitor and detect vulnerabilities, providing visibility into your cloud environment's security posture.
- C. Correct.
Binary Authorization ensures that only trusted, signed container images are deployed, preventing the use of unverified or potentially malicious images.
- D. Incorrect.
Manually configuring IAM roles and permissions is error-prone and does not scale well, making it unsuitable for automated security enforcement.
- E. Correct.
Forseti Security is a suite of tools to enforce policy compliance and scan for misconfigurations in your Google Cloud environment.