Professional-Cloud-Security-Engineer Exam Dumps - Google Cloud Certified Questions and Answers

Objective: Prevent users from creating projects while allowing only the DevOps team to create projects.

Solution: Modify IAM roles and permissions.

Steps:

Step 1: Open the Google Cloud Console.

Step 2: Navigate to the IAM & Admin page.

Step 3: At the organizational level, find and remove all users from the Project Creator role.

Step 4: Create or identify a group for the DevOps team.

Step 5: Assign the Project Creator role to the DevOps team group at the organizational level.

By removing all users from the Project Creator role and granting it only to the DevOps team, you ensure that only the designated team can create projects.

References:

GCP IAM Documentation

Project Creator Role

Organization Policy: Use the constraints/compute.skipDefaultNetworkCreation organization policy constraint to disable the creation of default networks in new projects.

Policy Application: Apply this constraint at the organization level to ensure it affects all projects within your organization, preventing the creation of default networks.

Best Practices Compliance: Following this best practice helps maintain a clean and secure network configuration by avoiding the use of default networks, which may not be properly segmented or secured.

Verification: Verify the policy application by creating new projects and ensuring that default networks are not created. References:

Google Cloud - Organization Policy Constraints

Google Cloud - Best Practices for Enterprise Organizations

This is a Customer-supplied encryption keys (CSEK). We generate our own encryption key and manage it on-premises. A KEK never leaves Cloud KMS.There is no KEK or KMS on-premises. Encryption at rest by default, with various key management options https://cloud.google.com/security/encryption-at-rest

Web Security Scanner is designed to scan your web applications deployed on Google Cloud for common vulnerabilities, including cross-site scripting (XSS). It can authenticate using Google accounts and can be scheduled to run scans regularly.

Steps:

Enable Web Security Scanner: In the Google Cloud Console, enable Web Security Scanner for your project.

Configure Scan: Set up the scan configuration, specifying the target URLs, authentication details (Google accounts), and scan frequency (at least once per week).

Run and Monitor Scans: Run the scans and monitor the results for vulnerabilities, addressing any issues found.

References:

Web Security Scanner documentation