Professional-Cloud-Security-Engineer Exam Dumps : Google Cloud Certified - Professional Cloud Security Engineer

To connect Compute Engine instances within a Google Cloud Platform project to workloads running in a dedicated server room that can only be accessed from within the private company network, you can use the following approaches:

Cloud VPN: Cloud VPN securely connects your on-premises network to your Google Cloud Virtual Private Cloud (VPC) network through an IPsec VPN connection. This enables secure communication between your GCP instances and your on-premises workloads over the internet.

Cloud Interconnect: Cloud Interconnect provides direct physical connections between your on-premises network and Google's network. It offers higher bandwidth and lower latency compared to Cloud VPN, making it suitable for workloads that require fast and reliable connectivity.

Both Cloud VPN and Cloud Interconnect allow you to securely connect your on-premises environments to Google Cloud, ensuring that the workloads remain within the private company network.

References

Cloud VPN Overview

Cloud Interconnect Overview

Objective: Synchronize security groups with email addresses from an LDAP directory to Cloud IAM.

Solution: Use Google Cloud Directory Sync (GCDS) to perform one-way synchronization based on LDAP search rules.

Steps:

Step 1: Download and install Google Cloud Directory Sync (GCDS) on a secure server.

Step 2: Configure GCDS with the LDAP server details and authentication.

Step 3: Define LDAP search rules to filter security groups based on the “user email address” attribute.

Step 4: Map LDAP security groups to Google Cloud IAM roles.

Step 5: Set up a synchronization schedule to keep the groups in sync.

Step 6: Perform a test sync to ensure that the configuration is correct.

Step 7: Activate the synchronization to keep the LDAP directory and Cloud IAM in sync.

Using GCDS for one-way synchronization ensures that the security groups in Cloud IAM are consistently updated based on the LDAP directory, maintaining alignment with the organization’s security policies.

Google Cloud Logging supports Field-level access control, which allows you to hide specific sensitive fields within a log entry from certain users while still allowing them to see the rest of the log entry.5 This is achieved using Log Views and IAM.

According to Google Cloud Documentation (Configuring field-level access):

"Field-level access control allows you to restrict access to specific fields of LogEntry objects. You can define which fields are sensitive (such as principalEmail) and then grant the logging.fieldAccessor role to specific users or groups.6 Users without this role will see the log entry, but the sensitive fields will be redacted or omitted from their view."

Key Implementation Steps:

Identify Fields: Determine which paths in the JSON payload are sensitive.

Define Access: Use a Log View to define the scope of logs and apply field-level restrictions.7

Grant Permissions: Grant the standard logging.viewer role for general access and the logging.fieldAccessor role ONLY to the security team for the specific sensitive fields.

Why other options are incorrect:

B is incorrect: IAM conditions cannot natively parse and redact specific JSON fields within a log entry at the platform level; they are typically used for resource-level access.

C is incorrect: While excluding fields via a sink works, it is "all or nothing." If you exclude it at the sink, no one (including the security team) will see that data in the destination.

D is incorrect: This is a workaround that only works if the team uses BigQuery for logs. It doesn't solve the problem within the Cloud Logging Logs Explorer itself.