Professional-Cloud-Security-Engineer Exam Dumps : Google Cloud Certified - Professional Cloud Security Engineer

The requirements are a combination of preventative and detective controls (prevent and detect misconfigurations) applied at the Folder level to meet both industry-specific (predefined standards) and internal/custom policies. The dedicated Google Cloud feature for this is Security Posture Management in Security Command Center (SCC).

Postures and Enforcement: A Security Posture is a feature within SCC Premium/Enterprise that allows you to define, deploy, and monitor the security status of your cloud assets. You can deploy postures at the organization, folder, or project level to enforce standards.

Custom and Predefined Policies: A posture combines both:

Predefined Policies: Using Security Health Analytics (SHA) detectors and mapped standards (like CIS, ISO 27001, PCI DSS) covers the industry-specific compliance requirements (detection).

Custom Policies: Using custom Organization Policy constraints and custom SHA modules allows you to enforce and detect your internal company policies (prevention and detection).

Extracts:

"In Google Cloud, you can use the security posture service in Security Command Center to define and deploy a security posture, monitor the security status of your Google Cloud resources..." (Source 2.3)

"You can deploy postures at the organization level, folder level, or project level." (Source 2.3)

"The security posture service includes the following components: Posture. One or more policy sets that enforce the preventative and detective controls that your organization requires to meet its security standard... Supported policies are the following: Organization Policy constraints, including custom constraints [Preventative]. Security Health Analytics detectors, including custom modules [Detective]." (Source 2.3, 8.2)

Option C correctly identifies the comprehensive solution for both prevention and detection using a Posture file, which supports custom and predefined policies enforced at the required scope (folder).

Generate Supply Chain Levels for Software Artifacts (SLSA) level 3 assurance by using Cloud Build: SLSA is a framework for ensuring the integrity of software artifacts. By using Cloud Build, you can automate the build process and generate SLSA level 3 compliance, which includes verifiable build steps and provenance.

View the build provenance in the Security insights side panel within the Google Cloud console: The build provenance provides a detailed history of how the software was built, including the source code, build process, and any dependencies. This information is accessible through the Security insights side panel in the Google Cloud console, allowing you to verify the integrity and authenticity of your software artifacts.

References

Supply Chain Levels for Software Artifacts (SLSA) documentation

Cloud Build documentation

Security insights in Google Cloud console

The core requirement is to ensure only scanned and verified containers can run in the environment, which is a deployment-time enforcement action.

Binary Authorization is the service designed for this purpose. It is a deployment-time security control that ensures only trusted container images are deployed on Google Kubernetes Engine (GKE) or other supported container platforms. The core mechanism it uses to verify that an image has completed required steps (like a vulnerability scan) is an attestation.

Extracts:

"GCP Binary Authorization is a security feature designed to prevent the deployment of unverified, unauthorized, or potentially malicious container images to Kubernetes clusters." (Source 1.1)

"Binary Authorization ensures that only images that are signed by trusted entities (such as a trusted attestation authority) are allowed to be deployed." (Source 1.1)

"Binary Authorization aims to reduce the risk of deploying defective, vulnerable, or unauthorized software in this type of environment. Using this service, you can prevent images from being deployed unless it satisfies a policy you define." (Source 1.2)

"The most common Binary Authorization use cases involve attestations. An attestation certifies that a specific image has completed a previous stage... Attestations signify that the associated image was built by successfully executing a specific, required process. For example, the attestation might indicate that the image has passed all required end-to-end functional testing in a staging environment." (Source 1.2, 1.4)

"After a container image is built, an attestation can be created to affirm that a required activity was performed on the image such as a regression test, vulnerability scan, or other test." (Source 1.5)

Option A correctly identifies the two necessary components for this deployment-time enforcement: Binary Authorization for policy enforcement and attestations to certify that the vulnerability scan (or other required check) has been completed and verified.