Changed Professional-Cloud-Security-Engineer Exam Questions

Set a time to live (TTL) of 12 months for the files in the Cloud Storage bucket that removes PH and movesthe files to the archive storage class.

Create a Cloud Data Loss Prevention (DLP) inspection job that de-identifies Pll in files created more than 12months ago and archives them to another Cloud Storage bucket. Delete the original files.

Schedule a Cloud Key Management Service (KMS) rotation period of 12 months for the encryption keys ofthe Cloud Storage files containing Pll to de-identify them Delete the original keys.

Configure the Autoclass feature of the Cloud Storage bucket to de-identify Pll Archive the files that are olderthan 12 months Delete the original files.

Create an ingress firewall rule to allow access only from the application to the database using firewall tags.

Create a different subnet for the frontend application and database to ensure network isolation.

Create two VPC networks, and connect the two networks using Cloud VPN gateways to ensure network isolation.

Create two VPC networks, and connect the two networks using VPC peering to ensure network isolation.

Configure GCDS and use GCDS search rules lo sync these users.

Use the transfer tool to migrate unmanaged users.

Write a custom script to identify existing Google Cloud users and call the Admin SDK Directory API totransfer their account.

Configure GCDS and use GCDS exclusion rules to ensure users are not suspended.

Change the access control model for the bucket

Update your sink with the correct bucket destination.

Add the roles/logging.logWriter Identity and Access Management (IAM) role to the bucket for the log sink identity.

Add the roles/logging.bucketWriter Identity and Access Management (IAM) role to the bucket for the log sink identity.