Sure Pass Exam Professional-Cloud-Security-Engineer PDF

roles/logging.privateLogViewer (Private Logs Viewer) includes all the permissions contained by roles/logging.viewer, plus the ability to read Data Access audit logs in the _Default bucket.

Objective: Implement external web application protection and validate policy changes before enforcement.

Solution: Use Google Cloud Armor's preconfigured rules in preview mode.

Steps:

Step 1: Open the Google Cloud Console.

Step 2: Navigate to the Google Cloud Armor section.

Step 3: Create or select a security policy.

Step 4: Apply preconfigured rules to the policy.

Step 5: Enable preview mode to simulate the effects of the rules without enforcing them.

Step 6: Monitor the logs to validate the policy changes.

Google Cloud Armor's preview mode allows you to test and validate the impact of security policies on your application traffic before applying them, ensuring that they work as intended without disrupting the service.

The core requirement is to grant temporary, external users access to your Google Cloud environment while ensuring access control remains managed by their employer's identity provider (IdP). This allows your organization to follow the principle of least privilege and ensures access is revoked automatically when the user leaves the partner company (or is removed from the partner's IdP).

Workforce Identity Federation is the service specifically designed for granting external identities (partners, vendors, customers) access to Google Cloud resources without needing to sync or create managed Google accounts for them.

Extracts:

"Workforce Identity Federation is designed for the scenario where a partner organization needs to access your Google Cloud resources... it lets you use an external IdP to authenticate and authorize access to Google Cloud." (Source 1.1)

"Using Workforce Identity Federation is the most secure and efficient way to give external users access. Because authentication is handled by the external IdP, access is automatically revoked or suspended if the user is deactivated in the partner's IdP." (Source 1.2)

Option C would require your organization to manage the partner identities, violating the requirement for the partner's IdP to control the access lifecycle.

To ensure that data is encrypted while in use by the virtual machines (VMs) and enforce this policy across your organization, you should use Confidential VM instances. Here are the steps:

Enable Confidential VM:

Ensure that Confidential VMs are available in your selected regions and enabled for your project.

Set Organization Policy:

Implement an organization policy to enforce the use of Confidential VM instances for all VMs across your organization.

Use the Google Cloud Console or the gcloud command-line tool to set this policy. Example command:

gcloud resource-manager org-policies set-policy my_policy.yaml

Example my_policy.yaml:

name: organizations/1234567890/policies/compute.requireConfidentialCompute spec: rules: - enforce: true

Verify and Monitor:

Ensure that all newly created VMs across your organization are Confidential VMs.

Regularly monitor compliance through the Google Cloud Console and set up alerts if non-compliant VMs are created.

Benefits:

Data Encryption in Use: Confidential VMs ensure that data is encrypted not just at rest and in transit but also while in use.

Policy Enforcement: Organization policies provide a way to enforce security configurations across all projects under your organization.

References

Confidential Computing Documentation

Creating and Managing Organization Policies