Google Updated Professional-Cloud-Security-Engineer Exam Questions and Answers by caelan

To restrict access to the MySQL instance to only the frontend application while other VMs are present in the subnets, creating an ingress firewall rule is the most appropriate approach. This rule will specifically allow traffic from subnet A (where the frontend application resides) to the MySQL instance in subnet B on port 3306, using network tags to target the specific MySQL VM.

Steps:

Create Network Tags: Apply a network tag (e.g., "data-tag") to the MySQL VM in subnet B.

Create Ingress Firewall Rule: Configure an ingress firewall rule with the following settings:

Source IP Range: Subnet A's IP range.

Target Tag: "data-tag".

Allowed Protocol/Ports: TCP:3306 (for MySQL).

This setup ensures that only instances in subnet A can communicate with the MySQL instance on port 3306.

References:

Google Cloud: Configuring firewall rules

Objective: Quickly recover a deleted service account used for data transfers.

Solution: Use the undelete command available in the gcloud command-line tool to recover the service account.

Steps:

Step 1: Open the Cloud Shell in the Google Cloud Console.

Step 2: Run the following command to list the deleted service accounts:

gcloud iam service-accounts list --filter="deleted: true"

Step 3: Identify the name and ID of the deleted service account.

Step 4: Use the undelete command to recover the service account:

gcloud iam service-accounts undelete [SERVICE_ACCOUNT_ID]

Step 5: Verify that the service account has been restored and reassign any necessary permissions.

By using the undelete command, you can quickly restore the service account and resume application functionality without compromising security.

References:

Restoring a Deleted Service Account

gcloud iam service-accounts undelete

Enable the compute.restrictXpnProjectLienRemoval organization-level policy constraint:

This constraint prevents users from removing liens from Shared VPC host projects.

By enabling this constraint, you ensure that the Shared VPC host project cannot be accidentally deleted, as liens prevent deletion without proper authorization.

Apply this constraint via the Google Cloud Console or using the gcloud command-line tool.

References:

Organization Policy Constraints

Shared VPC

To comply with FIPS 140-2 for the messaging app, you need to ensure that both data at rest and data in transit are encrypted according to the standard. Using customer-managed encryption keys (CMEK) ensures that you have control over the encryption keys, and BoringSSL is a library that meets FIPS 140-2 standards for encrypting data in transit.

Steps:

Encrypt Local SSDs: Modify the instance template for the Managed Instance Group (MIG) to use customer-managed encryption keys (CMEK) for encrypting Local SSDs.

Enable BoringSSL: Update the application to use the BoringSSL library for all instance-to-instance communication to ensure that all data in transit is encrypted according to FIPS 140-2 standards.

References:

Google Cloud: Customer-managed encryption keys (CMEK)

BoringSSL documentation