Google Updated Professional-Cloud-Security-Engineer Exam Questions and Answers by payton

"The service evaluates all changes and remote access attempts to detect runtime attacks in near-real time." : https://cloud.google.com/security-command-center/docs/concepts-container-threat-detection-overview This has nothing to do with KNOWN security Vulns in images

Customer-Managed Encryption Keys (CMEK):

CMEK allows you to manage encryption keys using Cloud Key Management Service (KMS). This gives you control over the lifecycle of the keys, including rotation, destruction, and auditing.

Set up a Cloud KMS key ring and create encryption keys that will be used to protect your data in BigQuery, Cloud SQL, and Cloud Storage.

Configure the services to use CMEK for encrypting data at rest, ensuring compliance with your organization's security policies.

Cloud External Key Manager (EKM):

Cloud EKM allows you to use keys managed by an external key management provider to encrypt data in Google Cloud services.

Integrate your external key management system with Google Cloud using supported protocols and APIs.

Configure your data warehouse services to use the external keys for encryption, ensuring that key management is handled outside of the Google Cloud environment.

Key Access Justifications:

Enable Key Access Justifications to provide visibility into why encryption keys are being accessed. This helps in monitoring and auditing key usage to ensure compliance and security.

Set up policies and logging to capture and review key access requests, providing insights into how and why keys are used.

Access Transparency and Approval:

Implement Access Transparency to gain visibility into Google’s access to your data and encryption keys.

Configure Access Approval to require explicit approval for Google support or engineering access to your data, adding an additional layer of security and control.

References:

Customer-Managed Encryption Keys (CMEK)

Cloud External Key Manager (EKM)

Key Access Justifications

Access Transparency

Access Approval

To ensure that PII data is separated from non-PII data, using Cloud Pub/Sub and Cloud Functions to trigger a scan by the Data Loss Prevention (DLP) API is an effective approach. This method allows for automated detection and handling of PII.

Steps:

Set Up Cloud Pub/Sub: Configure a Cloud Pub/Sub topic to receive notifications whenever a file is uploaded to the shared Cloud Storage bucket.

Deploy Cloud Functions: Create a Cloud Function that is triggered by the Pub/Sub topic. This function will invoke the DLP API to scan the uploaded file for PII.

Move Detected PII Files: If the scan detects PII, the Cloud Function will move the file to a secure Cloud Storage bucket accessible only by the administrator.

Set Permissions: Ensure that appropriate permissions are set on the Cloud Storage buckets to restrict access to files containing PII.

References:

Google Cloud: Data Loss Prevention

Cloud Functions documentation

To enforce private connectivity between on-premises hosts and Google Cloud APIs while optimizing for cost and operational efficiency, using a dedicated or Partner Interconnect is the best solution. This setup ensures a reliable, high-bandwidth connection with private IP addressing.

Choose Interconnect Type: Decide between Dedicated Interconnect and Partner Interconnect based on your bandwidth needs and proximity to Google Cloud locations.

Set Up Interconnect:

For Dedicated Interconnect, order circuits through the Google Cloud Console.

For Partner Interconnect, select a supported service provider and order the connection through them.

Configure VPC and Private Google Access:

In your VPC, enable Private Google Access to allow on-premises hosts to access Google APIs privately.

Go to "VPC network" -> "Private Google Access" and enable it for your subnets.

Establish Connectivity: Work with your network team and (if applicable) your Partner Interconnect provider to set up the physical and logical connections.

Test Connectivity: Verify that on-premises hosts can reach Google Cloud services using private IP addresses.

References:

Google Cloud Interconnect Overview

Configuring Private Google Access