Google Updated Professional-Cloud-Security-Engineer Exam Questions and Answers by hania

A security key is a physical device that you can use for two-step verification, providing an additional layer of security for your Google Account. Security keys can defend against phishing and man-in-the-middle attacks, making your login process more secure.

To ensure that data is encrypted while in use by the virtual machines (VMs) and enforce this policy across your organization, you should use Confidential VM instances. Here are the steps:

Enable Confidential VM:

Ensure that Confidential VMs are available in your selected regions and enabled for your project.

Set Organization Policy:

Implement an organization policy to enforce the use of Confidential VM instances for all VMs across your organization.

Use the Google Cloud Console or the gcloud command-line tool to set this policy. Example command:

gcloud resource-manager org-policies set-policy my_policy.yaml

Example my_policy.yaml:

name: organizations/1234567890/policies/compute.requireConfidentialCompute spec: rules: - enforce: true

Verify and Monitor:

Ensure that all newly created VMs across your organization are Confidential VMs.

Regularly monitor compliance through the Google Cloud Console and set up alerts if non-compliant VMs are created.

Benefits:

Data Encryption in Use: Confidential VMs ensure that data is encrypted not just at rest and in transit but also while in use.

Policy Enforcement: Organization policies provide a way to enforce security configurations across all projects under your organization.

References

Confidential Computing Documentation

Creating and Managing Organization Policies

Identity-Aware Proxy (IAP) controls access to web resources based on user identity and context, not network firewalls (like Option B). The tool used to define the contextual requirements (IP range) and identity (group membership) is an Access Level within Access Context Manager.

Access Level: Defines the required context (e.g., source IP range of the internal network) and the required identity attributes (e.g., user is a member of the AppDev group).

IAP Policy: The IAP policy for the Cloud Run application is then configured to only allow access if the user meets the conditions defined in the Access Level.

Extracts:

"Identity-Aware Proxy works by verifying a user's identity and context of the request to determine if the user should be allowed to access an application." (Source 3.1)

"When you set an IAP policy, you can define an Access Level from Context-Aware Access to enforce conditions based on user location (IP address), security status, and device policy, along with user identity/group membership." (Source 3.2)

"IAP with Context-Aware Access is the recommended zero-trust approach for enforcing both identity (AppDev group) and context (internal IP address) requirements." (Source 3.3)