Google Updated Professional-Cloud-Security-Engineer Exam Questions and Answers by amos

https://cloud.google.com/kms/docs/ekm#how_it_works

- First, you create or use an existing key in a supported external key management partner system. This key has a unique URI or key path.

- Next, you grant your Google Cloud project access to use the key, in the external key management partner system.

- In your Google Cloud project, you create a Cloud EKM key, using the URI or key path for the externally-managed key.

To ensure that data is encrypted while in use by the virtual machines (VMs) and enforce this policy across your organization, you should use Confidential VM instances. Here are the steps:

Enable Confidential VM:

Ensure that Confidential VMs are available in your selected regions and enabled for your project.

Set Organization Policy:

Implement an organization policy to enforce the use of Confidential VM instances for all VMs across your organization.

Use the Google Cloud Console or the gcloud command-line tool to set this policy. Example command:

gcloud resource-manager org-policies set-policy my_policy.yaml

Example my_policy.yaml:

name: organizations/1234567890/policies/compute.requireConfidentialCompute spec: rules: - enforce: true

Verify and Monitor:

Ensure that all newly created VMs across your organization are Confidential VMs.

Regularly monitor compliance through the Google Cloud Console and set up alerts if non-compliant VMs are created.

Benefits:

Data Encryption in Use: Confidential VMs ensure that data is encrypted not just at rest and in transit but also while in use.

Policy Enforcement: Organization policies provide a way to enforce security configurations across all projects under your organization.

References

Confidential Computing Documentation

Creating and Managing Organization Policies

Packet Mirroring Setup: Configure Packet Mirroring in your Google Cloud VPC to capture traffic to and from specific VM instances. This allows you to analyze the traffic for security and compliance purposes.

Security Software: Use specialized security software to inspect the mirrored traffic. This software can detect invalid or malicious content in the IP packets.

Mirroring Configuration: Specify the instances, network, and traffic direction (ingress, egress, or both) to be mirrored. Ensure that the mirrored traffic is directed to an appropriate analysis destination.

Traffic Analysis: Continuously monitor and analyze the mirrored traffic for any signs of malicious activity or anomalies. Use the findings to enhance your security posture and respond to potential threats. References:

Google Cloud - Packet Mirroring

Google Cloud - Packet Mirroring Best Practices

With Google Cloud Directory Sync (GCDS), you can synchronize the data in your Google Account with your Microsoft Active Directory or LDAP server. GCDS doesn't migrate any content (such as email messages, calendar events, or files) to your Google Account. You use GCDS to synchronize your Google users, groups, and shared contacts to match the information in your LDAP server.

https://support.google.com/a/answer/106368?hl=en