Professional Cloud Security Engineer
Prepare and test your skills
Prepare and test your skills
Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.
A financial enterprise is implementing continuous configuration drift detection across its Google Cloud organization using Security Command Center. To mitigate risks highlighted in recent security bulletins concerning OpenSSH vulnerabilities, the security team needs to deploy a custom Security Health Analytics (SHA) detection module.
The module must evaluate all Compute Engine firewall rules across projects and automatically generate a CRITICAL finding whenever an active ingress rule allows unrestricted traffic from the public internet (0.0.0.0/0) to TCP port 22.
How should the custom SHA module and its Common Expression Language (CEL) expression be configured?
Set the resource selector to compute.googleapis.com/Instance, set the severity to CRITICAL, and define a CEL expression checking resource.data.tags.items.exists(tag, tag == 'allow-ssh').
Create a custom Organization Policy boolean constraint using CEL on compute.googleapis.com/Firewall with enforcement set to audit to generate findings in Security Command Center.
Set the resource selector to compute.googleapis.com/Firewall, set the severity to CRITICAL, and define a CEL expression that evaluates to false when an ingress rule contains 0.0.0.0/0 and allows TCP port 22.
Set the resource selector to compute.googleapis.com/Firewall, set the severity to CRITICAL, and define a CEL expression that evaluates to true when an enabled ingress rule includes 0.0.0.0/0 in sourceRanges and allows TCP port 22.
Keep the momentum going with these hand-picked practice scenarios
Want more questions like this?
Get a free certification question every week.
Still curious? Scout, our AI tutor, can explain this concept further and answer your follow-up questions.
StudyCerts
StudyCerts