Professional Cloud Security Engineer
Prepare and test your skills
Prepare and test your skills
Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.
Keep the momentum going with these hand-picked practice scenarios
Want more questions like this?
Get a free certification question every week.
Last updated
A financial enterprise is implementing continuous configuration drift detection across its Google Cloud organization using Security Command Center. To mitigate risks highlighted in recent security bulletins concerning OpenSSH vulnerabilities, the security team needs to deploy a custom Security Health Analytics (SHA) detection module.
The module must evaluate all Compute Engine firewall rules across projects and automatically generate a CRITICAL finding whenever an active ingress rule allows unrestricted traffic from the public internet (0.0.0.0/0) to TCP port 22.
How should the custom SHA module and its Common Expression Language (CEL) expression be configured?
Set the resource selector to compute.googleapis.com/Firewall, set the severity to CRITICAL, and define a CEL expression that evaluates to false when an ingress rule contains 0.0.0.0/0 and allows TCP port 22.
Set the resource selector to compute.googleapis.com/Instance, set the severity to CRITICAL, and define a CEL expression checking resource.data.tags.items.exists(tag, tag == 'allow-ssh').
Set the resource selector to compute.googleapis.com/Firewall, set the severity to CRITICAL, and define a CEL expression that evaluates to true when an enabled ingress rule includes 0.0.0.0/0 in sourceRanges and allows TCP port 22.
Create a custom Organization Policy boolean constraint using CEL on compute.googleapis.com/Firewall with enforcement set to audit to generate findings in Security Command Center.
Set the resource selector to compute.googleapis.com/Firewall, set the severity to CRITICAL, and define a CEL expression that evaluates to false when an ingress rule contains 0.0.0.0/0 and allows TCP port 22.
Set the resource selector to compute.googleapis.com/Instance, set the severity to CRITICAL, and define a CEL expression checking resource.data.tags.items.exists(tag, tag == 'allow-ssh').
Set the resource selector to compute.googleapis.com/Firewall, set the severity to CRITICAL, and define a CEL expression that evaluates to true when an enabled ingress rule includes 0.0.0.0/0 in sourceRanges and allows TCP port 22.
Security Health Analytics (SHA) custom modules allow organizations to extend Security Command Center's built-in vulnerability scanning by creating custom rules. These modules use Common Expression Language (CEL) to continuously evaluate asset configurations and metadata reported by Cloud Asset Inventory (CAI).
StudyCerts
StudyCertsresource_types to compute.googleapis.com/Firewall instructs the SHA engine to evaluate all firewall assets within the organization or folder scope.predicate.expression must evaluate to true when a vulnerability or misconfiguration exists. When the condition evaluates to true, Security Command Center automatically creates an active finding.!resource.data.disabled), enforces incoming traffic (resource.data.direction == "INGRESS"), contains the public IP range (resource.data.sourceRanges.exists(r, r == "0.0.0.0/0")), and permits port 22 (resource.data.allowed.exists(a, a.IPProtocol == "tcp" && a.ports.exists(p, p == "22"))).severity: "CRITICAL" categorizes the finding appropriately in the Security Command Center dashboard and triggers corresponding alerts.Create a custom Organization Policy boolean constraint using CEL on compute.googleapis.com/Firewall with enforcement set to audit to generate findings in Security Command Center.