Google Cloud Certified Certification Professional-Cloud-Security-Engineer Sample Questions Reliable
Prepare for the Actual Google Cloud Certified Professional-Cloud-Security-Engineer Exam Practice Materials Collection
The Google Professional-Cloud-Security-Engineer exam is part of the Google Cloud Certified program, which offers a range of certifications for professionals who work with Google Cloud technologies. The Professional-Cloud-Security-Engineer certification is one of the most sought-after certifications in this program, as it demonstrates an individual's ability to design and implement secure cloud solutions using Google Cloud technologies.
Google Professional-Cloud-Security-Engineer (PCSE) exam is an advanced-level certification exam designed to test the knowledge and skills of security engineers who work with Google Cloud Platform (GCP). The PCSE certification is one of the most sought-after certifications in the cloud computing industry, and it demonstrates a high level of expertise in securing GCP environments.
NEW QUESTION # 142
Your team wants to centrally manage GCP IAM permissions from their on-premises Active Directory Service.
Your team wants to manage permissions by AD group membership.
What should your team do to meet these requirements?
- A. Use the Cloud Identity and Access Management API to create groups and IAM permissions from Active Directory.
- B. Use the Admin SDK to create groups and assign IAM permissions from Active Directory.
- C. Set up SAML 2.0 Single Sign-On (SSO), and assign IAM permissions to the groups.
- D. Set up Cloud Directory Sync to sync groups, and set IAM permissions on the groups.
Answer: D
Explanation:
Explanation
"In order to be able to keep using the existing identity management system, identities need to be synchronized between AD and GCP IAM. To do so google provides a tool called Cloud Directory Sync. This tool will read all identities in AD and replicate those within GCP. Once the identities have been replicated then it's possible to apply IAM permissions on the groups. After that you will configure SAML so google can act as a service provider and either you ADFS or other third party tools like Ping or Okta will act as the identity provider. This way you effectively delegate the authentication from Google to something that is under your control."
NEW QUESTION # 143
You work for a healthcare provider that is expanding into the cloud to store and process sensitive patient dat a. You must ensure the chosen Google Cloud configuration meets these strict regulatory requirements:
Data must reside within specific geographic regions.
Certain administrative actions on patient data require explicit approval from designated compliance officers.
Access to patient data must be auditable.
What should you do?
- A. Select multiple standard Google Cloud regions for high availability. Implement Access Control Lists (ACLs) on individual storage objects containing patient data. Enable Cloud Audit Logs.
- B. Deploy an Assured Workloads environment in an approved region. Configure Access Approval for sensitive operations on patient data. Enable both Cloud Audit Logs and Access Transparency.
- C. Select a standard Google Cloud region. Restrict access to patient data based on user location and job function by using Access Context Manager. Enable both Cloud Audit Logging and Access Transparency.
- D. Deploy an Assured Workloads environment in multiple regions for redundancy. Utilize custom IAM roles with granular permissions. Isolate network-level data by using VPC Service Controls.
Answer: B
Explanation:
To ensure compliance with strict regulatory requirements for storing and processing sensitive patient data in the cloud, the following measures should be implemented:
Assured Workloads: Deploying an Assured Workloads environment in an approved region ensures that data residency requirements are met by restricting data storage and processing to specific geographic locations. Assured Workloads provide predefined controls and configurations tailored to meet regulatory compliance needs.
Access Approval: Configuring Access Approval ensures that certain administrative actions on patient data require explicit approval from designated compliance officers. This adds a layer of control over sensitive operations, aligning with the need for explicit approvals.
Cloud Audit Logs and Access Transparency: Enabling Cloud Audit Logs provides a detailed record of actions taken on your data, supporting the requirement for auditability. Access Transparency logs offer visibility into Google's administrative access to your content, enhancing transparency and compliance.
Therefore, Option C is the most appropriate choice, as it comprehensively addresses data residency, administrative control, and auditability requirements.
Reference:
Assured Workloads Overview
Access Approval Documentation
Cloud Audit Logs Overview
Access Transparency Overview
NEW QUESTION # 144
A customer's company has multiple business units. Each business unit operates independently, and each has their own engineering group. Your team wants visibility into all projects created within the company and wants to organize their Google Cloud Platform (GCP) projects based on different business units. Each business unit also requires separate sets of IAM permissions.
Which strategy should you use to meet these needs?
- A. Create an organization node, and assign folders for each business unit.
- B. Assign GCP resources in a project, with a label identifying which business unit owns the resource.
- C. Assign GCP resources in a VPC for each business unit to separate network access.
- D. Establish standalone projects for each business unit, using gmail.com accounts.
Answer: A
Explanation:
To organize GCP projects based on different business units and manage IAM permissions, you should create an organization node and assign folders for each business unit. This approach allows you to logically separate projects under folders and apply IAM policies at the folder level.
Step-by-Step:
Create Organization Node: Ensure that your GCP account is linked to an organization.
Create Folders for Business Units:
Navigate to the GCP Console > IAM & Admin > Resource Manager.
Create a folder for each business unit under the organization node.
Move Projects to Folders:
Move existing projects into the respective folders according to the business unit.
Set IAM Policies:
Assign IAM roles and permissions at the folder level to manage access for each business unit independently.
Monitor and Manage: Use Cloud Audit Logs and other GCP tools to monitor the activities and ensure compliance with the organization's policies.
Reference:
Creating and Managing Folders
Managing IAM Policies
NEW QUESTION # 145
Your organization previously stored files in Cloud Storage by using Google Managed Encryption Keys (GMEK). but has recently updated the internal policy to require Customer Managed Encryption Keys (CMEK). You need to re-encrypt the files quickly and efficiently with minimal cost.
What should you do?
- A. Reupload the files to the same Cloud Storage bucket specifying a key file by using gsutil.
- B. Change the encryption type on the bucket to CMEK, and rewrite the objects
- C. Copy the files to a new bucket with CMEK enabled in a secondary region
- D. Encrypt the files locally, and then use gsutil to upload the files to a new bucket.
Answer: B
Explanation:
Explanation
Rewriting the objects in-place within the same bucket, specifying the new CMEK for encryption, allows you to re-encrypt the data without downloading and re-uploading it, thus minimizing costs and time.
https://cloud.google.com/storage/docs/encryption/using-customer-managed-keys
NEW QUESTION # 146
During a routine security review, your team discovered a suspicious login attempt to impersonate a highly privileged but regularly used service account by an unknown IP address. You need to effectively investigate in order to respond to this potential security incident. What should you do?
- A. Enable Cloud Audit Logs for the resources that the service account interacts with. Review the logs for further evidence of unauthorized activity.
- B. Run a vulnerability scan to identify potentially exploitable weaknesses in systems that use the service account.
- C. Review Cloud Audit Logs for activity related to the service account. Focus on the time period of the suspicious login attempt.
- D. Check Event Threat Detection in Security Command Center for any related alerts. Cross-reference your findings with Cloud Audit Logs.
Answer: D
Explanation:
ETD automatically detects suspicious activity, such as anomalous service account usage or potential credential compromise, by analyzing logs in near real-time.
Checking ETD alerts can quickly surface relevant insights about the suspicious activity.
Cloud Audit Logs:
Cross-referencing findings in ETD with Cloud Audit Logs helps confirm the scope of the incident by providing a complete history of actions performed by the service account, including the time of the suspicious login attempt.
NEW QUESTION # 147
You are a consultant for an organization that is considering migrating their data from its private cloud to Google Cloud. The organization's compliance team is not familiar with Google Cloud and needs guidance on how compliance requirements will be met on Google Cloud. One specific compliance requirement is for customer data at rest to reside within specific geographic boundaries. Which option should you recommend for the organization to meet their data residency requirements on Google Cloud?
- A. Access control lists
- B. Shielded VM instances
- C. Organization Policy Service constraints
- D. Geolocation access controls
- E. Google Cloud Armor
Answer: C
Explanation:
Explanation
https://cloud.google.com/resource-manager/docs/organization-policy/using-constraints#list-constraint
NEW QUESTION # 148
A company is running workloads in a dedicated server room. They must only be accessed from within the private company network. You need to connect to these workloads from Compute Engine instances within a Google Cloud Platform project.
Which two approaches can you take to meet the requirements? (Choose two.)
- A. Configure the project with Shared VPC.
- B. Configure all Compute Engine instances with Private Access.
- C. Configure the project with Cloud VPN.
- D. Configure the project with VPC peering.
- E. Configure the project with Cloud Interconnect.
Answer: B,D
NEW QUESTION # 149
A customer needs to prevent attackers from hijacking their domain/IP and redirecting users to a malicious site through a man-in-the-middle attack.
Which solution should this customer use?
- A. VPC Flow Logs
- B. Cloud Identity-Aware Proxy
- C. DNS Security Extensions
- D. Cloud Armor
Answer: C
Explanation:
https://cloud.google.com/blog/products/gcp/dnssec-now-available-in-cloud-dns
NEW QUESTION # 150
Your organization operates a hybrid cloud environment and has recently deployed a private Artifact Registry repository in Google Cloud. On-premises developers cannot resolve the Artifact Registry hostname and therefore cannot push or pull artifacts. You've verified the following:
Connectivity to Google Cloud is established by Cloud VPN or Cloud Interconnect.
No custom DNS configurations exist on-premises.
There is no route to the internet from the on-premises network.
You need to identify the cause and enable the developers to push and pull artifacts. What is likely causing the issue and what should you do to fix the issue?
- A. Artifact Registry requires external HTTP/HTTPS access. Create a new firewall rule allowing ingress traffic on ports 80 and 443 from the developer's IP ranges.
- B. On-premises DNS servers lack the necessary records to resolve private Google API domains. Create DNS records for restricted.googleapis.com or private.googleapis.com pointing to Google's published IP ranges.
- C. Developers must be granted the artifactregistry.writer IAM role. Grant the relevant developer group this role.
- D. Private Google Access is not enabled for the subnet hosting the Artifact Registry. Enable Private Google Access for the appropriate subnet.
Answer: B
Explanation:
Comprehensive and Detailed Explanation From Exact Extract:
The problem is that the on-premises developers cannot resolve the Artifact Registry hostname, and they have no route to the internet. This is a classic DNS resolution problem in a hybrid network using private API access.
Artifact Registry is a Google-managed service, and its hostname (e.g., us-west1-docker.pkg.dev) resolves to a Google API domain. To access Google services privately from an on-premises network without an internet route, the traffic must be directed to Private Google Access IP ranges.
Issue: The on-premises DNS cannot resolve the Google service domain to the required private IP range.
Solution: The on-premises DNS needs a record (or a forwarding rule) to resolve the Google service domain to the dedicated IP ranges used for Private Google Access, specifically restricted.googleapis.com or private.
googleapis.com (which provide the IP addresses for private access).
Extracts (Conceptual Basis):
"To direct traffic privately, you must ensure that your on-premises network's DNS is configured to resolve Google API and service domain names to the IP address range for Private Google Access." (Source 1.1)
"The IP addresses for private.googleapis.com are used for Private Google Access. To enable on-premises hosts to access Google APIs and services using this method, you must configure on-premises DNS to resolve requests for Google API domain names to the IP address range for private.googleapis.com." (Source 1.2) Option B is incorrect because Private Google Access (PGA) is enabled on the VPC subnet, allowing VMs within the VPC to access Google APIs. However, the problem is with the on-premises developers; the on- premises DNS must be configured to resolve the hostname correctly.
NEW QUESTION # 151
You discovered that sensitive personally identifiable information (PII) is being ingested to your Google Cloud environment in the daily ETL process from an on-premises environment to your BigQuery datasets. You need to redact this data to obfuscate the PII, but need to re-identify it for data analytics purposes. Which components should you use in your solution? (Choose two.)
- A. Cloud Data Loss Prevention with deterministic encryption using AES-SIV
- B. Cloud Data Loss Prevention with cryptographic hashing
- C. Cloud Key Management Service
- D. Secret Manager
- E. Cloud Data Loss Prevention with automatic text redaction
Answer: A,C
Explanation:
Explanation
B: you need KMS to store the
CryptoKeyhttps://cloud.google.com/dlp/docs/reference/rest/v2/projects.deidentifyTemplates#crypt E: for the de-identity you need to use CryptoReplaceFfxFpeConfig or CryptoDeterministicConfighttps://cloud.google.com/dlp/docs/reference/rest/v2/projects.deidentifyTemplates#cry
https://cloud.google.com/dlp/docs/deidentify-sensitive-data
NEW QUESTION # 152
Your organization s customers must scan and upload the contract and their driver license into a web portal in Cloud Storage. You must remove all personally identifiable information (Pll) from files that are older than 12 months. Also you must archive the anonymized files for retention purposes.
What should you do?
- A. Configure the Autoclass feature of the Cloud Storage bucket to de-identify Pll Archive the files that are older than 12 months Delete the original files.
- B. Create a Cloud Data Loss Prevention (DLP) inspection job that de-identifies Pll in files created more than 12 months ago and archives them to another Cloud Storage bucket. Delete the original files.
- C. Schedule a Cloud Key Management Service (KMS) rotation period of 12 months for the encryption keys of the Cloud Storage files containing Pll to de-identify them Delete the original keys.
- D. Set a time to live (TTL) of 12 months for the files in the Cloud Storage bucket that removes PH and moves the files to the archive storage class.
Answer: B
Explanation:
To remove personally identifiable information (PII) from files older than 12 months and archive the anonymized files for retention purposes, you can use Google Cloud Data Loss Prevention (DLP).
Create a Cloud DLP Inspection Job:
Go to the Cloud DLP section in the Google Cloud Console.
Create an inspection job that scans files in your Cloud Storage bucket for PII.
Configure the job to only target files that are older than 12 months.
Configure De-identification:
In the inspection job settings, configure de-identification actions to remove or obfuscate PII in the files.
Specify the transformation techniques appropriate for your data, such as masking or tokenization.
Archive Anonymized Files:
Set up the job to move the de-identified files to another Cloud Storage bucket designated for archival.
Ensure this bucket has the appropriate retention policies and access controls in place.
Delete Original Files:
After de-identification and archiving, configure the job to delete the original files from the source bucket.
This approach ensures that PII is effectively removed from old files and that the anonymized data is securely archived, maintaining compliance with data retention and privacy policies.
Reference:
Cloud Data Loss Prevention Documentation
Setting Up DLP Jobs
Cloud Storage Documentation
NEW QUESTION # 153
A customer needs to prevent attackers from hijacking their domain/IP and redirecting users to a malicious site through a man-in-the-middle attack.
Which solution should this customer use?
- A. VPC Flow Logs
- B. Cloud Identity-Aware Proxy
- C. DNS Security Extensions
- D. Cloud Armor
Answer: C
Explanation:
DNSSEC - use a DNS registrar that supports DNSSEC, and enable it. DNSSEC digitally signs DNS communication, making it more difficult (but not impossible) for hackers to intercept and spoof. Domain Name System Security Extensions (DNSSEC) adds security to the Domain Name System (DNS) protocol by enabling DNS responses to be validated. Having a trustworthy Domain Name System (DNS) that translates a domain name like www.example.com into its associated IP address is an increasingly important building block of today's web-based applications. Attackers can hijack this process of domain/IP lookup and redirect users to a malicious site through DNS hijacking and man-in-the-middle attacks. DNSSEC helps mitigate the risk of such attacks by cryptographically signing DNS records. As a result, it prevents attackers from issuing fake DNS responses that may misdirect browsers to nefarious websites. https://cloud.google.com/blog/products/gcp/dnssec-now-available-in-cloud-dns
NEW QUESTION # 154
You have an application where the frontend is deployed on a managed instance group in subnet A and the data layer is stored on a mysql Compute Engine virtual machine (VM) in subnet B on the same VPC. Subnet A and Subnet B hold several other Compute Engine VMs. You only want to allow thee application frontend to access the data in the application's mysql instance on port 3306.
What should you do?
- A. Configure an ingress firewall rule that allows communication from the src IP range of subnet A to the tag "data-tag" that is applied to the mysql Compute Engine VM on port 3306.
- B. Configure an ingress firewall rule that allows communication from the frontend's unique service account to the unique service account of the mysql Compute Engine VM on port 3306.
- C. Configure a network tag "fe-tag" to be applied to all instances in subnet A and a network tag "data-tag" to be applied to all instances in subnet B. Then configure an egress firewall rule that allows communication from Compute Engine VMs tagged with data-tag to destination Compute Engine VMs tagged fe-tag.
- D. Configure a network tag "fe-tag" to be applied to all instances in subnet A and a network tag "data-tag" to be applied to all instances in subnet B. Then configure an ingress firewall rule that allows communication from Compute Engine VMs tagged with fe-tag to destination Compute Engine VMs tagged with data-tag.
Answer: B
NEW QUESTION # 155
Your company has deployed an artificial intelligence model in a central project. As this model has a lot of sensitive intellectual property and must be kept strictly isolated from the internet, you must expose the model endpoint only to a defined list of projects in your organization. What should you do?
- A. Within the model project, create an external Application Load Balancer that points to the model endpoint. Create a Cloud Armor policy to restrict IP addresses to Google Cloud.
- B. Within the model project, create an internal Application Load Balancer that points to the model endpoint. Expose this load balancer with Private Service Connect to a configured list of projects.
- C. Create a central project to host Shared VPC networks that are provided to all other projects. Centrally administer all firewall rules in this project to grant access to the model.
- D. Activate Private Google Access in both the model project as well as in each project that needs to connect to the model. Create a firewall policy to allow connectivity to Private Google Access addresses.
Answer: B
Explanation:
The problem requires exposing a sensitive AI model endpoint internally (strictly isolated from the internet) to a defined list of projects within the organization.
Internal Exposure and Isolation: An "internal Application Load Balancer" is suitable for exposing services within your VPC network, ensuring they are not accessible from the internet.
Private Service Connect (PSC): This is the key technology for securely and privately exposing services from one VPC network (the service producer, where the model is) to other VPC networks (the service consumers, the defined list of projects) within the same or different organizations. PSC allows consumers to access services using internal IP addresses, with traffic remaining on Google's private network. You can configure a service attachment that points to the internal load balancer, and then permit specific consumer projects to connect to this service attachment.Extract Reference: "Private Service Connect is a capability of Google Cloud networking that allows consumers to access managed services privately from inside their VPC network. Similarly, it allows managed service producers to host these services in their own separate VPC networks and offer a private connection to their consumers." (Google Cloud Documentation: "Private Service Connect | VPC" - https://cloud.google.com/vpc/docs/private-service-connect) Extract Reference: "Private Service Connect endpoints are internal IP addresses in a consumer VPC network that can be directly accessed by clients in that network. Endpoints are created by deploying a forwarding rule that references a service attachment or a bundle of Google APIs." (Google Cloud Documentation: "About Private Service Connect | VPC" - https://cloud.google.com/vpc/docs/private-service-connect) Extract Reference: "Private Service Connect can be used to access managed services that are owned by Google, third-party software as a service (SaaS) companies, or other teams within the consumer's own company. Both published services and Google APIs can be targets of Private Service Connect." (Google Cloud Documentation: "About Private Service Connect | VPC" - https://cloud.google.com/vpc/docs/private- service-connect) Let's evaluate the other options:
A). Shared VPC and central firewall rules: While Shared VPC centralizes network management, it does not provide a direct managed service exposure mechanism like PSC for a model endpoint to specific projects. It's more about sharing subnets and network resources. Administering all firewall rules centrally would also not meet the need for exposing only this specific model to a defined list of projects in a managed, private service pattern.
B). Activate Private Google Access (PGA): Private Google Access allows VMs without external IP addresses to access Google APIs and services (like Cloud Storage, BigQuery, etc.) privately from within their VPC network. It's for consuming Google services, not for exposing custom services hosted in a Google Cloud project to other projects.
D). External Application Load Balancer + Cloud Armor: An "external Application Load Balancer" exposes the service to the internet. While Cloud Armor can restrict access based on IP addresses, it still involves internet exposure, which contradicts the "strictly isolated from the internet" requirement. Restricting to "Google Cloud IP addresses" doesn't guarantee access only to a defined list of projects and still exposes the service externally.
Therefore, creating an internal Application Load Balancer and exposing it via Private Service Connect is the most suitable and secure solution for this scenario.
NEW QUESTION # 156
Your organization is moving virtual machines (VMs) to Google Cloud. You must ensure that operating system images that are used across your projects are trusted and meet your security requirements.
What should you do?
- A. Implement an organization policy to enforce that boot disks can only be created from images that come from the trusted image project.
- B. Implement an organization policy constraint that enables the Shielded VM service on all projects to enforce the trusted image repository usage.
- C. Create a Cloud Function that is automatically triggered when a new virtual machine is created from the trusted image repository Verify that the image is not deprecated.
- D. Automate a security scanner that verifies that no common vulnerabilities and exposures (CVEs) are present in your trusted image repository.
Answer: D
NEW QUESTION # 157
Your organization hosts a financial services application running on Compute Engine instances for a third-party company. The third-party company's servers that will consume the application also run on Compute Engine in a separate Google Cloud organization. You need to configure a secure network connection between the Compute Engine instances. You have the following requirements:
The network connection must be encrypted.
The communication between servers must be over private IP addresses.
What should you do?
- A. Configure an Apigee proxy that exposes your Compute Engine-hosted application as an API, and is encrypted with TLS which allows access only to the third party.
- B. Configure a Cloud VPN connection between your organization's VPC network and the third party's that is controlled by VPC firewall rules.
- C. Configure a VPC Service Controls perimeter around your Compute Engine instances, and provide access to the third party via an access level.
- D. Configure a VPC peering connection between your organization's VPC network and the third party's that is controlled by VPC firewall rules.
Answer: B
NEW QUESTION # 158
You are onboarding new users into Cloud Identity and discover that some users have created consumer user accounts using the corporate domain name. How should you manage these consumer user accounts with Cloud Identity?
- A. Use the transfer tool for unmanaged user accounts.
- B. Use Google Cloud Directory Sync to convert the unmanaged user accounts.
- C. Configure single sign-on using a customer's third-party provider.
- D. Create a new managed user account for each consumer user account.
Answer: A
Explanation:
To manage consumer user accounts created using the corporate domain name, you can use the transfer tool for unmanaged user accounts provided by Google Cloud Identity. Here's how you can proceed:
* Identify Unmanaged Accounts:
* Use the Cloud Identity interface to identify consumer (unmanaged) accounts that exist with your corporate domain.
* Initiate Transfer Process:
* Use the transfer tool for unmanaged user accounts to initiate the transfer. This tool helps in converting unmanaged accounts (consumer accounts) into managed accounts.
* User Notification:
* Users with unmanaged accounts will receive an email notification prompting them to accept the transfer to the organization's managed account system.
* Accept Transfer:
* Users need to follow the instructions in the email to accept the transfer. Once accepted, their accounts will be managed under your organization's Cloud Identity setup.
* Benefits:
* Centralized Management: All user accounts under your corporate domain are managed centrally, ensuring compliance and security.
* Enhanced Security: Managed accounts provide better control over security policies and access management.
References
* Transfer tool for unmanaged users
* Cloud Identity Documentation
NEW QUESTION # 159
Your company has been creating users manually in Cloud Identity to provide access to Google Cloud resources. Due to continued growth of the environment, you want to authorize the Google Cloud Directory Sync (GCDS) instance and integrate it with your on-premises LDAP server to onboard hundreds of users. You are required to:
Replicate user and group lifecycle changes from the on-premises LDAP server in Cloud Identity.
Disable any manually created users in Cloud Identity.
You have already configured the LDAP search attributes to include the users and security groups in scope for Google Cloud. What should you do next to complete this solution?
- A. 1. Configure the option to suspend domain users not found in LDAP.
2. Set up a recurring GCDS task. - B. 1. Configure the option to delete domain users not found in LDAP.
2. Run GCDS after user and group lifecycle changes. - C. 1. Configure the LDAP search attributes to exclude manually created Cloud Identity users not found in LDAP.
2. Set up a recurring GCDS task. - D. 1. Configure the LDAP search attributes to exclude manually created Cloud identity users not found in LDAP.
2. Run GCDS after user and group lifecycle changes.
Answer: D
NEW QUESTION # 160
......
The Google Cloud Certified - Professional Cloud Security Engineer Exam certification validates the knowledge and skills required to design, implement and manage security solutions in Google Cloud. Google Cloud Certified - Professional Cloud Security Engineer Exam certification exam covers various topics, including security policies and procedures, identity and access management, network security, data security, security controls, application security, and incident management. Professional-Cloud-Security-Engineer exam format consists of multiple-choice questions and performance-based scenarios, and candidates are expected to demonstrate practical knowledge and experience in securing Google Cloud infrastructure.
Ace Google Professional-Cloud-Security-Engineer Certification with Actual Questions Jan 28, 2026 Updated: https://www.fast2test.com/Professional-Cloud-Security-Engineer-premium-file.html
Google Cloud Certified Certified Official Practice Test Professional-Cloud-Security-Engineer: https://drive.google.com/open?id=1NbwNuWtZsN_QEYjzBoB467B33CYTSPAu