Cloud Digital Leader Google Cloud Security — 10 Questions

Question 1

A security team needs to detect and respond to threats across their cloud environment. Which THREE services should they use together? (Choose 3)

Accepted Answer

Security Command Center. Security Command Center provides vulnerability and threat detection, Cloud IDS detects network intrusions, and Chronicle is a SIEM for log analysis and threat detection. Together they cover cloud workload, network, and log-based threats. Cloud Audit Logs are for auditing, not active detection. Mandiant is a threat intelligence/incident response offering, but not one of the primary three services to use together for day-to-day threat detection across the cloud environment.

Answer

Cloud Audit Logs

Answer

Mandiant

Question 2

A security engineer needs to create a VPC Service Controls perimeter that prevents data exfiltration from a project containing sensitive data. The perimeter should allow BigQuery datasets in the project to be accessed only from authorized VMs within the same perimeter. Which step is essential?

Accepted Answer

Add the project to a perimeter and set an ingress policy that allows access from the authorized VMs' service accounts. VPC Service Controls perimeters block access from outside. Resources inside the perimeter can communicate freely by default, subject to IAM permissions. Since the authorized VMs are within the same perimeter, adding the project to the perimeter alone is sufficient to block outside access while allowing internal access. An ingress policy would be necessary only if the VMs were outside the perimeter, contradicting the stem.

Answer

Create a separate perimeter for each VM and use IAM conditions

Answer

Add the project to a perimeter and create an egress rule to allow access from authorized VMs

Answer

Use Cloud Armor to whitelist the VMs' IP addresses for BigQuery access

Question 3

A company wants to protect sensitive data stored in Cloud Storage from being downloaded by users outside their organization. They also need to prevent data from being copied to external projects. Which TWO services should they use? (Choose two.)

Accepted Answer

IAM conditions with access levels. To protect sensitive data in Cloud Storage, use both VPC Service Controls and IAM conditions. VPC Service Controls create a security perimeter around Cloud Storage buckets, preventing data exfiltration to external projects and unauthorized networks. IAM conditions restrict access to Cloud Storage buckets based on attributes like user identity, device, or IP address, ensuring only authorized users within the organization can download data. Together, they provide defense in depth: VPC Service Controls block data movement across perimeters, while IAM conditions enforce fine-grained access control within the perimeter.

Answer

Cloud DLP

Answer

Cloud KMS

Answer

Cloud Armor

Question 4

A company uses Cloud KMS to manage encryption keys. They want to rotate keys automatically every 90 days. How can they achieve this?

Accepted Answer

Use the gcloud kms keys set-rotation-schedule command. Cloud KMS supports automatic key rotation by setting a rotation period. This can be configured using the gcloud command-line tool with 'gcloud kms keys set-rotation-schedule', or by setting the rotation period when creating the key in the Cloud Console. Both methods achieve automatic rotation every 90 days.

Answer

Use a cron job to call the Google Cloud API

Answer

Manually create a new key version every 90 days

Question 5

Which TWO services help protect against data exfiltration in Google Cloud? (Choose 2)

Accepted Answer

Cloud Data Loss Prevention (DLP). VPC Service Controls create security perimeters that prevent data from being exfiltrated from specified VPC networks. Cloud Data Loss Prevention (DLP) helps detect and redact sensitive data, preventing accidental leaks of sensitive information. Cloud Armor protects against DDoS attacks, and Cloud IDS detects intrusions, but neither directly prevents data exfiltration.

Answer

Cloud Armor

Answer

Sensitive Data Protection (DLP)

Answer

Cloud IDS

Question 6

A security engineer wants to ensure that Google personnel access to customer data stored in Cloud Storage is visible and auditable. Which Google Cloud feature should be enabled?

Accepted Answer

Access Transparency. Access Transparency provides near real-time logs of Google personnel access to customer data, enabling visibility and auditability. Access Approval would be used to require explicit approval before access, but it is not listed. Therefore, for the given options, Access Transparency is the correct choice.

Answer

Data Loss Prevention API

Answer

VPC Service Controls

Answer

Cloud Audit Logs

Question 7

A financial services company needs to restrict access to its Cloud Storage buckets containing sensitive customer data. The company wants to prevent data exfiltration by ensuring that only authorized VMs in specific VPCs can access the buckets, and that data cannot be copied to unauthorized locations. Which two Google Cloud services should be used together? (Choose two.)

Accepted Answer

VPC Service Controls. VPC Service Controls create perimeters around Google Cloud resources such as Cloud Storage, preventing data exfiltration to unauthorized networks and allowing only requests from authorized VPC networks via access levels. Private Google Access enables VMs without external IP addresses to reach Google APIs and services, including Cloud Storage, over the private Google network, ensuring that access to the restricted buckets occurs through a controlled, private path rather than the public internet. Cloud Armor provides DDoS and WAF protection but does not restrict data access. Cloud NAT is used for outbound connectivity, not for preventing data exfiltration. Identity-Aware Proxy (IAP) is an application-level access control, not suited for storage-level restrictions.

Answer

Cloud Armor

Answer

Identity-Aware Proxy (IAP)

Answer

Cloud NAT

Question 8

A company wants to replace its VPN-based remote access with a zero-trust solution that verifies user identity and device health before granting access to internal applications. Which Google Cloud service should they use?

Accepted Answer

BeyondCorp Enterprise. BeyondCorp Enterprise provides zero-trust access based on user identity and device context, eliminating the need for a VPN. IAP is a component but the full solution is BeyondCorp Enterprise.

Answer

Identity-Aware Proxy (IAP)

Answer

Cloud VPN

Answer

Cloud Identity

Question 9

An organization needs to ensure that data stored in Cloud Storage is encrypted using keys that they manage and rotate themselves. Which encryption option should they choose?

Accepted Answer

Customer-managed encryption keys (CMEK). CMEK allows customers to manage their own keys via Cloud KMS. CSEK requires customer-supplied keys but has operational overhead. Google-managed keys are default but not customer-managed.

Answer

Default encryption at rest

Answer

Customer-supplied encryption keys (CSEK)

Answer

Google-managed encryption keys

Question 10

A security team needs to monitor and analyze logs from multiple GCP projects to detect threats across the organization. They require a SIEM solution that can ingest logs from on-premises and other clouds. Which service should they use?

Accepted Answer

Chronicle. Chronicle is a Google Cloud SIEM that ingests logs from various sources, including on-premises and other clouds, and provides threat detection. Security Command Center is for vulnerability scanning, not SIEM.

Answer

Security Command Center

Answer

Cloud IDS

Answer

Cloud Logging