Cloud Digital Leader Google Cloud Security — 15 Questions

Question 1

A company wants to replace its VPN-based remote access with a zero-trust solution that verifies user identity and device health before granting access to internal applications. Which Google Cloud service should they use?

Accepted Answer

BeyondCorp Enterprise. BeyondCorp Enterprise provides zero-trust access based on user identity and device context, eliminating the need for a VPN. IAP is a component but the full solution is BeyondCorp Enterprise.

Answer

Identity-Aware Proxy (IAP)

Answer

Cloud VPN

Answer

Cloud Identity

Question 2

An organization needs to ensure that data stored in Cloud Storage is encrypted using keys that they manage and rotate themselves. Which encryption option should they choose?

Accepted Answer

Customer-managed encryption keys (CMEK). CMEK allows customers to manage their own keys via Cloud KMS. CSEK requires customer-supplied keys but has operational overhead. Google-managed keys are default but not customer-managed.

Answer

Default encryption at rest

Answer

Customer-supplied encryption keys (CSEK)

Answer

Google-managed encryption keys

Question 3

A security team needs to monitor and analyze logs from multiple GCP projects to detect threats across the organization. They require a SIEM solution that can ingest logs from on-premises and other clouds. Which service should they use?

Accepted Answer

Chronicle. Chronicle is a Google Cloud SIEM that ingests logs from various sources, including on-premises and other clouds, and provides threat detection. Security Command Center is for vulnerability scanning, not SIEM.

Answer

Security Command Center

Answer

Cloud IDS

Answer

Cloud Logging

Question 4

A company wants to protect its web application running on Google Cloud from DDoS attacks and SQL injection. Which service should they use?

Accepted Answer

Cloud Armor. Cloud Armor provides DDoS protection and WAF capabilities (including SQL injection prevention). Cloud CDN caches content but does not protect against attacks. VPC firewall rules are network-level only. reCAPTCHA protects against bots but not SQL injection.

Answer

reCAPTCHA Enterprise

Answer

Cloud CDN

Answer

VPC firewall rules

Question 5

A data engineering team needs to store and manage database passwords and API keys used by their applications. Which Google Cloud service should they use?

Accepted Answer

Secret Manager. Secret Manager is designed to store secrets like passwords and API keys. Cloud KMS is for encryption keys. Cloud Key Management Service is for creating and managing cryptographic keys, not storing secrets. Cloud Storage is for objects.

Answer

Cloud KMS

Answer

Cloud Key Management Service

Answer

Cloud Storage

Question 6

What is the primary purpose of VPC Service Controls?

Accepted Answer

To prevent data exfiltration from Google Cloud services. VPC Service Controls create perimeters around Google Cloud services to prevent data exfiltration. VPC firewall rules control network traffic. Cloud Armor is for DDoS. Cloud IDS is for intrusion detection.

Answer

To control ingress and egress traffic at the network level

Answer

To detect network intrusions

Answer

To protect against DDoS attacks

Question 7

A security administrator needs to ensure that Google personnel do not access customer data without explicit authorization. Which service should they use to get logs of Google employee access?

Accepted Answer

Access Transparency. Access Transparency provides logs of Google personnel actions on customer data. Cloud Audit Logs track user activities within the customer's project. Assured Workloads is for regulatory compliance. Security Command Center is for threat detection.

Answer

Cloud Audit Logs

Answer

Security Command Center

Answer

Assured Workloads

Question 8

A company wants to scan its Cloud Storage buckets for sensitive data like credit card numbers and social security numbers. Which service should they use?

Accepted Answer

Sensitive Data Protection. Sensitive Data Protection (DLP API) is used to inspect and de-identify sensitive data. Security Command Center is for vulnerabilities. Web Risk API checks URLs against threat lists. reCAPTCHA is for bot protection.

Answer

Security Command Center

Answer

reCAPTCHA Enterprise

Answer

Web Risk API

Question 9

Which principle states that a user should be granted only the permissions necessary to perform their job functions?

Accepted Answer

Principle of least privilege. The principle of least privilege is the security concept of granting minimal required permissions. Separation of duties divides tasks among multiple people. Zero trust is a broader security model. Defence in depth is layered security.

Answer

Defence in depth

Answer

Separation of duties

Answer

Zero trust

Question 10

A security team wants to find misconfigurations and vulnerabilities across their Google Cloud environment, including VMs, storage, and IAM. Which service provides a unified view of these findings?

Accepted Answer

Security Command Center. Security Command Center provides a centralized view of vulnerabilities and misconfigurations. Cloud Audit Logs are for auditing actions. Cloud IDS is for network threats. Assured Workloads is for compliance.

Answer

Cloud IDS

Answer

Assured Workloads

Answer

Cloud Audit Logs

Question 11

An administrator wants to enforce that all API calls to a specific Cloud Storage bucket must come from a limited range of IP addresses. Which configuration should they use?

Accepted Answer

VPC Service Controls with an access level that includes the IP range. VPC Service Controls can restrict access based on IP addresses via access levels. IAP is for user authentication. Cloud Armor is for HTTP(S) load balancing. Firewall rules apply to network traffic, not API access to Cloud Storage.

Answer

Cloud Armor security policy

Answer

Identity-Aware Proxy (IAP)

Answer

VPC firewall rules

Question 12

Which layer of Google's defence-in-depth security model includes the use of TLS for data in transit?

Accepted Answer

Data security. Data security covers encryption of data at rest and in transit. Physical security is about data centers. Operational security covers processes. Deployment security is about secure infrastructure deployment.

Answer

Operational security

Answer

Deployment security

Answer

Physical security

Question 13

A company wants to implement a zero-trust security model for accessing internal applications. Which TWO Google Cloud services should they use together? (Choose 2)

Accepted Answer

Identity-Aware Proxy (IAP). BeyondCorp Enterprise provides the zero-trust framework, and IAP enforces identity and context-based access to applications. Cloud VPN is not zero-trust. Cloud Identity is an identity provider but not sufficient alone. Cloud Armor is for DDoS protection.

Answer

Cloud Identity

Answer

Cloud Armor

Answer

Cloud VPN

Question 14

A security team needs to detect and respond to threats across their cloud environment. Which THREE services should they use together? (Choose 3)

Accepted Answer

Security Command Center. Security Command Center provides vulnerability and threat detection. Chronicle is a SIEM for log analysis and threat detection. Mandiant offers threat intelligence and incident response. Cloud IDS is network-based. Cloud Audit Logs are for auditing, not detection.

Answer

Cloud IDS

Answer

Cloud Audit Logs

Question 15

A company needs to encrypt data at rest using keys that they manage, but they want to reduce operational overhead by having Google Cloud host the key management infrastructure. Which TWO options achieve this? (Choose 2)

Accepted Answer

Cloud HSM. CMEK uses Cloud KMS to manage keys, which Google hosts. CSEK requires the customer to supply and manage keys outside Google. Google-managed keys are not customer-managed. Cloud HSM is a hardware security module that can be used with CMEK. Secret Manager is for secrets, not encryption keys.

Answer

Secret Manager

Answer

Google-managed encryption keys

Answer

Customer-supplied encryption keys (CSEK)