Cloud Digital Leader Google Cloud Security Practice Test 2 — 15 Questions

Question 1

Which principle states that a user should be granted only the permissions necessary to perform their job functions?

Accepted Answer

Principle of least privilege. The principle of least privilege is the security concept of granting minimal required permissions. Separation of duties divides tasks among multiple people. Zero trust is a broader security model. Defence in depth is layered security.

Answer

Defence in depth

Answer

Separation of duties

Answer

Zero trust

Question 2

A security team wants to find misconfigurations and vulnerabilities across their Google Cloud environment, including VMs, storage, and IAM. Which service provides a unified view of these findings?

Accepted Answer

Security Command Center. Security Command Center provides a centralized view of vulnerabilities and misconfigurations. Cloud Audit Logs are for auditing actions. Cloud IDS is for network threats. Assured Workloads is for compliance.

Answer

Cloud IDS

Answer

Assured Workloads

Answer

Cloud Audit Logs

Question 3

An administrator wants to enforce that all API calls to a specific Cloud Storage bucket must come from a limited range of IP addresses. Which configuration should they use?

Accepted Answer

VPC Service Controls with an access level that includes the IP range. VPC Service Controls can restrict access based on IP addresses via access levels. IAP is for user authentication. Cloud Armor is for HTTP(S) load balancing. Firewall rules apply to network traffic, not API access to Cloud Storage.

Answer

Cloud Armor security policy

Answer

Identity-Aware Proxy (IAP)

Answer

VPC firewall rules

Question 4

Which layer of Google's defence-in-depth security model includes the use of TLS for data in transit?

Accepted Answer

Data security. Data security covers encryption of data at rest and in transit. Physical security is about data centers. Operational security covers processes. Deployment security is about secure infrastructure deployment.

Answer

Operational security

Answer

Deployment security

Answer

Physical security

Question 5

A company wants to implement a zero-trust security model for accessing internal applications. Which TWO Google Cloud services should they use together? (Choose 2)

Accepted Answer

Identity-Aware Proxy (IAP). BeyondCorp Enterprise provides the zero-trust framework, and IAP enforces identity and context-based access to applications. Cloud VPN is not zero-trust. Cloud Identity is an identity provider but not sufficient alone. Cloud Armor is for DDoS protection.

Answer

Cloud Identity

Answer

Cloud Armor

Answer

Cloud VPN

Question 6

A company needs to encrypt data at rest using keys that they manage, but they want to reduce operational overhead by having Google Cloud host the key management infrastructure. Which TWO options achieve this? (Choose 2)

Accepted Answer

Cloud HSM. CMEK uses Cloud KMS to manage keys, which Google hosts. CSEK requires the customer to supply and manage keys outside Google. Google-managed keys are not customer-managed. Cloud HSM is a hardware security module that can be used with CMEK. Secret Manager is for secrets, not encryption keys.

Answer

Secret Manager

Answer

Google-managed encryption keys

Answer

Customer-supplied encryption keys (CSEK)

Question 7

A startup wants to secure access to its internal web applications without using a VPN. They need to enforce access based on user identity and device security posture. Which Google Cloud service should they use?

Accepted Answer

Identity-Aware Proxy (IAP). BeyondCorp Enterprise is Google's zero-trust solution that replaces VPNs by using identity and context (device, location) to grant access. Identity-Aware Proxy (IAP) is a component of BeyondCorp that enforces access at the application layer.

Answer

Cloud VPN

Answer

VPC Service Controls

Answer

Cloud Armor

Question 8

An organization wants to ensure that all data stored in Cloud Storage is encrypted with customer-managed keys that can be rotated on demand. They also need to log every key use for audit compliance. Which combination of services should they use?

Accepted Answer

Cloud KMS with Customer-Managed Encryption Keys (CMEK) and Cloud Audit Logs. Cloud KMS allows creation and management of customer-managed encryption keys (CMEK) for Cloud Storage. Cloud Audit Logs can be used to log key usage (e.g., via Data Access audit logs). CSEK is deprecated; Secret Manager is for secrets, not encryption keys for storage.

Answer

Cloud KMS with Customer-Supplied Encryption Keys (CSEK)

Answer

Google-managed encryption keys with Access Transparency

Answer

Secret Manager with encryption keys and Cloud Logging

Question 9

A company wants to detect and prioritize vulnerabilities in their Compute Engine VMs and GKE clusters. They also need a centralized view of security findings across their organization. Which service should they use?

Accepted Answer

Security Command Center. Security Command Center (SCC) is the central vulnerability and threat detection service for GCP. It finds misconfigurations, vulnerabilities, and threats across services like Compute Engine and GKE, and provides a dashboard for prioritization. Chronicle is a SIEM for log analysis, not vulnerability scanning. Cloud IDS is for network intrusion detection. Web Risk API is for checking URLs against threat lists.

Answer

Cloud IDS

Answer

Web Risk API

Answer

Chronicle

Question 10

A developer needs to store a database password securely and access it from a Compute Engine VM. The password should be automatically rotated every 90 days. Which Google Cloud service should they use?

Accepted Answer

Secret Manager. Secret Manager is designed to store secrets like passwords, API keys, and certificates. It supports automatic rotation of secrets. Cloud KMS is for encryption keys, not secrets. Cloud Storage is not secure for secrets. IAM does not store secrets.

Answer

IAM

Answer

Cloud Storage with server-side encryption

Answer

Cloud KMS

Question 11

An organization needs to protect a web application hosted on Google Cloud from DDoS attacks and SQL injection attempts. They want a managed security service that integrates with Cloud Load Balancing. Which service should they use?

Accepted Answer

Cloud Armor. Cloud Armor is Google's managed DDoS protection and Web Application Firewall (WAF) service. It integrates with Cloud Load Balancing to filter traffic based on IP, geo, and HTTP headers, and includes preconfigured rules (e.g., OWASP) to block SQL injection. Cloud IDS is for network intrusion detection. reCAPTCHA Enterprise is for bot detection. VPC firewall rules are for network-level access control.

Answer

Cloud IDS

Answer

reCAPTCHA Enterprise

Answer

VPC firewall rules

Question 12

A DevOps engineer wants to audit all actions performed by Google personnel on their customer data stored in Cloud Storage. They need to review logs that show access by Google employees and the reason for access. Which logging feature should they enable?

Accepted Answer

Access Transparency. Access Transparency provides logs of Google personnel accessing customer data. It shows the time, reason, and data accessed. Cloud Audit Logs track actions performed by users and services within the customer's project, not Google personnel. VPC Flow Logs are for network flows. Cloud Logging is the general platform but does not specifically capture Google personnel access without Access Transparency.

Answer

Cloud Audit Logs

Answer

Cloud Logging

Answer

VPC Flow Logs

Question 13

A company wants to enforce the principle of least privilege by granting a service account only the permissions necessary to publish messages to a specific Pub/Sub topic. Which IAM approach should they use?

Accepted Answer

Grant the roles/pubsub.publisher role to the service account at the topic level. IAM allows granting roles at specific resource levels. To grant only publish permission on a specific topic, you should add the service account as a member and assign the Pub/Sub Publisher role (roles/pubsub.publisher) directly on that topic. Granting the role at the project level would give too broad access. Using a custom role with only the required permission is also correct but more complex; however, the simplest correct approach among the options is to assign a predefined role at the topic level.

Answer

Grant the roles/editor role to the service account at the project level

Answer

Grant the roles/pubsub.subscriber role to the service account at the topic level

Answer

Grant the roles/pubsub.publisher role to the service account at the project level

Question 14

A security team needs to detect and alert on suspicious outbound network traffic from their GCP environment, such as data exfiltration attempts. They require a managed service that analyzes traffic for threats. Which service should they use?

Accepted Answer

Cloud IDS. Cloud IDS (Intrusion Detection System) monitors network traffic for threats like malware and data exfiltration. It integrates with VPC flow logs and provides threat detection. Cloud Armor is for inbound DDoS/WAF. Security Command Center is a broader security management platform. Chronicle is a SIEM for log analysis, not real-time network traffic inspection.

Answer

Cloud Armor

Answer

Security Command Center

Answer

Chronicle

Question 15

An organization has a compliance requirement to run workloads in specific geographic regions only. They want to prevent any resources from being created outside those regions. Which Google Cloud control should they use?

Accepted Answer

Organization policy with location restriction. Organization policies with location restrictions allow administrators to set constraints on where resources can be created. The constraint `gcp.resourceLocations` can be used to restrict allowed regions. IAM roles control who can create resources, but not where. VPC Service Controls restrict data access, not resource creation location. Cloud Audit Logs only record actions.

Answer

Cloud Audit Logs

Answer

VPC Service Controls

Answer

IAM conditions with resource location