Cloud Digital Leader Google Cloud Security Practice Test 2 — 15 Questions

Question 1

A startup wants to secure access to its internal web applications without using a VPN. They need to enforce access based on user identity and device security posture. Which Google Cloud service should they use?

Accepted Answer

Identity-Aware Proxy (IAP). BeyondCorp Enterprise is Google's zero-trust solution that replaces VPNs by using identity and context (device, location) to grant access. Identity-Aware Proxy (IAP) is a component of BeyondCorp that enforces access at the application layer.

Answer

Cloud VPN

Answer

VPC Service Controls

Answer

Cloud Armor

Question 2

An organization wants to ensure that all data stored in Cloud Storage is encrypted with customer-managed keys that can be rotated on demand. They also need to log every key use for audit compliance. Which combination of services should they use?

Accepted Answer

Cloud KMS with Customer-Managed Encryption Keys (CMEK) and Cloud Audit Logs. Cloud KMS allows creation and management of customer-managed encryption keys (CMEK) for Cloud Storage. Cloud Audit Logs can be used to log key usage (e.g., via Data Access audit logs). CSEK is deprecated; Secret Manager is for secrets, not encryption keys for storage.

Answer

Cloud KMS with Customer-Supplied Encryption Keys (CSEK)

Answer

Google-managed encryption keys with Access Transparency

Answer

Secret Manager with encryption keys and Cloud Logging

Question 3

A security engineer needs to create a VPC Service Controls perimeter that prevents data exfiltration from a project containing sensitive data. The perimeter should allow BigQuery datasets in the project to be accessed only from authorized VMs within the same perimeter. Which step is essential?

Accepted Answer

Add the project to a perimeter and set an ingress policy that allows access from the authorized VMs' service accounts. VPC Service Controls use perimeters to restrict access to Google-managed services. To allow access only from authorized VMs, you must create an ingress policy that specifies the source VPC network and the allowed identities (e.g., service accounts of the VMs). Simply adding the project to a perimeter blocks all external access; an ingress rule is needed to grant access from the specified VMs.

Answer

Create a separate perimeter for each VM and use IAM conditions

Answer

Add the project to a perimeter and create an egress rule to allow access from authorized VMs

Answer

Use Cloud Armor to whitelist the VMs' IP addresses for BigQuery access

Question 4

A company wants to detect and prioritize vulnerabilities in their Compute Engine VMs and GKE clusters. They also need a centralized view of security findings across their organization. Which service should they use?

Accepted Answer

Security Command Center. Security Command Center (SCC) is the central vulnerability and threat detection service for GCP. It finds misconfigurations, vulnerabilities, and threats across services like Compute Engine and GKE, and provides a dashboard for prioritization. Chronicle is a SIEM for log analysis, not vulnerability scanning. Cloud IDS is for network intrusion detection. Web Risk API is for checking URLs against threat lists.

Answer

Cloud IDS

Answer

Web Risk API

Answer

Chronicle

Question 5

A developer needs to store a database password securely and access it from a Compute Engine VM. The password should be automatically rotated every 90 days. Which Google Cloud service should they use?

Accepted Answer

Secret Manager. Secret Manager is designed to store secrets like passwords, API keys, and certificates. It supports automatic rotation of secrets. Cloud KMS is for encryption keys, not secrets. Cloud Storage is not secure for secrets. IAM does not store secrets.

Answer

IAM

Answer

Cloud Storage with server-side encryption

Answer

Cloud KMS

Question 6

An organization needs to protect a web application hosted on Google Cloud from DDoS attacks and SQL injection attempts. They want a managed security service that integrates with Cloud Load Balancing. Which service should they use?

Accepted Answer

Cloud Armor. Cloud Armor is Google's managed DDoS protection and Web Application Firewall (WAF) service. It integrates with Cloud Load Balancing to filter traffic based on IP, geo, and HTTP headers, and includes preconfigured rules (e.g., OWASP) to block SQL injection. Cloud IDS is for network intrusion detection. reCAPTCHA Enterprise is for bot detection. VPC firewall rules are for network-level access control.

Answer

Cloud IDS

Answer

reCAPTCHA Enterprise

Answer

VPC firewall rules

Question 7

A DevOps engineer wants to audit all actions performed by Google personnel on their customer data stored in Cloud Storage. They need to review logs that show access by Google employees and the reason for access. Which logging feature should they enable?

Accepted Answer

Access Transparency. Access Transparency provides logs of Google personnel accessing customer data. It shows the time, reason, and data accessed. Cloud Audit Logs track actions performed by users and services within the customer's project, not Google personnel. VPC Flow Logs are for network flows. Cloud Logging is the general platform but does not specifically capture Google personnel access without Access Transparency.

Answer

Cloud Audit Logs

Answer

Cloud Logging

Answer

VPC Flow Logs

Question 8

A company wants to enforce the principle of least privilege by granting a service account only the permissions necessary to publish messages to a specific Pub/Sub topic. Which IAM approach should they use?

Accepted Answer

Grant the roles/pubsub.publisher role to the service account at the topic level. IAM allows granting roles at specific resource levels. To grant only publish permission on a specific topic, you should add the service account as a member and assign the Pub/Sub Publisher role (roles/pubsub.publisher) directly on that topic. Granting the role at the project level would give too broad access. Using a custom role with only the required permission is also correct but more complex; however, the simplest correct approach among the options is to assign a predefined role at the topic level.

Answer

Grant the roles/editor role to the service account at the project level

Answer

Grant the roles/pubsub.subscriber role to the service account at the topic level

Answer

Grant the roles/pubsub.publisher role to the service account at the project level

Question 9

A security team needs to detect and alert on suspicious outbound network traffic from their GCP environment, such as data exfiltration attempts. They require a managed service that analyzes traffic for threats. Which service should they use?

Accepted Answer

Cloud IDS. Cloud IDS (Intrusion Detection System) monitors network traffic for threats like malware and data exfiltration. It integrates with VPC flow logs and provides threat detection. Cloud Armor is for inbound DDoS/WAF. Security Command Center is a broader security management platform. Chronicle is a SIEM for log analysis, not real-time network traffic inspection.

Answer

Cloud Armor

Answer

Security Command Center

Answer

Chronicle

Question 10

An organization has a compliance requirement to run workloads in specific geographic regions only. They want to prevent any resources from being created outside those regions. Which Google Cloud control should they use?

Accepted Answer

Organization policy with location restriction. Organization policies with location restrictions allow administrators to set constraints on where resources can be created. The constraint `gcp.resourceLocations` can be used to restrict allowed regions. IAM roles control who can create resources, but not where. VPC Service Controls restrict data access, not resource creation location. Cloud Audit Logs only record actions.

Answer

Cloud Audit Logs

Answer

VPC Service Controls

Answer

IAM conditions with resource location

Question 11

A company uses Cloud SQL and wants to encrypt data at rest with a key that they manage and rotate themselves. They also want to ensure that the encryption happens automatically before data is written to disk. Which configuration should they choose?

Accepted Answer

Use a Customer-Managed Encryption Key (CMEK) from Cloud KMS. Cloud SQL supports CMEK (Customer-Managed Encryption Keys) via Cloud KMS. The key is created in Cloud KMS and specified when creating the Cloud SQL instance. The data is automatically encrypted with the key at rest. CSEK is deprecated and not supported by Cloud SQL. Google-managed keys do not allow customer control. Secret Manager is for secrets.

Answer

Enable default Google-managed encryption

Answer

Store the encryption key in Secret Manager and configure Cloud SQL to use it

Answer

Use a Customer-Supplied Encryption Key (CSEK)

Question 12

Which defense-in-depth layer includes measures like access controls, vulnerability management, and intrusion detection systems?

Accepted Answer

Operational security. Operational security involves the policies and procedures to protect data and systems during operation, including access controls, vulnerability scanning, and intrusion detection. Physical security covers hardware and facilities; infrastructure security covers network and platform; data security covers encryption and data loss prevention.

Answer

Data security

Answer

Physical security

Answer

Infrastructure security

Question 13

A company wants to protect sensitive data stored in Cloud Storage from being downloaded by users outside their organization. They also need to prevent data from being copied to external projects. Which TWO services should they use? (Choose two.)

Accepted Answer

IAM conditions with access levels. VPC Service Controls create a perimeter around the Cloud Storage buckets to prevent data exfiltration to external projects and unauthorized networks. IAM conditions can restrict access based on identity, but alone cannot prevent data copying to external projects. Cloud DLP can redact sensitive data but does not prevent exfiltration. Cloud Armor is for HTTP(S) traffic. Cloud KMS encrypts data but does not control access.

Answer

Cloud DLP

Answer

Cloud KMS

Answer

Cloud Armor

Question 14

A security team needs to implement a zero-trust architecture for a web application that is accessed by both internal employees and external partners. They require context-aware access that checks device posture and identity. Which THREE components should they use? (Choose three.)

Accepted Answer

Identity-Aware Proxy (IAP). BeyondCorp Enterprise provides the zero-trust framework, including device and identity verification. Identity-Aware Proxy (IAP) is a key component that enforces access based on context. Access levels in IAP define conditions (e.g., device posture, IP range) that must be met for access. Cloud Armor is for DDoS/WAF, not context-aware access. VPC firewall rules are network-level, not user-level. Chronicle is a SIEM.

Answer

VPC firewall rules

Answer

Cloud Armor

Question 15

A company wants to store encryption keys for encrypting data at rest in Cloud Storage, and also needs to automatically rotate the keys every 30 days. Additionally, they require an audit log of key usage. Which TWO services should they use? (Choose two.)

Accepted Answer

Cloud KMS. Cloud KMS allows creating and managing keys with automatic rotation (via rotation period). Cloud Audit Logs can be configured to log every use of the key (Data Access audit logs). Secret Manager is for secrets, not encryption keys. Cloud HSM provides hardware-backed keys but is part of Cloud KMS. Cloud Storage itself does not manage key rotation.

Answer

Cloud HSM

Answer

Secret Manager

Answer

Cloud Storage