Cloud Digital Leader Google Cloud Security Practice Test 3 — 15 Questions

Question 1

A company uses Cloud SQL and wants to encrypt data at rest with a key that they manage and rotate themselves. They also want to ensure that the encryption happens automatically before data is written to disk. Which configuration should they choose?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use a Customer-Managed Encryption Key (CMEK) from Cloud KMS. Cloud SQL supports CMEK (Customer-Managed Encryption Keys) via Cloud KMS. The key is created in Cloud KMS and specified when creating the Cloud SQL instance. The data is automatically encrypted with the key at rest. CSEK is deprecated and not supported by Cloud SQL. Google-managed keys do not allow customer control. Secret Manager is for secrets.

Answer

Enable default Google-managed encryption

Answer

Store the encryption key in Secret Manager and configure Cloud SQL to use it

Answer

Use a Customer-Supplied Encryption Key (CSEK)

Question 2

Which defense-in-depth layer includes measures like access controls, vulnerability management, and intrusion detection systems?

Accepted Answer

Operational security. Operational security involves the policies and procedures to protect data and systems during operation, including access controls, vulnerability scanning, and intrusion detection. Physical security covers hardware and facilities; infrastructure security covers network and platform; data security covers encryption and data loss prevention.

Answer

Data security

Answer

Physical security

Answer

Infrastructure security

Question 3

A security team needs to implement a zero-trust architecture for a web application that is accessed by both internal employees and external partners. They require context-aware access that checks device posture and identity. Which THREE components should they use? (Choose three.)

Accepted Answer

Identity-Aware Proxy (IAP). BeyondCorp Enterprise provides the zero-trust framework, including device and identity verification. Identity-Aware Proxy (IAP) is a key component that enforces access based on context. Access levels in IAP define conditions (e.g., device posture, IP range) that must be met for access. Cloud Armor is for DDoS/WAF, not context-aware access. VPC firewall rules are network-level, not user-level. Chronicle is a SIEM.

Answer

VPC firewall rules

Answer

Cloud Armor

Question 4

A company wants to store encryption keys for encrypting data at rest in Cloud Storage, and also needs to automatically rotate the keys every 30 days. Additionally, they require an audit log of key usage. Which TWO services should they use? (Choose two.)

Accepted Answer

Cloud KMS. Cloud KMS allows creating and managing keys with automatic rotation (via rotation period). Cloud Audit Logs can be configured to log every use of the key (Data Access audit logs). Secret Manager is for secrets, not encryption keys. Cloud HSM provides hardware-backed keys but is part of Cloud KMS. Cloud Storage itself does not manage key rotation.

Answer

Cloud HSM

Answer

Secret Manager

Answer

Cloud Storage

Question 5

A company wants to replace its VPN-based remote access with a solution that grants access based on user identity, device security status, and context (e.g., location, IP). Which Google Cloud service should they use?

Accepted Answer

BeyondCorp Enterprise. BeyondCorp Enterprise provides zero-trust remote access without a VPN, using identity and context-aware access policies.

Answer

Cloud Armor

Answer

Identity-Aware Proxy (IAP)

Answer

Cloud VPN

Question 6

An organization wants to enforce that all data stored in Cloud Storage buckets is encrypted with a key that they control and rotate periodically. They also need to audit key usage. Which approach should they take?

Accepted Answer

Use Customer-Managed Encryption Keys (CMEK) with Cloud KMS. Customer-Managed Encryption Keys (CMEK) via Cloud KMS allow customers to control and rotate keys and audit usage via Cloud Audit Logs.

Answer

Use Customer-Supplied Encryption Keys (CSEK)

Answer

Use default Google-managed encryption keys

Answer

Use Cloud External Key Manager (Cloud EKM)

Question 7

A security engineer needs to analyze network traffic for malicious payloads and anomalies in real-time across multiple VPC networks in a project. The solution must be managed and not require deploying third-party appliances. Which service should they use?

Accepted Answer

Cloud IDS. Cloud IDS provides managed intrusion detection across VPC networks, analyzing traffic for threats like malware and anomalies.

Answer

Security Command Center

Answer

Cloud Armor

Answer

VPC Flow Logs

Question 8

Which Google Cloud service provides a fully managed SIEM solution for log analysis, threat detection, and incident response?

Accepted Answer

Chronicle. Chronicle is Google's SIEM offering that ingests logs and telemetry for security analytics.

Answer

Security Command Center

Answer

Operations Suite

Answer

Cloud Logging

Question 9

A company wants to ensure that only API calls from within a specific VPC can access their Cloud Storage buckets, even if the bucket is public. Which Google Cloud feature should they use?

Accepted Answer

VPC Service Controls. VPC Service Controls allow creating perimeters that restrict access to Google Cloud services to trusted VPCs and IP ranges.

Answer

VPC firewall rules

Answer

Cloud Armor

Answer

IAM conditions

Question 10

An engineer needs to store database passwords and API keys securely. The secrets must be encrypted at rest with a customer-managed key and automatically rotated every 90 days. Which service should they use?

Accepted Answer

Cloud Secret Manager. Secret Manager is designed for storing secrets like API keys and passwords, with built-in rotation and integration with Cloud KMS for CMEK.

Answer

Cloud KMS

Answer

Datastore

Answer

Cloud Storage with encryption

Question 11

A security team wants to be alerted when Google Cloud personnel access their customer data. They need logs that show the reason for access and what data was accessed. Which service provides this?

Accepted Answer

Access Transparency. Access Transparency logs provide detailed records of Google personnel access to customer data, including reason and scope.

Answer

Cloud Audit Logs

Answer

Security Command Center

Answer

Cloud Logging

Question 12

Which IAM component determines what actions a user is allowed to perform on a resource?

Accepted Answer

Authorization. Authorization is the process of determining what actions a user can perform; IAM roles and permissions define this.

Answer

Audit Logging

Answer

Authentication

Answer

Encryption

Question 13

A company wants to protect its web application from common web exploits like SQL injection and cross-site scripting. They also need to block traffic from known malicious IP addresses. Which Google Cloud service should they use?

Accepted Answer

Cloud Armor. Cloud Armor provides WAF capabilities to protect against web exploits and DDoS, and can block traffic based on IP reputation.

Answer

Security Command Center

Answer

reCAPTCHA Enterprise

Answer

Cloud IDS

Question 14

A DevOps engineer needs to grant a CI/CD pipeline (running on Compute Engine) permissions to deploy a Cloud Run service. The pipeline uses a service account. What is the correct approach to assign the necessary IAM role to the service account?

Accepted Answer

Grant the Cloud Run Deployer role to the Compute Engine default service account. The best practice is to attach the service account to the Compute Engine instance and grant the Cloud Run Deployer role to that service account.

Answer

Create a new service account, grant the Cloud Run Deployer role, and export a key file to the instance

Answer

Use the Cloud Run service agent with the roles/run.serviceAgent role

Answer

Grant the Cloud Run Admin role to the user account running the pipeline

Question 15

Which Google Cloud service helps identify and classify sensitive data such as credit card numbers or personal health information in Cloud Storage and BigQuery?

Accepted Answer

Data Loss Prevention (DLP) API. Sensitive Data Protection (DLP API) scans content to discover and classify sensitive data.

Answer

Security Command Center

Answer

Cloud Data Catalog

Answer

Access Transparency