Cloud Digital Leader Google Cloud Security Practice Test 3 — 15 Questions

Question 1

An organization needs to protect a web application hosted on Google Cloud from DDoS attacks and SQL injection attempts. They want a managed security service that integrates with Cloud Load Balancing. Which service should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Cloud Armor. Cloud Armor is Google's managed DDoS protection and Web Application Firewall (WAF) service. It integrates with Cloud Load Balancing to filter traffic based on IP, geo, and HTTP headers, and includes preconfigured rules (e.g., OWASP) to block SQL injection. Cloud IDS is for network intrusion detection. reCAPTCHA Enterprise is for bot detection. VPC firewall rules are for network-level access control.

Answer

Cloud IDS

Answer

reCAPTCHA Enterprise

Answer

VPC firewall rules

Question 2

A DevOps engineer wants to audit all actions performed by Google personnel on their customer data stored in Cloud Storage. They need to review logs that show access by Google employees and the reason for access. Which logging feature should they enable?

Accepted Answer

Access Transparency. Access Transparency provides logs specifically showing when Google personnel access customer data, including the reason and justification for access. It is designed for auditing Google employee actions on customer data, which is exactly the requirement.

Answer

Cloud Audit Logs

Answer

Cloud Logging

Answer

VPC Flow Logs

Question 3

A company wants to enforce the principle of least privilege by granting a service account only the permissions necessary to publish messages to a specific Pub/Sub topic. Which IAM approach should they use?

Accepted Answer

Grant the roles/pubsub.publisher role to the service account at the topic level. To enforce least privilege for a service account that only needs to publish to a specific Pub/Sub topic, you should grant the roles/pubsub.publisher role at the topic level. This scopes the permission to that single topic, preventing the service account from publishing to other topics or accessing other resources. This is the most granular and least-privilege approach.

Answer

Grant the roles/editor role to the service account at the project level

Answer

Grant the roles/pubsub.subscriber role to the service account at the topic level

Answer

Grant the roles/pubsub.publisher role to the service account at the project level

Question 4

A security team needs to detect and alert on suspicious outbound network traffic from their GCP environment, such as data exfiltration attempts. They require a managed service that analyzes traffic for threats. Which service should they use?

Accepted Answer

Cloud IDS. Cloud IDS is Google Cloud's managed network intrusion detection service that inspects traffic (via packet mirroring) for threats such as malware, command-and-control, and data exfiltration, and generates alerts. It is purpose-built for detecting suspicious network activity in a GCP environment without deploying third-party appliances.

Answer

Cloud Armor

Answer

Security Command Center

Answer

Chronicle

Question 5

An organization has a compliance requirement to run workloads in specific geographic regions only. They want to prevent any resources from being created outside those regions. Which Google Cloud control should they use?

Accepted Answer

Organization policy with location restriction. Organization policies with location restrictions allow administrators to set constraints on where resources can be created. The constraint `gcp.resourceLocations` can be used to restrict allowed regions. IAM roles control who can create resources, but not where. VPC Service Controls restrict data access, not resource creation location. Cloud Audit Logs only record actions.

Answer

Cloud Audit Logs

Answer

VPC Service Controls

Answer

IAM conditions with resource location

Question 6

A company uses Cloud SQL and wants to encrypt data at rest with a key that they manage and rotate themselves. They also want to ensure that the encryption happens automatically before data is written to disk. Which configuration should they choose?

Accepted Answer

Use a Customer-Managed Encryption Key (CMEK) from Cloud KMS. Customer-Managed Encryption Keys (CMEK) in Cloud KMS let you own, manage, and rotate the key while Cloud SQL automatically uses it to encrypt data at rest before writing to disk. This satisfies both the customer-managed rotation requirement and the automatic pre-write encryption requirement.

Answer

Enable default Google-managed encryption

Answer

Store the encryption key in Secret Manager and configure Cloud SQL to use it

Answer

Use a Customer-Supplied Encryption Key (CSEK)

Question 7

Which defense-in-depth layer includes measures like access controls, vulnerability management, and intrusion detection systems?

Accepted Answer

Operational security. Operational security (OpSec) is the defense-in-depth layer focused on day-to-day processes, people, and procedures that protect systems — it explicitly encompasses access controls, vulnerability management, and intrusion detection systems. These are ongoing operational activities rather than physical barriers or data-at-rest protections, which is why OpSec is the correct classification.

Answer

Data security

Answer

Physical security

Answer

Infrastructure security

Question 8

A company wants to protect sensitive data stored in Cloud Storage from being downloaded by users outside their organization. They also need to prevent data from being copied to external projects. Which TWO services should they use? (Choose two.)

Accepted Answer

IAM conditions with access levels. IAM conditions with access levels (A) are correct because they let you enforce context-aware access rules on Cloud Storage, such as allowing access only when the request originates from a trusted network or device, which directly addresses preventing downloads by users outside the organization. VPC Service Controls (C) are correct because they create a service perimeter around Cloud Storage that blocks data exfiltration, including preventing data from being copied to external projects outside the perimeter. Cloud DLP (B) is incorrect because it is used to discover, classify, and redact sensitive data, not to enforce access or exfiltration boundaries. Cloud KMS (D) is incorrect because it manages encryption keys and does not control who can download or copy data. Cloud Armor (E) is incorrect because it protects web applications from network-layer and application-layer attacks at the edge, not Cloud Storage data access or project boundaries.

Answer

Cloud DLP

Answer

Cloud KMS

Answer

Cloud Armor

Question 9

A security team needs to implement a zero-trust architecture for a web application that is accessed by both internal employees and external partners. They require context-aware access that checks device posture and identity. Which THREE components should they use? (Choose three.)

Accepted Answer

Identity-Aware Proxy (IAP). BeyondCorp Enterprise provides the zero-trust framework, including device and identity verification. Identity-Aware Proxy (IAP) is a key component that enforces access based on context. Access levels in IAP define conditions (e.g., device posture, IP range) that must be met for access. Cloud Armor is for DDoS/WAF, not context-aware access. VPC firewall rules are network-level, not user-level. Chronicle is a SIEM.

Answer

VPC firewall rules

Answer

Cloud Armor

Question 10

A company wants to store encryption keys for encrypting data at rest in Cloud Storage, and also needs to automatically rotate the keys every 30 days. Additionally, they require an audit log of key usage. Which TWO services should they use? (Choose two.)

Accepted Answer

Cloud KMS. Cloud KMS (C) is correct because it is the Google Cloud service designed to create and manage cryptographic keys used for encrypting data at rest, including Cloud Storage objects via customer-managed encryption keys (CMEK), and it natively supports automatic key rotation schedules (e.g., every 30 days) through rotation periods on key versions. Cloud Audit Logs (D) is correct because it records administrative and data-access activity on Cloud KMS keys, such as Encrypt/Decrypt operations and key rotation events, providing the required audit trail of key usage. Cloud HSM (A) is not the right choice here because it is a hardware security module backing for Cloud KMS keys, not a separate service that provides rotation scheduling or audit logging by itself. Secret Manager (B) stores secrets like passwords and API keys, not encryption keys for data-at-rest encryption with rotation. Cloud Storage (E) is the data store being encrypted, not a key management or auditing service.

Answer

Cloud HSM

Answer

Secret Manager

Answer

Cloud Storage

Question 11

A company wants to replace its VPN-based remote access with a solution that grants access based on user identity, device security status, and context (e.g., location, IP). Which Google Cloud service should they use?

Accepted Answer

BeyondCorp Enterprise. BeyondCorp Enterprise is Google Cloud's zero-trust access platform that grants access based on user identity, device security posture, and contextual signals (location, IP, time), replacing traditional VPN-based remote access. It builds on Identity-Aware Proxy (IAP) and adds device trust, continuous authorization, and threat/data protection. This matches the requirement for identity- and context-based access without a VPN.

Answer

Cloud Armor

Answer

Identity-Aware Proxy (IAP)

Answer

Cloud VPN

Question 12

An organization wants to enforce that all data stored in Cloud Storage buckets is encrypted with a key that they control and rotate periodically. They also need to audit key usage. Which approach should they take?

Accepted Answer

Use Customer-Managed Encryption Keys (CMEK) with Cloud KMS. Customer-Managed Encryption Keys (CMEK) via Cloud KMS allow customers to control and rotate keys and audit usage via Cloud Audit Logs.

Answer

Use Customer-Supplied Encryption Keys (CSEK)

Answer

Use default Google-managed encryption keys

Answer

Use Cloud External Key Manager (Cloud EKM)

Question 13

A security engineer needs to analyze network traffic for malicious payloads and anomalies in real-time across multiple VPC networks in a project. The solution must be managed and not require deploying third-party appliances. Which service should they use?

Accepted Answer

Cloud IDS. Cloud IDS provides managed intrusion detection across VPC networks, analyzing traffic for threats like malware and anomalies.

Answer

Security Command Center

Answer

Cloud Armor

Answer

VPC Flow Logs

Question 14

Which Google Cloud service provides a fully managed SIEM solution for log analysis, threat detection, and incident response?

Accepted Answer

Chronicle. Chronicle is Google's SIEM offering that ingests logs and telemetry for security analytics.

Answer

Security Command Center

Answer

Operations Suite

Answer

Cloud Logging

Question 15

A company wants to ensure that only API calls from within a specific VPC can access their Cloud Storage buckets, even if the bucket is public. Which Google Cloud feature should they use?

Accepted Answer

VPC Service Controls. VPC Service Controls create a service perimeter that restricts access to Google Cloud APIs (including Cloud Storage) so that requests originating outside the perimeter are denied even if the bucket is public or IAM grants access. This is the only feature that enforces a network-origin boundary around managed services like Cloud Storage.

Answer

VPC firewall rules

Answer

Cloud Armor

Answer

IAM conditions