Cloud Digital Leader Google Cloud Security Practice Test 3 — 15 Questions

Question 1

A company wants to replace its VPN-based remote access with a solution that grants access based on user identity, device security status, and context (e.g., location, IP). Which Google Cloud service should they use?

Accepted Answer

BeyondCorp Enterprise. BeyondCorp Enterprise provides zero-trust remote access without a VPN, using identity and context-aware access policies.

Answer

Cloud Armor

Answer

Identity-Aware Proxy (IAP)

Answer

Cloud VPN

Question 2

An organization wants to enforce that all data stored in Cloud Storage buckets is encrypted with a key that they control and rotate periodically. They also need to audit key usage. Which approach should they take?

Accepted Answer

Use Customer-Managed Encryption Keys (CMEK) with Cloud KMS. Customer-Managed Encryption Keys (CMEK) via Cloud KMS allow customers to control and rotate keys and audit usage via Cloud Audit Logs.

Answer

Use Customer-Supplied Encryption Keys (CSEK)

Answer

Use default Google-managed encryption keys

Answer

Use Cloud External Key Manager (Cloud EKM)

Question 3

A security engineer needs to analyze network traffic for malicious payloads and anomalies in real-time across multiple VPC networks in a project. The solution must be managed and not require deploying third-party appliances. Which service should they use?

Accepted Answer

Cloud IDS. Cloud IDS provides managed intrusion detection across VPC networks, analyzing traffic for threats like malware and anomalies.

Answer

Security Command Center

Answer

Cloud Armor

Answer

VPC Flow Logs

Question 4

Which Google Cloud service provides a fully managed SIEM solution for log analysis, threat detection, and incident response?

Accepted Answer

Chronicle. Chronicle is Google's SIEM offering that ingests logs and telemetry for security analytics.

Answer

Security Command Center

Answer

Operations Suite

Answer

Cloud Logging

Question 5

A company wants to ensure that only API calls from within a specific VPC can access their Cloud Storage buckets, even if the bucket is public. Which Google Cloud feature should they use?

Accepted Answer

VPC Service Controls. VPC Service Controls allow creating perimeters that restrict access to Google Cloud services to trusted VPCs and IP ranges.

Answer

VPC firewall rules

Answer

Cloud Armor

Answer

IAM conditions

Question 6

An engineer needs to store database passwords and API keys securely. The secrets must be encrypted at rest with a customer-managed key and automatically rotated every 90 days. Which service should they use?

Accepted Answer

Cloud Secret Manager. Secret Manager is designed for storing secrets like API keys and passwords, with built-in rotation and integration with Cloud KMS for CMEK.

Answer

Cloud KMS

Answer

Datastore

Answer

Cloud Storage with encryption

Question 7

A security team wants to be alerted when Google Cloud personnel access their customer data. They need logs that show the reason for access and what data was accessed. Which service provides this?

Accepted Answer

Access Transparency. Access Transparency logs provide detailed records of Google personnel access to customer data, including reason and scope.

Answer

Cloud Audit Logs

Answer

Security Command Center

Answer

Cloud Logging

Question 8

Which IAM component determines what actions a user is allowed to perform on a resource?

Accepted Answer

Authorization. Authorization is the process of determining what actions a user can perform; IAM roles and permissions define this.

Answer

Audit Logging

Answer

Authentication

Answer

Encryption

Question 9

A company wants to protect its web application from common web exploits like SQL injection and cross-site scripting. They also need to block traffic from known malicious IP addresses. Which Google Cloud service should they use?

Accepted Answer

Cloud Armor. Cloud Armor provides WAF capabilities to protect against web exploits and DDoS, and can block traffic based on IP reputation.

Answer

Security Command Center

Answer

reCAPTCHA Enterprise

Answer

Cloud IDS

Question 10

A DevOps engineer needs to grant a CI/CD pipeline (running on Compute Engine) permissions to deploy a Cloud Run service. The pipeline uses a service account. What is the correct approach to assign the necessary IAM role to the service account?

Accepted Answer

Grant the Cloud Run Deployer role to the Compute Engine default service account. The best practice is to attach the service account to the Compute Engine instance and grant the Cloud Run Deployer role to that service account.

Answer

Create a new service account, grant the Cloud Run Deployer role, and export a key file to the instance

Answer

Use the Cloud Run service agent with the roles/run.serviceAgent role

Answer

Grant the Cloud Run Admin role to the user account running the pipeline

Question 11

Which Google Cloud service helps identify and classify sensitive data such as credit card numbers or personal health information in Cloud Storage and BigQuery?

Accepted Answer

Data Loss Prevention (DLP) API. Sensitive Data Protection (DLP API) scans content to discover and classify sensitive data.

Answer

Security Command Center

Answer

Cloud Data Catalog

Answer

Access Transparency

Question 12

An organization needs to enforce that developers can only create Compute Engine instances in the us-central1 region. Which IAM approach should they use?

Accepted Answer

Grant the Compute Instance Admin role with an IAM condition on resource.location. IAM conditions allow setting regional constraints on roles, such as granting the Compute Instance Admin role with a condition on resource.location == 'us-central1'.

Answer

Use Organization Policy to restrict allowed regions

Answer

Create a custom role with permission restricted to us-central1

Answer

Create a separate project for each region

Question 13

A security team needs to detect and respond to threats across their Google Cloud environment. Which THREE services should they use together? (Choose 3)

Accepted Answer

Mandiant. Security Command Center for vulnerability scanning and threat detection, Chronicle for SIEM and incident response, and Mandiant for threat intelligence and forensic investigation.

Answer

Cloud Logging

Answer

Cloud Armor

Question 14

A company wants to ensure data encryption at rest using customer-managed keys for Cloud SQL and Cloud Storage. Which TWO actions must they take? (Choose 2)

Accepted Answer

Create a key ring and cryptographic key in Cloud KMS. Create a key ring and key in Cloud KMS, then configure each service to use that key (CMEK).

Answer

Grant the Cloud KMS CryptoKey Encrypter/Decrypter role to the service accounts

Answer

Enable CMEK in the project settings

Answer

Upload a custom key to Cloud HSM

Question 15

An engineer needs to prevent data exfiltration from a project by ensuring that Cloud Storage buckets can only be accessed from within a VPC network. Which TWO steps should they take? (Choose 2)

Accepted Answer

Set an ingress policy to allow access only from the VPC network. Create a VPC Service Controls perimeter that includes the project and restricts access to the VPC, and set ingress rules to allow traffic from the VPC.

Answer

Use IAM conditions to restrict access to the VPC

Answer

Enable Private Google Access on the VPC subnets

Answer

Create a firewall rule that denies all traffic to Cloud Storage