Cloud Digital Leader Google Cloud Security Practice Test 4 — 15 Questions

Question 1

An engineer needs to store database passwords and API keys securely. The secrets must be encrypted at rest with a customer-managed key and automatically rotated every 90 days. Which service should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Cloud Secret Manager. Cloud Secret Manager is purpose-built for storing, accessing, and rotating secrets such as database passwords and API keys, and it supports customer-managed encryption keys (CMEK) plus automatic rotation schedules. It provides versioning, audit logging, and fine-grained IAM access, which are exactly the requirements stated. Cloud KMS, by contrast, manages encryption keys themselves rather than the secrets they protect.

Answer

Cloud KMS

Answer

Datastore

Answer

Cloud Storage with encryption

Question 2

A security team wants to be alerted when Google Cloud personnel access their customer data. They need logs that show the reason for access and what data was accessed. Which service provides this?

Accepted Answer

Access Transparency. Access Transparency logs provide detailed records of Google personnel access to customer data, including reason and scope.

Answer

Cloud Audit Logs

Answer

Security Command Center

Answer

Cloud Logging

Question 3

Which IAM component determines what actions a user is allowed to perform on a resource?

Accepted Answer

Authorization. Authorization is the IAM component that determines what an authenticated principal is allowed to do on a resource; it evaluates policies attached to users, groups, roles, and resources to allow or deny specific actions. Authentication establishes identity, while authorization decides permissions — so authorization is the correct answer.

Answer

Audit Logging

Answer

Authentication

Answer

Encryption

Question 4

A company wants to protect its web application from common web exploits like SQL injection and cross-site scripting. They also need to block traffic from known malicious IP addresses. Which Google Cloud service should they use?

Accepted Answer

Cloud Armor. Cloud Armor provides WAF capabilities to protect against web exploits and DDoS, and can block traffic based on IP reputation.

Answer

Security Command Center

Answer

reCAPTCHA Enterprise

Answer

Cloud IDS

Question 5

Which Google Cloud service helps identify and classify sensitive data such as credit card numbers or personal health information in Cloud Storage and BigQuery?

Accepted Answer

Data Loss Prevention (DLP) API. The Data Loss Prevention (DLP) API is specifically designed to discover, classify, and protect sensitive data such as credit card numbers, personal health information, and other PII. It can scan Cloud Storage buckets and BigQuery tables, using built-in infoType detectors to identify and classify sensitive content. This makes it the correct service for the described requirement.

Answer

Security Command Center

Answer

Cloud Data Catalog

Answer

Access Transparency

Question 6

An organization needs to enforce that developers can only create Compute Engine instances in the us-central1 region. Which IAM approach should they use?

Accepted Answer

Grant the Compute Instance Admin role with an IAM condition on resource.location. IAM conditions allow setting regional constraints on roles, such as granting the Compute Instance Admin role with a condition on resource.location == 'us-central1'.

Answer

Use Organization Policy to restrict allowed regions

Answer

Create a custom role with permission restricted to us-central1

Answer

Create a separate project for each region

Question 7

A security team needs to detect and respond to threats across their Google Cloud environment. Which THREE services should they use together? (Choose 3)

Accepted Answer

Mandiant. Security Command Center for vulnerability scanning and threat detection, Chronicle for SIEM and incident response, and Mandiant for threat intelligence and forensic investigation.

Answer

Cloud Logging

Answer

Cloud Armor

Question 8

A company wants to implement a zero-trust security model to replace its legacy VPN for accessing internal web applications. Employees use both company-managed and personal devices. Which Google Cloud service provides context-aware access based on user identity and device posture?

Accepted Answer

Identity-Aware Proxy (IAP). Identity-Aware Proxy (IAP) verifies user identity and context (device security, location, etc.) before granting access to applications, enabling zero-trust without a VPN.

Answer

Cloud VPN

Answer

Cloud Armor

Answer

VPC Service Controls

Question 9

An organization needs to store API keys, database passwords, and certificates securely, with automatic rotation and audit logging. Which Google Cloud service should they use?

Accepted Answer

Secret Manager. Secret Manager is purpose-built for storing API keys, passwords, and certificates with versioning, automatic rotation, IAM-based access control, and audit logging via Cloud Audit Logs. It directly addresses the requirement for secure storage plus rotation and auditing.

Answer

Cloud Storage with encryption

Answer

Cloud KMS

Answer

Cloud HSM

Question 10

A security engineer needs to ensure that a Compute Engine instance can access a Cloud Storage bucket using its own identity, without embedding service account keys in the instance. What should the engineer do?

Accepted Answer

Create a service account, grant it the required IAM roles on the bucket, and attach the service account to the Compute Engine instance.. Attaching a service account to the Compute Engine instance allows it to authenticate using instance metadata without keys.

Answer

Create a service account and download its key. Store the key in Cloud Storage and have the instance download it at startup.

Answer

Create a service account, generate a key, and use the gcloud auth activate-service-account command on the instance.

Answer

Use the default Compute Engine service account and grant it roles on the bucket; no additional steps needed.

Question 11

A company uses Cloud Storage to store sensitive data. They want to enforce that all objects uploaded are encrypted with a customer-managed key that they can rotate and control. What should they configure?

Accepted Answer

Set default encryption on the bucket to use a CMEK key from Cloud KMS.. Customer-Managed Encryption Keys (CMEK) allow customers to manage their own keys using Cloud KMS.

Answer

Use customer-supplied encryption keys (CSEK) for each upload.

Answer

Use Cloud HSM to generate a key and import it to Cloud KMS.

Answer

Enable default encryption with a Google-managed key.

Question 12

An organization wants to detect and respond to threats across their GCP environment, including finding misconfigurations, vulnerabilities, and potential malicious activity. Which service provides a unified view of security findings?

Accepted Answer

Security Command Center. Security Command Center is a central dashboard for security findings including vulnerabilities, misconfigurations, and threats.

Answer

Mandiant

Answer

Chronicle

Answer

Cloud Audit Logs

Question 13

A small startup wants to protect its web application from common attacks like SQL injection and cross-site scripting (XSS). They also need DDoS protection. Which Google Cloud security service should they use?

Accepted Answer

Cloud Armor. Google Cloud Armor is a web application firewall (WAF) and DDoS protection service that filters HTTP(S) traffic at the edge of Google's network. It provides preconfigured WAF rules to block OWASP Top 10 attacks such as SQL injection and XSS, and it includes built-in DDoS protection for external HTTP(S) load balancers. For a small startup needing both WAF and DDoS protection in one service, Cloud Armor is the correct choice.

Answer

Security Command Center

Answer

Cloud IDS

Answer

reCAPTCHA Enterprise

Question 14

A company wants to ensure that its Google Cloud resources can only be accessed from within a specific VPC network, preventing data exfiltration to the internet. They need to enforce this for Cloud Storage and BigQuery APIs. Which service should they use?

Accepted Answer

VPC Service Controls. VPC Service Controls create perimeters around managed services to restrict access to only allowed VPC networks.

Answer

Cloud NAT

Answer

VPC Firewall Rules

Answer

Private Google Access

Question 15

A company needs to audit all actions performed by administrators on their Google Cloud project, including who accessed what resource and when. Which logging feature should they enable?

Accepted Answer

Cloud Audit Logs. Cloud Audit Logs record all administrative and data access activities in Google Cloud, including who did what, where, and when. They are specifically designed for auditing and compliance, capturing Admin Activity, Data Access, System Event, and Policy Denied logs. Enabling Cloud Audit Logs provides the detailed trail needed to audit administrator actions across the project.

Answer

Cloud Monitoring

Answer

Access Transparency

Answer

VPC Flow Logs