Cloud Digital Leader Google Cloud Security Practice Test 4 — 15 Questions

Question 1

An organization needs to enforce that developers can only create Compute Engine instances in the us-central1 region. Which IAM approach should they use?

Accepted Answer

Grant the Compute Instance Admin role with an IAM condition on resource.location. IAM conditions allow setting regional constraints on roles, such as granting the Compute Instance Admin role with a condition on resource.location == 'us-central1'.

Answer

Use Organization Policy to restrict allowed regions

Answer

Create a custom role with permission restricted to us-central1

Answer

Create a separate project for each region

Question 2

A security team needs to detect and respond to threats across their Google Cloud environment. Which THREE services should they use together? (Choose 3)

Accepted Answer

Mandiant. Security Command Center for vulnerability scanning and threat detection, Chronicle for SIEM and incident response, and Mandiant for threat intelligence and forensic investigation.

Answer

Cloud Logging

Answer

Cloud Armor

Question 3

A company wants to ensure data encryption at rest using customer-managed keys for Cloud SQL and Cloud Storage. Which TWO actions must they take? (Choose 2)

Accepted Answer

Create a key ring and cryptographic key in Cloud KMS. Create a key ring and key in Cloud KMS, then configure each service to use that key (CMEK).

Answer

Grant the Cloud KMS CryptoKey Encrypter/Decrypter role to the service accounts

Answer

Enable CMEK in the project settings

Answer

Upload a custom key to Cloud HSM

Question 4

An engineer needs to prevent data exfiltration from a project by ensuring that Cloud Storage buckets can only be accessed from within a VPC network. Which TWO steps should they take? (Choose 2)

Accepted Answer

Set an ingress policy to allow access only from the VPC network. Create a VPC Service Controls perimeter that includes the project and restricts access to the VPC, and set ingress rules to allow traffic from the VPC.

Answer

Use IAM conditions to restrict access to the VPC

Answer

Enable Private Google Access on the VPC subnets

Answer

Create a firewall rule that denies all traffic to Cloud Storage

Question 5

A company wants to implement a zero-trust security model to replace its legacy VPN for accessing internal web applications. Employees use both company-managed and personal devices. Which Google Cloud service provides context-aware access based on user identity and device posture?

Accepted Answer

Identity-Aware Proxy (IAP). Identity-Aware Proxy (IAP) verifies user identity and context (device security, location, etc.) before granting access to applications, enabling zero-trust without a VPN.

Answer

Cloud VPN

Answer

Cloud Armor

Answer

VPC Service Controls

Question 6

An organization needs to store API keys, database passwords, and certificates securely, with automatic rotation and audit logging. Which Google Cloud service should they use?

Accepted Answer

Secret Manager. Secret Manager is designed to store secrets like API keys and passwords, with built-in rotation and audit logging.

Answer

Cloud Storage with encryption

Answer

Cloud KMS

Answer

Cloud HSM

Question 7

A security engineer needs to ensure that a Compute Engine instance can access a Cloud Storage bucket using its own identity, without embedding service account keys in the instance. What should the engineer do?

Accepted Answer

Create a service account, grant it the required IAM roles on the bucket, and attach the service account to the Compute Engine instance.. Attaching a service account to the Compute Engine instance allows it to authenticate using instance metadata without keys.

Answer

Create a service account and download its key. Store the key in Cloud Storage and have the instance download it at startup.

Answer

Create a service account, generate a key, and use the gcloud auth activate-service-account command on the instance.

Answer

Use the default Compute Engine service account and grant it roles on the bucket; no additional steps needed.

Question 8

A company uses Cloud Storage to store sensitive data. They want to enforce that all objects uploaded are encrypted with a customer-managed key that they can rotate and control. What should they configure?

Accepted Answer

Set default encryption on the bucket to use a CMEK key from Cloud KMS.. Customer-Managed Encryption Keys (CMEK) allow customers to manage their own keys using Cloud KMS.

Answer

Use customer-supplied encryption keys (CSEK) for each upload.

Answer

Use Cloud HSM to generate a key and import it to Cloud KMS.

Answer

Enable default encryption with a Google-managed key.

Question 9

An organization wants to detect and respond to threats across their GCP environment, including finding misconfigurations, vulnerabilities, and potential malicious activity. Which service provides a unified view of security findings?

Accepted Answer

Security Command Center. Security Command Center is a central dashboard for security findings including vulnerabilities, misconfigurations, and threats.

Answer

Mandiant

Answer

Chronicle

Answer

Cloud Audit Logs

Question 10

A small startup wants to protect its web application from common attacks like SQL injection and cross-site scripting (XSS). They also need DDoS protection. Which Google Cloud security service should they use?

Accepted Answer

Cloud Armor. Cloud Armor provides web application firewall (WAF) rules to block SQL injection and XSS, plus DDoS protection.

Answer

Security Command Center

Answer

Cloud IDS

Answer

reCAPTCHA Enterprise

Question 11

A company wants to ensure that its Google Cloud resources can only be accessed from within a specific VPC network, preventing data exfiltration to the internet. They need to enforce this for Cloud Storage and BigQuery APIs. Which service should they use?

Accepted Answer

VPC Service Controls. VPC Service Controls create perimeters around managed services to restrict access to only allowed VPC networks.

Answer

Cloud NAT

Answer

VPC Firewall Rules

Answer

Private Google Access

Question 12

A company needs to audit all actions performed by administrators on their Google Cloud project, including who accessed what resource and when. Which logging feature should they enable?

Accepted Answer

Cloud Audit Logs. Cloud Audit Logs record admin activity, data access, and system events for compliance and auditing.

Answer

Cloud Monitoring

Answer

Access Transparency

Answer

VPC Flow Logs

Question 13

A security analyst needs to analyze large volumes of security logs from multiple GCP projects, detect anomalies, and investigate incidents. The solution should support advanced analytics and threat hunting. Which service is best suited?

Accepted Answer

Chronicle. Chronicle is a cloud-native SIEM that ingests logs, provides analytics, and supports threat hunting.

Answer

Cloud Logging

Answer

BigQuery

Answer

Security Command Center

Question 14

A company wants to encrypt sensitive data stored in Cloud Storage with a key that is generated and stored on-premises using a hardware security module (HSM). They do not want Google to have access to the key. Which encryption option should they use?

Accepted Answer

Customer-supplied encryption keys (CSEK). Customer-Supplied Encryption Keys (CSEK) allow customers to provide their own keys; Google does not store the key and has no access to it.

Answer

Google-managed encryption keys

Answer

Customer-managed encryption keys (CMEK)

Answer

Cloud HSM

Question 15

A company has a requirement to rotate encryption keys every 90 days. They are using Cloud KMS to manage keys for Cloud Storage. What is the correct way to achieve key rotation with minimal impact to existing encrypted objects?

Accepted Answer

Enable automatic rotation on the key with a 90-day period.. Cloud KMS supports automatic rotation based on a schedule. When a key is rotated, a new version is created, and new data is encrypted with the new version while old data remains decryptable with the old version.

Answer

Manually rotate the key every 90 days by generating a new key version.

Answer

Use Cloud HSM to generate a new key and update the bucket default encryption.

Answer

Create a new key and re-encrypt all existing objects using the new key.