Cloud Digital Leader Google Cloud Security Practice Test 4 — 15 Questions

Question 1

A company wants to implement a zero-trust security model to replace its legacy VPN for accessing internal web applications. Employees use both company-managed and personal devices. Which Google Cloud service provides context-aware access based on user identity and device posture?

Accepted Answer

Identity-Aware Proxy (IAP). Identity-Aware Proxy (IAP) verifies user identity and context (device security, location, etc.) before granting access to applications, enabling zero-trust without a VPN.

Answer

Cloud VPN

Answer

Cloud Armor

Answer

VPC Service Controls

Question 2

An organization needs to store API keys, database passwords, and certificates securely, with automatic rotation and audit logging. Which Google Cloud service should they use?

Accepted Answer

Secret Manager. Secret Manager is designed to store secrets like API keys and passwords, with built-in rotation and audit logging.

Answer

Cloud Storage with encryption

Answer

Cloud KMS

Answer

Cloud HSM

Question 3

A security engineer needs to ensure that a Compute Engine instance can access a Cloud Storage bucket using its own identity, without embedding service account keys in the instance. What should the engineer do?

Accepted Answer

Create a service account, grant it the required IAM roles on the bucket, and attach the service account to the Compute Engine instance.. Attaching a service account to the Compute Engine instance allows it to authenticate using instance metadata without keys.

Answer

Create a service account and download its key. Store the key in Cloud Storage and have the instance download it at startup.

Answer

Create a service account, generate a key, and use the gcloud auth activate-service-account command on the instance.

Answer

Use the default Compute Engine service account and grant it roles on the bucket; no additional steps needed.

Question 4

A company uses Cloud Storage to store sensitive data. They want to enforce that all objects uploaded are encrypted with a customer-managed key that they can rotate and control. What should they configure?

Accepted Answer

Set default encryption on the bucket to use a CMEK key from Cloud KMS.. Customer-Managed Encryption Keys (CMEK) allow customers to manage their own keys using Cloud KMS.

Answer

Use customer-supplied encryption keys (CSEK) for each upload.

Answer

Use Cloud HSM to generate a key and import it to Cloud KMS.

Answer

Enable default encryption with a Google-managed key.

Question 5

An organization wants to detect and respond to threats across their GCP environment, including finding misconfigurations, vulnerabilities, and potential malicious activity. Which service provides a unified view of security findings?

Accepted Answer

Security Command Center. Security Command Center is a central dashboard for security findings including vulnerabilities, misconfigurations, and threats.

Answer

Mandiant

Answer

Chronicle

Answer

Cloud Audit Logs

Question 6

A small startup wants to protect its web application from common attacks like SQL injection and cross-site scripting (XSS). They also need DDoS protection. Which Google Cloud security service should they use?

Accepted Answer

Cloud Armor. Cloud Armor provides web application firewall (WAF) rules to block SQL injection and XSS, plus DDoS protection.

Answer

Security Command Center

Answer

Cloud IDS

Answer

reCAPTCHA Enterprise

Question 7

A company wants to ensure that its Google Cloud resources can only be accessed from within a specific VPC network, preventing data exfiltration to the internet. They need to enforce this for Cloud Storage and BigQuery APIs. Which service should they use?

Accepted Answer

VPC Service Controls. VPC Service Controls create perimeters around managed services to restrict access to only allowed VPC networks.

Answer

Cloud NAT

Answer

VPC Firewall Rules

Answer

Private Google Access

Question 8

A company needs to audit all actions performed by administrators on their Google Cloud project, including who accessed what resource and when. Which logging feature should they enable?

Accepted Answer

Cloud Audit Logs. Cloud Audit Logs record admin activity, data access, and system events for compliance and auditing.

Answer

Cloud Monitoring

Answer

Access Transparency

Answer

VPC Flow Logs

Question 9

A security analyst needs to analyze large volumes of security logs from multiple GCP projects, detect anomalies, and investigate incidents. The solution should support advanced analytics and threat hunting. Which service is best suited?

Accepted Answer

Chronicle. Chronicle is a cloud-native SIEM that ingests logs, provides analytics, and supports threat hunting.

Answer

Cloud Logging

Answer

BigQuery

Answer

Security Command Center

Question 10

A company wants to encrypt sensitive data stored in Cloud Storage with a key that is generated and stored on-premises using a hardware security module (HSM). They do not want Google to have access to the key. Which encryption option should they use?

Accepted Answer

Customer-supplied encryption keys (CSEK). Customer-Supplied Encryption Keys (CSEK) allow customers to provide their own keys; Google does not store the key and has no access to it.

Answer

Google-managed encryption keys

Answer

Customer-managed encryption keys (CMEK)

Answer

Cloud HSM

Question 11

A company has a requirement to rotate encryption keys every 90 days. They are using Cloud KMS to manage keys for Cloud Storage. What is the correct way to achieve key rotation with minimal impact to existing encrypted objects?

Accepted Answer

Enable automatic rotation on the key with a 90-day period.. Cloud KMS supports automatic rotation based on a schedule. When a key is rotated, a new version is created, and new data is encrypted with the new version while old data remains decryptable with the old version.

Answer

Manually rotate the key every 90 days by generating a new key version.

Answer

Use Cloud HSM to generate a new key and update the bucket default encryption.

Answer

Create a new key and re-encrypt all existing objects using the new key.

Question 12

A developer needs to allow a Compute Engine VM to read from a specific Cloud Storage bucket. Which IAM role should be granted to the VM's service account?

Accepted Answer

roles/storage.objectViewer. The roles/storage.objectViewer role grants read access to objects in a bucket.

Answer

roles/storage.legacyBucketReader

Answer

roles/storage.admin

Answer

roles/storage.objectCreator

Question 13

A company wants to protect its web application deployed on Google Cloud from OWASP Top 10 attacks and also block traffic from specific geographic regions. Which TWO services should they use together? (Choose 2)

Accepted Answer

Cloud CDN. Cloud Armor provides WAF rules for OWASP Top 10 and geo-blocking. Cloud CDN caches content and can be used with Cloud Armor for edge protection.

Answer

Cloud Load Balancing

Answer

Cloud IDS

Answer

reCAPTCHA Enterprise

Question 14

A security team needs to implement the principle of least privilege for a group of data scientists who only need to query BigQuery datasets, but not modify or delete them. Which THREE IAM roles should be granted? (Choose 3)

Accepted Answer

roles/bigquery.dataViewer. BigQuery Data Viewer allows querying datasets. BigQuery Job User allows running jobs. BigQuery User is a broader role that includes querying but also other permissions. The combination of these allows read-only querying.

Answer

roles/bigquery.dataEditor

Answer

roles/bigquery.admin

Question 15

An organization needs to ensure that data stored in Cloud Storage is encrypted at rest using keys that are rotated every 30 days. They also need to audit who accesses the keys and when. Which THREE services should they use? (Choose 3)

Accepted Answer

Cloud Audit Logs. Cloud KMS manages key rotation. Cloud Audit Logs record key access. Cloud Storage stores the data. Cloud HSM can be used but is not required for the scenario.

Answer

Cloud HSM

Answer

Secret Manager