Cloud Digital Leader Google Cloud Security Practice Test 5 — 15 Questions

Question 1

A developer needs to allow a Compute Engine VM to read from a specific Cloud Storage bucket. Which IAM role should be granted to the VM's service account?

Accepted Answer

roles/storage.objectViewer. The roles/storage.objectViewer role grants read access to objects in a bucket.

Answer

roles/storage.legacyBucketReader

Answer

roles/storage.admin

Answer

roles/storage.objectCreator

Question 2

A company wants to protect its web application deployed on Google Cloud from OWASP Top 10 attacks and also block traffic from specific geographic regions. Which TWO services should they use together? (Choose 2)

Accepted Answer

Cloud CDN. Cloud Armor provides WAF rules for OWASP Top 10 and geo-blocking. Cloud CDN caches content and can be used with Cloud Armor for edge protection.

Answer

Cloud Load Balancing

Answer

Cloud IDS

Answer

reCAPTCHA Enterprise

Question 3

A security team needs to implement the principle of least privilege for a group of data scientists who only need to query BigQuery datasets, but not modify or delete them. Which THREE IAM roles should be granted? (Choose 3)

Accepted Answer

roles/bigquery.dataViewer. BigQuery Data Viewer allows querying datasets. BigQuery Job User allows running jobs. BigQuery User is a broader role that includes querying but also other permissions. The combination of these allows read-only querying.

Answer

roles/bigquery.dataEditor

Answer

roles/bigquery.admin

Question 4

An organization needs to ensure that data stored in Cloud Storage is encrypted at rest using keys that are rotated every 30 days. They also need to audit who accesses the keys and when. Which THREE services should they use? (Choose 3)

Accepted Answer

Cloud Audit Logs. Cloud KMS manages key rotation. Cloud Audit Logs record key access. Cloud Storage stores the data. Cloud HSM can be used but is not required for the scenario.

Answer

Cloud HSM

Answer

Secret Manager

Question 5

Which Google Cloud security layer is responsible for protecting data stored on disk using either Google-managed or customer-managed encryption keys?

Accepted Answer

Data security. Data encryption at rest is a core component of data security, ensuring data stored on disk is encrypted. Google Cloud encrypts all data at rest by default using Google-managed keys, with options for CMEK and CSEK.

Answer

Operational security

Answer

Infrastructure security

Answer

Hardware security

Question 6

A company wants to replace its VPN-based remote access with a solution that grants access to internal web applications based on user identity and device context, without requiring a VPN. Which Google Cloud service should they use?

Accepted Answer

Identity-Aware Proxy (IAP). Identity-Aware Proxy (IAP) provides context-aware access to applications without a VPN, verifying user identity and device context. BeyondCorp Enterprise is a framework that includes IAP, but the question asks for the service that directly enforces access based on identity and context.

Answer

Access Transparency

Answer

Cloud Identity

Answer

Cloud VPN

Question 7

A security engineer needs to monitor and analyze security logs from multiple GCP projects and on-premises sources in a centralized SIEM. Which Google Cloud service is designed for log management and security analytics at scale?

Accepted Answer

Chronicle. Chronicle is Google Cloud's SIEM platform that ingests logs from various sources and provides security analytics. Security Command Center is for vulnerability management, not a SIEM. Cloud Logging is for log storage and basics, but not a full SIEM.

Answer

Cloud Logging

Answer

Security Command Center

Answer

Cloud IDS

Question 8

A company has a VPC with multiple subnets and wants to prevent data exfiltration by restricting access to a Cloud Storage bucket from only resources within a defined perimeter. Which Google Cloud service should they use to create an API perimeter around the bucket?

Accepted Answer

VPC Service Controls. VPC Service Controls allows you to define perimeters around Google Cloud services like Cloud Storage, preventing data exfiltration to networks outside the perimeter. VPC firewall rules control network traffic but not API access. Cloud Armor is for DDoS protection. Cloud NAT is for outbound internet access.

Answer

Cloud Armor

Answer

Cloud NAT

Answer

VPC firewall rules

Question 9

Which Google Cloud service provides threat intelligence and incident response capabilities, including access to Mandiant expertise?

Accepted Answer

Mandiant. Mandiant is Google Cloud's threat intelligence and incident response service. Security Command Center provides vulnerability scanning but not Mandiant expertise. Chronicle is a SIEM. Cloud IDS is network intrusion detection.

Answer

Security Command Center

Answer

Chronicle

Answer

Cloud IDS

Question 10

A developer needs to store and manage API keys and certificates in a secure, centralized manner, with automatic rotation and integration with Cloud Functions. Which Google Cloud service should they use?

Accepted Answer

Secret Manager. Secret Manager stores secrets like API keys, passwords, and certificates, and integrates with Cloud Functions for secure access. Cloud KMS manages encryption keys, not secrets. Cloud Storage is not designed for secret management. Cloud Asset Inventory tracks resources.

Answer

Cloud Storage

Answer

Cloud KMS

Answer

Cloud Asset Inventory

Question 11

A company must meet regulatory requirements that restrict where data can be stored and processed. They need to ensure that Google Cloud personnel have limited and audited access to their data. Which combination of services should they use?

Accepted Answer

Assured Workloads and Access Transparency. Assured Workloads provides regulatory compliance controls and access restrictions for specific regions. Access Transparency logs Google personnel access. Cloud Audit Logs track user activity. The question asks for a combination that restricts personnel access and provides audit logs.

Answer

Access Transparency and VPC Service Controls

Answer

Cloud KMS and Cloud Audit Logs

Answer

VPC Service Controls and Cloud Audit Logs

Question 12

An organization wants to protect its web application from DDoS attacks and SQL injection. Which Google Cloud service should they deploy?

Accepted Answer

Cloud Armor. Cloud Armor provides DDoS protection and Web Application Firewall (WAF) capabilities to block attacks like SQL injection. Cloud IDS is for intrusion detection. Security Command Center is for vulnerability management. Cloud DNS is for DNS resolution.

Answer

Cloud DNS

Answer

Security Command Center

Answer

Cloud IDS

Question 13

Which IAM concept defines what actions a user can perform on a resource?

Accepted Answer

Authorization. Authorization defines what actions are allowed. Authentication verifies identity. Roles and permissions are part of authorization. The question asks for the concept that defines actions.

Answer

Permissions

Answer

Authentication

Answer

Roles

Question 14

A security team wants to detect and respond to threats across multiple GCP projects, including identifying misconfigurations and vulnerabilities. They need a single pane of glass. Which service provides a unified view of security findings across projects?

Accepted Answer

Security Command Center. Security Command Center provides a unified dashboard for security findings across projects, including vulnerability scanning, threat detection, and misconfiguration alerts. Chronicle is a SIEM for log analysis but not a unified view of findings. Cloud Audit Logs provide logs but not aggregation. Cloud Operations is for monitoring and logging, not security-specific findings.

Answer

Cloud Operations

Answer

Cloud Audit Logs

Answer

Chronicle

Question 15

A company wants to implement the principle of least privilege for a team of developers who need to deploy applications on Compute Engine and monitor logs. Which THREE IAM roles should be granted? (Choose 3)

Accepted Answer

roles/iam.serviceAccountUser. roles/compute.instanceAdmin provides permissions to manage instances. roles/logging.viewer provides read access to logs. roles/iam.serviceAccountUser allows attaching service accounts to instances. roles/compute.networkAdmin is too broad for developers. roles/compute.admin is a full admin role, violating least privilege.

Answer

roles/compute.networkAdmin

Answer

roles/compute.admin