Cloud Digital Leader Google Cloud Security — Timed 25 Questions

Question 1

A company wants to replace its VPN-based remote access with a zero-trust solution that verifies user identity and device health before granting access to internal applications. Which Google Cloud service should they use?

Accepted Answer

BeyondCorp Enterprise. BeyondCorp Enterprise provides zero-trust access based on user identity and device context, eliminating the need for a VPN. IAP is a component but the full solution is BeyondCorp Enterprise.

Answer

Identity-Aware Proxy (IAP)

Answer

Cloud VPN

Answer

Cloud Identity

Question 2

An organization needs to ensure that data stored in Cloud Storage is encrypted using keys that they manage and rotate themselves. Which encryption option should they choose?

Accepted Answer

Customer-managed encryption keys (CMEK). CMEK allows customers to manage their own keys via Cloud KMS. CSEK requires customer-supplied keys but has operational overhead. Google-managed keys are default but not customer-managed.

Answer

Default encryption at rest

Answer

Customer-supplied encryption keys (CSEK)

Answer

Google-managed encryption keys

Question 3

A security team needs to monitor and analyze logs from multiple GCP projects to detect threats across the organization. They require a SIEM solution that can ingest logs from on-premises and other clouds. Which service should they use?

Accepted Answer

Chronicle. Chronicle is a Google Cloud SIEM that ingests logs from various sources, including on-premises and other clouds, and provides threat detection. Security Command Center is for vulnerability scanning, not SIEM.

Answer

Security Command Center

Answer

Cloud IDS

Answer

Cloud Logging

Question 4

A company wants to protect its web application running on Google Cloud from DDoS attacks and SQL injection. Which service should they use?

Accepted Answer

Cloud Armor. Cloud Armor provides DDoS protection and WAF capabilities (including SQL injection prevention). Cloud CDN caches content but does not protect against attacks. VPC firewall rules are network-level only. reCAPTCHA protects against bots but not SQL injection.

Answer

reCAPTCHA Enterprise

Answer

Cloud CDN

Answer

VPC firewall rules

Question 5

A data engineering team needs to store and manage database passwords and API keys used by their applications. Which Google Cloud service should they use?

Accepted Answer

Secret Manager. Secret Manager is designed to store secrets like passwords and API keys. Cloud KMS is for encryption keys. Cloud Key Management Service is for creating and managing cryptographic keys, not storing secrets. Cloud Storage is for objects.

Answer

Cloud KMS

Answer

Cloud Key Management Service

Answer

Cloud Storage

Question 6

What is the primary purpose of VPC Service Controls?

Accepted Answer

To prevent data exfiltration from Google Cloud services. VPC Service Controls create perimeters around Google Cloud services to prevent data exfiltration. VPC firewall rules control network traffic. Cloud Armor is for DDoS. Cloud IDS is for intrusion detection.

Answer

To control ingress and egress traffic at the network level

Answer

To detect network intrusions

Answer

To protect against DDoS attacks

Question 7

A security administrator needs to ensure that Google personnel do not access customer data without explicit authorization. Which service should they use to get logs of Google employee access?

Accepted Answer

Access Transparency. Access Transparency provides logs of Google personnel actions on customer data. Cloud Audit Logs track user activities within the customer's project. Assured Workloads is for regulatory compliance. Security Command Center is for threat detection.

Answer

Cloud Audit Logs

Answer

Security Command Center

Answer

Assured Workloads

Question 8

A company wants to scan its Cloud Storage buckets for sensitive data like credit card numbers and social security numbers. Which service should they use?

Accepted Answer

Sensitive Data Protection. Sensitive Data Protection (DLP API) is used to inspect and de-identify sensitive data. Security Command Center is for vulnerabilities. Web Risk API checks URLs against threat lists. reCAPTCHA is for bot protection.

Answer

Security Command Center

Answer

reCAPTCHA Enterprise

Answer

Web Risk API

Question 9

Which principle states that a user should be granted only the permissions necessary to perform their job functions?

Accepted Answer

Principle of least privilege. The principle of least privilege is the security concept of granting minimal required permissions. Separation of duties divides tasks among multiple people. Zero trust is a broader security model. Defence in depth is layered security.

Answer

Defence in depth

Answer

Separation of duties

Answer

Zero trust

Question 10

A security team wants to find misconfigurations and vulnerabilities across their Google Cloud environment, including VMs, storage, and IAM. Which service provides a unified view of these findings?

Accepted Answer

Security Command Center. Security Command Center provides a centralized view of vulnerabilities and misconfigurations. Cloud Audit Logs are for auditing actions. Cloud IDS is for network threats. Assured Workloads is for compliance.

Answer

Cloud IDS

Answer

Assured Workloads

Answer

Cloud Audit Logs

Question 11

An administrator wants to enforce that all API calls to a specific Cloud Storage bucket must come from a limited range of IP addresses. Which configuration should they use?

Accepted Answer

VPC Service Controls with an access level that includes the IP range. VPC Service Controls can restrict access based on IP addresses via access levels. IAP is for user authentication. Cloud Armor is for HTTP(S) load balancing. Firewall rules apply to network traffic, not API access to Cloud Storage.

Answer

Cloud Armor security policy

Answer

Identity-Aware Proxy (IAP)

Answer

VPC firewall rules

Question 12

Which layer of Google's defence-in-depth security model includes the use of TLS for data in transit?

Accepted Answer

Data security. Data security covers encryption of data at rest and in transit. Physical security is about data centers. Operational security covers processes. Deployment security is about secure infrastructure deployment.

Answer

Operational security

Answer

Deployment security

Answer

Physical security

Question 13

A company wants to implement a zero-trust security model for accessing internal applications. Which TWO Google Cloud services should they use together? (Choose 2)

Accepted Answer

Identity-Aware Proxy (IAP). BeyondCorp Enterprise provides the zero-trust framework, and IAP enforces identity and context-based access to applications. Cloud VPN is not zero-trust. Cloud Identity is an identity provider but not sufficient alone. Cloud Armor is for DDoS protection.

Answer

Cloud Identity

Answer

Cloud Armor

Answer

Cloud VPN

Question 14

A security team needs to detect and respond to threats across their cloud environment. Which THREE services should they use together? (Choose 3)

Accepted Answer

Security Command Center. Security Command Center provides vulnerability and threat detection. Chronicle is a SIEM for log analysis and threat detection. Mandiant offers threat intelligence and incident response. Cloud IDS is network-based. Cloud Audit Logs are for auditing, not detection.

Answer

Cloud IDS

Answer

Cloud Audit Logs

Question 15

A company needs to encrypt data at rest using keys that they manage, but they want to reduce operational overhead by having Google Cloud host the key management infrastructure. Which TWO options achieve this? (Choose 2)

Accepted Answer

Cloud HSM. CMEK uses Cloud KMS to manage keys, which Google hosts. CSEK requires the customer to supply and manage keys outside Google. Google-managed keys are not customer-managed. Cloud HSM is a hardware security module that can be used with CMEK. Secret Manager is for secrets, not encryption keys.

Answer

Secret Manager

Answer

Google-managed encryption keys

Answer

Customer-supplied encryption keys (CSEK)

Question 16

A startup wants to secure access to its internal web applications without using a VPN. They need to enforce access based on user identity and device security posture. Which Google Cloud service should they use?

Accepted Answer

Identity-Aware Proxy (IAP). BeyondCorp Enterprise is Google's zero-trust solution that replaces VPNs by using identity and context (device, location) to grant access. Identity-Aware Proxy (IAP) is a component of BeyondCorp that enforces access at the application layer.

Answer

Cloud VPN

Answer

VPC Service Controls

Answer

Cloud Armor

Question 17

An organization wants to ensure that all data stored in Cloud Storage is encrypted with customer-managed keys that can be rotated on demand. They also need to log every key use for audit compliance. Which combination of services should they use?

Accepted Answer

Cloud KMS with Customer-Managed Encryption Keys (CMEK) and Cloud Audit Logs. Cloud KMS allows creation and management of customer-managed encryption keys (CMEK) for Cloud Storage. Cloud Audit Logs can be used to log key usage (e.g., via Data Access audit logs). CSEK is deprecated; Secret Manager is for secrets, not encryption keys for storage.

Answer

Cloud KMS with Customer-Supplied Encryption Keys (CSEK)

Answer

Google-managed encryption keys with Access Transparency

Answer

Secret Manager with encryption keys and Cloud Logging

Question 18

A security engineer needs to create a VPC Service Controls perimeter that prevents data exfiltration from a project containing sensitive data. The perimeter should allow BigQuery datasets in the project to be accessed only from authorized VMs within the same perimeter. Which step is essential?

Accepted Answer

Add the project to a perimeter and set an ingress policy that allows access from the authorized VMs' service accounts. VPC Service Controls use perimeters to restrict access to Google-managed services. To allow access only from authorized VMs, you must create an ingress policy that specifies the source VPC network and the allowed identities (e.g., service accounts of the VMs). Simply adding the project to a perimeter blocks all external access; an ingress rule is needed to grant access from the specified VMs.

Answer

Create a separate perimeter for each VM and use IAM conditions

Answer

Add the project to a perimeter and create an egress rule to allow access from authorized VMs

Answer

Use Cloud Armor to whitelist the VMs' IP addresses for BigQuery access

Question 19

A company wants to detect and prioritize vulnerabilities in their Compute Engine VMs and GKE clusters. They also need a centralized view of security findings across their organization. Which service should they use?

Accepted Answer

Security Command Center. Security Command Center (SCC) is the central vulnerability and threat detection service for GCP. It finds misconfigurations, vulnerabilities, and threats across services like Compute Engine and GKE, and provides a dashboard for prioritization. Chronicle is a SIEM for log analysis, not vulnerability scanning. Cloud IDS is for network intrusion detection. Web Risk API is for checking URLs against threat lists.

Answer

Cloud IDS

Answer

Web Risk API

Answer

Chronicle

Question 20

A developer needs to store a database password securely and access it from a Compute Engine VM. The password should be automatically rotated every 90 days. Which Google Cloud service should they use?

Accepted Answer

Secret Manager. Secret Manager is designed to store secrets like passwords, API keys, and certificates. It supports automatic rotation of secrets. Cloud KMS is for encryption keys, not secrets. Cloud Storage is not secure for secrets. IAM does not store secrets.

Answer

IAM

Answer

Cloud Storage with server-side encryption

Answer

Cloud KMS