Cloud Digital Leader Trust and security with Google Cloud — 20 Questions

Question 1

A security audit finds that a company's application service accounts have been granted broad IAM roles (e.g., Storage Admin on the entire project) when they only need to read specific Cloud Storage buckets. The auditor recommends following the principle of least privilege. What is the most precise way to implement this for the Cloud Storage use case?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Grant Storage Object Viewer (read-only) at the specific bucket level for each service account that needs read access — not at the project level. It grants the minimal required permission (Storage Object Viewer) at the specific bucket level, adhering to the principle of least privilege. This ensures the service account can only read objects in that bucket and cannot perform any other storage operations, even accidentally. Granting roles at the resource level (bucket) rather than the project level eliminates unnecessary broad access.

Answer

Grant the Storage Admin role at the project level but add a condition that limits it to specific operations

Answer

Create a custom IAM role that combines all permissions from all predefined roles but removes the most dangerous ones

Answer

Use the same broad Storage Admin role but rotate the service account key every 90 days to reduce the window of exposure

Question 2

A small IT team needs to grant developers the ability to deploy instances in a project but not delete them. Which IAM best practice should they use?

Accepted Answer

Use organization policy to restrict deletion of compute instances.. It follows the IAM best practice of using organizational policies to enforce constraints on resources. By applying an organization policy that restricts the deletion of compute instances, the IT team can allow developers to have IAM permissions to deploy instances (e.g., compute.instances.insert) but prevent them from deleting them, without granting delete permissions directly. This approach aligns with least privilege by using policy-level controls to override allowed actions.

Answer

Create a custom role with compute.instances.insert and compute.instances.delete permissions.

Answer

Assign all developers the primitive role of Editor.

Answer

Create a service account for each developer and grant it the compute.instanceAdmin role.

Question 3

A financial services company needs to ensure that all access to sensitive data in Cloud Storage is logged with information about the user and the reason for access. Which feature should they enable?

Accepted Answer

Access Transparency. Access Transparency provides detailed logs of actions taken by Google Cloud support and engineering personnel when accessing customer data, including the specific user and the business reason for access. This meets the requirement for logging access with user identity and reason, as Cloud Audit Logs do not capture the business justification.

Answer

Cloud Data Loss Prevention (DLP)

Answer

Security Command Center

Answer

Cloud Audit Logs

Question 4

Which TWO actions are the customer's responsibility under the GCP shared responsibility model?

Accepted Answer

Managing user accounts and authentication. Options A and C are correct. Under the GCP shared responsibility model, the customer is responsible for managing user accounts and authentication (A) and configuring IAM policies to control access (C). Default encryption of data at rest (B) is Google's responsibility to provide by default, though customers can manage additional encryption options. Network infrastructure maintenance (D) and physical security of data centers (E) are managed by Google.

Answer

Encryption of data at rest by default

Answer

Network infrastructure maintenance

Answer

Physical security of data centers

Question 5

Refer to the exhibit. A security engineer applies this IAM policy. What is the effect?

Accepted Answer

Access is allowed only from the IP address 203.0.113.1.. The IAM policy shown in the exhibit restricts access to requests coming from IP address 203.0.113.1. In Google Cloud IAM, this is expressed using a condition on `source.ip` (or `request.headers['x-goog-user-ip']`). Only requests from that IP satisfy the condition, and requests from any other IP are denied.

Answer

Access is allowed only to resources tagged with 'production'.

Answer

Access is allowed only with two-factor authentication.

Answer

Access is allowed only during business hours.

Question 6

Refer to the exhibit. A developer receives this error when trying to create a Compute Engine instance. The developer is authenticated as a user with Project Editor role. What is the most likely cause?

Accepted Answer

The service account used for the instance lacks IAM permissions.. The error occurs because the developer lacks the iam.serviceAccountUser role on the service account they are attempting to attach to the instance. Even though Project Editor includes compute.instances.create, creating an instance with a service account requires the iam.serviceAccounts.actAs permission on that service account (provided by roles/iam.serviceAccountUser). Without this, the API call is denied.

Answer

The project has reached its compute instance quota.

Answer

The developer does not have the compute.instances.create permission.

Answer

The VPC network has insufficient IP addresses.

Question 7

Refer to the exhibit. A security administrator reviews this Cloud Audit Logs entry. What does this entry indicate?

Accepted Answer

The user attempted to read the object 'secret.pdf' and the request resulted in an error.. The log entry shows a 'storage.objects.get' method with severity ERROR. This indicates that the user attempted to read the object 'secret.pdf' but the request resulted in an error (e.g., insufficient permissions or object not found). Therefore, option A is correct. Options B, C, D are incorrect because the method is not 'delete', 'setIamPolicy', or a successful read.

Answer

The user updated the IAM policy on the bucket.

Answer

The user attempted to delete the object 'secret.pdf'.

Answer

The user successfully read the object 'secret.pdf'.

Question 8

Which TWO features are part of Cloud Data Loss Prevention (Cloud DLP)?

Accepted Answer

Classification of sensitive data such as credit card numbers. Cloud DLP is specifically designed to inspect, classify, and protect sensitive data. Option A is correct because Cloud DLP uses over 150 built-in infoType detectors to automatically identify sensitive data types, such as credit card numbers (matching Luhn algorithm and PAN format), Social Security numbers, and passport numbers, enabling organizations to understand where their sensitive data resides. Option B is correct because Cloud DLP also provides de-identification techniques including masking, tokenization, and encryption to protect sensitive data while maintaining its usability. Options C, D, and E are incorrect because these are not functions of Cloud DLP; network vulnerability scanning, malware removal, and IAM policy creation belong to other security services such as Cloud Security Command Center, Google Cloud Armor, and IAM respectively.

Answer

Network vulnerability scanning

Answer

Removal of malware from uploaded files

Answer

Creation of IAM policies

Question 9

Which TWO of the following are best practices for securing a Google Cloud environment? (Choose two.)

Accepted Answer

Grant minimal permissions to users and services using IAM roles.. The principle of least privilege is a foundational security best practice in Google Cloud. By granting minimal permissions using IAM roles, you limit the attack surface and reduce the risk of unauthorized access or accidental data exposure. This aligns with Google Cloud's security model where roles are predefined or custom, and permissions are additive, never implicit. Additionally, enabling VPC Flow Logs for all subnets provides visibility into network traffic, allowing you to monitor for anomalies and support forensic analysis, which is a key security best practice.

Answer

Use the same SSH key for all Compute Engine instances.

Answer

Export service account keys and use them in on-premises applications for authentication.

Answer

Rotate service account keys every month.

Question 10

A multinational corporation operates a hybrid cloud environment with on-premises data centers connected to Google Cloud via Dedicated Interconnect. The company uses Cloud Storage to store sensitive financial data and has enabled Cloud Audit Logs for admin activities. Recently, the security team noticed that an unknown actor accessed a bucket containing customer personally identifiable information (PII). The access occurred from an IP address outside the corporate network. The security team suspects that an employee's Google Cloud credentials were compromised. They need to investigate the incident thoroughly and determine the extent of the breach. The company has enabled VPC Flow Logs, but they are not sure how to correlate the audit logs with network flows. They also want to ensure that similar incidents are prevented in the future. What should the security team do first to investigate the incident?

Accepted Answer

Use Cloud Logging to analyze Cloud Audit Logs and identify the user who accessed the bucket and the associated context.. The first step in investigating a suspected credential compromise is to analyze Cloud Audit Logs to identify which user accessed the bucket, from what IP address, and at what time. This provides the primary leads for the investigation. Option A is wrong because immediately revoking all keys and resetting passwords may disrupt operations and should only be done after confirming the compromise and identifying affected accounts. Option B is wrong because Cloud IDS is a network threat detection service that monitors network traffic for anomalies, but it does not provide historical logs of who accessed a specific bucket. Option D is wrong because VPC Flow Logs show network traffic but do not identify the user or the specific API calls made to Cloud Storage.

Answer

Immediately revoke all service account keys and reissue them, then reset all user passwords.

Answer

Enable Cloud IDS to detect similar attacks and block the malicious IP address.

Answer

Export VPC Flow Logs to BigQuery and analyze for the attacker's IP address.

Question 11

Refer to the exhibit. The IAM policy is applied at the project level. The bucket 'sensitive-data' exists and contains objects. What is the effective access for user alice@example.com?

Accepted Answer

Alice can view objects in all buckets including sensitive-data.. The IAM policy grants the 'roles/storage.objectViewer' role to Alice at the project level, but with a condition that only allows access to the 'sensitive-data' bucket before 9 AM. When the request occurs after 9 AM, the condition is false, so the role binding does not apply to 'sensitive-data'. Therefore, Alice can view objects in non-sensitive buckets (assuming the condition allows them always), but she cannot view objects in 'sensitive-data' after 9 AM. The correct behavior is that Alice has access to 'sensitive-data' only before 9 AM, and to other buckets unconditionally. Since no provided option matches this, none of the options are correct.

Answer

Alice can view objects only in non-sensitive buckets, and can view objects in sensitive-data only after 9 AM due to condition.

Answer

Alice can view objects in all buckets except sensitive-data.

Answer

Alice can view and modify objects in all buckets.

Question 12

A healthcare organization is migrating a HIPAA-covered application to Google Cloud. The application processes electronic protected health information (ePHI) and must maintain strict data residency within a specific geographic region. The organization has already signed a Business Associate Agreement (BAA) with Google Cloud. During a compliance review, the security team discovers that one of the Cloud Storage buckets containing ePHI is located in the 'US' multi-region, but the organization's data residency policy requires data to be stored only in the United States region (e.g., us-central1). The bucket was created without any enforcement of organization policies. The team also finds that several Compute Engine instances in the us-central1 zone have public IP addresses and are accessible over the internet via SSH, which could expose ePHI in transit. The security team needs to remediate these issues while minimizing downtime and without violating the BAA. Which course of action should the security team take first?

Accepted Answer

Move the bucket to a regional location (e.g., us-central1) using the 'gcloud storage buckets update' command and set the location constraint.. The immediate priority is to resolve the data residency violation. However, it is not possible to change the location of an existing bucket using 'gcloud storage buckets update'. The correct procedure is to create a new regional bucket in us-central1, copy all data from the 'US' multi-region bucket to the new bucket, verify compliance, and then delete the original bucket. This directly addresses the compliance requirement without violating the BAA. Other options such as removing public IPs, configuring VPC Service Controls, or enabling CMEK address security but do not solve the location violation.

Answer

Remove public IPs from all Compute Engine instances and enforce firewall rules to block SSH from the internet.

Answer

Configure VPC Service Controls to create a secure perimeter around the project and restrict data movement.

Answer

Enable customer-managed encryption keys (CMEK) on the bucket to encrypt all objects at rest.

Question 13

Google Cloud encrypts all customer data at rest by default without any configuration required. A customer asks: 'Do we need to do anything special to encrypt our data stored in Cloud Storage?' What is the correct answer?

Accepted Answer

No, Google Cloud encrypts all data at rest automatically using AES-256 — no configuration is needed.. Google Cloud automatically encrypts all customer data at rest using AES-256 encryption, with no configuration required. This default encryption applies to all Cloud Storage buckets, regardless of storage class or region, and the encryption keys are managed by Google Cloud unless the customer chooses to use Customer-Managed Encryption Keys (CMEK) or Customer-Supplied Encryption Keys (CSEK).

Answer

Yes, customers must enable encryption in the Cloud Storage bucket settings for each bucket.

Answer

Only data in premium storage tiers is encrypted; Standard storage requires manual encryption.

Answer

Customers must purchase the Security Command Center Premium tier to enable data encryption.

Question 14

A security architect wants to implement a 'never trust, always verify' security approach where no user or service is assumed to be trustworthy based on network location alone. Every access request must be authenticated and authorized regardless of whether it comes from inside or outside the corporate network. Which security model describes this approach?

Accepted Answer

Zero Trust security model. The Zero Trust security model (Option B) is correct because it explicitly enforces the 'never trust, always verify' principle, requiring authentication and authorization for every access request regardless of network location. In Google Cloud, this aligns with BeyondCorp, which uses identity-aware proxy (IAP) and context-aware access to verify each request based on user identity, device posture, and other attributes, rather than trusting based on IP address or network perimeter.

Answer

Perimeter security model

Answer

Defense in depth model

Answer

Principle of least privilege

Question 15

A company is concerned about which security responsibilities belong to Google versus which belong to them when using Google Cloud's managed database service (Cloud SQL). In the shared responsibility model, which security tasks does Google handle?

Accepted Answer

Google handles physical security, hardware maintenance, and OS and database software patching.. In the shared responsibility model for Google Cloud services like Cloud SQL, Google is responsible for security 'of' the cloud, which includes physical security of data centers, hardware maintenance, and patching the underlying operating system and database software. This ensures the infrastructure hosting Cloud SQL instances is secure, while the customer remains responsible for securing their data, access policies, and application-level configurations.

Answer

Google controls who can access the database and what data can be stored.

Answer

Google is responsible for backing up customer data and ensuring data recovery.

Answer

Google determines which compliance certifications the customer's application must meet.

Question 16

A healthcare company needs to store patient data in Google Cloud and must comply with HIPAA (Health Insurance Portability and Accountability Act). Which statement correctly describes how Google Cloud helps them achieve HIPAA compliance?

Accepted Answer

Google offers HIPAA-eligible services and signs a Business Associate Agreement (BAA), but customers must implement their own technical safeguards and access controls.. Google Cloud provides HIPAA-eligible services and offers a Business Associate Agreement (BAA) to covered entities, but compliance is a shared responsibility. Customers must configure their own technical safeguards, such as access controls, audit logging, and encryption key management, to meet HIPAA requirements. Google Cloud does not automatically make an application compliant; the customer must implement the necessary controls.

Answer

Storing data in Google Cloud automatically makes an application HIPAA-compliant.

Answer

HIPAA compliance is impossible on public cloud; healthcare data must stay on-premises.

Answer

Google Cloud's automatic data encryption fully satisfies all HIPAA technical safeguard requirements.

Question 17

An organization uses Google Cloud Identity and Access Management (IAM). A new employee is a data engineer who needs to read BigQuery datasets and run queries but should NOT be able to create new datasets, delete tables, or modify IAM policies. Which IAM role should be assigned?

Accepted Answer

`roles/bigquery.dataViewer` (with `roles/bigquery.jobUser` if needed to run queries). The `roles/bigquery.dataViewer` role grants read access to BigQuery datasets and their contents, while `roles/bigquery.jobUser` allows the user to run query jobs. Together, they satisfy the requirement to read datasets and run queries without permitting dataset creation, table deletion, or IAM policy modification.

Answer

`roles/bigquery.admin`

Answer

`roles/viewer` (project-level Viewer)

Answer

`roles/bigquery.dataEditor`

Question 18

A company wants to ensure that sensitive data (credit card numbers, SSNs) stored in BigQuery is automatically identified and protected. They also want ongoing scanning to detect if any new data violates their data governance policies. Which Google Cloud service provides these capabilities?

Accepted Answer

Cloud Data Loss Prevention (Cloud DLP) with BigQuery inspection jobs.. Cloud DLP with BigQuery inspection jobs is the correct choice because it provides both automated identification of sensitive data (such as credit card numbers and SSNs) within BigQuery tables and ongoing scanning capabilities via scheduled inspection jobs. Cloud DLP uses built-in infoType detectors to match patterns like credit card numbers (Luhn check) and SSNs, and can trigger actions or alerts when new data violates governance policies.

Answer

Security Command Center — it scans BigQuery for sensitive data automatically.

Answer

Cloud Monitoring custom dashboards with SQL queries that search for PII patterns.

Answer

Cloud Audit Logs — they record all BigQuery queries and can identify when sensitive columns are accessed.

Question 19

When data is transmitted between a user's browser and a Google Cloud-hosted web application over HTTPS, which security protection does this provide?

Accepted Answer

It encrypts data in transit between the user's browser and the server, preventing eavesdropping and tampering.. HTTPS (HTTP over TLS) encrypts the communication channel between the user's browser and the web server using Transport Layer Security (TLS). This ensures that any data transmitted, such as login credentials or API requests, is protected from eavesdropping and tampering while in transit. It does not protect data at rest or control access to cloud management interfaces.

Answer

It prevents unauthorized users from accessing the Google Cloud Console.

Answer

It encrypts data stored in the server's database.

Answer

It authenticates the user and verifies their permissions to use the application.

Question 20

A company is evaluating Google Cloud and wants to know: what is Access Transparency, and how does it benefit customers with stringent governance requirements?

Accepted Answer

Access Transparency logs when Google Cloud personnel access customer content, providing an audit trail for governance.. Access Transparency logs are a Google Cloud feature that provides customers with near real-time logs whenever Google personnel access their data. This creates a detailed audit trail, which is essential for customers with stringent governance or compliance requirements, as it allows them to monitor and verify that access is only for authorized purposes.

Answer

Access Transparency shows customers which Google Cloud services are available in their region.

Answer

Access Transparency is a feature that makes all customer data visible to Google for quality improvement.

Answer

Access Transparency provides customers with real-time dashboards of their application's security vulnerabilities.