Cloud Digital Leader Trust and security with Google Cloud Practice Test 2 — 15 Questions

Question 1

A company stores its data in Google Cloud. The security team asks: can Google employees access our customer data without our knowledge or consent? What does Google's commitment ensure?

Accepted Answer

Google commits that customer data is not accessed without authorization, with access logged via Access Transparency and governed by contractual data processing commitments.. Google Cloud's Access Transparency feature logs all data access attempts by Google personnel, and contractual data processing commitments under the Cloud Data Processing Addendum (CDPA) prohibit unauthorized access. This ensures that customer data is not accessed without explicit authorization, and any access is logged and auditable, aligning with the security team's concern about knowledge and consent.

Answer

Google employees have unrestricted access to all customer data as part of the infrastructure service agreement.

Answer

Google uses customer data to train its global AI models to improve services.

Answer

Customer data stored in Google Cloud is automatically accessible by government agencies on request.

Question 2

A regulated financial services firm must ensure that its data never leaves a specific geographic region (EU) for compliance with GDPR data residency requirements. Which Google Cloud features help enforce this requirement?

Accepted Answer

Select EU regions for all resources and apply the `gcp.resourceLocations` org policy to restrict resource creation to EU regions only.. The `gcp.resourceLocations` organization policy constraint explicitly restricts the physical location where Google Cloud resources can be created. By setting this policy to allow only EU regions, the organization ensures that no compute, storage, or database resources can be provisioned outside the EU, directly enforcing GDPR data residency requirements. This policy is evaluated at resource creation time and applies to all projects under the organization, providing a hard enforcement boundary.

Answer

Enable Cloud Armor on all load balancers to block non-EU traffic.

Answer

Use HTTPS for all connections to ensure data is encrypted when it leaves the EU.

Answer

Enable Google Workspace's regional storage settings to restrict where emails are stored.

Question 3

What compliance certification verifies that an organization's Information Security Management System (ISMS) meets internationally recognized standards for managing information security risks?

Accepted Answer

ISO/IEC 27001. ISO/IEC 27001 is the international standard that specifies the requirements for establishing, implementing, maintaining, and continually improving an Information Security Management System (ISMS). It provides a systematic approach to managing sensitive company information, ensuring it remains secure through risk management processes. This certification is recognized globally and is the primary standard for ISMS compliance.

Answer

SOC 2 Type II

Answer

PCI DSS

Answer

FedRAMP

Question 4

A company uses Google Workspace for identity. They want employees to use their Google Workspace credentials to access third-party applications (Salesforce, Slack, etc.) without separate passwords for each app. Which technology enables this?

Accepted Answer

Single Sign-On (SSO) using SAML 2.0 or OIDC with Google Workspace as the Identity Provider.. Single Sign-On (SSO) using SAML 2.0 or OIDC allows Google Workspace to act as the Identity Provider (IdP), issuing authentication tokens that third-party applications (like Salesforce and Slack) trust. This eliminates the need for separate passwords, as users authenticate once with Google Workspace and the IdP handles subsequent access via security assertions or ID tokens.

Answer

VPN — employees connect to the corporate VPN which provides access to all apps.

Answer

Cloud Armor — blocks unauthorized access attempts to applications.

Answer

Shared service account — all employees use the same credential.

Question 5

A company's security policy requires all employees to verify their identity using more than just a password when accessing Google Cloud resources. What security feature enforces this requirement?

Accepted Answer

Multi-factor authentication (MFA) / Two-step verification (2SV).. Multi-factor authentication (MFA) / Two-step verification (2SV) is the correct answer because it explicitly requires users to provide two or more verification factors (e.g., something you know, something you have, something you are) to access Google Cloud resources. This directly enforces the policy of verifying identity beyond just a password, as MFA/2SV adds an additional layer of security by requiring a second factor such as a time-based one-time password (TOTP) from an authenticator app, a hardware security key (e.g., FIDO2), or a push notification. Google Cloud Identity Platform supports this via security key enforcement and 2SV policies, ensuring that password compromise alone is insufficient for access.

Answer

Password complexity requirements — enforcing long, complex passwords.

Answer

IP allowlisting — only allowing access from office IP addresses.

Answer

Session timeout — automatically logging out users after 30 minutes of inactivity.

Question 6

Google's physical data center security includes multiple layers of protection. Which of the following is NOT a physical security measure Google uses at its data centers?

Accepted Answer

Customers can schedule tours of Google data centers to verify security practices directly.. Google does not offer public tours of its data centers. Allowing customers to schedule tours would introduce unnecessary security risks and is not part of Google's physical security model. Instead, Google provides transparency through third-party audit reports and certifications (e.g., SOC 2, ISO 27001) to verify security practices.

Answer

Biometric authentication and badge access controls at multiple security perimeters.

Answer

24/7 on-site security personnel who monitor the facility continuously.

Answer

Secure hardware destruction procedures for decommissioned storage devices.

Question 7

A company has a requirement from their security auditor to demonstrate that all administrative actions performed in Google Cloud (such as creating VMs, modifying IAM policies, and deleting storage buckets) are logged and tamper-evident. Which Cloud Logging log type fulfills this requirement?

Accepted Answer

Admin Activity audit logs — always-on, tamper-resistant logs of all administrative API calls.. Admin Activity audit logs are always-on, tamper-resistant logs that record all administrative API calls, such as creating VMs, modifying IAM policies, and deleting storage buckets. They cannot be disabled or modified by users, ensuring tamper-evident logging for security auditor requirements.

Answer

Data Access audit logs — they capture all read and write operations.

Answer

System Event audit logs — they capture all Google Cloud operations.

Answer

Cloud Monitoring logs — they track all changes to monitored resources.

Question 8

A company wants to ensure that even if an attacker compromises an employee's password and passes MFA, the attacker cannot access sensitive Google Cloud resources from an unmanaged personal laptop. Which Google security feature enforces device trust as part of access decisions?

Accepted Answer

Access Context Manager with device policy conditions requiring managed, compliant devices.. Access Context Manager allows you to define device policy conditions that require devices to be managed (e.g., via endpoint verification) and compliant with corporate security policies. When an attacker attempts to access sensitive Google Cloud resources from an unmanaged personal laptop, the access level will not be satisfied, and access is denied even if the user's password and MFA are valid. This enforces device trust as a distinct attribute in the access decision, separate from user authentication.

Answer

Cloud Armor — it inspects device fingerprints on incoming requests.

Answer

Cloud Firewall rules that allow only corporate office IP ranges.

Answer

Two-step verification — the second factor proves the device is trusted.

Question 9

A company stores customer data in Google Cloud and wants to ensure data confidentiality in the event that hardware is decommissioned and returned by Google. How does Google protect customer data when storage hardware reaches end of life?

Accepted Answer

Google uses approved data erasure and physical destruction processes (shredding, degaussing) for decommissioned storage media before hardware leaves its facilities.. Google Cloud follows strict data destruction policies for decommissioned storage media. Before any hardware leaves Google's facilities, it undergoes approved data erasure (e.g., NIST SP 800-88 compliant wiping) followed by physical destruction (e.g., shredding, degaussing) to ensure customer data cannot be recovered. This process guarantees data confidentiality even if the hardware is returned or recycled.

Answer

Google transfers customer data to new hardware first, then ships the old hardware to the customer for self-destruction.

Answer

Customer data on decommissioned hardware is automatically encrypted, making it safe to discard without wiping.

Answer

Customers must pay a data destruction fee to ensure their data is wiped from decommissioned hardware.

Question 10

A company uses Google Cloud and has a compliance requirement to store certain data only within the European Union and ensure it cannot be accessed from outside the EU, even by Google operations personnel. Which Google Cloud offering specifically addresses this level of data sovereignty?

Accepted Answer

Sovereign Controls offerings (e.g., T-Systems Sovereign Cloud) or Assured Workloads with data residency and personnel access controls.. Sovereign Controls offerings (such as T-Systems Sovereign Cloud) and Assured Workloads with data residency and personnel access controls are specifically designed to meet strict data sovereignty requirements. These solutions ensure that data remains within the EU and that Google operations personnel cannot access it, addressing both geographic storage and access restrictions mandated by compliance frameworks like GDPR.

Answer

Selecting EU regions for all resources in the Cloud Console.

Answer

VPC Service Controls — they prevent data from leaving the VPC boundary.

Answer

Cloud Armor — it blocks requests originating from outside the EU.

Question 11

A security team wants to get a comprehensive, organization-wide view of security misconfigurations (such as publicly accessible storage buckets, VMs without firewalls, and IAM overprivilege), vulnerabilities in container images, and active threats across all Google Cloud projects. Which Google Cloud service provides this unified security posture management?

Accepted Answer

Security Command Center (SCC) — unified security posture management across all GCP projects.. Security Command Center (SCC) is the correct answer because it is Google Cloud's native, unified security and risk management platform that provides continuous monitoring for misconfigurations (e.g., publicly accessible storage buckets, VMs without firewalls, IAM overprivilege), vulnerability scanning for container images, and threat detection across all projects in an organization. It aggregates findings from services like Cloud Asset Inventory, Web Security Scanner, and Event Threat Detection into a single dashboard, enabling comprehensive security posture management.

Answer

Cloud Monitoring — it detects security anomalies through metric analysis.

Answer

Cloud Audit Logs — they show all API calls that could indicate security issues.

Answer

Cloud DLP — it scans all resources for sensitive data exposure.

Question 12

A company wants to know: if Google Cloud experiences a data breach that exposes customer data, what are Google's notification obligations under standard Cloud service terms?

Accepted Answer

Google will notify affected customers of personal data breaches without undue delay per its Data Processing Addendum, enabling customers to meet their own regulatory notification obligations.. Google Cloud's standard Data Processing Addendum (DPA) contractually obligates Google to notify affected customers of personal data breaches without undue delay after confirmation. This enables customers to fulfill their own regulatory notification requirements under laws like GDPR or CCPA, as the customer remains the data controller responsible for end-user notifications.

Answer

Google has no obligation to notify customers of data breaches — customers must discover breaches themselves.

Answer

Google will notify all media outlets immediately upon breach detection to maximize transparency.

Answer

Breach notification is only available to customers with Premium support tier.

Question 13

The principle of least privilege is a fundamental security concept applied to IAM in Google Cloud. Which statement best describes this principle?

Accepted Answer

Users and services should be granted only the minimum permissions required for their specific function, nothing more.. The principle of least privilege in Google Cloud IAM dictates that identities (users, groups, or service accounts) should be granted only the permissions necessary to perform their intended tasks. This minimizes the attack surface and limits the blast radius of a compromised credential. In Google Cloud, this is implemented by assigning predefined or custom roles with the exact set of permissions required, rather than using broad roles like Owner or Editor.

Answer

All users should have read-only access to prevent accidental changes.

Answer

Administrators should have full access so they can respond to any emergency quickly.

Answer

All employees should share the same IAM role to simplify permission management.

Question 14

A company uses service accounts to allow their application running on a Compute Engine VM to access Cloud Storage. Which is the most secure way to configure this service account access?

Accepted Answer

Attach the service account to the Compute Engine VM; the application obtains credentials automatically via the metadata server with no key files needed.. Attaching a service account to a Compute Engine VM allows the application to automatically obtain short-lived OAuth 2.0 access tokens from the instance metadata server (http://169.254.169.254). This eliminates the need to download, store, or manage any long-lived service account key files, which are a significant security risk. The metadata server provides credentials that are automatically rotated and scoped to the service account's IAM roles, making this the most secure method for accessing Cloud Storage from a VM.

Answer

Download the service account key JSON file and store it in the application's source code repository.

Answer

Grant all users the Storage Admin role so the application can access Cloud Storage through their credentials.

Answer

Create a shared service account key file accessible to all VMs via a Cloud Storage bucket.

Question 15

A company stores encryption keys in Cloud KMS to protect sensitive data. What does Cloud KMS provide that standard application-layer encryption does not?

Accepted Answer

Centralized key lifecycle management with IAM-controlled access, audit logs, rotation policies, and optional HSM-backed key protection.. Cloud KMS provides centralized key lifecycle management, including IAM-based access control, audit logging, automatic key rotation, and optional HSM-backed key protection. Standard application-layer encryption typically embeds keys within the application code or configuration, lacking these governance and security controls. This separation of key management from application logic is a core security best practice.

Answer

Faster encryption performance because Google's hardware is optimized for cryptographic operations.

Answer

The ability to encrypt data without any performance impact on the application.

Answer

Free unlimited encryption for all data stored in Google Cloud.