Cloud Digital Leader Trust and security with Google Cloud Practice Test 3 — 15 Questions

Question 1

A company classifies its data into four sensitivity levels: Public, Internal, Confidential, and Restricted. Which type of data would typically be classified as 'Restricted' and require the highest level of security controls?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Customer Social Security Numbers, payment card numbers, and employee health records.. Restricted data, under Google Cloud's data classification framework, includes personally identifiable information (PII) such as Social Security Numbers, payment card numbers (PCI DSS), and protected health information (PHI). These require the highest security controls, including encryption at rest and in transit, strict IAM policies, and Data Loss Prevention (DLP) API scanning to prevent unauthorized access or leakage.

Answer

Public press releases and marketing materials published on the company website.

Answer

Internal meeting notes and project status reports shared among employees.

Answer

Product roadmap documents shared only with the product team.

Question 2

A security team wants to ensure that only container images built by their approved CI/CD pipeline can run in their GKE cluster. Images built outside the approved process — even by internal engineers — should be blocked. Which Google Cloud security feature enforces this?

Accepted Answer

Binary Authorization — requiring cryptographic attestations for container images before they can be deployed to GKE.. Binary Authorization is the correct answer because it enforces deployment-time policy by requiring that container images have a valid cryptographic attestation (e.g., from a trusted CI/CD pipeline) before they can be scheduled on GKE. This ensures that only images built and signed by the approved process are allowed to run, blocking all others regardless of who built them.

Answer

Cloud Armor — it blocks unauthorized container images at the load balancer.

Answer

Cloud IAM — restricting `container.pods.create` permission to only the CI/CD service account.

Answer

Artifact Registry vulnerability scanning — blocking images with CVEs from being deployed.

Question 3

A company wants to allow a third-party security firm to conduct a penetration test against their Google Cloud environment to identify vulnerabilities. What is Google Cloud's policy on penetration testing?

Accepted Answer

Customers are authorized to penetration test their own GCP resources without prior Google approval, within the Acceptable Use Policy.. Google Cloud's policy explicitly authorizes customers to conduct penetration testing on their own GCP resources without prior approval from Google, as long as the testing complies with the Acceptable Use Policy. This is because Google treats the customer's environment as their own responsibility, and the shared responsibility model places security testing under the customer's control. Option B correctly reflects this policy, which is documented in Google Cloud's security testing guidelines.

Answer

Customers must submit a formal request to Google and wait for written approval before any penetration testing.

Answer

Penetration testing is illegal in cloud environments and customers should use vulnerability scanners instead.

Answer

Google automatically performs penetration testing on all customer resources monthly and shares the report.

Question 4

Which Google Cloud feature provides reports on how Google processes government requests for customer data and how often Google challenges overly broad requests?

Accepted Answer

Google's Transparency Report — publishing data about government requests and legal compliance.. Google's Transparency Report is the correct answer because it specifically publishes data on government requests for user data, including how Google processes these requests and how often it challenges overly broad or legally questionable demands. This report is designed to provide public visibility into government actions, not to log individual API calls or access events.

Answer

Cloud Audit Logs — they record all API calls including government data requests.

Answer

Security Command Center — it alerts when government agencies access customer data.

Answer

Access Transparency logs — they record every time any external entity accesses customer data.

Question 5

A company's application stores user passwords. Their security team says passwords must be stored as hashes, never in plaintext. They want to ensure this requirement is met even if a database is compromised. Why is password hashing (with salt) the correct approach?

Accepted Answer

Hashing with salt makes stored passwords irreversible — even if the database is stolen, attackers cannot recover the original passwords without computationally intensive per-user brute force.. Password hashing with salt is the correct approach because it transforms passwords into irreversible digests. Even if the database is compromised, an attacker cannot recover the original passwords without performing a computationally expensive brute-force attack on each salted hash individually. This ensures the plaintext password is never stored or recoverable, meeting the security requirement.

Answer

Hashing passwords allows the application to recover the original password when users forget it.

Answer

Storing passwords as hashes allows sharing them between systems for single sign-on.

Answer

Google Cloud automatically encrypts all database contents, making password hashing unnecessary.

Question 6

An organization's security team reviews their Google Cloud environment and finds that several Cloud Storage buckets have `allAuthenticatedUsers` bindings, and multiple service accounts have the Owner role. Which Google Cloud tool automatically identifies these types of high-risk IAM configurations?

Accepted Answer

Security Command Center (SCC) with IAM Recommender and Security Health Analytics.. Security Command Center (SCC) with Security Health Analytics and IAM Recommender is the correct tool because it automatically scans for high-risk IAM configurations, such as `allAuthenticatedUsers` bindings on Cloud Storage buckets and service accounts with the Owner role. Security Health Analytics detects misconfigurations against CIS benchmarks and Google Cloud best practices, while IAM Recommender provides actionable recommendations to reduce excessive permissions. This combination proactively identifies and helps remediate these specific security risks without requiring manual log review or billing analysis.

Answer

Cloud Audit Logs — reviewing all recent IAM changes.

Answer

Cloud Billing reports — they flag expensive configurations that indicate security issues.

Answer

Cloud Monitoring — it alerts when IAM policies are modified.

Question 7

A company's security architect wants to implement 'privacy by design' principles when building a new customer data platform on Google Cloud. What does privacy by design mean in this context?

Accepted Answer

Privacy by design means privacy protections (encryption, data minimization, access controls, retention policies) are architected into the system from the start, not added after deployment.. Privacy by design is a foundational principle that requires embedding privacy controls—such as encryption, data minimization, access controls, and retention policies—into the architecture of a system from the initial design phase, rather than retrofitting them after deployment. In the context of Google Cloud, this means using services like Cloud KMS for encryption, IAM for fine-grained access control, and data lifecycle policies to minimize data collection and enforce retention limits from the start. Option B correctly captures this proactive, integrated approach.

Answer

Privacy by design means the platform must refuse to collect any personal data from customers.

Answer

Privacy by design is a legal requirement that mandates using only on-premises systems for customer data.

Answer

Privacy by design means storing all data in an encrypted format and using a VPN for all access.

Question 8

A company's security team wants to ensure that only approved corporate devices can access Google Cloud resources, regardless of whether the user has valid credentials. Which Google Cloud security capability enforces device-level access requirements?

Accepted Answer

Access Context Manager, which enforces device-level access requirements as part of context-aware access control policies. Access Context Manager is the correct choice because it allows security teams to define context-aware access policies that include device-level attributes such as device OS type, device ID, and whether the device is managed (e.g., via endpoint verification or third-party EMM). This enforces device-level access requirements even if the user has valid credentials, directly addressing the scenario.

Answer

Cloud Armor, which filters incoming requests based on IP allowlists and denylists

Answer

Identity-Aware Proxy (IAP), which provides application-level authentication but without device checks

Answer

VPC Service Controls, which restrict access to Google APIs based on network perimeter membership

Question 9

A financial services company is subject to regulations requiring them to demonstrate that their cloud provider's employees cannot access customer data without the customer's explicit approval. Which Google Cloud feature most directly addresses this requirement?

Accepted Answer

Access Transparency and Access Approval, which log and require explicit customer approval for Google personnel access to customer content. Access Transparency and Access Approval directly address the regulatory requirement by providing near real-time logs of Google personnel actions on customer content and requiring explicit customer approval before such access can occur. Access Transparency logs every access attempt by Google employees, while Access Approval allows customers to approve or deny those requests, ensuring no unauthorized access without customer consent.

Answer

Customer-Managed Encryption Keys (CMEK), where the customer controls the encryption key and can revoke access

Answer

Cloud Audit Logs, which record all customer actions within Google Cloud

Answer

VPC Service Controls, which prevent Google employees from accessing resources inside the service perimeter

Question 10

A security team is reviewing a developer's request to be granted the 'Owner' role on a production Google Cloud project 'just in case they need broad access.' The security team rejects this and instead grants a more specific role. Which security principle does the security team's decision enforce?

Accepted Answer

Principle of least privilege, by granting only the minimum permissions necessary for the developer's specific role and tasks. The security team's decision to reject the overly broad 'Owner' role and grant a more specific role directly enforces the principle of least privilege. This principle dictates that users should be granted only the minimum permissions necessary to perform their job functions, reducing the risk of accidental or malicious misuse of elevated access. In Google Cloud, this is implemented by assigning predefined or custom IAM roles with precisely scoped permissions rather than broad roles like Owner.

Answer

Defense in depth, by ensuring multiple security layers protect the project

Answer

Separation of duties, by ensuring no single person has too many responsibilities

Answer

Zero trust networking, by treating the developer's device as untrusted

Question 11

A company is moving a regulated workload to Google Cloud and must ensure that their encryption keys are stored in a hardware security module (HSM) that meets FIPS 140-2 Level 3 validation. Which Google Cloud key management option satisfies this requirement?

Accepted Answer

Cloud HSM, which stores and manages keys in FIPS 140-2 Level 3 validated hardware security modules. Cloud HSM is the correct choice because it provides a dedicated HSM service that stores and manages encryption keys in FIPS 140-2 Level 3 validated hardware security modules. This directly meets the regulatory requirement for a hardware security module with that specific validation level, as opposed to software-backed or customer-supplied key options.

Answer

Cloud KMS software-backed keys, which are managed by Google and stored in Google's secure key management infrastructure

Answer

Customer-supplied encryption keys (CSEK), where the customer provides the key with each API request

Answer

Secret Manager, which stores API keys and credentials with automatic rotation

Question 12

A company has employees who use personal (unmanaged) devices to access corporate applications. The security team wants to prevent sensitive Google Workspace documents from being downloaded to personal devices. Which Google control most directly addresses this data loss prevention requirement for device-based scenarios?

Accepted Answer

Google Workspace context-aware access and endpoint management controls that restrict actions (such as downloads) for users accessing from unmanaged personal devices. Google Workspace context-aware access combined with endpoint management allows administrators to create access level policies that restrict specific actions—such as downloading, printing, or copying—based on device trust signals. When a user accesses Google Workspace from an unmanaged personal device, the policy can block the download of sensitive documents directly, addressing the data loss prevention requirement at the action level rather than just the access level.

Answer

Cloud Armor, by blocking requests from IP addresses associated with personal devices

Answer

Enabling two-factor authentication for all users, which prevents unauthorized access

Answer

Encrypting all Google Drive files so they cannot be read on personal devices

Question 13

A startup is building a web application and wants to protect it from common web attacks like SQL injection and cross-site scripting. Which Google Cloud product provides web application firewall (WAF) capabilities?

Accepted Answer

Cloud Armor, which provides WAF rules to detect and block SQL injection, XSS, and other OWASP Top 10 attacks. Cloud Armor is Google Cloud's web application firewall (WAF) service that provides pre-configured rules to detect and block common web attacks, including SQL injection and cross-site scripting (XSS), as well as other OWASP Top 10 threats. It integrates with Cloud Load Balancing and allows you to create custom security policies with rate limiting, IP allow/deny lists, and managed rule sets. This makes it the correct choice for protecting a web application at the application layer.

Answer

Cloud Firewall, which controls network-level traffic based on IP and port rules

Answer

VPC Service Controls, which prevent data exfiltration from Google Cloud services

Answer

Security Command Center, which detects security misconfigurations across Google Cloud resources

Question 14

An organization wants to ensure that Google Cloud services used by its employees cannot be used to exfiltrate data to a competitor's Google Cloud project. For example, they want to prevent copying data from their Cloud Storage bucket to a Storage bucket owned by a competitor. Which Google Cloud security control most directly prevents this type of insider data exfiltration?

Accepted Answer

VPC Service Controls, which create a security perimeter around Google Cloud APIs so data cannot be moved to projects outside the defined perimeter. VPC Service Controls (C) directly prevent data exfiltration by creating a security perimeter around Google Cloud APIs. This perimeter blocks any data movement to resources outside the defined perimeter, such as a competitor's Cloud Storage bucket, regardless of the user's IAM permissions. It works at the API layer, intercepting requests that attempt to copy data to an unauthorized project.

Answer

IAM permissions that restrict users from accessing competitor projects

Answer

Cloud DLP, by scanning and redacting sensitive data before it can be stored

Answer

Organization Policy constraints that prevent resource creation in competitor accounts

Question 15

A company has migrated sensitive customer data to Google Cloud. The legal team asks: 'If Google is hosting our data, who is responsible for ensuring that data is not improperly accessed by unauthorized users through our application?' Under the shared responsibility model, how should the CTO answer?

Accepted Answer

The customer is responsible for application access controls, authentication, and IAM policies that protect data from unauthorized application-layer access, while Google secures the underlying infrastructure. Under the Google Cloud shared responsibility model, the customer is responsible for securing access to their application and data, including authentication, authorization, and IAM policies, while Google is responsible for the security of the underlying infrastructure (physical security, network, hypervisor). The legal team's question specifically asks about unauthorized access through the customer's application, which falls under the customer's responsibility for application-layer controls.

Answer

Google is fully responsible because they host the data and control the infrastructure

Answer

Both Google and the customer share equal 50/50 responsibility for all data access controls

Answer

No one is responsible because cloud computing inherently cannot prevent unauthorized access