Cloud Digital Leader Trust and security with Google Cloud Practice Test 4 — 15 Questions

Question 1

A company's security policy requires that all cloud-to-cloud communication between services must be encrypted in transit. An auditor asks how Google Cloud handles encryption for network traffic between Google services within its network. What is Google's default approach to encryption in transit within its infrastructure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Google encrypts all traffic between its data centers and internal services by default, with no customer configuration required. Google Cloud encrypts all network traffic between its data centers and internal services by default, using application-layer (e.g., gRPC with TLS) and link-layer encryption (e.g., MACsec or similar). This is a foundational security measure that requires no customer configuration, ensuring data is protected in transit even within Google's own infrastructure.

Answer

Google does not encrypt internal traffic by default; customers must configure TLS for all service-to-service communication

Answer

Google only encrypts traffic that crosses the public internet; internal network traffic is unencrypted for performance

Answer

Encryption in transit is the customer's responsibility for all traffic, including traffic within Google's network

Question 2

A CISO is evaluating Google Cloud's security posture and asks about independent third-party validation of Google's security practices. Which types of certifications and audit reports most directly provide this independent assurance?

Accepted Answer

Third-party audit certifications such as ISO 27001, SOC 2 Type II, PCI DSS, and FedRAMP, which independently verify that Google's security controls meet defined international and industry standards. Independent third-party validation of Google Cloud's security posture is most directly provided by certifications and audit reports such as ISO 27001, SOC 2 Type II, PCI DSS, and FedRAMP. These are issued by accredited external auditors who verify that Google's security controls, processes, and infrastructure meet rigorous, internationally recognized standards. This gives customers objective assurance beyond Google's own claims.

Answer

Google's internal security policies and self-assessment reports published on its website

Answer

Google's Bug Bounty program, which shows that the public can report security vulnerabilities

Answer

Customer testimonials from large enterprises that use Google Cloud for sensitive workloads

Question 3

A company's security team wants to be alerted when someone with administrative permissions changes an IAM policy in their Google Cloud organization. Which Google Cloud capability enables this detection?

Accepted Answer

Admin Activity audit logs combined with Cloud Monitoring log-based alerting, which records and alerts on IAM policy modifications by any principal. Admin Activity audit logs record all changes to IAM policies and other configuration changes in Google Cloud. By combining these logs with Cloud Monitoring log-based alerting, the security team can create a specific alert that triggers whenever an IAM policy is modified by a principal with administrative permissions, enabling real-time detection of unauthorized changes.

Answer

Data Access audit logs, which record when data is read from Cloud Storage buckets

Answer

Cloud Armor, which blocks unauthorized IAM policy changes at the network layer

Answer

VPC flow logs, which capture all network traffic including IAM API calls

Question 4

A multinational company must ensure that personal data of European citizens stored in Google Cloud cannot be accessed by or transferred to systems outside the European Union, as required by GDPR data residency requirements. Which Google Cloud controls most directly enforce this?

Accepted Answer

Configuring organization policy to restrict resource creation to EU regions, using VPC Service Controls to prevent data movement outside the EU perimeter, and establishing a GDPR-compliant Data Processing Agreement with Google. It combines three essential controls that directly enforce GDPR data residency: Organization Policies restrict resource creation to EU regions, VPC Service Controls create a data perimeter preventing exfiltration outside the EU, and a GDPR-compliant Data Processing Agreement (DPA) establishes the legal framework for data handling. These controls work together to ensure data at rest and in transit remains within the EU boundary, directly addressing the residency requirement.

Answer

Enabling HTTPS for all data transmission to ensure data is encrypted during transfer

Answer

Using Customer-Managed Encryption Keys (CMEK) where the encryption keys are stored outside Google's infrastructure

Answer

Training developers about GDPR requirements and requiring manual approval for any cross-region data transfers

Question 5

An enterprise's security team is implementing a strategy to protect against 'credential stuffing' attacks — where attackers use lists of username/password combinations from previous data breaches to try to log in to the company's applications. Which authentication control most effectively mitigates this threat?

Accepted Answer

Multi-Factor Authentication (MFA/2SV), which requires a second verification factor beyond the password that attackers don't have even when they possess the stolen credentials. Multi-Factor Authentication (MFA/2SV) is the most effective control against credential stuffing because it requires an additional verification factor (e.g., a one-time code from an authenticator app, a hardware token, or a biometric) that the attacker does not possess, even if they have valid username/password pairs from a breach. This renders the stolen credentials useless for authentication, as the attacker cannot complete the second factor challenge. In Google Cloud, this is commonly enforced via Identity Platform or Cloud Identity with security keys or TOTP.

Answer

Requiring longer, more complex passwords to make credentials harder to guess

Answer

Encrypting passwords in the company's database using bcrypt to prevent the stolen passwords from being usable

Answer

Implementing HTTPS on the login page to prevent credentials from being intercepted in transit

Question 6

A developer accidentally commits an application's Google Cloud service account key to a public GitHub repository. The key is valid and grants access to production resources. What is the correct immediate response?

Accepted Answer

Immediately revoke/delete the exposed service account key in Google Cloud IAM, review Cloud Audit Logs for unauthorized access, and generate a new key distributed through secure channels. The immediate priority is to invalidate the exposed credential to prevent unauthorized access to production resources. Revoking the key in Google Cloud IAM ensures it can no longer be used for authentication, while reviewing Cloud Audit Logs helps identify any potential misuse. Generating a new key and distributing it securely restores access for legitimate applications.

Answer

Delete the commit from GitHub history using git rebase; the key is safe once removed from the repository

Answer

Change the service account's permissions to read-only to limit the damage from potential misuse

Answer

Send an internal email informing the security team and wait for their guidance before taking any action

Question 7

A CISO asks why Google Cloud's security model is described as a 'defense-in-depth' approach. Which explanation best describes this concept in the context of Google Cloud's infrastructure security?

Accepted Answer

Defense in depth means security is implemented as multiple independent layers — physical security, hardware attestation, network encryption, hypervisor isolation, and application-level IAM — so that bypassing any single layer does not compromise the entire system. Google Cloud's defense-in-depth model implements security at multiple independent layers: physical security (e.g., tamper-evident cages), hardware attestation (e.g., Titan chips verifying boot integrity), network encryption (e.g., mTLS between all services), hypervisor isolation (e.g., gVisor or KVM-based sandboxing), and application-level IAM (e.g., Cloud IAM policies). This layered approach ensures that if an attacker bypasses one layer, other layers remain intact to protect the system, aligning with the core principle of defense in depth.

Answer

Defense in depth means that Google uses a single, very strong encryption algorithm to protect all customer data

Answer

Defense in depth means Google deploys security controls only at the network perimeter, creating a strong outer boundary

Answer

Defense in depth means customers are responsible for all security layers, with Google providing only the physical infrastructure

Question 8

A company runs a multi-tenant SaaS application on Google Cloud where each customer's data must be strictly isolated from other customers'. A security architect is evaluating approaches: (A) logical isolation using application-level tenant IDs in a shared database, (B) IAM-based separation using separate service accounts per tenant, or (C) infrastructure-level isolation with separate Google Cloud projects per tenant. Which approach provides the strongest isolation guarantee?

Accepted Answer

Separate Google Cloud projects per tenant, which provides the strongest isolation: separate IAM boundaries, separate resource namespaces, separate audit logs, and no shared database instances with other tenants. Separate Google Cloud projects provide the strongest isolation guarantee by creating independent IAM boundaries, resource namespaces, audit logs, and network configurations. This approach ensures that no shared database instances or other resources exist between tenants, eliminating any risk of cross-tenant data leakage through application bugs or misconfigurations. In contrast, logical isolation (A) relies on application-level tenant IDs which can be bypassed by software vulnerabilities, and IAM-based separation (C) still shares the underlying project infrastructure, including the same database and network.

Answer

Logical isolation using application-level tenant IDs, because it is the most cost-efficient and sufficient for regulated workloads

Answer

IAM-based separation using separate service accounts per tenant within a shared project, because IAM provides cryptographically enforced access control

Answer

All three approaches provide equivalent isolation because Google Cloud's hypervisor ensures complete tenant separation at the hardware level

Question 9

A company's compliance team asks what evidence they can provide to regulators to demonstrate that Google Cloud services meet industry security standards. Which type of documentation most directly provides this evidence?

Accepted Answer

Third-party audit reports and compliance certifications (SOC 2 Type II, ISO 27001, PCI DSS) available through Google Cloud's Compliance Reports Manager, which provide independent verification of security controls. Third-party audit reports and compliance certifications (SOC 2 Type II, ISO 27001, PCI DSS) available through Google Cloud's Compliance Reports Manager provide independent verification of security controls. These are the most direct evidence for regulators because they are produced by independent auditors and attest to the effectiveness of controls.

Answer

Google Cloud's marketing materials and product documentation describing security features

Answer

The company's own internal security policies that reference using Google Cloud

Answer

A Google Cloud support ticket confirming that the company's account is in good standing

Question 10

A company is concerned that employees might accidentally or maliciously upload sensitive personal data (such as credit card numbers or Social Security Numbers) to Cloud Storage buckets. Which Google Cloud product can automatically scan uploaded files and identify sensitive data patterns?

Accepted Answer

Cloud DLP (Data Loss Prevention), which scans Cloud Storage objects for sensitive data types like credit card numbers and SSNs using built-in pattern detection. Cloud DLP (Data Loss Prevention) is the correct service because it is specifically designed to inspect and classify sensitive data within Cloud Storage objects. It uses built-in detectors (infoTypes) to identify patterns like credit card numbers (Luhn check) and Social Security Numbers, and can trigger automated actions such as redaction or logging when sensitive data is found.

Answer

Cloud Armor, which inspects incoming HTTP requests for sensitive data patterns

Answer

Cloud Logging, which records all file upload events to Cloud Storage

Answer

Security Command Center, which audits Cloud Storage bucket permissions

Question 11

A CISO is implementing a Zero Trust security architecture for the company's Google Cloud environment. Under Zero Trust, which fundamental assumption about network traffic changes compared to traditional perimeter-based security?

Accepted Answer

Zero Trust assumes no traffic is trusted by default regardless of network origin — every request must be explicitly authenticated and authorized based on identity, device posture, and context. Zero Trust fundamentally shifts from implicit trust based on network location to explicit verification of every request. In Google Cloud, this means every API call, regardless of whether it originates from within the VPC or the internet, must be authenticated (e.g., using OAuth 2.0 or service account keys) and authorized based on identity, device posture, and context, as enforced by tools like Identity-Aware Proxy (IAP) and VPC Service Controls.

Answer

Zero Trust assumes that internal network traffic is more secure than external traffic because it has passed through the corporate firewall

Answer

Zero Trust assumes all traffic is malicious and blocks all requests by default, requiring explicit allowlisting for each connection

Answer

Zero Trust eliminates the need for encryption since all traffic is assumed to be on secure internal networks

Question 12

A company is moving its financial reporting application to Google Cloud. The CFO asks: 'If Google Cloud experiences a data breach and our financial data is exposed, who is financially liable?' How should the cloud architect answer this question?

Accepted Answer

Liability depends on where the breach originated: Google is responsible for failures in its infrastructure security; the customer is responsible for breaches resulting from misconfiguration, application vulnerabilities, or inadequate access controls in areas under their responsibility. The Google Cloud Shared Responsibility Model explicitly delineates liability: Google is responsible for the security of the cloud (e.g., physical infrastructure, hypervisor, network controls), while the customer is responsible for security in the cloud (e.g., IAM policies, application code, data encryption). In a breach, liability is determined by where the failure occurred—if Google’s infrastructure (e.g., GKE node isolation) fails, Google bears liability; if the customer misconfigures a Cloud Storage bucket or leaves a Compute Engine firewall open, the customer bears liability. This aligns with the CFO’s question about financial liability, which is not absolute but contingent on the breach’s origin.

Answer

Google Cloud bears full financial liability for all data breaches involving customer data on its platform

Answer

The customer bears all liability for any breach because they chose to use cloud services

Answer

No party is liable because data breaches in cloud are force majeure events similar to natural disasters

Question 13

An organization wants to use Google Cloud for processing healthcare data subject to HIPAA regulations in the United States. Which contractual document must the organization obtain from Google before storing Protected Health Information (PHI) in Google Cloud?

Accepted Answer

A Business Associate Agreement (BAA), which is legally required by HIPAA before any covered entity can process Protected Health Information with a cloud provider. Under HIPAA, a covered entity or business associate must obtain a Business Associate Agreement (BAA) from any cloud service provider that will create, receive, maintain, or transmit Protected Health Information (PHI). Google Cloud offers a BAA that contractually binds Google to comply with HIPAA Security and Privacy Rules, including safeguarding PHI and reporting breaches. Without a signed BAA, storing PHI in Google Cloud would violate HIPAA regulations.

Answer

A Non-Disclosure Agreement (NDA) to prevent Google from disclosing the existence of the healthcare application

Answer

A Data Processing Agreement (DPA) as required under GDPR for European data subjects

Answer

An ISO 27001 certificate issued by Google Cloud demonstrating information security compliance

Question 14

A CISO is designing an identity strategy for Google Cloud that follows Zero Trust principles. She proposes that no long-lived credentials (API keys, service account keys) should be used for any automated workloads. What Google Cloud mechanism replaces service account keys for authenticating workloads running on Google Cloud infrastructure?

Accepted Answer

Attaching a service account to the Compute Engine VM or GKE workload, allowing the workload to obtain short-lived access tokens from the metadata server automatically — no key files required. Google Cloud's default service account attached to Compute Engine VMs or GKE nodes uses the metadata server to automatically obtain short-lived OAuth 2.0 access tokens (typically valid for 1 hour). This eliminates the need for any long-lived key files, aligning with Zero Trust principles by reducing credential exposure and enabling automatic rotation.

Answer

Using long-lived API keys stored in Secret Manager instead of environment variables — the keys are the same but stored more securely

Answer

Rotating service account keys every 24 hours to minimize the exposure window

Answer

Using OAuth 2.0 user accounts instead of service accounts for all automated workloads

Question 15

A security team is conducting a threat model for their Google Cloud environment. They identify 'insider threat' — a malicious authorized employee who intentionally exfiltrates or destroys data — as a key risk. Which combination of Google Cloud controls most effectively mitigates this risk?

Accepted Answer

Least privilege IAM (limiting access to only necessary resources), comprehensive audit logging (detecting anomalous access), VPC Service Controls (preventing data exfiltration to external projects), and separation of duties for critical actions. It combines least privilege IAM to limit the blast radius, comprehensive audit logging (e.g., Cloud Audit Logs) to detect anomalous access patterns, VPC Service Controls to prevent data exfiltration via VPC perimeter enforcement, and separation of duties (e.g., using Cloud IAM Conditions) to ensure no single insider can perform critical actions alone. This layered defense addresses both prevention and detection of malicious insider activity.

Answer

Strong external firewall rules, because insider threats come from internal network actors who must be blocked at the perimeter

Answer

Encrypting all data at rest with CMEK, since encryption prevents authorized users from reading data

Answer

Requiring all employees to pass annual security training to prevent insider threats