Cloud Digital Leader Trust and security with Google Cloud Practice Test 5 — 15 Questions

Question 1

Drag and drop the steps to configure a load balancer for an HTTP application on Compute Engine into the correct order.

Question 2

Drag and drop the steps to set up a Cloud NAT for private Compute Engine instances to access the internet in the correct order.

Question 3

Match each Google Cloud data service to its primary function.

Question 4

Match each Google Cloud storage class to its use case.

Question 5

A small IT team needs to grant developers the ability to deploy instances in a project but not delete them. Which IAM best practice should they use?

Accepted Answer

Create a service account for each developer and grant it the compute.instanceAdmin role.. Option D is correct because creating a service account for each developer and granting the `compute.instanceAdmin` role provides the precise permissions needed to deploy instances (via `compute.instances.insert`) without granting the ability to delete them (the `compute.instanceAdmin` role does not include `compute.instances.delete`). This follows the IAM best practice of least privilege, ensuring developers can perform only the required actions.

Answer

Create a custom role with compute.instances.insert and compute.instances.delete permissions.

Answer

Assign all developers the primitive role of Editor.

Answer

Use organization policy to restrict deletion of compute instances.

Question 6

A healthcare company must store PHI in Cloud Storage. They require encryption at rest and in transit, and need to comply with HIPAA. Which combination of Google Cloud features should they implement?

Accepted Answer

Cloud Storage with SSE-GCP and use HTTPS, sign BAA with Google.. Option C is correct because Cloud Storage with server-side encryption (SSE-GCP) provides encryption at rest by default, HTTPS ensures encryption in transit, and signing a Business Associate Agreement (BAA) with Google is a mandatory contractual requirement for HIPAA compliance. This combination satisfies all stated requirements: encryption at rest, encryption in transit, and HIPAA compliance.

Answer

Cloud Storage with SSE-C, HTTP for in-transit, and enable HIPAA compliance flag.

Answer

Use Cloud Storage with CSEK and disable public access.

Answer

Use Cloud Storage with CMEK and use VPN for transit.

Question 7

A multinational corporation uses Cloud Identity-Aware Proxy (IAP) to secure access to applications. They notice that some users outside the corporate network can still reach the applications. What is the most likely misconfiguration?

Accepted Answer

IAP is set to 'allUsers' instead of 'allAuthenticatedUsers'.. Option A is correct because setting IAP to 'allUsers' allows unauthenticated access from any user on the internet, bypassing IAP's authentication and authorization checks. IAP should be configured with 'allAuthenticatedUsers' or a more specific set of principals to enforce identity verification before granting access to the application.

Answer

The firewall rules allow ingress from 0.0.0.0/0.

Answer

IAP is not enabled on the backend service.

Answer

The OAuth 2.0 client ID is misconfigured.

Question 8

A company wants to enforce that all Cloud Storage buckets in a project have uniform bucket-level access enabled. Which Google Cloud tool should they use?

Accepted Answer

Define an Organization Policy with a constraint on uniform bucket-level access.. Organization Policies in Google Cloud allow administrators to enforce constraints across the entire resource hierarchy. The constraint `constraints/storage.uniformBucketLevelAccess` can be applied at the project, folder, or organization level to require uniform bucket-level access on all Cloud Storage buckets, preventing any bucket from being created or updated without it.

Answer

Use Cloud Audit Logs to monitor and alert on non-compliant buckets.

Answer

Set an IAM policy to deny access to buckets without uniform access.

Answer

Use Cloud Key Management Service to rotate keys.

Question 9

A company's security team wants to detect and remediate public exposure of Cloud SQL instances. Which service should they use?

Accepted Answer

Security Command Center. Security Command Center (SCC) is the correct service because it provides centralized visibility and monitoring of Google Cloud resources, including the ability to detect and alert on public exposure of Cloud SQL instances. SCC's built-in vulnerability and threat detection findings, such as 'Public SQL instance,' directly identify misconfigured Cloud SQL instances that are accessible from the internet, enabling the security team to remediate the exposure.

Answer

Cloud Armor

Answer

Cloud Data Loss Prevention (DLP)

Answer

VPC Service Controls

Question 10

An organization stores sensitive data in BigQuery. They need to restrict access to specific columns based on user role, while allowing analysis at the dataset level. Which feature should they use?

Accepted Answer

Column-level access control using authorized views or taxonomy policies. Option B is correct because BigQuery column-level access control, implemented through authorized views or taxonomy policies (via Data Catalog), allows restricting access to specific columns while preserving dataset-level analysis permissions. Authorized views use SQL logic to expose only permitted columns, and taxonomy policies apply fine-grained access controls at the column level without requiring separate datasets.

Answer

BigQuery row-level security

Answer

IAM roles at the dataset level with fine-grained permissions

Answer

Cloud Data Loss Prevention (DLP) to mask data

Question 11

A startup wants to automatically rotate encryption keys used for Cloud Storage objects every 90 days. Which service should they use?

Accepted Answer

Use Cloud Key Management Service (KMS) with automatic rotation schedule. Option D is correct because Cloud KMS supports automatic key rotation with a configurable rotation period (e.g., every 90 days). When you create a key ring and key in Cloud KMS, you can set a rotation schedule, and Cloud KMS will automatically generate a new key version on the specified date. This allows the startup to meet the 90-day rotation requirement without manual intervention, and the new key version is used for encrypting new Cloud Storage objects while old versions remain available for decrypting existing data.

Answer

Use Cloud Secret Manager to store and rotate encryption keys

Answer

Use default Cloud Storage encryption (SSE-GCP)

Answer

Use Cloud HSM to store keys and rotate manually

Question 12

A company uses Cloud Load Balancing to distribute traffic to Compute Engine VMs. They want to protect against SQL injection and cross-site scripting attacks. Which service should they enable?

Accepted Answer

Cloud Armor. Cloud Armor is the correct service because it provides web application firewall (WAF) capabilities that can inspect HTTP/S traffic for malicious patterns, including SQL injection and cross-site scripting (XSS) signatures. It integrates directly with Cloud Load Balancing to filter requests before they reach backend Compute Engine VMs, using pre-configured rules from the ModSecurity Core Rule Set (CRS) to block these common OWASP Top 10 threats.

Answer

Identity-Aware Proxy (IAP)

Answer

Cloud CDN

Answer

VPC Service Controls

Question 13

A financial services company needs to ensure that all access to sensitive data in Cloud Storage is logged with information about the user and the reason for access. Which feature should they enable?

Accepted Answer

Access Transparency. Access Transparency provides detailed logs of actions taken by Google Cloud support and engineering personnel when accessing customer data, including the specific user and the business reason for access. This meets the requirement for logging all access to sensitive data in Cloud Storage with user identity and reason, as it covers both Google and customer-side access.

Answer

Cloud Data Loss Prevention (DLP)

Answer

Security Command Center

Answer

Cloud Audit Logs

Question 14

Which TWO Google Cloud services help prevent data exfiltration from virtual machines?

Accepted Answer

Cloud Data Loss Prevention (DLP). Cloud Data Loss Prevention (DLP) is correct because it enables inspection of data at rest and in motion for sensitive content (e.g., PII, credit card numbers) using predefined or custom infoTypes. When integrated with VPC Service Controls, it can block or redact sensitive data before it leaves the virtual machine's network boundary, directly preventing data exfiltration.

Answer

Access Transparency

Answer

Security Command Center

Answer

Cloud Armor

Question 15

Which TWO actions are the customer's responsibility under the GCP shared responsibility model?

Accepted Answer

Managing user accounts and authentication. Options B and D are correct. Configuring IAM policies and managing user accounts are customer responsibilities. Physical data center security and network infrastructure maintenance are Google's responsibilities. Encrypting data at rest using default settings is Google's responsibility, but customer can choose additional encryption.

Answer

Encryption of data at rest by default

Answer

Network infrastructure maintenance

Answer

Physical security of data centers