Cloud Digital Leader Trust and security with Google Cloud Practice Test 6 — 15 Questions

Question 1

A startup wants to automatically rotate encryption keys used for Cloud Storage objects every 90 days. Which service should they use?

Accepted Answer

Use Cloud Key Management Service (KMS) with automatic rotation schedule. Cloud KMS supports automatic key rotation with a configurable rotation period (e.g., every 90 days). When you create a key ring and key in Cloud KMS, you can set a rotation schedule, and Cloud KMS will automatically generate a new key version on the specified date. This allows the startup to meet the 90-day rotation requirement without manual intervention, and the new key version is used for encrypting new Cloud Storage objects while old versions remain available for decrypting existing data.

Answer

Use Cloud Secret Manager to store and rotate encryption keys

Answer

Use default Cloud Storage encryption (SSE-GCP)

Answer

Use Cloud HSM to store keys and rotate manually

Question 2

A company uses Cloud Load Balancing to distribute traffic to Compute Engine VMs. They want to protect against SQL injection and cross-site scripting attacks. Which service should they enable?

Accepted Answer

Cloud Armor. Cloud Armor is the correct service because it provides web application firewall (WAF) capabilities that can inspect HTTP/S traffic for malicious patterns, including SQL injection and cross-site scripting (XSS) signatures. It integrates directly with Cloud Load Balancing to filter requests before they reach backend Compute Engine VMs, using pre-configured rules from the ModSecurity Core Rule Set (CRS) to block these common OWASP Top 10 threats.

Answer

Identity-Aware Proxy (IAP)

Answer

Cloud CDN

Answer

VPC Service Controls

Question 3

Which TWO Google Cloud services help prevent data exfiltration from virtual machines?

Accepted Answer

Cloud Data Loss Prevention (DLP). Cloud Data Loss Prevention (DLP) is correct because it enables inspection of data at rest and in motion for sensitive content (e.g., PII, credit card numbers) using predefined or custom infoTypes. When integrated with VPC Service Controls, it can block or redact sensitive data before it leaves the virtual machine's network boundary, directly preventing data exfiltration.

Answer

Access Transparency

Answer

Security Command Center

Answer

Cloud Armor

Question 4

Which TWO actions are the customer's responsibility under the GCP shared responsibility model?

Accepted Answer

Managing user accounts and authentication. Under the GCP shared responsibility model, the customer is responsible for managing their own user accounts and authentication (Option A), since identity lifecycle, credential management, and authentication configuration for their users fall on the customer side of the line. The customer is also responsible for configuring IAM policies to control access (Option C), because defining who can do what on which resources via roles and bindings is a customer-controlled security task. By contrast, encryption of data at rest by default (Option B) is provided by Google as part of the platform's baseline security, network infrastructure maintenance (Option D) is handled by Google, and physical security of data centers (Option E) is entirely Google's responsibility.

Answer

Encryption of data at rest by default

Answer

Network infrastructure maintenance

Answer

Physical security of data centers

Question 5

Which THREE are required to achieve HIPAA compliance on Google Cloud?

Accepted Answer

Sign a Business Associate Agreement (BAA) with Google. HIPAA requires covered entities and their business associates to have a written agreement that establishes the permitted and required uses of protected health information (PHI). Google Cloud provides a standard Business Associate Agreement (BAA) that customers must sign to contractually bind Google to HIPAA obligations, including safeguarding ePHI and reporting breaches. Without a signed BAA, Google is not legally liable as a business associate under HIPAA, making this a foundational requirement for compliance.

Answer

Use a dedicated project for all PHI workloads

Answer

Configure multi-factor authentication for all users

Question 6

Refer to the exhibit. A security engineer applies this IAM policy. What is the effect?

Accepted Answer

Access is allowed only from the IP address 203.0.113.1.. The IAM policy shown in the exhibit restricts access to requests coming from IP address 203.0.113.1. In Google Cloud IAM, this is expressed using a condition on `source.ip` (or `request.headers['x-goog-user-ip']`). Only requests from that IP satisfy the condition, and requests from any other IP are denied.

Answer

Access is allowed only to resources tagged with 'production'.

Answer

Access is allowed only with two-factor authentication.

Answer

Access is allowed only during business hours.

Question 7

Refer to the exhibit. A security administrator reviews this Cloud Audit Logs entry. What does this entry indicate?

Accepted Answer

The user attempted to read the object 'secret.pdf' and the request resulted in an error.. The correct option is A: the user attempted to read the object 'secret.pdf' and the request resulted in an error. In Cloud Audit Logs, a data-access entry for a storage object typically records a method such as storage.objects.get, which corresponds to reading/downloading an object, and the presence of an error/status field (for example, a non-OK status or error code) indicates the request failed rather than succeeded. Option D is wrong because a successful read would show a successful status without an error result. Option B is wrong because updating an IAM policy would appear as a setIamPolicy operation on the bucket, not an object read. Option C is wrong because deleting an object would be logged as storage.objects.delete, not a read/get operation.

Answer

The user updated the IAM policy on the bucket.

Answer

The user attempted to delete the object 'secret.pdf'.

Answer

The user successfully read the object 'secret.pdf'.

Question 8

A startup is building a mobile health app that stores sensitive patient data in Cloud Storage. They want to ensure data is encrypted at rest using a key they manage themselves and rotate monthly. Which encryption approach should they use?

Accepted Answer

Use customer-managed encryption keys (CMEK) with Cloud KMS. Customer-managed encryption keys (CMEK) with Cloud KMS allow the customer to create and manage their own keys in Cloud KMS, and use them to encrypt data in Cloud Storage. The customer can rotate the key monthly via Cloud KMS key rotation schedules. This meets the requirement of self-managed keys with monthly rotation.

Answer

Use customer-supplied encryption keys (CSEK)

Answer

Use default Google-managed encryption keys

Answer

Use server-side encryption with customer-provided keys (SSE-C)

Question 9

A retail company uses Google Cloud to run an online store. They have a security requirement that all API calls to Cloud Storage must come from the company's on-premises network only. Which Google Cloud security feature should they implement?

Accepted Answer

VPC Service Controls. VPC Service Controls allow you to define perimeters that restrict access to Google Cloud services from specified VPC networks or IP ranges. Cloud Armor is for DDoS and WAF. IAM conditions are for attribute-based access control within a policy. Identity-Aware Proxy protects web applications, not storage APIs.

Answer

IAM conditions with source IP constraint

Answer

Cloud Armor

Answer

Identity-Aware Proxy (IAP)

Question 10

A financial services company is designing a multi-cloud architecture with Google Cloud and AWS. They need to encrypt data at rest in Google Cloud using a key stored in their on-premises Hardware Security Module (HSM). What is the best approach?

Accepted Answer

Use Cloud External Key Manager (Cloud EKM). Cloud External Key Manager (Cloud EKM) is the correct approach because it allows you to manage encryption keys in an external key management system, such as an on-premises HSM, while using those keys to encrypt data at rest in Google Cloud. This meets the requirement of storing the key in the on-premises HSM, as Cloud EKM integrates with supported external key management partners or directly with your HSM via a key management proxy, ensuring that Google Cloud never has direct access to the raw key material.

Answer

Use default encryption

Answer

Use Cloud HSM

Answer

Use Cloud Key Management Service (Cloud KMS) with CMEK

Question 11

A security engineer notices that a Compute Engine instance is running a VM with a public IP that should not be accessible from the internet. They want to ensure this configuration is prevented by default for all future projects in the organization. What should they do?

Accepted Answer

Define an Organization Policy with the constraint compute.vmExternalIpAccess. Organization Policies in Google Cloud allow you to set constraints at the organization, folder, or project level to enforce security controls. The `compute.vmExternalIpAccess` constraint specifically prevents VMs from being created with external IP addresses, ensuring that no future Compute Engine instances in the organization can have public IPs by default. This is a preventive control that applies to all new VM creations, unlike IAM policies or firewall rules which are more granular or reactive.

Answer

Set an IAM policy to deny compute.instances.create with public IP

Answer

Create a VPC firewall rule to deny all traffic from the internet to the VM

Answer

Use Cloud Security Scanner to identify and remediate

Question 12

A multinational corporation must comply with data residency requirements that prohibit storing data outside specific geographic regions. They plan to use BigQuery for analytics. How can Google Cloud help enforce this requirement?

Accepted Answer

Use BigQuery’s location parameter to set dataset location and enforce via Organization Policy. BigQuery datasets are created with a specific location parameter (e.g., `us-central1` or `EU`), and Google Cloud Organization Policies can be used to restrict where datasets can be created. By defining a constraint like `constraints/bigquery.locationRestriction`, administrators can enforce that datasets must reside only in approved geographic regions, preventing any data from being stored outside those boundaries. This directly addresses data residency requirements without relying on detection or blocking mechanisms that don't control storage location.

Answer

Use Cloud Audit Logs to detect and alert on cross-region data storage

Answer

Use Cloud Data Loss Prevention to redact cross-region data

Answer

Use VPC Service Controls to block access to BigQuery APIs from other regions

Question 13

A cloud architect wants to ensure that only certain users in the finance team can access a Cloud Storage bucket containing invoices. They also want to log all access attempts. Which two services should they use?

Accepted Answer

IAM and Cloud Audit Logs. IAM (Identity and Access Management) is used to grant specific users (e.g., finance team members) granular access to the Cloud Storage bucket via roles like roles/storage.objectViewer. Cloud Audit Logs (specifically Admin Activity and Data Access audit logs) capture all access attempts, including who accessed the bucket, when, and from which IP address, meeting the logging requirement.

Answer

Cloud NAT and Cloud Audit Logs

Answer

Cloud NAT and Cloud Load Balancing

Answer

IAM and Cloud CDN

Question 14

A company uses Cloud SQL for MySQL and wants to ensure that data is encrypted at rest using customer-managed keys. They also need to rotate the key every 90 days. What should they do?

Accepted Answer

Enable CMEK on the Cloud SQL instance and rotate the key in Cloud KMS. Cloud SQL supports Customer-Managed Encryption Keys (CMEK) via integration with Cloud KMS. By enabling CMEK on the Cloud SQL instance, you can use a key you create and manage in Cloud KMS, and you can set a rotation period (e.g., 90 days) on that key in Cloud KMS. This ensures data at rest is encrypted with a key you control and that is automatically rotated according to your schedule.

Answer

Use customer-supplied encryption keys (CSEK) with Cloud SQL

Answer

Use default Google-managed encryption and rotate the key using Cloud KMS

Answer

Bring your own key (BYOK) without using Cloud KMS

Question 15

An organization uses Security Command Center (SCC) premium tier and wants to automatically remediate a specific finding type by disabling public access to Cloud Storage buckets. What is the recommended approach?

Accepted Answer

Set up a Cloud Function triggered by SCC findings to remove public access. Security Command Center (SCC) premium tier can publish findings to Cloud Pub/Sub, which can trigger a Cloud Function via a push subscription. The Cloud Function can then use the Google Cloud Storage API (specifically, the `storage.buckets.setIamPolicy` method) to remove the `allUsers` or `allAuthenticatedUsers` bindings that grant public access, enabling automated, event-driven remediation without manual intervention.

Answer

Use Cloud Pub/Sub alone to listen for SCC findings and then manually remediate

Answer

Use IAM to deny all users except project owners from making buckets public

Answer

Configure a Cloud Scheduler job to run a script that checks and removes public access