Cloud Digital Leader Trust and security with Google Cloud Practice Test 6 — 15 Questions

Question 1

A healthcare company must store PHI in Cloud Storage. They require encryption at rest and in transit, and need to comply with HIPAA. Which combination of Google Cloud features should they implement?

Accepted Answer

Cloud Storage with SSE-GCP and use HTTPS, sign BAA with Google.. Cloud Storage with server-side encryption (SSE-GCP) provides encryption at rest by default, HTTPS ensures encryption in transit, and signing a Business Associate Agreement (BAA) with Google is a mandatory contractual requirement for HIPAA compliance. This combination satisfies all stated requirements: encryption at rest, encryption in transit, and HIPAA compliance.

Answer

Cloud Storage with SSE-C, HTTP for in-transit, and enable HIPAA compliance flag.

Answer

Use Cloud Storage with CSEK and disable public access.

Answer

Use Cloud Storage with CMEK and use VPN for transit.

Question 2

A multinational corporation uses Cloud Identity-Aware Proxy (IAP) to secure access to applications. They notice that some users outside the corporate network can still reach the applications. What is the most likely misconfiguration?

Accepted Answer

IAP is set to 'allUsers' instead of 'allAuthenticatedUsers'.. Setting IAP to 'allUsers' allows unauthenticated access from any user on the internet, bypassing IAP's authentication and authorization checks. IAP should be configured with 'allAuthenticatedUsers' or a more specific set of principals to enforce identity verification before granting access to the application.

Answer

The firewall rules allow ingress from 0.0.0.0/0.

Answer

IAP is not enabled on the backend service.

Answer

The OAuth 2.0 client ID is misconfigured.

Question 3

A company wants to enforce that all Cloud Storage buckets in a project have uniform bucket-level access enabled. Which Google Cloud tool should they use?

Accepted Answer

Define an Organization Policy with a constraint on uniform bucket-level access.. Organization Policies in Google Cloud allow administrators to enforce constraints across the entire resource hierarchy. The constraint `constraints/storage.uniformBucketLevelAccess` can be applied at the project, folder, or organization level to require uniform bucket-level access on all Cloud Storage buckets, preventing any bucket from being created or updated without it.

Answer

Use Cloud Audit Logs to monitor and alert on non-compliant buckets.

Answer

Set an IAM policy to deny access to buckets without uniform access.

Answer

Use Cloud Key Management Service to rotate keys.

Question 4

A company's security team wants to detect and remediate public exposure of Cloud SQL instances. Which service should they use?

Accepted Answer

Security Command Center. Security Command Center (SCC) is the correct service because it provides centralized visibility and monitoring of Google Cloud resources, including the ability to detect and alert on public exposure of Cloud SQL instances. SCC's built-in vulnerability and threat detection findings, such as 'Public SQL instance,' directly identify misconfigured Cloud SQL instances that are accessible from the internet, enabling the security team to remediate the exposure.

Answer

Cloud Armor

Answer

Cloud Data Loss Prevention (DLP)

Answer

VPC Service Controls

Question 5

An organization stores sensitive data in BigQuery. They need to restrict access to specific columns based on user role, while allowing analysis at the dataset level. Which feature should they use?

Accepted Answer

Column-level access control using authorized views or taxonomy policies. BigQuery column-level access control, implemented through authorized views or taxonomy policies (via Data Catalog), allows restricting access to specific columns while preserving dataset-level analysis permissions. Authorized views use SQL logic to expose only permitted columns, and taxonomy policies apply fine-grained access controls at the column level without requiring separate datasets.

Answer

BigQuery row-level security

Answer

IAM roles at the dataset level with fine-grained permissions

Answer

Cloud Data Loss Prevention (DLP) to mask data

Question 6

A startup wants to automatically rotate encryption keys used for Cloud Storage objects every 90 days. Which service should they use?

Accepted Answer

Use Cloud Key Management Service (KMS) with automatic rotation schedule. Cloud KMS supports automatic key rotation with a configurable rotation period (e.g., every 90 days). When you create a key ring and key in Cloud KMS, you can set a rotation schedule, and Cloud KMS will automatically generate a new key version on the specified date. This allows the startup to meet the 90-day rotation requirement without manual intervention, and the new key version is used for encrypting new Cloud Storage objects while old versions remain available for decrypting existing data.

Answer

Use Cloud Secret Manager to store and rotate encryption keys

Answer

Use default Cloud Storage encryption (SSE-GCP)

Answer

Use Cloud HSM to store keys and rotate manually

Question 7

A company uses Cloud Load Balancing to distribute traffic to Compute Engine VMs. They want to protect against SQL injection and cross-site scripting attacks. Which service should they enable?

Accepted Answer

Cloud Armor. Cloud Armor is the correct service because it provides web application firewall (WAF) capabilities that can inspect HTTP/S traffic for malicious patterns, including SQL injection and cross-site scripting (XSS) signatures. It integrates directly with Cloud Load Balancing to filter requests before they reach backend Compute Engine VMs, using pre-configured rules from the ModSecurity Core Rule Set (CRS) to block these common OWASP Top 10 threats.

Answer

Identity-Aware Proxy (IAP)

Answer

Cloud CDN

Answer

VPC Service Controls

Question 8

Which TWO Google Cloud services help prevent data exfiltration from virtual machines?

Accepted Answer

Cloud Data Loss Prevention (DLP). Cloud Data Loss Prevention (DLP) is correct because it enables inspection of data at rest and in motion for sensitive content (e.g., PII, credit card numbers) using predefined or custom infoTypes. When integrated with VPC Service Controls, it can block or redact sensitive data before it leaves the virtual machine's network boundary, directly preventing data exfiltration.

Answer

Access Transparency

Answer

Security Command Center

Answer

Cloud Armor

Question 9

Which THREE are required to achieve HIPAA compliance on Google Cloud?

Accepted Answer

Sign a Business Associate Agreement (BAA) with Google. HIPAA requires covered entities and their business associates to have a written agreement that establishes the permitted and required uses of protected health information (PHI). Google Cloud provides a standard Business Associate Agreement (BAA) that customers must sign to contractually bind Google to HIPAA obligations, including safeguarding ePHI and reporting breaches. Without a signed BAA, Google is not legally liable as a business associate under HIPAA, making this a foundational requirement for compliance.

Answer

Use a dedicated project for all PHI workloads

Answer

Configure multi-factor authentication for all users

Question 10

A startup is building a mobile health app that stores sensitive patient data in Cloud Storage. They want to ensure data is encrypted at rest using a key they manage themselves and rotate monthly. Which encryption approach should they use?

Accepted Answer

Use customer-managed encryption keys (CMEK) with Cloud KMS. Cloud Key Management Service (Cloud KMS) with a customer-managed encryption key (CMEK) allows customers to control and rotate keys. CSEK is deprecated and less flexible. SSE-C is not available in Cloud Storage. Default encryption is Google-managed and cannot be rotated by the customer.

Answer

Use customer-supplied encryption keys (CSEK)

Answer

Use default Google-managed encryption keys

Answer

Use server-side encryption with customer-provided keys (SSE-C)

Question 11

A retail company uses Google Cloud to run an online store. They have a security requirement that all API calls to Cloud Storage must come from the company's on-premises network only. Which Google Cloud security feature should they implement?

Accepted Answer

VPC Service Controls. VPC Service Controls allow you to define perimeters that restrict access to Google Cloud services from specified VPC networks or IP ranges. Cloud Armor is for DDoS and WAF. IAM conditions are for attribute-based access control within a policy. Identity-Aware Proxy protects web applications, not storage APIs.

Answer

IAM conditions with source IP constraint

Answer

Cloud Armor

Answer

Identity-Aware Proxy (IAP)

Question 12

A financial services company is designing a multi-cloud architecture with Google Cloud and AWS. They need to encrypt data at rest in Google Cloud using a key stored in their on-premises Hardware Security Module (HSM). What is the best approach?

Accepted Answer

Use Cloud External Key Manager (Cloud EKM). Cloud External Key Manager (Cloud EKM) is the correct approach because it allows you to manage encryption keys in an external key management system, such as an on-premises HSM, while using those keys to encrypt data at rest in Google Cloud. This meets the requirement of storing the key in the on-premises HSM, as Cloud EKM integrates with supported external key management partners or directly with your HSM via a key management proxy, ensuring that Google Cloud never has direct access to the raw key material.

Answer

Use default encryption

Answer

Use Cloud HSM

Answer

Use Cloud Key Management Service (Cloud KMS) with CMEK

Question 13

A company wants to grant a data analyst read-only access to specific BigQuery datasets, but only if the request comes from within the corporate network. Which two Google Cloud tools should they combine to enforce this?

Accepted Answer

IAM and VPC Service Controls. IAM defines the read-only role (e.g., roles/bigquery.dataViewer) for the data analyst, while VPC Service Controls create a security perimeter that restricts access to the BigQuery API from only the corporate network IP range. Together, they ensure the request is both authorized by IAM and originates from within the allowed VPC perimeter, blocking any access from outside the corporate network even if the IAM role is granted.

Answer

IAM and Cloud IAP

Answer

Cloud Armor and IAM

Answer

Organization Policies and Cloud Audit Logs

Question 14

A security engineer notices that a Compute Engine instance is running a VM with a public IP that should not be accessible from the internet. They want to ensure this configuration is prevented by default for all future projects in the organization. What should they do?

Accepted Answer

Define an Organization Policy with the constraint compute.vmExternalIpAccess. Organization Policies in Google Cloud allow you to set constraints at the organization, folder, or project level to enforce security controls. The `compute.vmExternalIpAccess` constraint specifically prevents VMs from being created with external IP addresses, ensuring that no future Compute Engine instances in the organization can have public IPs by default. This is a preventive control that applies to all new VM creations, unlike IAM policies or firewall rules which are more granular or reactive.

Answer

Set an IAM policy to deny compute.instances.create with public IP

Answer

Create a VPC firewall rule to deny all traffic from the internet to the VM

Answer

Use Cloud Security Scanner to identify and remediate

Question 15

A multinational corporation must comply with data residency requirements that prohibit storing data outside specific geographic regions. They plan to use BigQuery for analytics. How can Google Cloud help enforce this requirement?

Accepted Answer

Use BigQuery’s location parameter to set dataset location and enforce via Organization Policy. BigQuery datasets are created with a specific location parameter (e.g., `us-central1` or `EU`), and Google Cloud Organization Policies can be used to restrict where datasets can be created. By defining a constraint like `constraints/bigquery.locationRestriction`, administrators can enforce that datasets must reside only in approved geographic regions, preventing any data from being stored outside those boundaries. This directly addresses data residency requirements without relying on detection or blocking mechanisms that don't control storage location.

Answer

Use Cloud Audit Logs to detect and alert on cross-region data storage

Answer

Use Cloud Data Loss Prevention to redact cross-region data

Answer

Use VPC Service Controls to block access to BigQuery APIs from other regions