Cloud Digital Leader Trust and security with Google Cloud — Timed 15 Questions

Question 1

Google Cloud encrypts all customer data at rest by default without any configuration required. A customer asks: 'Do we need to do anything special to encrypt our data stored in Cloud Storage?' What is the correct answer?

Accepted Answer

No, Google Cloud encrypts all data at rest automatically using AES-256 — no configuration is needed.. Option B is correct because Google Cloud automatically encrypts all customer data at rest using AES-256 encryption, with no configuration required. This default encryption applies to all Cloud Storage buckets, regardless of storage class or region, and the encryption keys are managed by Google Cloud unless the customer chooses to use Customer-Managed Encryption Keys (CMEK) or Customer-Supplied Encryption Keys (CSEK).

Answer

Yes, customers must enable encryption in the Cloud Storage bucket settings for each bucket.

Answer

Only data in premium storage tiers is encrypted; Standard storage requires manual encryption.

Answer

Customers must purchase the Security Command Center Premium tier to enable data encryption.

Question 2

A security architect wants to implement a 'never trust, always verify' security approach where no user or service is assumed to be trustworthy based on network location alone. Every access request must be authenticated and authorized regardless of whether it comes from inside or outside the corporate network. Which security model describes this approach?

Accepted Answer

Zero Trust security model. The Zero Trust security model (Option B) is correct because it explicitly enforces the 'never trust, always verify' principle, requiring authentication and authorization for every access request regardless of network location. In Google Cloud, this aligns with BeyondCorp, which uses identity-aware proxy (IAP) and context-aware access to verify each request based on user identity, device posture, and other attributes, rather than trusting based on IP address or network perimeter.

Answer

Perimeter security model

Answer

Defense in depth model

Answer

Principle of least privilege

Question 3

A company is concerned about which security responsibilities belong to Google versus which belong to them when using Google Cloud's managed database service (Cloud SQL). In the shared responsibility model, which security tasks does Google handle?

Accepted Answer

Google handles physical security, hardware maintenance, and OS and database software patching.. In the shared responsibility model for Google Cloud services like Cloud SQL, Google is responsible for security 'of' the cloud, which includes physical security of data centers, hardware maintenance, and patching the underlying operating system and database software. This ensures the infrastructure hosting Cloud SQL instances is secure, while the customer remains responsible for securing their data, access policies, and application-level configurations.

Answer

Google controls who can access the database and what data can be stored.

Answer

Google is responsible for backing up customer data and ensuring data recovery.

Answer

Google determines which compliance certifications the customer's application must meet.

Question 4

A healthcare company needs to store patient data in Google Cloud and must comply with HIPAA (Health Insurance Portability and Accountability Act). Which statement correctly describes how Google Cloud helps them achieve HIPAA compliance?

Accepted Answer

Google offers HIPAA-eligible services and signs a Business Associate Agreement (BAA), but customers must implement their own technical safeguards and access controls.. Option B is correct because Google Cloud provides HIPAA-eligible services and offers a Business Associate Agreement (BAA) to covered entities, but compliance is a shared responsibility. Customers must configure their own technical safeguards, such as access controls, audit logging, and encryption key management, to meet HIPAA requirements. Google Cloud does not automatically make an application compliant; the customer must implement the necessary controls.

Answer

Storing data in Google Cloud automatically makes an application HIPAA-compliant.

Answer

HIPAA compliance is impossible on public cloud; healthcare data must stay on-premises.

Answer

Google Cloud's automatic data encryption fully satisfies all HIPAA technical safeguard requirements.

Question 5

An organization uses Google Cloud Identity and Access Management (IAM). A new employee is a data engineer who needs to read BigQuery datasets and run queries but should NOT be able to create new datasets, delete tables, or modify IAM policies. Which IAM role should be assigned?

Accepted Answer

`roles/bigquery.dataViewer` (with `roles/bigquery.jobUser` if needed to run queries). Option B is correct because the `roles/bigquery.dataViewer` role grants read access to BigQuery datasets and their contents, while `roles/bigquery.jobUser` allows the user to run query jobs. Together, they satisfy the requirement to read datasets and run queries without permitting dataset creation, table deletion, or IAM policy modification.

Answer

`roles/bigquery.admin`

Answer

`roles/viewer` (project-level Viewer)

Answer

`roles/bigquery.dataEditor`

Question 6

A company wants to ensure that sensitive data (credit card numbers, SSNs) stored in BigQuery is automatically identified and protected. They also want ongoing scanning to detect if any new data violates their data governance policies. Which Google Cloud service provides these capabilities?

Accepted Answer

Cloud Data Loss Prevention (Cloud DLP) with BigQuery inspection jobs.. Cloud DLP with BigQuery inspection jobs is the correct choice because it provides both automated identification of sensitive data (such as credit card numbers and SSNs) within BigQuery tables and ongoing scanning capabilities via scheduled inspection jobs. Cloud DLP uses built-in infoType detectors to match patterns like credit card numbers (Luhn check) and SSNs, and can trigger actions or alerts when new data violates governance policies.

Answer

Security Command Center — it scans BigQuery for sensitive data automatically.

Answer

Cloud Monitoring custom dashboards with SQL queries that search for PII patterns.

Answer

Cloud Audit Logs — they record all BigQuery queries and can identify when sensitive columns are accessed.

Question 7

When data is transmitted between a user's browser and a Google Cloud-hosted web application over HTTPS, which security protection does this provide?

Accepted Answer

It encrypts data in transit between the user's browser and the server, preventing eavesdropping and tampering.. HTTPS (HTTP over TLS) encrypts the communication channel between the user's browser and the web server using Transport Layer Security (TLS). This ensures that any data transmitted, such as login credentials or API requests, is protected from eavesdropping and tampering while in transit. It does not protect data at rest or control access to cloud management interfaces.

Answer

It prevents unauthorized users from accessing the Google Cloud Console.

Answer

It encrypts data stored in the server's database.

Answer

It authenticates the user and verifies their permissions to use the application.

Question 8

A company is evaluating Google Cloud and wants to know: what is Access Transparency, and how does it benefit customers with stringent governance requirements?

Accepted Answer

Access Transparency logs when Google Cloud personnel access customer content, providing an audit trail for governance.. Access Transparency logs are a Google Cloud feature that provides customers with near real-time logs whenever Google personnel access their data. This creates a detailed audit trail, which is essential for customers with stringent governance or compliance requirements, as it allows them to monitor and verify that access is only for authorized purposes.

Answer

Access Transparency shows customers which Google Cloud services are available in their region.

Answer

Access Transparency is a feature that makes all customer data visible to Google for quality improvement.

Answer

Access Transparency provides customers with real-time dashboards of their application's security vulnerabilities.

Question 9

A company stores its data in Google Cloud. The security team asks: can Google employees access our customer data without our knowledge or consent? What does Google's commitment ensure?

Accepted Answer

Google commits that customer data is not accessed without authorization, with access logged via Access Transparency and governed by contractual data processing commitments.. Option B is correct because Google Cloud's Access Transparency feature logs all data access attempts by Google personnel, and contractual data processing commitments under the Cloud Data Processing Addendum (CDPA) prohibit unauthorized access. This ensures that customer data is not accessed without explicit authorization, and any access is logged and auditable, aligning with the security team's concern about knowledge and consent.

Answer

Google employees have unrestricted access to all customer data as part of the infrastructure service agreement.

Answer

Google uses customer data to train its global AI models to improve services.

Answer

Customer data stored in Google Cloud is automatically accessible by government agencies on request.

Question 10

A regulated financial services firm must ensure that its data never leaves a specific geographic region (EU) for compliance with GDPR data residency requirements. Which Google Cloud features help enforce this requirement?

Accepted Answer

Select EU regions for all resources and apply the `gcp.resourceLocations` org policy to restrict resource creation to EU regions only.. Option A is correct because the `gcp.resourceLocations` organization policy constraint explicitly restricts the physical location where Google Cloud resources can be created. By setting this policy to allow only EU regions, the organization ensures that no compute, storage, or database resources can be provisioned outside the EU, directly enforcing GDPR data residency requirements. This policy is evaluated at resource creation time and applies to all projects under the organization, providing a hard enforcement boundary.

Answer

Enable Cloud Armor on all load balancers to block non-EU traffic.

Answer

Use HTTPS for all connections to ensure data is encrypted when it leaves the EU.

Answer

Enable Google Workspace's regional storage settings to restrict where emails are stored.

Question 11

What compliance certification verifies that an organization's Information Security Management System (ISMS) meets internationally recognized standards for managing information security risks?

Accepted Answer

ISO/IEC 27001. ISO/IEC 27001 is the international standard that specifies the requirements for establishing, implementing, maintaining, and continually improving an Information Security Management System (ISMS). It provides a systematic approach to managing sensitive company information, ensuring it remains secure through risk management processes. This certification is recognized globally and is the primary standard for ISMS compliance.

Answer

SOC 2 Type II

Answer

PCI DSS

Answer

FedRAMP

Question 12

A company uses Google Workspace for identity. They want employees to use their Google Workspace credentials to access third-party applications (Salesforce, Slack, etc.) without separate passwords for each app. Which technology enables this?

Accepted Answer

Single Sign-On (SSO) using SAML 2.0 or OIDC with Google Workspace as the Identity Provider.. Option B is correct because Single Sign-On (SSO) using SAML 2.0 or OIDC allows Google Workspace to act as the Identity Provider (IdP), issuing authentication tokens that third-party applications (like Salesforce and Slack) trust. This eliminates the need for separate passwords, as users authenticate once with Google Workspace and the IdP handles subsequent access via security assertions or ID tokens.

Answer

VPN — employees connect to the corporate VPN which provides access to all apps.

Answer

Cloud Armor — blocks unauthorized access attempts to applications.

Answer

Shared service account — all employees use the same credential.

Question 13

A company's security policy requires all employees to verify their identity using more than just a password when accessing Google Cloud resources. What security feature enforces this requirement?

Accepted Answer

Multi-factor authentication (MFA) / Two-step verification (2SV).. Multi-factor authentication (MFA) / Two-step verification (2SV) is the correct answer because it explicitly requires users to provide two or more verification factors (e.g., something you know, something you have, something you are) to access Google Cloud resources. This directly enforces the policy of verifying identity beyond just a password, as MFA/2SV adds an additional layer of security by requiring a second factor such as a time-based one-time password (TOTP) from an authenticator app, a hardware security key (e.g., FIDO2), or a push notification. Google Cloud Identity Platform supports this via security key enforcement and 2SV policies, ensuring that password compromise alone is insufficient for access.

Answer

Password complexity requirements — enforcing long, complex passwords.

Answer

IP allowlisting — only allowing access from office IP addresses.

Answer

Session timeout — automatically logging out users after 30 minutes of inactivity.

Question 14

Google's physical data center security includes multiple layers of protection. Which of the following is NOT a physical security measure Google uses at its data centers?

Accepted Answer

Customers can schedule tours of Google data centers to verify security practices directly.. Option C is correct because Google does not offer public tours of its data centers. Allowing customers to schedule tours would introduce unnecessary security risks and is not part of Google's physical security model. Instead, Google provides transparency through third-party audit reports and certifications (e.g., SOC 2, ISO 27001) to verify security practices.

Answer

Biometric authentication and badge access controls at multiple security perimeters.

Answer

24/7 on-site security personnel who monitor the facility continuously.

Answer

Secure hardware destruction procedures for decommissioned storage devices.

Question 15

A company has a requirement from their security auditor to demonstrate that all administrative actions performed in Google Cloud (such as creating VMs, modifying IAM policies, and deleting storage buckets) are logged and tamper-evident. Which Cloud Logging log type fulfills this requirement?

Accepted Answer

Admin Activity audit logs — always-on, tamper-resistant logs of all administrative API calls.. Admin Activity audit logs are always-on, tamper-resistant logs that record all administrative API calls, such as creating VMs, modifying IAM policies, and deleting storage buckets. They cannot be disabled or modified by users, ensuring tamper-evident logging for security auditor requirements.

Answer

Data Access audit logs — they capture all read and write operations.

Answer

System Event audit logs — they capture all Google Cloud operations.

Answer

Cloud Monitoring logs — they track all changes to monitored resources.