Google PCA Practice Test 19 — 15 Questions

Question 1

A company deploys a Kubernetes workload in GKE that needs to access Cloud Storage. They want to avoid managing service account keys. What is the recommended approach?

Accepted Answer

Use Workload Identity to map the Kubernetes service account to a GCP service account.. Workload Identity allows you to bind a Kubernetes service account to a GCP service account, so pods can authenticate using the GCP service account without managing keys.

Answer

Use the default Compute Engine service account on the node.

Answer

Store a service account key in a Kubernetes secret and mount it.

Answer

Use Cloud Key Management Service to encrypt the service account key.

Question 2

An organization wants to enforce that all container images deployed to Google Kubernetes Engine (GKE) are signed and approved via an attestation authority. Which GCP service should they use?

Accepted Answer

Binary Authorization. Binary Authorization enforces deployment-time policies that require container images to be signed by trusted authorities. It integrates with GKE and Cloud Build to ensure only signed images are deployed.

Answer

Container Registry

Answer

Cloud Armor

Answer

Cloud Security Scanner

Question 3

A company wants to use Binary Authorization to enforce that only images signed by their internal CI/CD pipeline can be deployed to their GKE clusters. They have set up Cloud Build to sign images. Which THREE steps are required to configure this? (Choose 3)

Accepted Answer

Create an attestation for each container image using Cloud Build. To use Binary Authorization, you need to create an attestor that represents the signing authority, create an attestation (signed metadata) for each image, and create a policy that requires attestations. The policy can be cluster-specific. Granting the attestor the Cloud KMS signer role is needed to sign, but the question asks for steps to configure; storing keys in Cloud KMS is a prerequisite but not listed as a step here.

Answer

Store the signing keys in Cloud HSM

Answer

Grant the GKE service account the roles/container.deployer role

Question 4

An organization wants to enforce that all container images deployed to their Google Kubernetes Engine (GKE) clusters are signed and have passed a vulnerability scan. Which GCP service should they use to enforce this policy?

Accepted Answer

Binary Authorization. Binary Authorization enforces policies that require container images to be signed by trusted authorities and optionally pass vulnerability scans before deployment. Cloud Build can be used to sign images, but the enforcement is done by Binary Authorization. Artifact Registry stores images, and IAM controls access but does not enforce signing policies.

Answer

Cloud Build

Answer

Artifact Registry

Answer

IAM

Question 5

A developer wants to allow a Compute Engine VM to authenticate to Google Cloud APIs without embedding service account keys in the VM image. What is the recommended approach?

Accepted Answer

Attach a service account to the VM instance. Attaching a service account to the Compute Engine VM allows it to automatically obtain credentials via the metadata server, avoiding key management.

Answer

Use Cloud KMS to encrypt a service account key and store it in a bucket

Answer

Use a service account impersonation flow

Answer

Create a service account key and store it in the VM's startup script

Question 6

An organization needs to run workloads that are subject to ITAR (International Traffic in Arms Regulations) in Google Cloud. Which region should they use to ensure compliance with ITAR requirements?

Accepted Answer

us-military-east4. Assured Workloads for Government provides controlled regions that are compliant with ITAR. The us-central1 region is not ITAR-compliant. The us-military regions (e.g., us-military-east4) are part of Assured Workloads for Government and support ITAR.

Answer

europe-west1

Answer

us-central1

Answer

us-east1

Question 7

A company wants to encrypt data at rest in Cloud Storage using their own keys stored on-premises. They need to rotate the key every 30 days. Which encryption option should they use?

Accepted Answer

Customer-Supplied Encryption Keys (CSEK). Customer-Supplied Encryption Keys (CSEK) allow users to provide their own keys for encrypting Cloud Storage objects. The keys are managed on-premises and can be rotated as needed.

Answer

Default encryption with Google-managed keys

Answer

Customer-Managed Encryption Keys (CMEK) with Cloud KMS

Answer

Cloud HSM

Question 8

Which GCP service can be used to detect and redact sensitive data such as credit card numbers in text files stored in Cloud Storage?

Accepted Answer

Cloud Data Loss Prevention (DLP). Cloud DLP provides built-in detectors for many sensitive data types and can redact or tokenize them.

Answer

Security Command Center

Answer

Cloud Key Management Service

Answer

Cloud Audit Logs

Question 9

A company needs to encrypt data at rest in Cloud Storage using their own keys. They require that the keys are stored in a hardware security module (HSM) that is FIPS 140-2 Level 3 certified. Which key management option should they choose?

Accepted Answer

Customer-Managed Encryption Keys (CMEK) with Cloud HSM. Cloud HSM is a FIPS 140-2 Level 3 certified HSM service that allows you to manage your own encryption keys for CMEK. CSEK requires you to supply keys yourself, but they are not stored in an HSM. Cloud KMS without HSM is only Level 1. Google-managed keys do not use customer keys.

Answer

Google-managed encryption keys

Answer

Customer-Supplied Encryption Keys (CSEK)

Answer

Customer-Managed Encryption Keys (CMEK) with Cloud KMS

Question 10

An organization wants to implement a zero-trust architecture for a web application running on Compute Engine. They require: - All traffic must be authenticated and authorized at the application layer. - Access decisions must consider the user's identity, device security posture, and IP address. - Session hijacking must be mitigated. Which THREE services or features should they use? (Choose three.)

Accepted Answer

IAP's signed headers (X-Goog-Authenticated-User-Email). IAP provides identity-aware access, Cloud Armor can enforce context-based access, and IAP signed headers prevent session hijacking.

Answer

Cloud Armor with adaptive protection

Answer

VPC Service Controls

Question 11

An organization needs to grant a third-party auditor read-only access to view all resources in a project, including sensitive data like IAM policies and logs. Which role should be assigned?

Accepted Answer

Viewer. The Viewer primitive role provides read-only access to all resources in a project, including IAM policies and logs.

Answer

Security Reviewer

Answer

Logs Viewer

Answer

Monitoring Viewer

Question 12

A company needs to ensure that data stored in Cloud Storage is encrypted with customer-managed keys that are rotated every 90 days. Which two steps must be taken to achieve this? (Choose TWO).

Accepted Answer

Create a key ring and a key in Cloud KMS. A CMEK key must be created in Cloud KMS, and the Cloud Storage bucket must be configured to use that CMEK key.

Answer

Set a rotation period of 90 days on the Cloud KMS key

Answer

Enable CSEK on the bucket

Answer

Grant the Cloud Storage service account access to the Cloud KMS key

Question 13

A company wants to deploy a web application behind an HTTPS Load Balancer and only allow authenticated users from their corporate Active Directory. Which two services should they use together? (Choose two.)

Accepted Answer

Identity-Aware Proxy (IAP). Identity-Aware Proxy (IAP) provides authentication and authorization for applications. Cloud Identity (or Cloud Directory Sync) integrates with Active Directory to provide user identities.

Answer

VPC Service Controls

Answer

Cloud NAT

Answer

Cloud Armor

Question 14

A company wants to use Cloud DLP to scan a Cloud Storage bucket for personally identifiable information (PII) and de-identify the data before storing it in another bucket. Which TWO actions should they take? (Choose 2)

Accepted Answer

Use DLP de-identification templates to transform data and write to a target bucket. Cloud DLP can inspect the data and de-identify it using techniques like masking. The output is typically stored in a different bucket. Exporting to BigQuery is optional and not required for de-identification. IAM roles for DLP are needed to create jobs.

Answer

Export the inspection results to BigQuery for analysis

Answer

Set up a Cloud Dataflow pipeline to stream data

Answer

Grant the Cloud DLP service account the roles/storage.objectViewer role on the source bucket

Question 15

A company wants to centrally manage firewall rules for all projects in an organization using hierarchical firewall policies. Which three resources can be used in conjunction with hierarchical firewall policies? (Choose three.)

Accepted Answer

Organization node. Hierarchical firewall policies can be applied to the organization, folders, and projects. They cannot be applied to VPC networks or individual resources directly.

Answer

Compute Engine instance

Answer

VPC network