Google PCA Designing for Security and Compliance — 10 Questions

Question 1

A company wants to control which resources can be accessed by a service account in a specific project. Which IAM policy binding approach should be used?

Accepted Answer

Grant the service account a role at the project or resource level. IAM roles are bound to members (including service accounts) at the resource, project, folder, or organization level. The correct approach is to grant the service account an IAM role at the project or resource level.

Answer

Use VPC Service Controls to restrict the service account

Answer

Add the service account to a Cloud Identity group and grant the group a role

Answer

Grant the service account a role at the organization level

Question 2

An organization requires that all container images deployed to GKE be signed and verified before deployment. Which GCP service should be used?

Accepted Answer

Binary Authorization. Binary Authorization enforces deployment policies that require images to be signed by trusted authorities (e.g., using Cloud KMS) and verified before being deployed to GKE.

Answer

Container Registry vulnerability scanning

Answer

Cloud Build

Answer

Artifact Registry

Question 3

A security team wants to prevent data exfiltration from a GKE cluster to external storage. They need to restrict access to Cloud Storage buckets from the cluster without using private IPs. Which solution should they implement?

Accepted Answer

Implement VPC Service Controls with a service perimeter. VPC Service Controls use service perimeters to protect resources and prevent data exfiltration from authorized networks, including GKE clusters, to external resources.

Answer

Configure firewall rules to block outbound traffic to Cloud Storage

Answer

Enable Cloud Armor on the GKE cluster

Answer

Use Private Google Access for on-premises access

Question 4

A company uses Cloud KMS with CMEK to encrypt data stored in BigQuery. They need to audit who has used the encryption key and when. Which type of audit log should they enable?

Accepted Answer

Data Access audit logs. Cloud KMS operations (e.g., encrypt, decrypt) are recorded in Data Access audit logs. Admin Activity logs record configuration changes, not data access.

Answer

Network Security audit logs

Answer

Admin Activity audit logs

Answer

System Event audit logs

Question 5

An engineer needs to grant a user the ability to create and manage service accounts in a project. Which predefined IAM role provides these permissions?

Accepted Answer

roles/iam.serviceAccountAdmin. The roles/iam.serviceAccountAdmin role includes permissions to create, delete, and manage service accounts.

Answer

roles/owner

Answer

roles/editor

Answer

roles/iam.workloadIdentityUser

Question 6

A company wants to enforce that all API calls to GCP services from outside their corporate network come through a specific Cloud VPN tunnel. Which GCP service can enforce this policy?

Accepted Answer

VPC Service Controls. VPC Service Controls with access levels can restrict access based on IP address ranges, including the VPN tunnel's egress IP.

Answer

Cloud NAT

Answer

Identity-Aware Proxy

Answer

Cloud Armor

Question 7

An organization needs to store secrets used by multiple GCP services. They require automatic rotation of secrets every 30 days and integration with Cloud Functions. Which service should they use?

Accepted Answer

Secret Manager. Secret Manager supports automatic rotation (via rotation period and next rotation time) and integrates with Cloud Functions via the API client libraries.

Answer

Cloud HSM

Answer

Cloud KMS

Answer

Cloud Asset Inventory

Question 8

A company wants to use its existing Active Directory credentials to authenticate users to the GCP Console. Which service should they integrate with?

Accepted Answer

Cloud Identity with SAML SSO. Cloud Identity can federate with Active Directory via SAML or OIDC, allowing users to sign in with their AD credentials.

Answer

Identity-Aware Proxy

Answer

Cloud KMS

Answer

Cloud Directory Sync

Question 9

Which GCP service can be used to detect and redact sensitive data such as credit card numbers in text files stored in Cloud Storage?

Accepted Answer

Cloud Data Loss Prevention (DLP). Cloud DLP provides built-in detectors for many sensitive data types and can redact or tokenize them.

Answer

Security Command Center

Answer

Cloud Key Management Service

Answer

Cloud Audit Logs

Question 10

A company needs to ensure that only approved container images can be deployed to a GKE cluster. They already use Binary Authorization. What additional step is required to enforce this policy?

Accepted Answer

Create an attestor and attach it to a Binary Authorization policy. Binary Authorization requires an attestor that verifies image signatures. The attestor must be created and attached to a policy that requires at least one attestation.

Answer

Configure a VPC Service Perimeter

Answer

Enable Container Registry vulnerability scanning

Answer

Assign the container.deployer role to the GKE service account