Google PCA Designing for Security and Compliance — 15 Questions

Question 1

A company wants to use its existing Active Directory credentials to authenticate users to the GCP Console. Which service should they integrate with?

Accepted Answer

Cloud Identity with SAML SSO. Cloud Identity (or Google Workspace) can be configured with SAML SSO so that an external identity provider — in this case Active Directory Federation Services or Entra ID — authenticates users and issues SAML assertions to the GCP Console. This lets users sign in with existing AD credentials without duplicating accounts in Google. The integration is established by exchanging metadata between AD FS/Entra ID and Google's SAML SSO configuration.

Answer

Identity-Aware Proxy

Answer

Cloud KMS

Answer

Cloud Directory Sync

Question 2

A company uses Cloud Armor to protect an HTTP(S) Load Balancer. They want to block traffic from a specific IP address range during off-peak hours but allow it during peak hours. How can they achieve this?

Accepted Answer

Use a Cloud Armor security policy rule with a condition on the IP address and a time condition. Cloud Armor security policy rules support CEL-based match conditions, and the condition language includes request.time, which lets you scope a rule to a specific time window (e.g., off-peak hours). By combining an IP-range match (srcIpRanges) with a time condition in a single rule, the policy denies the range only during the configured window and allows it otherwise, satisfying the requirement without external automation.

Answer

Implement a Cloud Function that updates the security policy on a schedule

Answer

Create two separate security policies and switch between them using Cloud Load Balancer URL maps

Answer

Use VPC firewall rules to block the IP range during off-peak hours

Question 3

A company wants to enforce that only approved container images can be deployed to GKE. They also want to ensure images are scanned for vulnerabilities before deployment. Which two GCP services should they use? (Choose TWO).

Accepted Answer

Container Analysis API. Binary Authorization (E) is the GKE-native admission controller that enforces deploy-time policy, allowing only images that meet attestation requirements (e.g., signed by a trusted authority or scanned) to be admitted to the cluster, which directly satisfies the 'only approved images' requirement. Container Analysis API (A) is the underlying service that stores and serves metadata about container images, including vulnerability findings and attestations, and it is what Binary Authorization queries to verify that an image has been scanned and attested before deployment. Together they form the standard GKE supply-chain security pattern: Container Analysis provides the vulnerability/attestation data, and Binary Authorization enforces the policy at admission time. Cloud Security Command Center (B) is a security posture and findings dashboard, not a deploy-time enforcement mechanism, so it cannot block unapproved images. Container Registry vulnerability scanning (C) is a feature that triggers scans and publishes results to Container Analysis, but scanning alone does not enforce that only approved images are deployed. Cloud Build (D) is a CI/CD build service that can run scans or create attestations, but it is not the enforcement or metadata service required here.

Answer

Cloud Security Command Center

Answer

Container Registry vulnerability scanning

Answer

Cloud Build

Question 4

A company needs to store secrets used by multiple GCP services. They require automatic rotation of secrets every 30 days and integration with Cloud Functions. Which two GCP services should they use? (Choose TWO).

Accepted Answer

Cloud Functions. Secret Manager (C) is the correct service for centrally storing and managing secrets, and it natively supports automatic rotation schedules (for example, a 30-day rotation period) plus IAM-based access for multiple GCP services. Cloud Functions (B) is correct because it can be triggered by Secret Manager rotation notifications (via Pub/Sub) to execute the rotation logic, and it can also retrieve secrets at runtime through the Secret Manager API. Cloud Run (A) is a container hosting platform, not a secret store or rotation mechanism, so it does not satisfy the requirement. Cloud KMS (D) manages encryption keys rather than application secrets and does not provide secret rotation for arbitrary credentials. Cloud Scheduler (E) can trigger jobs on a cron schedule but is not a secret store and cannot itself perform secret rotation or integrate as the secret backend.

Answer

Cloud Run

Answer

Cloud KMS

Answer

Cloud Scheduler

Question 5

A company wants to protect a web application from SQL injection and cross-site scripting (XSS) attacks. They also need to block traffic from specific geographic regions. Which three features of Cloud Armor should they use? (Choose THREE).

Accepted Answer

Rate limiting. Google Cloud Armor's WAF rules (B) are the correct feature for defending a web application against SQL injection and XSS, because the preconfigured OWASP ModSecurity Core Rule Set signatures (e.g., sqli-v33-stable and xss-v33-stable) detect and block these Layer 7 payload patterns. Geographic restrictions (C) are correct because Cloud Armor security policies can include geo-based rules that allow or deny traffic by source country/region using the origin's geographic location, which directly satisfies the requirement to block specific regions. Rate limiting (A) is correct because Cloud Armor rate-based rules throttle or ban clients that exceed a configured request threshold per interval, protecting the application from abusive or volumetric request floods that often accompany injection/XSS probing. Cloud CDN (D) is not a Cloud Armor security feature; it is a content delivery service and does not itself filter SQLi/XSS or enforce geo-blocking. Adaptive Protection (E) is a Cloud Armor capability that learns baseline traffic and suggests or auto-deploys rules against Layer 7 DDoS, but it is not the feature used to specifically block SQLi/XSS signatures or geographic regions.

Answer

Cloud CDN

Answer

Adaptive Protection

Question 6

A company needs to ensure that data stored in Cloud Storage is encrypted with customer-managed keys that are rotated every 90 days. Which two steps must be taken to achieve this? (Choose TWO).

Accepted Answer

Create a key ring and a key in Cloud KMS. Option D is correct because before any customer-managed encryption can be applied, you must create a Cloud KMS key ring and a CryptoKey in the same location as the bucket; the key ring is the organizational container and the key is the actual AES-256 key used for envelope encryption. Option E is correct because setting the bucket's default KMS key (via gsutil kms encryption or the defaultKmsKeyName property) makes Cloud Storage automatically encrypt all newly written objects with that CMEK, which is the required mechanism for customer-managed keys on a bucket. Option A is not required by the scenario as stated: rotation is configured on the KMS key, but the question asks for the steps to achieve CMEK encryption, and rotation alone does not apply the key to the bucket; moreover, the two marked answers are the ones that establish and bind the key. Option B is wrong because CSEK (customer-supplied encryption keys) uses keys supplied by the client on each request and are not managed or rotated by Cloud KMS, so it does not meet the customer-managed-key requirement. Option C is a supporting IAM step (granting the Cloud Storage service account roles/cloudkms.cryptoKeyEncrypterDecrypter on the key), but it is not one of the two marked correct answers here.

Answer

Set a rotation period of 90 days on the Cloud KMS key

Answer

Enable CSEK on the bucket

Answer

Grant the Cloud Storage service account access to the Cloud KMS key

Question 7

A company wants to restrict access to their Cloud Storage bucket so that only requests from within a specific VPC network are allowed, and all other traffic (including internet) is denied. They also need to allow access from on-premises through a VPN. Which configuration should they use?

Accepted Answer

Configure the bucket with VPC Service Controls and enable Private Google Access. VPC Service Controls create a security perimeter around Google Cloud services, including Cloud Storage, so that only requests originating from within the specified VPC network (or authorized networks like VPN) are allowed. Enabling Private Google Access ensures that resources in the VPC can reach Google APIs without public IPs, complementing the perimeter. Together, they restrict bucket access to the VPC and on-premises via VPN while denying all other traffic.

Answer

Use IAM conditions to restrict access based on IP address

Answer

Use firewall rules to allow traffic only from the VPC IP range

Answer

Set up Cloud VPN and use Cloud NAT for egress

Question 8

An engineer needs to grant a service account the ability to create and manage VMs in a specific project, but only those VMs with a certain label. Which IAM feature should they use?

Accepted Answer

IAM conditions. IAM conditions allow you to grant a role with a condition that restricts the permission based on resource attributes, such as a resource's label. By using a condition like 'resource.matchLabels("env", "dev")', the service account can create and manage VMs only when the VM has the specified label. This is the correct IAM feature for attribute-based access control at the resource level.

Answer

Primitive roles

Answer

Custom roles

Answer

Service account impersonation

Question 9

A company wants to allow a Kubernetes pod in GKE to access a Cloud Storage bucket using the pod's own identity, without managing long-lived credentials. They have created a Google service account (GSA) and a Kubernetes service account (KSA). What should they do to bind the KSA to the GSA?

Accepted Answer

Add an annotation to the KSA referencing the GSA, and grant the KSA the iam.workloadIdentityUser role on the GSA. Workload Identity allows you to configure a KSA to act as a GSA by adding an annotation to the KSA and granting the GSA the necessary IAM role. The GSA does not impersonate the KSA; the KSA impersonates the GSA. The annotation is set on the KSA, not the pod. The GSA does not need to be bound to the KSA via an IAM role on the KSA.

Answer

Create a service account key and mount it as a secret in the pod

Answer

Grant the GSA the roles/iam.serviceAccountUser role on the project

Answer

Add an annotation to the GSA referencing the KSA, and grant the KSA the iam.workloadIdentityUser role on the GSA

Question 10

A company wants to use Cloud DLP to scan a Cloud Storage bucket for personally identifiable information (PII) and de-identify the data before storing it in another bucket. Which TWO actions should they take? (Choose 2)

Accepted Answer

Use DLP de-identification templates to transform data and write to a target bucket. Option E is correct because the first step in any Cloud DLP workflow is to create an inspection job (or inspection template) that scans the source Cloud Storage bucket to identify PII using built-in infoType detectors. Option A is correct because after inspection, de-identification templates (using transformations such as masking, tokenization, or redaction) are applied to the findings and the transformed output is written to a target bucket, which is exactly the de-identify-before-storing requirement. Option B is incorrect because exporting inspection results to BigQuery is for analytics/reporting, not for de-identifying and relocating data. Option C is incorrect because a Cloud Dataflow streaming pipeline is unnecessary here; Cloud DLP natively supports Cloud Storage scanning and de-identification without Dataflow. Option D is incorrect because while permissions are needed, the Cloud DLP service account requires roles/storage.objectViewer on the source bucket only as a supporting prerequisite, and the question asks for the two primary actions to accomplish the scan-and-de-identify workflow, which are the inspection job and the de-identification template writing to the target bucket.

Answer

Export the inspection results to BigQuery for analysis

Answer

Set up a Cloud Dataflow pipeline to stream data

Answer

Grant the Cloud DLP service account the roles/storage.objectViewer role on the source bucket

Question 11

A company uses Cloud Identity to manage users and wants to allow employees to authenticate to Google Cloud using their existing corporate Active Directory credentials. Which solution should they implement?

Accepted Answer

Cloud Directory Sync. Cloud Directory Sync (CDS) is the correct solution because it synchronizes user identities from an on-premises Active Directory (or LDAP directory) to Cloud Identity or Google Workspace. This allows employees to use their existing corporate AD credentials to authenticate to Google Cloud services. CDS provisions users and groups, and optionally passwords, enabling a single source of truth for identity. It is specifically designed for hybrid identity scenarios where AD is the authoritative directory.

Answer

Workload Identity Federation

Answer

IAM policies

Answer

Identity-Aware Proxy

Question 12

A company wants to use their own HSM to hold encryption keys for Google Cloud services, but they want Google Cloud to perform cryptographic operations without exposing the keys. Which service should they use?

Accepted Answer

Cloud HSM. Cloud HSM is a cloud-hosted HSM that allows customers to manage keys in FIPS 140-2 Level 3 HSMs, with Google performing operations without exposing key material.

Answer

Cloud KMS (software)

Answer

CSEK

Answer

Secret Manager

Question 13

An organization needs to grant a third-party auditor read-only access to view all resources in a project, including sensitive data like IAM policies and logs. Which role should be assigned?

Accepted Answer

Viewer. The Viewer role (roles/viewer) grants read-only access to all resources in a project, including IAM policies and logs, which is exactly what a third-party auditor needs to review sensitive data without modification rights. It is a basic role that provides broad read access across the project, satisfying the 'view all resources' requirement. More granular roles like Security Reviewer or Logs Viewer only cover subsets of the required visibility.

Answer

Security Reviewer

Answer

Logs Viewer

Answer

Monitoring Viewer

Question 14

A security engineer needs to allow a Compute Engine instance with the service account 'sa-prod@project.iam.gserviceaccount.com' to connect to a Cloud SQL instance over a private IP. The VPC has no firewall rules allowing this traffic. What is the MOST secure way to grant access?

Accepted Answer

Add a firewall rule with source service account 'sa-prod@project.iam.gserviceaccount.com' and target service account 'cloud-sql-sa@project.iam.gserviceaccount.com'. The most secure approach is a firewall rule that uses service accounts as both source and target, because service-account-based firewall rules enforce identity rather than network location. This allows only the specific instance running as sa-prod@project.iam.gserviceaccount.com to reach the Cloud SQL instance's service account, following least privilege and avoiding broad tag-based access.

Answer

Grant the IAM role 'cloudsql.client' to the service account 'sa-prod@project.iam.gserviceaccount.com'

Answer

Add a firewall rule with source tag 'prod' and target tag 'cloud-sql'

Answer

Create a VPC peering connection between the Compute Engine VPC and the Cloud SQL VPC

Question 15

A company uses Cloud Key Management Service (Cloud KMS) with a customer-managed encryption key (CMEK) to encrypt data in BigQuery. They want to ensure the key can only be used by the BigQuery service account in the 'us-central1' region. Which IAM condition should be added to the key's IAM policy?

Accepted Answer

resource.name.startsWith('projects/_/locations/us-central1') && request.auth.principalSet == 'serviceAccount:bq-<project-number>@bigquery-encryption.iam.gserviceaccount.com'. The correct IAM condition uses resource.name.startsWith to restrict the key to the us-central1 region and request.auth.principalSet to match the BigQuery encryption service account. The principalSet is used because the service account is a Google-managed service account, and the format includes the project number and the service account email.

Answer

resource.name.startsWith('projects/_/locations/us-central1') && request.auth.principal == 'bigquery@system.gserviceaccount.com'

Answer

resource.name.startsWith('projects/_/locations/global') && request.auth.principal == 'bigquery@system.gserviceaccount.com'

Answer

resource.service == 'bigquery.googleapis.com' && resource.location == 'us-central1'