Google PCA Designing for Security and Compliance — 15 Questions

Question 1

A company wants to control which resources can be accessed by a service account in a specific project. Which IAM policy binding approach should be used?

Accepted Answer

Grant the service account a role at the project or resource level. IAM roles are bound to members (including service accounts) at the resource, project, folder, or organization level. The correct approach is to grant the service account an IAM role at the project or resource level.

Answer

Use VPC Service Controls to restrict the service account

Answer

Add the service account to a Cloud Identity group and grant the group a role

Answer

Grant the service account a role at the organization level

Question 2

An organization requires that all container images deployed to GKE be signed and verified before deployment. Which GCP service should be used?

Accepted Answer

Binary Authorization. Binary Authorization enforces deployment policies that require images to be signed by trusted authorities (e.g., using Cloud KMS) and verified before being deployed to GKE.

Answer

Container Registry vulnerability scanning

Answer

Cloud Build

Answer

Artifact Registry

Question 3

A security team wants to prevent data exfiltration from a GKE cluster to external storage. They need to restrict access to Cloud Storage buckets from the cluster without using private IPs. Which solution should they implement?

Accepted Answer

Implement VPC Service Controls with a service perimeter. VPC Service Controls use service perimeters to protect resources and prevent data exfiltration from authorized networks, including GKE clusters, to external resources.

Answer

Configure firewall rules to block outbound traffic to Cloud Storage

Answer

Enable Cloud Armor on the GKE cluster

Answer

Use Private Google Access for on-premises access

Question 4

A company uses Cloud KMS with CMEK to encrypt data stored in BigQuery. They need to audit who has used the encryption key and when. Which type of audit log should they enable?

Accepted Answer

Data Access audit logs. Cloud KMS operations (e.g., encrypt, decrypt) are recorded in Data Access audit logs. Admin Activity logs record configuration changes, not data access.

Answer

Network Security audit logs

Answer

Admin Activity audit logs

Answer

System Event audit logs

Question 5

An engineer needs to grant a user the ability to create and manage service accounts in a project. Which predefined IAM role provides these permissions?

Accepted Answer

roles/iam.serviceAccountAdmin. The roles/iam.serviceAccountAdmin role includes permissions to create, delete, and manage service accounts.

Answer

roles/owner

Answer

roles/editor

Answer

roles/iam.workloadIdentityUser

Question 6

A company wants to enforce that all API calls to GCP services from outside their corporate network come through a specific Cloud VPN tunnel. Which GCP service can enforce this policy?

Accepted Answer

VPC Service Controls. VPC Service Controls with access levels can restrict access based on IP address ranges, including the VPN tunnel's egress IP.

Answer

Cloud NAT

Answer

Identity-Aware Proxy

Answer

Cloud Armor

Question 7

An organization needs to store secrets used by multiple GCP services. They require automatic rotation of secrets every 30 days and integration with Cloud Functions. Which service should they use?

Accepted Answer

Secret Manager. Secret Manager supports automatic rotation (via rotation period and next rotation time) and integrates with Cloud Functions via the API client libraries.

Answer

Cloud HSM

Answer

Cloud KMS

Answer

Cloud Asset Inventory

Question 8

A company wants to use its existing Active Directory credentials to authenticate users to the GCP Console. Which service should they integrate with?

Accepted Answer

Cloud Identity with SAML SSO. Cloud Identity can federate with Active Directory via SAML or OIDC, allowing users to sign in with their AD credentials.

Answer

Identity-Aware Proxy

Answer

Cloud KMS

Answer

Cloud Directory Sync

Question 9

Which GCP service can be used to detect and redact sensitive data such as credit card numbers in text files stored in Cloud Storage?

Accepted Answer

Cloud Data Loss Prevention (DLP). Cloud DLP provides built-in detectors for many sensitive data types and can redact or tokenize them.

Answer

Security Command Center

Answer

Cloud Key Management Service

Answer

Cloud Audit Logs

Question 10

A company needs to ensure that only approved container images can be deployed to a GKE cluster. They already use Binary Authorization. What additional step is required to enforce this policy?

Accepted Answer

Create an attestor and attach it to a Binary Authorization policy. Binary Authorization requires an attestor that verifies image signatures. The attestor must be created and attached to a policy that requires at least one attestation.

Answer

Configure a VPC Service Perimeter

Answer

Enable Container Registry vulnerability scanning

Answer

Assign the container.deployer role to the GKE service account

Question 11

An organization needs to encrypt data at rest in BigQuery using keys that are rotated every 90 days. They want to manage the keys themselves but cannot store keys on-premises. Which encryption approach should they use?

Accepted Answer

Customer-Managed Encryption Keys (CMEK) with Cloud KMS. CMEK with Cloud KMS allows customers to manage their own keys (including rotation) while keys are stored in Google's Cloud KMS.

Answer

Default Google-managed encryption

Answer

Cloud HSM

Answer

Customer-Supplied Encryption Keys (CSEK)

Question 12

A developer wants to allow a Compute Engine VM to authenticate to Google Cloud APIs without embedding service account keys in the VM image. What is the recommended approach?

Accepted Answer

Attach a service account to the VM instance. Attaching a service account to the Compute Engine VM allows it to automatically obtain credentials via the metadata server, avoiding key management.

Answer

Use Cloud KMS to encrypt a service account key and store it in a bucket

Answer

Use a service account impersonation flow

Answer

Create a service account key and store it in the VM's startup script

Question 13

A company wants to restrict network access to Cloud SQL instances such that only applications running in a specific VPC can connect. Which GCP feature should they use?

Accepted Answer

Private Service Access. Private Service Access (PSA) is the GCP feature that allows private connectivity from a VPC network to Google-managed services like Cloud SQL. It uses VPC peering with the Google-managed service's VPC to enable private IP communication. Private Service Connect, on the other hand, is used for publishing services to consumers, not for consuming services like Cloud SQL.

Answer

Private Service Connect

Answer

VPC peering

Answer

Private Services Access

Question 14

A company uses Cloud Armor to protect an HTTP(S) Load Balancer. They want to block traffic from a specific IP address range during off-peak hours but allow it during peak hours. How can they achieve this?

Accepted Answer

Use a Cloud Armor security policy rule with a condition on the IP address and a time condition. Cloud Armor security policies can use rules with conditions based on IP addresses and can also have time-based conditions (e.g., via headers or custom conditions). However, natively, Cloud Armor does not support scheduled rules. An alternative is to use a Cloud Function to modify the security policy based on time. But the simplest approach is to configure a rule with a condition that evaluates the request time using the `request.time` attribute if supported; else, use a Cloud Function to update rules. Given the options, the closest is using a rule that includes a time condition via `request.time` but that is not a standard feature. Actually, Cloud Armor rules can use expressions including `request.time` to match time windows. So the correct answer is a rule with a time condition.

Answer

Implement a Cloud Function that updates the security policy on a schedule

Answer

Create two separate security policies and switch between them using Cloud Load Balancer URL maps

Answer

Use VPC firewall rules to block the IP range during off-peak hours

Question 15

A company needs to ensure that only applications running in a specific GKE namespace can access a Cloud Storage bucket. Which approach should they use?

Accepted Answer

Use Workload Identity to bind the Kubernetes service account to a GCP service account with appropriate IAM roles. Workload Identity allows binding a Kubernetes service account to a GCP service account. Then, IAM can be granted to that GCP service account for the Cloud Storage bucket.

Answer

Use VPC Service Controls to restrict the bucket to only the GKE cluster's VPC

Answer

Use firewall rules to allow traffic only from the GKE cluster's pod CIDR

Answer

Use Cloud Armor to restrict access based on source IP