Google PCA Designing for Security and Compliance — 50 Questions

Question 1

A company wants to restrict network access to Cloud SQL instances such that only applications running in a specific VPC can connect. Which GCP feature should they use?

Accepted Answer

Private Service Access. Private Service Access (PSA) is the GCP feature that allows private connectivity from a VPC network to Google-managed services like Cloud SQL. It uses VPC peering with the Google-managed service's VPC to enable private IP communication. Private Service Connect, on the other hand, is used for publishing services to consumers, not for consuming services like Cloud SQL.

Answer

Private Service Connect

Answer

VPC peering

Answer

Private Services Access

Question 2

A company is using Cloud SQL for MySQL and wants to encrypt data at rest with a key that they manage and rotate. They also want to avoid any additional cost for the encryption feature. What should they do?

Accepted Answer

Use Google-managed encryption keys (default).. The company wants to avoid any additional cost for encryption. Google-managed encryption keys (default) are provided at no extra cost. Although they do not allow customer management and rotation, this is the only option that meets the cost requirement. Customer-Managed Encryption Keys (CMEK) incur charges for Cloud KMS usage, and Customer-Supplied Encryption Keys (CSEK) are deprecated and also add complexity. Cloud HSM adds significant cost.

Answer

Use Customer-Supplied Encryption Keys (CSEK).

Answer

Use Cloud HSM to manage the keys.

Answer

Enable Customer-Managed Encryption Keys (CMEK) with Cloud KMS.

Question 3

An organization needs to comply with FedRAMP High requirements and wants to run workloads in a GCP region that supports these controls. They also need to restrict data movement to only approved services. Which GCP feature should they use?

Accepted Answer

Assured Workloads [CORRECT]. Assured Workloads (option B) is the correct choice because it provides compliance controls for FedRAMP High and other regulatory frameworks, enabling the creation of a folder with specific compliance requirements. VPC Service Controls (option D) can be used to restrict data movement, but the primary feature for meeting FedRAMP High is Assured Workloads. Cloud HSM (A) provides hardware security module services for key management, not compliance frameworks. Data Access Audit Logging (C) provides logging but doesn't enforce compliance or restrict data movement.

Answer

Cloud HSM [wrong]

Answer

Data Access Audit Logging [wrong]

Answer

VPC Service Controls [wrong]

Question 4

A company wants to control which resources can be accessed by a service account in a specific project. Which IAM policy binding approach should be used?

Accepted Answer

Grant the service account a role at the project or resource level. IAM roles are bound to members (including service accounts) at the resource, project, folder, or organization level. The correct approach is to grant the service account an IAM role at the project or resource level.

Answer

Use VPC Service Controls to restrict the service account

Answer

Add the service account to a Cloud Identity group and grant the group a role

Answer

Grant the service account a role at the organization level

Question 5

An organization requires that all container images deployed to GKE be signed and verified before deployment. Which GCP service should be used?

Accepted Answer

Binary Authorization. Binary Authorization enforces deployment policies that require images to be signed by trusted authorities (e.g., using Cloud KMS) and verified before being deployed to GKE.

Answer

Container Registry vulnerability scanning

Answer

Cloud Build

Answer

Artifact Registry

Question 6

A security team wants to prevent data exfiltration from a GKE cluster to external storage. They need to restrict access to Cloud Storage buckets from the cluster without using private IPs. Which solution should they implement?

Accepted Answer

Implement VPC Service Controls with a service perimeter. VPC Service Controls use service perimeters to protect resources and prevent data exfiltration from authorized networks, including GKE clusters, to external resources.

Answer

Configure firewall rules to block outbound traffic to Cloud Storage

Answer

Enable Cloud Armor on the GKE cluster

Answer

Use Private Google Access for on-premises access

Question 7

A company uses Cloud KMS with CMEK to encrypt data stored in BigQuery. They need to audit who has used the encryption key and when. Which type of audit log should they enable?

Accepted Answer

Data Access audit logs. Cloud KMS operations (e.g., encrypt, decrypt) are recorded in Data Access audit logs. Admin Activity logs record configuration changes, not data access.

Answer

Network Security audit logs

Answer

Admin Activity audit logs

Answer

System Event audit logs

Question 8

An engineer needs to grant a user the ability to create and manage service accounts in a project. Which predefined IAM role provides these permissions?

Accepted Answer

roles/iam.serviceAccountAdmin. The roles/iam.serviceAccountAdmin role includes permissions to create, delete, and manage service accounts.

Answer

roles/owner

Answer

roles/editor

Answer

roles/iam.workloadIdentityUser

Question 9

A company wants to enforce that all API calls to GCP services from outside their corporate network come through a specific Cloud VPN tunnel. Which GCP service can enforce this policy?

Accepted Answer

VPC Service Controls. VPC Service Controls with access levels can restrict access based on IP address ranges, including the VPN tunnel's egress IP.

Answer

Cloud NAT

Answer

Identity-Aware Proxy

Answer

Cloud Armor

Question 10

An organization needs to store secrets used by multiple GCP services. They require automatic rotation of secrets every 30 days and integration with Cloud Functions. Which service should they use?

Accepted Answer

Secret Manager. Secret Manager supports automatic rotation (via rotation period and next rotation time) and integrates with Cloud Functions via the API client libraries.

Answer

Cloud HSM

Answer

Cloud KMS

Answer

Cloud Asset Inventory

Question 11

A company wants to use its existing Active Directory credentials to authenticate users to the GCP Console. Which service should they integrate with?

Accepted Answer

Cloud Identity with SAML SSO. Cloud Identity can federate with Active Directory via SAML or OIDC, allowing users to sign in with their AD credentials.

Answer

Identity-Aware Proxy

Answer

Cloud KMS

Answer

Cloud Directory Sync

Question 12

Which GCP service can be used to detect and redact sensitive data such as credit card numbers in text files stored in Cloud Storage?

Accepted Answer

Cloud Data Loss Prevention (DLP). Cloud DLP provides built-in detectors for many sensitive data types and can redact or tokenize them.

Answer

Security Command Center

Answer

Cloud Key Management Service

Answer

Cloud Audit Logs

Question 13

A company needs to ensure that only approved container images can be deployed to a GKE cluster. They already use Binary Authorization. What additional step is required to enforce this policy?

Accepted Answer

Create an attestor and attach it to a Binary Authorization policy. Binary Authorization requires an attestor that verifies image signatures. The attestor must be created and attached to a policy that requires at least one attestation.

Answer

Configure a VPC Service Perimeter

Answer

Enable Container Registry vulnerability scanning

Answer

Assign the container.deployer role to the GKE service account

Question 14

An organization needs to encrypt data at rest in BigQuery using keys that are rotated every 90 days. They want to manage the keys themselves but cannot store keys on-premises. Which encryption approach should they use?

Accepted Answer

Customer-Managed Encryption Keys (CMEK) with Cloud KMS. CMEK with Cloud KMS allows customers to manage their own keys (including rotation) while keys are stored in Google's Cloud KMS.

Answer

Default Google-managed encryption

Answer

Cloud HSM

Answer

Customer-Supplied Encryption Keys (CSEK)

Question 15

A developer wants to allow a Compute Engine VM to authenticate to Google Cloud APIs without embedding service account keys in the VM image. What is the recommended approach?

Accepted Answer

Attach a service account to the VM instance. Attaching a service account to the Compute Engine VM allows it to automatically obtain credentials via the metadata server, avoiding key management.

Answer

Use Cloud KMS to encrypt a service account key and store it in a bucket

Answer

Use a service account impersonation flow

Answer

Create a service account key and store it in the VM's startup script

Question 16

A company uses Cloud Armor to protect an HTTP(S) Load Balancer. They want to block traffic from a specific IP address range during off-peak hours but allow it during peak hours. How can they achieve this?

Accepted Answer

Use a Cloud Armor security policy rule with a condition on the IP address and a time condition. Cloud Armor security policies can use rules with conditions based on IP addresses and can also have time-based conditions (e.g., via headers or custom conditions). However, natively, Cloud Armor does not support scheduled rules. An alternative is to use a Cloud Function to modify the security policy based on time. But the simplest approach is to configure a rule with a condition that evaluates the request time using the `request.time` attribute if supported; else, use a Cloud Function to update rules. Given the options, the closest is using a rule that includes a time condition via `request.time` but that is not a standard feature. Actually, Cloud Armor rules can use expressions including `request.time` to match time windows. So the correct answer is a rule with a time condition.

Answer

Implement a Cloud Function that updates the security policy on a schedule

Answer

Create two separate security policies and switch between them using Cloud Load Balancer URL maps

Answer

Use VPC firewall rules to block the IP range during off-peak hours

Question 17

A company needs to ensure that only applications running in a specific GKE namespace can access a Cloud Storage bucket. Which approach should they use?

Accepted Answer

Use Workload Identity to bind the Kubernetes service account to a GCP service account with appropriate IAM roles. Workload Identity allows binding a Kubernetes service account to a GCP service account. Then, IAM can be granted to that GCP service account for the Cloud Storage bucket.

Answer

Use VPC Service Controls to restrict the bucket to only the GKE cluster's VPC

Answer

Use firewall rules to allow traffic only from the GKE cluster's pod CIDR

Answer

Use Cloud Armor to restrict access based on source IP

Question 18

A company wants to enforce that only approved container images can be deployed to GKE. They also want to ensure images are scanned for vulnerabilities before deployment. Which two GCP services should they use? (Choose TWO).

Accepted Answer

Container Analysis API. Binary Authorization enforces deployment policies based on image signatures. Container Analysis (or vulnerability scanning) identifies vulnerabilities in images.

Answer

Cloud Security Command Center

Answer

Container Registry vulnerability scanning

Answer

Cloud Build

Question 19

A company needs to store secrets used by multiple GCP services. They require automatic rotation of secrets every 30 days and integration with Cloud Functions. Which two GCP services should they use? (Choose TWO).

Accepted Answer

Cloud Functions. Secret Manager stores secrets and supports rotation. Cloud Functions can access secrets via the Secret Manager API or by mounting them as volumes.

Answer

Cloud Run

Answer

Cloud KMS

Answer

Cloud Scheduler

Question 20

Which two GCP audit log types are available by default? (Choose TWO).

Accepted Answer

Admin Activity audit logs. Admin Activity and System Event audit logs are enabled by default. Data Access logs must be explicitly enabled.

Answer

Cloud Audit Logs

Answer

Policy Denied audit logs

Answer

Data Access audit logs