Google PCA Designing for Security and Compliance Practice Test 2 — 15 Questions

Question 1

A company uses Cloud Armor to protect an HTTP(S) Load Balancer. They want to block traffic from a specific IP address range during off-peak hours but allow it during peak hours. How can they achieve this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use a Cloud Armor security policy rule with a condition on the IP address and a time condition. Cloud Armor security policies can use rules with conditions based on IP addresses and can also have time-based conditions (e.g., via headers or custom conditions). However, natively, Cloud Armor does not support scheduled rules. An alternative is to use a Cloud Function to modify the security policy based on time. But the simplest approach is to configure a rule with a condition that evaluates the request time using the `request.time` attribute if supported; else, use a Cloud Function to update rules. Given the options, the closest is using a rule that includes a time condition via `request.time` but that is not a standard feature. Actually, Cloud Armor rules can use expressions including `request.time` to match time windows. So the correct answer is a rule with a time condition.

Answer

Implement a Cloud Function that updates the security policy on a schedule

Answer

Create two separate security policies and switch between them using Cloud Load Balancer URL maps

Answer

Use VPC firewall rules to block the IP range during off-peak hours

Question 2

A company needs to ensure that only applications running in a specific GKE namespace can access a Cloud Storage bucket. Which approach should they use?

Accepted Answer

Use Workload Identity to bind the Kubernetes service account to a GCP service account with appropriate IAM roles. Workload Identity allows binding a Kubernetes service account to a GCP service account. Then, IAM can be granted to that GCP service account for the Cloud Storage bucket.

Answer

Use VPC Service Controls to restrict the bucket to only the GKE cluster's VPC

Answer

Use firewall rules to allow traffic only from the GKE cluster's pod CIDR

Answer

Use Cloud Armor to restrict access based on source IP

Question 3

A company wants to enforce that only approved container images can be deployed to GKE. They also want to ensure images are scanned for vulnerabilities before deployment. Which two GCP services should they use? (Choose TWO).

Accepted Answer

Container Analysis API. Binary Authorization enforces deployment policies based on image signatures. Container Analysis (or vulnerability scanning) identifies vulnerabilities in images.

Answer

Cloud Security Command Center

Answer

Container Registry vulnerability scanning

Answer

Cloud Build

Question 4

A company needs to store secrets used by multiple GCP services. They require automatic rotation of secrets every 30 days and integration with Cloud Functions. Which two GCP services should they use? (Choose TWO).

Accepted Answer

Cloud Functions. Secret Manager stores secrets and supports rotation. Cloud Functions can access secrets via the Secret Manager API or by mounting them as volumes.

Answer

Cloud Run

Answer

Cloud KMS

Answer

Cloud Scheduler

Question 5

Which two GCP audit log types are available by default? (Choose TWO).

Accepted Answer

Admin Activity audit logs. Admin Activity and System Event audit logs are enabled by default. Data Access logs must be explicitly enabled.

Answer

Cloud Audit Logs

Answer

Policy Denied audit logs

Answer

Data Access audit logs

Question 6

A company wants to protect a web application from SQL injection and cross-site scripting (XSS) attacks. They also need to block traffic from specific geographic regions. Which three features of Cloud Armor should they use? (Choose THREE).

Accepted Answer

Rate limiting. WAF rules (preconfigured rules for SQLi, XSS), rate limiting (optional), and geographic restrictions (geo-based access control) are all features of Cloud Armor.

Answer

Cloud CDN

Answer

Adaptive Protection

Question 7

A company needs to ensure that data stored in Cloud Storage is encrypted with customer-managed keys that are rotated every 90 days. Which two steps must be taken to achieve this? (Choose TWO).

Accepted Answer

Create a key ring and a key in Cloud KMS. A CMEK key must be created in Cloud KMS, and the Cloud Storage bucket must be configured to use that CMEK key.

Answer

Set a rotation period of 90 days on the Cloud KMS key

Answer

Enable CSEK on the bucket

Answer

Grant the Cloud Storage service account access to the Cloud KMS key

Question 8

An organization wants to enforce that all container images deployed to their Google Kubernetes Engine (GKE) clusters are signed and have passed a vulnerability scan. Which GCP service should they use to enforce this policy?

Accepted Answer

Binary Authorization. Binary Authorization enforces policies that require container images to be signed by trusted authorities and optionally pass vulnerability scans before deployment. Cloud Build can be used to sign images, but the enforcement is done by Binary Authorization. Artifact Registry stores images, and IAM controls access but does not enforce signing policies.

Answer

Cloud Build

Answer

Artifact Registry

Answer

IAM

Question 9

A company wants to restrict access to their Cloud Storage bucket so that only requests from within a specific VPC network are allowed, and all other traffic (including internet) is denied. They also need to allow access from on-premises through a VPN. Which configuration should they use?

Accepted Answer

Configure the bucket with VPC Service Controls and enable Private Google Access. VPC Service Controls create a service perimeter around the bucket, and private Google Access allows resources in the VPC to use the bucket's private IP addresses. The on-premises network can connect via VPN using VPC Private Google Access. Public access is blocked by the perimeter. Firewall rules alone cannot block internet traffic to a public bucket.

Answer

Use IAM conditions to restrict access based on IP address

Answer

Use firewall rules to allow traffic only from the VPC IP range

Answer

Set up Cloud VPN and use Cloud NAT for egress

Question 10

A financial services company must store customer data in a GCP region that is certified for FedRAMP High. They also need to ensure that only authorized personnel can access the data, and that access logs are kept for 10 years. Which combination of services meets these requirements?

Accepted Answer

Assured Workloads with Cloud Audit Logs and IAM. Assured Workloads provides a FedRAMP High environment with specific regions. Cloud Audit Logs can be configured for extended retention. IAM controls access. CMEK is not required for compliance in this case. DLP is for data classification, not access control.

Answer

Cloud HSM and Cloud Audit Logs

Answer

VPC Service Controls with Cloud DLP

Answer

Cloud KMS with CMEK and Cloud Audit Logs

Question 11

An engineer needs to grant a service account the ability to create and manage VMs in a specific project, but only those VMs with a certain label. Which IAM feature should they use?

Accepted Answer

IAM conditions. IAM conditions allow you to grant conditional access based on resource attributes such as labels, name, or creation time. Custom roles are a collection of permissions but do not enforce conditions. Service account impersonation is used to act as another service account. Primitive roles are broad and do not support conditions.

Answer

Primitive roles

Answer

Custom roles

Answer

Service account impersonation

Question 12

A company wants to use their existing Active Directory for authentication to Google Cloud. They need to sync user and group identities to Cloud Identity and allow users to log in with their corporate credentials. Which two services should they use together?

Accepted Answer

Cloud Directory Sync and SAML SSO. Cloud Directory Sync (CDS) syncs users and groups from LDAP/AD to Cloud Identity. SAML SSO allows users to authenticate using their corporate credentials. IAP is for application access, not directory sync. Cloud Identity as a standalone does not sync automatically. Workload Identity is for Kubernetes.

Answer

Cloud Directory Sync and Workload Identity

Answer

SAML SSO and IAP

Answer

Cloud Identity and IAP

Question 13

A developer needs to securely store a database password that will be used by a Compute Engine instance. The password must be rotated automatically every 30 days. Which service should they use?

Accepted Answer

Secret Manager. Secret Manager is designed for storing secrets like API keys and passwords, and it supports automatic rotation schedules. Cloud KMS is for encryption keys, not generic secrets. Cloud Storage can store encrypted data but does not natively support rotation. Environment variables are insecure and not managed.

Answer

Cloud KMS

Answer

Cloud Storage with encryption

Answer

Environment variables

Question 14

A company wants to allow a Kubernetes pod in GKE to access a Cloud Storage bucket using the pod's own identity, without managing long-lived credentials. They have created a Google service account (GSA) and a Kubernetes service account (KSA). What should they do to bind the KSA to the GSA?

Accepted Answer

Add an annotation to the KSA referencing the GSA, and grant the KSA the iam.workloadIdentityUser role on the GSA. Workload Identity allows you to configure a KSA to act as a GSA by adding an annotation to the KSA and granting the GSA the necessary IAM role. The GSA does not impersonate the KSA; the KSA impersonates the GSA. The annotation is set on the KSA, not the pod. The GSA does not need to be bound to the KSA via an IAM role on the KSA.

Answer

Create a service account key and mount it as a secret in the pod

Answer

Grant the GSA the roles/iam.serviceAccountUser role on the project

Answer

Add an annotation to the GSA referencing the KSA, and grant the KSA the iam.workloadIdentityUser role on the GSA

Question 15

A company wants to protect their web application hosted on Google Cloud HTTP(S) Load Balancer from common web attacks like SQL injection and cross-site scripting (XSS). Which GCP service should they use?

Accepted Answer

Cloud Armor. Cloud Armor provides WAF (Web Application Firewall) capabilities including preconfigured rules to block OWASP Top 10 attacks like SQL injection and XSS. IAP is for access control, not attack prevention. VPC Service Controls are for data exfiltration prevention. Cloud CDN is for caching content.

Answer

Identity-Aware Proxy (IAP)

Answer

Cloud CDN

Answer

VPC Service Controls