Google PCA Designing for Security and Compliance Practice Test 2 — 15 Questions

Question 1

A company wants to enforce that only approved container images can be deployed to GKE. They also want to ensure images are scanned for vulnerabilities before deployment. Which two GCP services should they use? (Choose TWO).

Accepted Answer

Container Analysis API. Binary Authorization enforces deployment policies based on image signatures. Container Analysis (or vulnerability scanning) identifies vulnerabilities in images.

Answer

Cloud Security Command Center

Answer

Container Registry vulnerability scanning

Answer

Cloud Build

Question 2

A company needs to store secrets used by multiple GCP services. They require automatic rotation of secrets every 30 days and integration with Cloud Functions. Which two GCP services should they use? (Choose TWO).

Accepted Answer

Cloud Functions. Secret Manager stores secrets and supports rotation. Cloud Functions can access secrets via the Secret Manager API or by mounting them as volumes.

Answer

Cloud Run

Answer

Cloud KMS

Answer

Cloud Scheduler

Question 3

Which two GCP audit log types are available by default? (Choose TWO).

Accepted Answer

Admin Activity audit logs. Admin Activity and System Event audit logs are enabled by default. Data Access logs must be explicitly enabled.

Answer

Cloud Audit Logs

Answer

Policy Denied audit logs

Answer

Data Access audit logs

Question 4

A company wants to protect a web application from SQL injection and cross-site scripting (XSS) attacks. They also need to block traffic from specific geographic regions. Which three features of Cloud Armor should they use? (Choose THREE).

Accepted Answer

Rate limiting. WAF rules (preconfigured rules for SQLi, XSS), rate limiting (optional), and geographic restrictions (geo-based access control) are all features of Cloud Armor.

Answer

Cloud CDN

Answer

Adaptive Protection

Question 5

A company needs to ensure that data stored in Cloud Storage is encrypted with customer-managed keys that are rotated every 90 days. Which two steps must be taken to achieve this? (Choose TWO).

Accepted Answer

Create a key ring and a key in Cloud KMS. A CMEK key must be created in Cloud KMS, and the Cloud Storage bucket must be configured to use that CMEK key.

Answer

Set a rotation period of 90 days on the Cloud KMS key

Answer

Enable CSEK on the bucket

Answer

Grant the Cloud Storage service account access to the Cloud KMS key

Question 6

An organization wants to enforce that all container images deployed to their Google Kubernetes Engine (GKE) clusters are signed and have passed a vulnerability scan. Which GCP service should they use to enforce this policy?

Accepted Answer

Binary Authorization. Binary Authorization enforces policies that require container images to be signed by trusted authorities and optionally pass vulnerability scans before deployment. Cloud Build can be used to sign images, but the enforcement is done by Binary Authorization. Artifact Registry stores images, and IAM controls access but does not enforce signing policies.

Answer

Cloud Build

Answer

Artifact Registry

Answer

IAM

Question 7

A company wants to restrict access to their Cloud Storage bucket so that only requests from within a specific VPC network are allowed, and all other traffic (including internet) is denied. They also need to allow access from on-premises through a VPN. Which configuration should they use?

Accepted Answer

Configure the bucket with VPC Service Controls and enable Private Google Access. VPC Service Controls create a service perimeter around the bucket, and private Google Access allows resources in the VPC to use the bucket's private IP addresses. The on-premises network can connect via VPN using VPC Private Google Access. Public access is blocked by the perimeter. Firewall rules alone cannot block internet traffic to a public bucket.

Answer

Use IAM conditions to restrict access based on IP address

Answer

Use firewall rules to allow traffic only from the VPC IP range

Answer

Set up Cloud VPN and use Cloud NAT for egress

Question 8

A financial services company must store customer data in a GCP region that is certified for FedRAMP High. They also need to ensure that only authorized personnel can access the data, and that access logs are kept for 10 years. Which combination of services meets these requirements?

Accepted Answer

Assured Workloads with Cloud Audit Logs and IAM. Assured Workloads provides a FedRAMP High environment with specific regions. Cloud Audit Logs can be configured for extended retention. IAM controls access. CMEK is not required for compliance in this case. DLP is for data classification, not access control.

Answer

Cloud HSM and Cloud Audit Logs

Answer

VPC Service Controls with Cloud DLP

Answer

Cloud KMS with CMEK and Cloud Audit Logs

Question 9

An engineer needs to grant a service account the ability to create and manage VMs in a specific project, but only those VMs with a certain label. Which IAM feature should they use?

Accepted Answer

IAM conditions. IAM conditions allow you to grant conditional access based on resource attributes such as labels, name, or creation time. Custom roles are a collection of permissions but do not enforce conditions. Service account impersonation is used to act as another service account. Primitive roles are broad and do not support conditions.

Answer

Primitive roles

Answer

Custom roles

Answer

Service account impersonation

Question 10

A company wants to use their existing Active Directory for authentication to Google Cloud. They need to sync user and group identities to Cloud Identity and allow users to log in with their corporate credentials. Which two services should they use together?

Accepted Answer

Cloud Directory Sync and SAML SSO. Cloud Directory Sync (CDS) syncs users and groups from LDAP/AD to Cloud Identity. SAML SSO allows users to authenticate using their corporate credentials. IAP is for application access, not directory sync. Cloud Identity as a standalone does not sync automatically. Workload Identity is for Kubernetes.

Answer

Cloud Directory Sync and Workload Identity

Answer

SAML SSO and IAP

Answer

Cloud Identity and IAP

Question 11

A developer needs to securely store a database password that will be used by a Compute Engine instance. The password must be rotated automatically every 30 days. Which service should they use?

Accepted Answer

Secret Manager. Secret Manager is designed for storing secrets like API keys and passwords, and it supports automatic rotation schedules. Cloud KMS is for encryption keys, not generic secrets. Cloud Storage can store encrypted data but does not natively support rotation. Environment variables are insecure and not managed.

Answer

Cloud KMS

Answer

Cloud Storage with encryption

Answer

Environment variables

Question 12

A company wants to allow a Kubernetes pod in GKE to access a Cloud Storage bucket using the pod's own identity, without managing long-lived credentials. They have created a Google service account (GSA) and a Kubernetes service account (KSA). What should they do to bind the KSA to the GSA?

Accepted Answer

Add an annotation to the KSA referencing the GSA, and grant the KSA the iam.workloadIdentityUser role on the GSA. Workload Identity allows you to configure a KSA to act as a GSA by adding an annotation to the KSA and granting the GSA the necessary IAM role. The GSA does not impersonate the KSA; the KSA impersonates the GSA. The annotation is set on the KSA, not the pod. The GSA does not need to be bound to the KSA via an IAM role on the KSA.

Answer

Create a service account key and mount it as a secret in the pod

Answer

Grant the GSA the roles/iam.serviceAccountUser role on the project

Answer

Add an annotation to the GSA referencing the KSA, and grant the KSA the iam.workloadIdentityUser role on the GSA

Question 13

A company wants to protect their web application hosted on Google Cloud HTTP(S) Load Balancer from common web attacks like SQL injection and cross-site scripting (XSS). Which GCP service should they use?

Accepted Answer

Cloud Armor. Cloud Armor provides WAF (Web Application Firewall) capabilities including preconfigured rules to block OWASP Top 10 attacks like SQL injection and XSS. IAP is for access control, not attack prevention. VPC Service Controls are for data exfiltration prevention. Cloud CDN is for caching content.

Answer

Identity-Aware Proxy (IAP)

Answer

Cloud CDN

Answer

VPC Service Controls

Question 14

A company needs to encrypt data at rest in Cloud Storage using their own keys. They require that the keys are stored in a hardware security module (HSM) that is FIPS 140-2 Level 3 certified. Which key management option should they choose?

Accepted Answer

Customer-Managed Encryption Keys (CMEK) with Cloud HSM. Cloud HSM is a FIPS 140-2 Level 3 certified HSM service that allows you to manage your own encryption keys for CMEK. CSEK requires you to supply keys yourself, but they are not stored in an HSM. Cloud KMS without HSM is only Level 1. Google-managed keys do not use customer keys.

Answer

Google-managed encryption keys

Answer

Customer-Supplied Encryption Keys (CSEK)

Answer

Customer-Managed Encryption Keys (CMEK) with Cloud KMS

Question 15

A security engineer wants to ensure that all admin activity in their GCP organization is logged and retained for 3 years. They also need to be alerted if a new firewall rule is created. Which logs should they enable?

Accepted Answer

Admin Activity audit logs. Admin Activity audit logs record all API calls that modify configuration or metadata, such as creating firewall rules. Data Access audit logs record reads/writes to data, not admin actions. VPC flow logs record network traffic, not admin actions. Cloud DNS logging records DNS queries.

Answer

Data Access audit logs

Answer

VPC flow logs

Answer

Cloud DNS logging