Google PCA Designing for Security and Compliance Practice Test 3 — 15 Questions

Question 1

A company needs to encrypt data at rest in Cloud Storage using their own keys. They require that the keys are stored in a hardware security module (HSM) that is FIPS 140-2 Level 3 certified. Which key management option should they choose?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Customer-Managed Encryption Keys (CMEK) with Cloud HSM. Cloud HSM is a FIPS 140-2 Level 3 certified HSM service that allows you to manage your own encryption keys for CMEK. CSEK requires you to supply keys yourself, but they are not stored in an HSM. Cloud KMS without HSM is only Level 1. Google-managed keys do not use customer keys.

Answer

Google-managed encryption keys

Answer

Customer-Supplied Encryption Keys (CSEK)

Answer

Customer-Managed Encryption Keys (CMEK) with Cloud KMS

Question 2

A security engineer wants to ensure that all admin activity in their GCP organization is logged and retained for 3 years. They also need to be alerted if a new firewall rule is created. Which logs should they enable?

Accepted Answer

Admin Activity audit logs. Admin Activity audit logs record all API calls that modify configuration or metadata, such as creating firewall rules. Data Access audit logs record reads/writes to data, not admin actions. VPC flow logs record network traffic, not admin actions. Cloud DNS logging records DNS queries.

Answer

Data Access audit logs

Answer

VPC flow logs

Answer

Cloud DNS logging

Question 3

A company is deploying a multi-tenant SaaS application on GKE. Each tenant's data must be isolated at the network level. They want to use a single GKE cluster but ensure that pods from different tenants cannot communicate with each other. Which GCP feature should they use?

Accepted Answer

Kubernetes Network Policies. Kubernetes Network Policies allow you to define rules for pod-to-pod communication within a cluster, enabling tenant isolation. GKE Sandbox provides stronger isolation at the kernel level but is not specifically for network isolation. VPC Service Controls are for Google Cloud services, not pod-level. Istio can also provide network control but is a more complex mesh.

Answer

Istio service mesh

Answer

VPC Service Controls

Answer

GKE Sandbox

Question 4

A company wants to give a new employee read-only access to all projects in their GCP organization. Which IAM role should they assign at the organization level to grant this access?

Accepted Answer

roles/viewer. The Viewer primitive role (roles/viewer) grants read-only access to all resources in the organization. Owner and Editor roles are too broad. Organization Viewer is not a valid role.

Answer

roles/owner

Answer

roles/editor

Answer

roles/orgadmin

Question 5

A company wants to use Cloud DLP to scan a Cloud Storage bucket for personally identifiable information (PII) and de-identify the data before storing it in another bucket. Which TWO actions should they take? (Choose 2)

Accepted Answer

Use DLP de-identification templates to transform data and write to a target bucket. Cloud DLP can inspect the data and de-identify it using techniques like masking. The output is typically stored in a different bucket. Exporting to BigQuery is optional and not required for de-identification. IAM roles for DLP are needed to create jobs.

Answer

Export the inspection results to BigQuery for analysis

Answer

Set up a Cloud Dataflow pipeline to stream data

Answer

Grant the Cloud DLP service account the roles/storage.objectViewer role on the source bucket

Question 6

A company wants to use Binary Authorization to enforce that only images signed by their internal CI/CD pipeline can be deployed to their GKE clusters. They have set up Cloud Build to sign images. Which THREE steps are required to configure this? (Choose 3)

Accepted Answer

Create an attestation for each container image using Cloud Build. To use Binary Authorization, you need to create an attestor that represents the signing authority, create an attestation (signed metadata) for each image, and create a policy that requires attestations. The policy can be cluster-specific. Granting the attestor the Cloud KMS signer role is needed to sign, but the question asks for steps to configure; storing keys in Cloud KMS is a prerequisite but not listed as a step here.

Answer

Store the signing keys in Cloud HSM

Answer

Grant the GKE service account the roles/container.deployer role

Question 7

An organization wants to use VPC Service Controls to protect a Cloud Storage bucket and a BigQuery dataset from data exfiltration. They want to allow access from a specific on-premises network via a Cloud VPN. Which TWO components are required? (Choose 2)

Accepted Answer

A service perimeter that includes the Cloud Storage bucket and BigQuery dataset. VPC Service Controls use access levels (often based on IP address) to allow or deny access. A service perimeter defines the protected resources. Cloud VPN provides the encrypted connection from on-premises. Cloud Interconnect is an alternative but not required. Private Google Access is for VMs in the VPC, not on-premises. VPC firewall rules do not apply to Google Cloud services.

Answer

Cloud Interconnect (Dedicated or Partner)

Answer

VPC firewall rules allowing traffic from on-premises

Answer

Private Google Access enabled on the VPC subnet

Question 8

An organization wants to ensure that only container images signed by an authorized CI/CD pipeline can be deployed to their GKE clusters. Which GCP service should they use?

Accepted Answer

Binary Authorization. Binary Authorization is a GCP service that enforces attestation-based policies, ensuring only signed container images are deployed to GKE.

Answer

Artifact Registry

Answer

Cloud Security Scanner

Answer

Cloud Build

Question 9

A security engineer needs to restrict access to a Google Cloud project so that only a specific set of IP addresses can reach Cloud Storage buckets. Which feature should be configured?

Accepted Answer

VPC Service Controls. VPC Service Controls allow you to define perimeters that restrict access based on context, including IP addresses via access levels.

Answer

IAM Conditions

Answer

Firewall Rules

Answer

Cloud Armor

Question 10

A company uses Cloud Identity to manage users and wants to allow employees to authenticate to Google Cloud using their existing corporate Active Directory credentials. Which solution should they implement?

Accepted Answer

Cloud Directory Sync. Cloud Directory Sync synchronizes users and groups from on-premises AD to Cloud Identity, enabling SSO with existing credentials.

Answer

Workload Identity Federation

Answer

IAM policies

Answer

Identity-Aware Proxy

Question 11

A company wants to encrypt data at rest in Cloud Storage using a key that they generate and manage themselves, not stored in Google Cloud. Which encryption type should they use?

Accepted Answer

CSEK. CSEK (Customer-Supplied Encryption Keys) allows customers to provide their own encryption keys for Cloud Storage objects, which are used and then discarded by GCP.

Answer

Default encryption

Answer

Cloud HSM

Answer

CMEK with Cloud KMS

Question 12

A DevOps engineer needs to grant a CI/CD pipeline (running in a different Google Cloud project) the ability to deploy resources into a target project. The pipeline uses a service account. What is the best way to grant this access?

Accepted Answer

Add the service account email as a member of the target project with appropriate roles.. IAM allows granting roles to a service account principal from another project by specifying the full email of the service account as a member.

Answer

Use VPC peering to allow cross-project access.

Answer

Use Cloud NAT to enable communication.

Answer

Create a new service account in the target project and share the key with the pipeline.

Question 13

A company wants to use their own HSM to hold encryption keys for Google Cloud services, but they want Google Cloud to perform cryptographic operations without exposing the keys. Which service should they use?

Accepted Answer

Cloud HSM. Cloud HSM is a cloud-hosted HSM that allows customers to manage keys in FIPS 140-2 Level 3 HSMs, with Google performing operations without exposing key material.

Answer

Cloud KMS (software)

Answer

CSEK

Answer

Secret Manager

Question 14

A company needs to protect an HTTPS load-balanced web application from OWASP Top 10 attacks, including SQL injection and cross-site scripting. Which GCP service should they enable?

Accepted Answer

Cloud Armor. Cloud Armor provides WAF capabilities that can be attached to HTTPS Load Balancers to filter requests based on OWASP signatures.

Answer

Cloud NAT

Answer

Cloud CDN

Answer

Identity-Aware Proxy

Question 15

A security team needs to detect and redact personally identifiable information (PII) from documents uploaded to Cloud Storage before they are stored. Which GCP service should they use?

Accepted Answer

Cloud Data Loss Prevention (DLP) API. Cloud DLP (Data Loss Prevention) API can inspect and de-identify sensitive data in documents and can be integrated with Cloud Storage workflows.

Answer

Cloud Audit Logs

Answer

Security Command Center

Answer

Access Transparency