Google PCA Designing for Security and Compliance Practice Test 4 — 15 Questions

Question 1

A company deploys a Kubernetes workload in GKE that needs to access Cloud Storage. They want to avoid managing service account keys. What is the recommended approach?

Accepted Answer

Use Workload Identity to map the Kubernetes service account to a GCP service account.. Workload Identity allows you to bind a Kubernetes service account to a GCP service account, so pods can authenticate using the GCP service account without managing keys.

Answer

Use the default Compute Engine service account on the node.

Answer

Store a service account key in a Kubernetes secret and mount it.

Answer

Use Cloud Key Management Service to encrypt the service account key.

Question 2

A company with multiple projects must ensure that no data can be exfiltrated from a specific project's Cloud Storage buckets to unauthorized locations outside the organization. They also need to allow access only from a corporate VPN IP range. Which configuration meets these requirements?

Accepted Answer

Configure a VPC Service Controls perimeter with an access level restricted to the corporate VPN IP range.. VPC Service Controls create a service perimeter around the project, preventing data exfiltration by default. Access levels (based on IP ranges) can be used to allow access only from the corporate VPN.

Answer

Set firewall rules to block all traffic except from the VPN.

Answer

Use IAM conditions to restrict access based on IP address.

Answer

Use Cloud Armor with IP whitelisting.

Question 3

A company wants to deploy a web application behind an HTTPS Load Balancer and only allow authenticated users from their corporate Active Directory. Which two services should they use together? (Choose two.)

Accepted Answer

Identity-Aware Proxy (IAP). Identity-Aware Proxy (IAP) provides authentication and authorization for applications. Cloud Identity (or Cloud Directory Sync) integrates with Active Directory to provide user identities.

Answer

VPC Service Controls

Answer

Cloud NAT

Answer

Cloud Armor

Question 4

A company wants to centrally manage firewall rules for all projects in an organization using hierarchical firewall policies. Which three resources can be used in conjunction with hierarchical firewall policies? (Choose three.)

Accepted Answer

Organization node. Hierarchical firewall policies can be applied to the organization, folders, and projects. They cannot be applied to VPC networks or individual resources directly.

Answer

Compute Engine instance

Answer

VPC network

Question 5

An organization needs to comply with FedRAMP requirements and restrict data storage to specific regions. They also need to audit all admin activities and data access. Which three components should they implement? (Choose three.)

Accepted Answer

Data Access audit logs. Assured Workloads enforces compliance controls (e.g., region restrictions). Admin Activity audit logs capture administrative actions, and Data Access audit logs capture data reads/writes for compliance.

Answer

VPC Service Controls

Answer

Cloud Armor

Question 6

An organization wants to enforce that all container images deployed to Google Kubernetes Engine (GKE) clusters are signed by an authorized authority and only those images are allowed to run. Which GCP service should they use?

Accepted Answer

Binary Authorization. Binary Authorization enforces deployment-time policies that require container images to be signed by trusted authorities before they can be deployed to GKE.

Answer

Cloud Key Management Service (Cloud KMS)

Answer

Cloud Build

Answer

Artifact Registry

Question 7

A security engineer needs to allow a Compute Engine instance with the service account 'sa-prod@project.iam.gserviceaccount.com' to connect to a Cloud SQL instance over a private IP. The VPC has no firewall rules allowing this traffic. What is the MOST secure way to grant access?

Accepted Answer

Add a firewall rule with source service account 'sa-prod@project.iam.gserviceaccount.com' and target service account 'cloud-sql-sa@project.iam.gserviceaccount.com'. Firewall rules can target service accounts directly, allowing fine-grained access without relying on network tags. This avoids managing tags and reduces attack surface.

Answer

Grant the IAM role 'cloudsql.client' to the service account 'sa-prod@project.iam.gserviceaccount.com'

Answer

Add a firewall rule with source tag 'prod' and target tag 'cloud-sql'

Answer

Create a VPC peering connection between the Compute Engine VPC and the Cloud SQL VPC

Question 8

A company uses Cloud Key Management Service (Cloud KMS) with a customer-managed encryption key (CMEK) to encrypt data in BigQuery. They want to ensure the key can only be used by the BigQuery service account in the 'us-central1' region. Which IAM condition should be added to the key's IAM policy?

Accepted Answer

resource.name.startsWith('projects/_/locations/us-central1') && request.auth.principalSet == 'serviceAccount:bq-<project-number>@bigquery-encryption.iam.gserviceaccount.com'. IAM conditions allow restricting access based on attributes like region and service account. The condition must check the 'destination_service' for BigQuery and the 'region' for us-central1.

Answer

resource.name.startsWith('projects/_/locations/us-central1') && request.auth.principal == 'bigquery@system.gserviceaccount.com'

Answer

resource.name.startsWith('projects/_/locations/global') && request.auth.principal == 'bigquery@system.gserviceaccount.com'

Answer

resource.service == 'bigquery.googleapis.com' && resource.location == 'us-central1'

Question 9

Which Google Cloud service allows organizations to define perimeters that protect resources and data from exfiltration to other VPCs or networks?

Accepted Answer

VPC Service Controls. VPC Service Controls allow you to define service perimeters that restrict access to managed services from outside the perimeter, preventing data exfiltration.

Answer

Private Service Connect

Answer

Identity-Aware Proxy (IAP)

Answer

Cloud Armor

Question 10

A company is migrating an on-premises application to Google Cloud. The application requires access to a legacy database that can only be reached from a specific on-premises IP address. The company has established a Cloud VPN tunnel. What is the MOST secure way to ensure that only the migrated application's Compute Engine instances can initiate connections to the on-premises database?

Accepted Answer

Create a firewall egress rule with destination IP range of the on-premises database and source service account of the application instances. Using firewall rules with target service accounts allows you to control egress traffic based on the identity of the source instances, which is more secure than using tags or IP ranges.

Answer

Create a Cloud NAT and assign the application instances a static IP, then allow that IP in the on-premises firewall

Answer

Create a firewall egress rule with destination IP range of the on-premises database and source tags 'db-access'

Answer

Use VPC Service Controls to create a perimeter around the application VPC

Question 11

An organization needs to store API keys and database passwords securely in Google Cloud. They want to automatically rotate secrets every 30 days. Which service should they use?

Accepted Answer

Secret Manager. Secret Manager supports automatic rotation with a rotation period and can trigger a Cloud Function to generate a new secret version.

Answer

Cloud Storage with bucket-level encryption

Answer

Cloud Key Management Service (Cloud KMS)

Answer

Cloud Runtime Configurator

Question 12

A company wants to enforce that all data stored in Cloud Storage buckets is encrypted with a key that they manage and rotate quarterly. They also want to ensure that the key is stored in a hardware security module (HSM). Which combination of services should they use?

Accepted Answer

Cloud KMS with a key backed by Cloud HSM, and set the bucket's default encryption to use that key (CMEK). Cloud HSM provides HSM-backed keys, and Cloud KMS allows you to create and manage those keys. CMEK (Customer-Managed Encryption Keys) with Cloud KMS (backed by HSM) meets the requirements.

Answer

Customer-Supplied Encryption Keys (CSEK) with Cloud Storage

Answer

Cloud External Key Manager (Cloud EKM)

Answer

Cloud HSM with default Google-managed keys

Question 13

Which IAM role should be granted to a user who needs to view but not modify resources in a project?

Accepted Answer

roles/viewer. The Viewer role (roles/viewer) provides read-only access to all resources in a project.

Answer

roles/editor

Answer

roles/owner

Answer

roles/browser

Question 14

A company uses Assured Workloads to meet FedRAMP compliance. They need to ensure that only authorized personnel can access data access audit logs for their projects. Which IAM role should they grant to the security team?

Accepted Answer

roles/logging.privateLogViewer. Data Access audit logs require the 'roles/logging.privateLogViewer' role (or equivalent) to view. Admin Activity logs are visible with 'roles/logging.viewer' or higher.

Answer

roles/logging.viewer

Answer

roles/iam.securityReviewer

Answer

roles/logging.admin

Question 15

A company wants to allow users to authenticate to a web application running on Compute Engine using their existing corporate Active Directory credentials without exposing the application to the public internet. Which approach should they use?

Accepted Answer

Set up Identity-Aware Proxy (IAP) and sync Active Directory to Cloud Identity. Identity-Aware Proxy (IAP) provides zero-trust access to applications by verifying identity and context. It integrates with Cloud Identity, which can be synced with Active Directory via Cloud Directory Sync.

Answer

Configure a Cloud VPN and allow only corporate IP addresses in firewall rules

Answer

Use Cloud Load Balancing with SSL and client certificates

Answer

Configure Cloud NAT and assign static IPs to users