Google PCA Designing for Security and Compliance Practice Test 5 — 15 Questions

Question 1

A company uses Assured Workloads to meet FedRAMP compliance. They need to ensure that only authorized personnel can access data access audit logs for their projects. Which IAM role should they grant to the security team?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

roles/logging.privateLogViewer. Data Access audit logs require the 'roles/logging.privateLogViewer' role (or equivalent) to view. Admin Activity logs are visible with 'roles/logging.viewer' or higher.

Answer

roles/logging.viewer

Answer

roles/iam.securityReviewer

Answer

roles/logging.admin

Question 2

A company wants to allow users to authenticate to a web application running on Compute Engine using their existing corporate Active Directory credentials without exposing the application to the public internet. Which approach should they use?

Accepted Answer

Set up Identity-Aware Proxy (IAP) and sync Active Directory to Cloud Identity. Identity-Aware Proxy (IAP) provides zero-trust access to applications by verifying identity and context. It integrates with Cloud Identity, which can be synced with Active Directory via Cloud Directory Sync.

Answer

Configure a Cloud VPN and allow only corporate IP addresses in firewall rules

Answer

Use Cloud Load Balancing with SSL and client certificates

Answer

Configure Cloud NAT and assign static IPs to users

Question 3

A data engineer needs to scan a Cloud Storage bucket for personally identifiable information (PII) and de-identify the data before loading it into BigQuery. Which Google Cloud service should they use?

Accepted Answer

Cloud DLP. Cloud Data Loss Prevention (DLP) API can inspect data for PII and de-identify it using techniques like masking, tokenization, or bucketing.

Answer

Cloud Dataprep

Answer

Cloud Composer

Answer

Cloud Data Fusion

Question 4

An engineer is configuring Cloud Armor security policies for an HTTPS Load Balancer. They want to block requests from a specific IP range but allow all other traffic. What is the correct way to configure this?

Accepted Answer

Create a rule with priority 100 to deny the IP range, and a rule with priority 1000 to allow all traffic. Cloud Armor security policies use rules with a 'deny' action for blocking and 'allow' for permitting. Rules are evaluated in order of priority, with lower numbers having higher priority.

Answer

Create a rule with priority 1000 to allow all traffic, and a rule with priority 100 to deny the IP range

Answer

Create a single rule with the IP range and action 'deny'

Answer

Create a rule with priority 1000 to deny the IP range, and no allow rule

Question 5

A security team needs to restrict access to a set of Cloud Storage buckets so that only Compute Engine instances with a specific service account can read objects. Which TWO steps should they take? (Choose two.)

Accepted Answer

Grant the service account the 'roles/storage.objectViewer' role on the bucket. To restrict access to Cloud Storage buckets so that only Compute Engine instances with a specific service account can read objects, the correct approach is to use IAM permissions (option A) to grant the service account the 'roles/storage.objectViewer' role, and VPC Service Controls (option C) to create a perimeter that limits access to the VPC where the instances reside. IAM defines who can access resources, while VPC Service Controls enforce network-based boundaries. Firewall rules (option E) are not applicable to Cloud Storage access, as Cloud Storage is a global service accessed via HTTPS, not via IP ranges.

Answer

Grant the user who owns the instances the 'roles/storage.admin' role

Answer

Create a bucket ACL that allows read access for the service account

Answer

Add a firewall rule allowing ingress from the service account to the bucket's IP range

Question 6

A company wants to use Cloud Key Management Service (Cloud KMS) to manage encryption keys for multiple applications. They have the following requirements: 1) Keys must be automatically rotated every 90 days. 2) Different applications should have access only to their own keys. 3) All key operations must be logged for audit purposes. Which THREE steps should they take? (Choose three.)

Accepted Answer

Enable Cloud Audit Logs for the Cloud KMS API. Cloud KMS supports key rotation schedules, IAM for access control, and Cloud Audit Logs for logging.

Answer

Grant the roles/cloudkms.admin role to each application's service account

Answer

Store the keys in Cloud HSM

Question 7

An organization wants to implement a zero-trust architecture for a web application running on Compute Engine. They require: - All traffic must be authenticated and authorized at the application layer. - Access decisions must consider the user's identity, device security posture, and IP address. - Session hijacking must be mitigated. Which THREE services or features should they use? (Choose three.)

Accepted Answer

IAP's signed headers (X-Goog-Authenticated-User-Email). IAP provides identity-aware access, Cloud Armor can enforce context-based access, and IAP signed headers prevent session hijacking.

Answer

Cloud Armor with adaptive protection

Answer

VPC Service Controls

Question 8

A security team wants to ensure that all Compute Engine instances in a project are launched with a specific custom encryption key (CMEK) stored in Cloud KMS. What is the correct way to enforce this policy?

Accepted Answer

Use the organization policy constraint constraints/compute.requireCmek.. Using organization policy constraints, specifically constraints/compute.requireCmek, enforces that all new disks are encrypted with a CMEK from Cloud KMS. Other options do not enforce encryption at a project level.

Answer

Set a service account with permissions to use the CMEK.

Answer

Create a firewall rule to block unencrypted traffic.

Answer

Configure the VPC Service Perimeter to block non-CMEK instances.

Question 9

An organization uses Active Directory (AD) on-premises. They want to synchronize user accounts and groups to Google Cloud Identity so that users can sign in with their existing AD credentials. Which service should they use?

Accepted Answer

Google Cloud Directory Sync. Google Cloud Directory Sync (GCDS) is the tool that synchronizes users and groups from an existing LDAP directory, such as Active Directory, to Cloud Identity. It does not handle SAML SSO directly.

Answer

Cloud Identity Platform

Answer

Cloud Identity-Aware Proxy

Answer

Security Command Center

Question 10

A financial services company runs workloads on GKE and wants to ensure only container images that have been approved by the security team can be deployed. The approval process involves signing images after vulnerability scanning. Which GCP service should be integrated with GKE to enforce this policy?

Accepted Answer

Binary Authorization. Binary Authorization enforces that only signed container images from trusted authorities can be deployed on GKE. It integrates with Cloud KMS for signing and can be configured with attestors.

Answer

Cloud Key Management Service (Cloud KMS)

Answer

Cloud Build

Answer

Artifact Registry

Question 11

A company wants to use Customer-Managed Encryption Keys (CMEK) for data at rest in Cloud Storage, but also needs to ensure that the keys are stored in a hardware security module (HSM) to meet compliance requirements. Which Cloud KMS key type should they choose?

Accepted Answer

Cloud HSM key. Cloud HSM provides HSM-backed keys that are FIPS 140-2 Level 3 certified. Using Cloud HSM for the CMEK ensures the key material is stored in a hardware security module.

Answer

Predefined key

Answer

External key (Cloud External Key Manager)

Answer

Software-backed key

Question 12

An organization needs to restrict access to a Cloud Storage bucket so that only resources in a specific VPC network can read the data. They want to prevent data exfiltration via the internet. Which combination of services should they use?

Accepted Answer

VPC Service Controls and Private Google Access. VPC Service Controls create service perimeters that protect Cloud Storage and other services. Private Google Access allows on-premises or VM access via private IP. Together they restrict access to the VPC network.

Answer

Firewall Rules and Cloud VPN

Answer

Cloud Armor and Cloud NAT

Answer

IAM Conditions and Cloud CDN

Question 13

A developer needs to grant a Compute Engine instance the ability to read from a Cloud Storage bucket. The instance does not have a service account attached. What should the developer do?

Accepted Answer

Create a service account and assign it the Storage Object Viewer role, then attach the service account to the instance.. The best practice is to create a service account with the required roles (e.g., Storage Object Viewer) and attach it to the instance. This avoids managing keys and follows IAM best practices.

Answer

Add the instance's external IP to the bucket permissions.

Answer

Generate a JSON key for a user account and store it on the instance.

Answer

Create a firewall rule to allow access to Cloud Storage.

Question 14

A security engineer wants to configure Identity-Aware Proxy (IAP) for an HTTPS load-balanced application to enforce zero-trust access. Users will authenticate with their Google accounts. What is the minimum set of IAM roles needed for a user to access the application behind IAP?

Accepted Answer

roles/iap.httpsResourceAccessor. To access an application protected by IAP over HTTPS, a user must have the IAP-secured Web App User role (roles/iap.httpsResourceAccessor) on the resource. This role grants permission to access the resource through IAP. The other roles are not sufficient: roles/iam.serviceAccountUser is for managing service accounts, roles/iap.tunnelResourceAccessor is for TCP forwarding, and roles/compute.viewer only allows viewing Compute Engine resources, not accessing the application.

Answer

roles/iam.serviceAccountUser

Answer

roles/iap.tunnelResourceAccessor

Answer

roles/compute.viewer

Question 15

A company has a VPC Service Perimeter that protects a project containing BigQuery datasets. They want to allow an external customer's BigQuery job to query data across the perimeter boundary using a private connection. Which configuration is required?

Accepted Answer

Create an ingress rule in the service perimeter that allows access from the external customer's VPC network.. To allow access from outside the perimeter, you can use VPC Service Controls with ingress rules. Additionally, the external customer must use a private connection, such as Cloud VPN or Dedicated Interconnect, to access the perimeter. The ingress rule specifies the source and resources.

Answer

Remove the project from the service perimeter temporarily.

Answer

Use Access Transparency to log cross-perimeter access.

Answer

Grant the external customer's service account the BigQuery User role.