Google PCA Designing for Security and Compliance Practice Test 6 — 15 Questions

Question 1

A company wants to deploy a web application behind an HTTPS Load Balancer and only allow authenticated users from their corporate Active Directory. Which two services should they use together? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Identity-Aware Proxy (IAP). Identity-Aware Proxy (IAP) [CORRECT] is the right choice because it enforces authentication and authorization at the application layer for HTTPS Load Balancer backends, verifying user identity before any request reaches the web application. Cloud Identity [CORRECT] is also correct because it can federate with the corporate Active Directory (via SAML or secure LDAP), providing the identity source that IAP uses to authenticate and authorize corporate users. Together, IAP and Cloud Identity let the company restrict access to authenticated AD users without exposing the app publicly. VPC Service Controls is incorrect because it guards GCP API/service perimeters rather than end-user web application authentication. Cloud NAT is incorrect because it provides outbound internet access for private instances, not user authentication. Cloud Armor is incorrect because it provides WAF/DDoS protection and IP-based rules, not identity-based authentication against Active Directory.

Answer

VPC Service Controls

Answer

Cloud NAT

Answer

Cloud Armor

Question 2

A company wants to centrally manage firewall rules for all projects in an organization using hierarchical firewall policies. Which three resources can be used in conjunction with hierarchical firewall policies? (Choose three.)

Accepted Answer

Organization node. Hierarchical firewall policies in Google Cloud are attached at nodes of the resource hierarchy, and the three valid attachment points are the organization node (B), folders (E), and projects (C). Option B is correct because an organization-level policy applies to all resources beneath the organization and serves as the topmost layer of hierarchical firewall rules. Option E is correct because folders sit between the organization and projects, allowing policies to be scoped to a subset of projects within the hierarchy. Option C is correct because a project-level policy applies to that project's resources and is evaluated after organization and folder policies. Options A and D are not valid attachment points: a Compute Engine instance (A) is a compute resource governed by the policies, not a node where a hierarchical firewall policy is attached, and a VPC network (D) is associated with VPC firewall rules, not hierarchical firewall policies.

Answer

Compute Engine instance

Answer

VPC network

Question 3

An organization needs to comply with FedRAMP requirements and restrict data storage to specific regions. They also need to audit all admin activities and data access. Which three components should they implement? (Choose three.)

Accepted Answer

Data Access audit logs. Assured Workloads (E) is correct because it is the Google Cloud service specifically designed to enforce regulatory compliance frameworks such as FedRAMP and to restrict data storage and processing to specific regions through its compliance controls. Admin Activity audit logs (D) are correct because they record all administrative and configuration changes made to resources, which is required to audit all admin activities. Data Access audit logs (B) are correct because they capture read and write operations on user data, satisfying the requirement to audit all data access. VPC Service Controls (A) is not selected because, while it provides service perimeter security to mitigate data exfiltration, it does not itself enforce FedRAMP compliance or regional data residency. Cloud Armor (C) is not selected because it is a WAF/DDoS protection service for external HTTP(S) load balancers and does not address compliance, data residency, or audit logging requirements.

Answer

VPC Service Controls

Answer

Cloud Armor

Question 4

An organization wants to enforce that all container images deployed to Google Kubernetes Engine (GKE) clusters are signed by an authorized authority and only those images are allowed to run. Which GCP service should they use?

Accepted Answer

Binary Authorization. Binary Authorization is a deploy-time security control that ensures only trusted container images are deployed on GKE. It works by enforcing attestations that are created by authorized authorities after verifying the image's signature. This allows you to enforce that only images signed by an authorized authority are allowed to run.

Answer

Cloud Key Management Service (Cloud KMS)

Answer

Cloud Build

Answer

Artifact Registry

Question 5

Which Google Cloud service allows organizations to define perimeters that protect resources and data from exfiltration to other VPCs or networks?

Accepted Answer

VPC Service Controls. VPC Service Controls lets organizations define service perimeters that restrict access to Google Cloud services and prevent data exfiltration across project, VPC, or network boundaries. It enforces context-aware access at the API level, blocking operations that would move data outside the perimeter even if IAM would otherwise allow them. This is exactly the 'protect resources and data from exfiltration to other VPCs or networks' requirement.

Answer

Private Service Connect

Answer

Identity-Aware Proxy (IAP)

Answer

Cloud Armor

Question 6

An organization needs to store API keys and database passwords securely in Google Cloud. They want to automatically rotate secrets every 30 days. Which service should they use?

Accepted Answer

Secret Manager. Secret Manager supports automatic rotation with a rotation period and can trigger a Cloud Function to generate a new secret version.

Answer

Cloud Storage with bucket-level encryption

Answer

Cloud Key Management Service (Cloud KMS)

Answer

Cloud Runtime Configurator

Question 7

Which IAM role should be granted to a user who needs to view but not modify resources in a project?

Accepted Answer

roles/viewer. The roles/viewer role grants read-only access to all resources within a project, allowing the user to view but not modify them. This aligns with the principle of least privilege for a user who only needs to inspect resources. It includes permissions to list and get resources but not to create, update, or delete.

Answer

roles/editor

Answer

roles/owner

Answer

roles/browser

Question 8

A company uses Assured Workloads to meet FedRAMP compliance. They need to ensure that only authorized personnel can access data access audit logs for their projects. Which IAM role should they grant to the security team?

Accepted Answer

roles/logging.privateLogViewer. roles/logging.privateLogViewer grants read access to private logs, which includes Data Access audit logs, and is the least-privilege role designed for viewing sensitive audit data. Data Access logs are classified as private logs in Cloud Logging, so the security team needs a role that explicitly includes logging.privateLogs.view permission. This satisfies the FedRAMP requirement that only authorized personnel can view data access audit logs.

Answer

roles/logging.viewer

Answer

roles/iam.securityReviewer

Answer

roles/logging.admin

Question 9

A company wants to allow users to authenticate to a web application running on Compute Engine using their existing corporate Active Directory credentials without exposing the application to the public internet. Which approach should they use?

Accepted Answer

Set up Identity-Aware Proxy (IAP) and sync Active Directory to Cloud Identity. Identity-Aware Proxy (IAP) provides zero-trust access control to applications without exposing them to the public internet, and it integrates with Cloud Identity. By syncing on-premises Active Directory to Cloud Identity (via GCDS or federation), users can authenticate with their corporate credentials through IAP, which enforces IAM policies before allowing access to the Compute Engine-hosted app.

Answer

Configure a Cloud VPN and allow only corporate IP addresses in firewall rules

Answer

Use Cloud Load Balancing with SSL and client certificates

Answer

Configure Cloud NAT and assign static IPs to users

Question 10

A data engineer needs to scan a Cloud Storage bucket for personally identifiable information (PII) and de-identify the data before loading it into BigQuery. Which Google Cloud service should they use?

Accepted Answer

Cloud DLP. Cloud DLP (Data Loss Prevention) is the correct service because it is specifically designed to scan, classify, and de-identify sensitive data such as PII. It can inspect data in Cloud Storage and apply de-identification transformations like masking, tokenization, or redaction before loading into BigQuery. This is a core use case for Cloud DLP.

Answer

Cloud Dataprep

Answer

Cloud Composer

Answer

Cloud Data Fusion

Question 11

An organization uses Active Directory (AD) on-premises. They want to synchronize user accounts and groups to Google Cloud Identity so that users can sign in with their existing AD credentials. Which service should they use?

Accepted Answer

Google Cloud Directory Sync. Google Cloud Directory Sync (GCDS) is the official tool for synchronizing users, groups, and other directory data from an on-premises Active Directory or LDAP directory to Google Cloud Identity or Google Workspace. It runs on-premises, reads from AD, and provisions accounts in Google Cloud, allowing users to sign in with their existing AD credentials (often via SAML federation or password sync).

Answer

Cloud Identity Platform

Answer

Cloud Identity-Aware Proxy

Answer

Security Command Center

Question 12

A financial services company runs workloads on GKE and wants to ensure only container images that have been approved by the security team can be deployed. The approval process involves signing images after vulnerability scanning. Which GCP service should be integrated with GKE to enforce this policy?

Accepted Answer

Binary Authorization. Binary Authorization is a GCP service that enforces deploy-time security policies on GKE clusters. It ensures that only container images that have been signed by trusted authorities (after vulnerability scanning) are deployed. By integrating Binary Authorization with GKE, the company can enforce that only approved images are deployed.

Answer

Cloud Key Management Service (Cloud KMS)

Answer

Cloud Build

Answer

Artifact Registry

Question 13

A company wants to use Customer-Managed Encryption Keys (CMEK) for data at rest in Cloud Storage, but also needs to ensure that the keys are stored in a hardware security module (HSM) to meet compliance requirements. Which Cloud KMS key type should they choose?

Accepted Answer

Cloud HSM key. Cloud HSM keys in Cloud KMS are backed by a FIPS 140-2 Level 3 validated hardware security module, satisfying compliance requirements that mandate HSM-backed key storage. This is the only Cloud KMS key type that provides hardware-backed protection while remaining fully managed within Google Cloud.

Answer

Predefined key

Answer

External key (Cloud External Key Manager)

Answer

Software-backed key

Question 14

A developer needs to grant a Compute Engine instance the ability to read from a Cloud Storage bucket. The instance does not have a service account attached. What should the developer do?

Accepted Answer

Create a service account and assign it the Storage Object Viewer role, then attach the service account to the instance.. A Compute Engine instance must have a service account attached to obtain Google Cloud credentials for API calls. The developer should create a service account, grant it the Storage Object Viewer role (or a custom role with storage.objects.get/list), and attach it to the instance. The instance can then use the metadata server to obtain short-lived tokens and read the bucket.

Answer

Add the instance's external IP to the bucket permissions.

Answer

Generate a JSON key for a user account and store it on the instance.

Answer

Create a firewall rule to allow access to Cloud Storage.

Question 15

A security engineer wants to configure Identity-Aware Proxy (IAP) for an HTTPS load-balanced application to enforce zero-trust access. Users will authenticate with their Google accounts. What is the minimum set of IAM roles needed for a user to access the application behind IAP?

Accepted Answer

roles/iap.httpsResourceAccessor. To access an application protected by IAP over HTTPS, a user must have the IAP-secured Web App User role (roles/iap.httpsResourceAccessor) on the resource. This role grants permission to access the resource through IAP. The other roles are not sufficient: roles/iam.serviceAccountUser is for managing service accounts, roles/iap.tunnelResourceAccessor is for TCP forwarding, and roles/compute.viewer only allows viewing Compute Engine resources, not accessing the application.

Answer

roles/iam.serviceAccountUser

Answer

roles/iap.tunnelResourceAccessor

Answer

roles/compute.viewer