Google PCA Designing for Security and Compliance Practice Test 6 — 15 Questions

Question 1

An organization needs to run workloads that are subject to ITAR (International Traffic in Arms Regulations) in Google Cloud. Which region should they use to ensure compliance with ITAR requirements?

Accepted Answer

us-military-east4. Assured Workloads for Government provides controlled regions that are compliant with ITAR. The us-central1 region is not ITAR-compliant. The us-military regions (e.g., us-military-east4) are part of Assured Workloads for Government and support ITAR.

Answer

europe-west1

Answer

us-central1

Answer

us-east1

Question 2

A developer wants to store a database password securely and have it automatically rotated every 30 days. The password is used by a Compute Engine instance. Which Google Cloud service should they use?

Accepted Answer

Secret Manager. Secret Manager can store secrets and has built-in rotation capabilities. You can set a rotation period and a rotation function (e.g., Cloud Function) to generate a new password. This is the recommended service.

Answer

Cloud Storage with customer-supplied encryption keys

Answer

Cloud Key Management Service (Cloud KMS)

Answer

Environment variables in Compute Engine

Question 3

A security team needs to detect and redact personally identifiable information (PII) in documents stored in Cloud Storage before sharing them with external partners. Which two Google Cloud services should they use together? (Choose two.)

Accepted Answer

Cloud Data Loss Prevention (DLP) API. Cloud DLP can scan Cloud Storage for PII and de-identify the data. The scanned and de-identified results can be written back to Cloud Storage. Cloud Dataflow is not needed for this simple use case; Cloud Function can trigger DLP jobs.

Answer

Cloud KMS

Answer

Cloud Dataflow

Answer

Cloud NAT

Question 4

A company wants to allow a Kubernetes pod in GKE to authenticate to Google Cloud APIs without storing service account keys in the cluster. Which three components need to be configured to enable Workload Identity? (Choose three.)

Accepted Answer

Google Cloud service account. Workload Identity requires: (1) a Google Cloud IAM service account (GCP SA), (2) a Kubernetes service account (KSA) annotated with the GCP SA email, and (3) an IAM policy binding between the KSA and GCP SA to allow impersonation.

Answer

Firewall rule to allow traffic to metadata server

Answer

Cloud NAT for outbound access

Question 5

An organization wants to protect an HTTPS load-balanced web application from common web attacks, such as SQL injection and cross-site scripting (XSS), as well as rate-limit traffic from specific IPs. Which three capabilities should they use together? (Choose three.)

Accepted Answer

Cloud Armor rate limiting. Cloud Armor provides WAF rules (preconfigured rules for SQLi, XSS, etc.), rate limiting, and IP blacklisting/whitelisting. All three are part of Cloud Armor security policies.

Answer

Cloud CDN

Answer

Cloud Load Balancing logging

Question 6

An organization wants to enforce that all container images deployed to Google Kubernetes Engine (GKE) are signed and approved via an attestation authority. Which GCP service should they use?

Accepted Answer

Binary Authorization. Binary Authorization enforces deployment-time policies that require container images to be signed by trusted authorities. It integrates with GKE and Cloud Build to ensure only signed images are deployed.

Answer

Container Registry

Answer

Cloud Armor

Answer

Cloud Security Scanner

Question 7

A company needs to grant a data scientist read-only access to BigQuery datasets in the project 'analytics-prod' without granting permissions to any other resources. Which IAM role should be assigned at the project level?

Accepted Answer

roles/bigquery.dataViewer. The BigQuery Data Viewer role (roles/bigquery.dataViewer) grants read access to BigQuery datasets and tables. Assigning at the project level applies to all datasets in that project.

Answer

roles/viewer

Answer

roles/bigquery.user

Answer

roles/bigquery.jobUser

Question 8

A security engineer wants to prevent data exfiltration from a project 'prod-data' by ensuring that only approved VPC networks can access BigQuery datasets. Which GCP service should be used?

Accepted Answer

VPC Service Controls. VPC Service Controls create service perimeters that protect resources by restricting access from outside the perimeter. They can be used to limit BigQuery access to specific VPC networks or IP ranges.

Answer

Private Google Access

Answer

Cloud Armor

Answer

Cloud NAT

Question 9

A company wants to encrypt data at rest in Cloud Storage using their own keys stored on-premises. They need to rotate the key every 30 days. Which encryption option should they use?

Accepted Answer

Customer-Supplied Encryption Keys (CSEK). Customer-Supplied Encryption Keys (CSEK) allow users to provide their own keys for encrypting Cloud Storage objects. The keys are managed on-premises and can be rotated as needed.

Answer

Default encryption with Google-managed keys

Answer

Customer-Managed Encryption Keys (CMEK) with Cloud KMS

Answer

Cloud HSM

Question 10

An organization uses Active Directory (AD) on-premises and wants to synchronize user identities to Google Cloud Identity so that users can access G Suite and GCP resources with their existing credentials. Which service should they use?

Accepted Answer

Cloud Directory Sync. Cloud Directory Sync (formerly Google Cloud Directory Sync) synchronizes users and groups from LDAP-compliant directories like Active Directory to Cloud Identity. It allows single sign-on and identity management.

Answer

Cloud Identity-Aware Proxy (IAP)

Answer

Federation with Google Identity Platform

Answer

SAML SSO

Question 11

A data engineer needs to automatically detect and redact sensitive data such as credit card numbers from text files uploaded to Cloud Storage before the data is loaded into BigQuery. Which GCP service should be used?

Accepted Answer

Cloud Data Loss Prevention (DLP) API. Cloud Data Loss Prevention (DLP) API can inspect text for sensitive patterns and de-identify (redact, mask, etc.) the content. It can be triggered via Cloud Functions or Cloud Workflows on file upload.

Answer

Cloud KMS

Answer

Cloud Audit Logs

Answer

Cloud Vision API

Question 12

A company wants to allow a Kubernetes pod in GKE to access a Cloud Storage bucket using a specific service account without storing long-lived credentials. Which method should be used?

Accepted Answer

Use Workload Identity to bind the Kubernetes service account to a Google Cloud service account. Workload Identity allows a Kubernetes service account to act as a Google Cloud service account by binding them. This eliminates the need for static keys and uses short-lived tokens.

Answer

Assign the service account directly to the GKE node pool

Answer

Create a JSON key for a service account and mount it as a secret in the pod

Answer

Use Application Default Credentials on the pod

Question 13

An organization needs to comply with FedRAMP High requirements and wants to run workloads in a GCP region that supports these controls. They also need to restrict data movement to only approved services. Which GCP feature should they use?

Accepted Answer

Assured Workloads [CORRECT]. Assured Workloads (option B) is the correct choice because it provides compliance controls for FedRAMP High and other regulatory frameworks, enabling the creation of a folder with specific compliance requirements. VPC Service Controls (option D) can be used to restrict data movement, but the primary feature for meeting FedRAMP High is Assured Workloads. Cloud HSM (A) provides hardware security module services for key management, not compliance frameworks. Data Access Audit Logging (C) provides logging but doesn't enforce compliance or restrict data movement.

Answer

Cloud HSM [wrong]

Answer

Data Access Audit Logging [wrong]

Answer

VPC Service Controls [wrong]

Question 14

A company has multiple GCP projects under a folder. They want to define a custom IAM role that can be reused across all projects. Where should the custom role be defined?

Accepted Answer

At the folder level. Custom roles can be defined at the organization level, folder level, or project level. To reuse across all projects, the role should be defined at the organization level or at the folder level if the folder contains all projects.

Answer

At the project level

Answer

At the organization level

Answer

At the resource level

Question 15

A security admin wants to audit all 'create' and 'delete' operations on Compute Engine instances in a project for the last 90 days. Which type of audit log should they query?

Accepted Answer

Admin Activity audit logs. Admin Activity audit logs record all API calls that modify configuration or metadata of resources. They are retained for 400 days by default.

Answer

Data Access audit logs

Answer

System Event audit logs

Answer

Policy Denied audit logs