Google PCA Designing for Security and Compliance Practice Test 7 — 15 Questions

Question 1

A company has a VPC Service Perimeter that protects a project containing BigQuery datasets. They want to allow an external customer's BigQuery job to query data across the perimeter boundary using a private connection. Which configuration is required?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create an ingress rule in the service perimeter that allows access from the external customer's VPC network.. VPC Service Controls perimeters block access to protected services (like BigQuery) from outside the perimeter by default. To allow an external customer's BigQuery job to query data across the boundary using a private connection, you must create an ingress rule in the service perimeter that specifies the source (the external VPC network or project) and the allowed identities, services, and resources. Ingress rules are the designed mechanism for permitting inbound cross-perimeter access without removing the project from protection.

Answer

Remove the project from the service perimeter temporarily.

Answer

Use Access Transparency to log cross-perimeter access.

Answer

Grant the external customer's service account the BigQuery User role.

Question 2

A developer wants to store a database password securely and have it automatically rotated every 30 days. The password is used by a Compute Engine instance. Which Google Cloud service should they use?

Accepted Answer

Secret Manager. Secret Manager is purpose-built for storing, versioning, and rotating secrets such as database passwords, API keys, and certificates. It supports automatic rotation via Cloud Functions or Pub/Sub triggers on a schedule (e.g., every 30 days), and Compute Engine instances can retrieve secrets at runtime using the Secret Manager API with IAM-controlled access. This directly satisfies both the secure storage and automatic rotation requirements.

Answer

Cloud Storage with customer-supplied encryption keys

Answer

Cloud Key Management Service (Cloud KMS)

Answer

Environment variables in Compute Engine

Question 3

A security team needs to detect and redact personally identifiable information (PII) in documents stored in Cloud Storage before sharing them with external partners. Which two Google Cloud services should they use together? (Choose two.)

Accepted Answer

Cloud Data Loss Prevention (DLP) API. The Cloud Data Loss Prevention (DLP) API (A) is the correct service for detecting and redacting personally identifiable information, since it provides infoType detectors and de-identification transforms such as redaction, masking, and tokenization that can scan and sanitize sensitive data. Cloud Storage (B) is also correct because the documents being scanned and shared reside in Cloud Storage buckets, and DLP integrates directly with Cloud Storage to inspect and de-identify objects in place or on export. Together, DLP performs the PII detection and redaction while Cloud Storage holds the source and destination documents, matching the scenario's requirement to sanitize files before external sharing. Cloud KMS (C) only manages encryption keys and cannot detect or redact PII content. Cloud Dataflow (D) is a data processing pipeline service that could orchestrate jobs but does not itself provide PII detection or redaction logic. Cloud NAT (E) is a networking service for outbound internet access and is unrelated to data inspection or redaction.

Answer

Cloud KMS

Answer

Cloud Dataflow

Answer

Cloud NAT

Question 4

A company wants to allow a Kubernetes pod in GKE to authenticate to Google Cloud APIs without storing service account keys in the cluster. Which three components need to be configured to enable Workload Identity? (Choose three.)

Accepted Answer

Google Cloud service account. Workload Identity requires: (1) a Google Cloud IAM service account (GCP SA), (2) a Kubernetes service account (KSA) annotated with the GCP SA email, and (3) an IAM policy binding between the KSA and GCP SA to allow impersonation.

Answer

Firewall rule to allow traffic to metadata server

Answer

Cloud NAT for outbound access

Question 5

An organization wants to protect an HTTPS load-balanced web application from common web attacks, such as SQL injection and cross-site scripting (XSS), as well as rate-limit traffic from specific IPs. Which three capabilities should they use together? (Choose three.)

Accepted Answer

Cloud Armor rate limiting. Cloud Armor WAF rules (C) are correct because Cloud Armor's preconfigured WAF rulesets, based on the ModSecurity core rule set, are specifically designed to detect and block common web attacks like SQL injection and XSS at the load balancer edge. Cloud Armor rate limiting (A) is correct because it lets you define rate-based rules that throttle or ban clients exceeding a request threshold, which directly addresses rate-limiting traffic from specific IPs. Cloud Armor IP blacklist/whitelist (E) is correct because it allows allow/deny rules scoped to specific source IP addresses or CIDR ranges, which is needed to block or permit traffic from particular IPs. Cloud CDN (B) is not correct because it is a content caching and delivery service, not a security control for WAF or rate limiting. Cloud Load Balancing logging (D) is not correct because it only records request data for visibility and auditing; it does not block attacks or enforce rate limits.

Answer

Cloud CDN

Answer

Cloud Load Balancing logging

Question 6

An organization wants to enforce that all container images deployed to Google Kubernetes Engine (GKE) are signed and approved via an attestation authority. Which GCP service should they use?

Accepted Answer

Binary Authorization. Binary Authorization is the Google Cloud service that enforces deploy-time security controls on GKE by allowing only container images that are signed and attested by trusted authorities. It integrates with GKE admission controllers to block unsigned or unattested images. This directly matches the requirement to enforce signed and approved images via an attestation authority.

Answer

Container Registry

Answer

Cloud Armor

Answer

Cloud Security Scanner

Question 7

A security engineer wants to prevent data exfiltration from a project 'prod-data' by ensuring that only approved VPC networks can access BigQuery datasets. Which GCP service should be used?

Accepted Answer

VPC Service Controls. VPC Service Controls create a service perimeter around GCP resources such as BigQuery datasets, restricting access to only approved VPC networks and identities. By placing the 'prod-data' project inside a perimeter and defining access levels, the engineer can block data exfiltration from unapproved networks. This is the GCP-native control designed specifically for this scenario.

Answer

Private Google Access

Answer

Cloud Armor

Answer

Cloud NAT

Question 8

An organization uses Active Directory (AD) on-premises and wants to synchronize user identities to Google Cloud Identity so that users can access G Suite and GCP resources with their existing credentials. Which service should they use?

Accepted Answer

Cloud Directory Sync. Google Cloud Directory Sync (GCDS) is the tool designed to synchronize users, groups, and organizational units from on-premises Active Directory (or LDAP) to Google Cloud Identity or Google Workspace. It runs on-premises, reads from AD via LDAP, and provisions matching identities in Google, enabling users to sign in with existing credentials.

Answer

Cloud Identity-Aware Proxy (IAP)

Answer

Federation with Google Identity Platform

Answer

SAML SSO

Question 9

A data engineer needs to automatically detect and redact sensitive data such as credit card numbers from text files uploaded to Cloud Storage before the data is loaded into BigQuery. Which GCP service should be used?

Accepted Answer

Cloud Data Loss Prevention (DLP) API. Cloud Data Loss Prevention (DLP) API is purpose-built to discover, classify, and redact sensitive data such as credit card numbers, social security numbers, and other PII from text and structured content. It can be integrated into a pipeline that scans files in Cloud Storage before loading into BigQuery, applying de-identification transformations like masking or tokenization. No other listed service provides sensitive-data detection and redaction capabilities.

Answer

Cloud KMS

Answer

Cloud Audit Logs

Answer

Cloud Vision API

Question 10

A company wants to allow a Kubernetes pod in GKE to access a Cloud Storage bucket using a specific service account without storing long-lived credentials. Which method should be used?

Accepted Answer

Use Workload Identity to bind the Kubernetes service account to a Google Cloud service account. Workload Identity is the recommended way to allow a Kubernetes pod in GKE to access Google Cloud services like Cloud Storage using a specific service account without long-lived credentials. It binds a Kubernetes service account to a Google Cloud service account, and the pod uses the Kubernetes service account to obtain short-lived credentials via the GKE metadata server. This eliminates the need for JSON keys.

Answer

Assign the service account directly to the GKE node pool

Answer

Create a JSON key for a service account and mount it as a secret in the pod

Answer

Use Application Default Credentials on the pod

Question 11

A security admin wants to audit all 'create' and 'delete' operations on Compute Engine instances in a project for the last 90 days. Which type of audit log should they query?

Accepted Answer

Admin Activity audit logs. Admin Activity audit logs record all write operations (create, update, delete) on project resources, including Compute Engine instances, and are always enabled with a 400-day retention. Querying Admin Activity logs for the last 90 days will show all create and delete operations on instances. Data Access logs, by contrast, record read operations and are disabled by default.

Answer

Data Access audit logs

Answer

System Event audit logs

Answer

Policy Denied audit logs

Question 12

A developer wants to store a database password that is used by a Cloud Function. The password must be automatically rotated every 30 days and accessed securely without storing it in the source code. Which GCP service should they use?

Accepted Answer

Secret Manager. Secret Manager is the GCP service purpose-built for storing, accessing, and rotating secrets like database passwords. It supports automatic rotation schedules (including 30-day intervals) via Cloud Functions or Pub/Sub notifications, and Cloud Functions can access secrets at runtime using the Secret Manager API with IAM controls, keeping credentials out of source code.

Answer

Cloud KMS

Answer

Cloud Runtime Configuration

Answer

Firestore

Question 13

A company uses Cloud Armor to protect an HTTPS Load Balancer. They want to allow traffic only from users who have passed a reCAPTCHA challenge. Cloud Armor supports which feature for this?

Accepted Answer

WAF rules with reCAPTCHA. Cloud Armor supports reCAPTCHA integration through WAF rules that use the 'token.recaptcha_session.score' or 'token.recaptcha_action.score' attributes to allow, deny, or redirect traffic based on the reCAPTCHA assessment score. This is configured as a security policy rule with a reCAPTCHA challenge action, enabling the load balancer to enforce human verification before granting access.

Answer

Preconfigured WAF rules

Answer

Adaptive Protection

Answer

Rate limiting

Question 14

A company wants to implement a zero-trust access model for internal web applications running on Compute Engine. They need to authenticate users using corporate credentials and enforce context-aware access based on device posture and IP address. Which TWO services should they use?

Accepted Answer

Cloud Identity. Cloud Identity (C) is correct because it provides the identity provider and user/group management that lets the company authenticate users with their corporate credentials, which is the foundation of a zero-trust identity model. Identity-Aware Proxy (IAP) (E) is correct because it enforces context-aware access to internal web applications on Compute Engine, evaluating user identity plus device posture and IP address before granting access, exactly matching the scenario's requirements. VPC Service Controls (A) is not correct here because it protects Google Cloud APIs and services at the perimeter level rather than authenticating users to internal web apps. Cloud VPN (B) only provides encrypted network connectivity and does not perform user authentication or context-aware access control. Cloud Armor (D) is a WAF/DDoS protection service that filters traffic at the edge but does not authenticate users or enforce device-posture-based access.

Answer

VPC Service Controls

Answer

Cloud VPN

Answer

Cloud Armor

Question 15

A startup wants to grant a contractor limited access to a single Cloud Storage bucket. The contractor should be able to view and download objects, but not delete or overwrite them. Which IAM role should be assigned?

Accepted Answer

roles/storage.objectViewer. The roles/storage.objectViewer role grants read-only access to objects in a bucket, including listing and downloading objects, but does not allow modification or deletion.

Answer

roles/storage.admin

Answer

roles/storage.objectAdmin

Answer

roles/storage.objectCreator