Google PCA Designing for Security and Compliance Practice Test 8 — 15 Questions

Question 1

A healthcare company runs a multi-tenant SaaS platform on Google Cloud. Each tenant has a dedicated folder inside a single organization, with projects for each environment. A recent audit found that a compromised service account in one tenant's dev project could enumerate and read Cloud Storage buckets belonging to other tenants because the service account had been granted roles/storage.admin at the organization level by mistake. The security team wants a preventive control that blocks any future IAM binding that grants a role to a principal at a scope broader than a single project, unless the principal is part of a small break-glass group. They also want the control to apply automatically to all new projects. What should the architect implement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure an organization policy using a custom constraint on the iam.googleapis.com/AllowPolicy resource, denying bindings where the resource scope is the organization or a folder unless the principal is in the break-glass group.. The requirement is a preventive, hierarchy-wide guardrail against overly broad IAM grants. Custom organization policy constraints on the IAM allow policy resource can inspect both the binding's scope and the principal, so a rule that denies organization- and folder-level grants except for a designated break-glass group enforces least privilege automatically for existing and new projects. Domain-based and condition-based approaches either do not address scope breadth or rely on per-binding correctness, so they would not have prevented the audit finding.

Answer

Create an organization policy with the iam.allowedPolicyMemberDomains constraint set to the company's Cloud Identity domain, and apply it to the organization node.

Answer

Enable IAM Conditions on all role bindings and require a condition that the resource name matches the tenant's folder path.

Answer

Create an organization policy with the iam.disablePolicyMemberDomainCheck constraint and apply it to the organization node.

Question 2

A financial services firm stores sensitive customer transaction data in Cloud Storage buckets. The security team wants to ensure that the data is encrypted at rest with a key that the firm controls, and that the key is automatically rotated every 90 days. They also need to be able to revoke access to the data immediately by disabling the key. Which Google Cloud service and configuration should they use?

Accepted Answer

Use Customer-Managed Encryption Keys (CMEK) with Cloud KMS, set a rotation period of 90 days, and disable the key to revoke access.. Customer-Managed Encryption Keys (CMEK) with Cloud KMS allow organizations to control the encryption keys used for data at rest in Cloud Storage. You can set an automatic rotation period, such as 90 days, and disabling the key immediately revokes access to the data. This satisfies the requirements for control, automatic rotation, and immediate revocation.

Answer

Use Customer-Supplied Encryption Keys (CSEK) and store the keys in a secure vault, rotating them manually every 90 days.

Answer

Use Google-managed encryption keys and configure a Cloud Scheduler job to rotate the keys every 90 days.

Answer

Use Cloud HSM to generate keys, and configure Cloud Storage to use those keys with a 90-day rotation policy.

Question 3

A financial services company stores regulated data in BigQuery datasets. Auditors require that all data access be logged with the identity of the user, the query text, and the timestamp, and that logs be retained for 365 days and be immutable. The security team wants to use Google Cloud-native tools with minimal operational overhead. What should they implement?

Accepted Answer

Enable BigQuery Data Access audit logs in Cloud Audit Logs, then create a log sink to a Cloud Storage bucket with a 365-day retention policy and a Bucket Lock.. BigQuery Data Access audit logs provide the required identity, query text, and timestamp for every data access. Routing them through a log sink to a Cloud Storage bucket with a retention policy and Bucket Lock ensures immutability for 365 days. This combination uses native Google Cloud services and requires no custom code or third-party tooling, minimizing operational overhead.

Answer

Enable BigQuery Data Access audit logs and configure a log sink to a BigQuery dataset with a 365-day partition expiration and table-level IAM restrictions.

Answer

Use BigQuery's INFORMATION_SCHEMA.JOBS_BY_PROJECT view to query historical job metadata, and export results to Cloud Storage on a daily schedule via a Cloud Scheduler job.

Answer

Enable VPC Service Controls for BigQuery and configure access levels that log all API calls to Cloud Logging with a 365-day retention period.

Question 4

A company is migrating its on-premises data warehouse to BigQuery. The security team requires that all data at rest in BigQuery is encrypted with keys that the company controls, and that key usage is logged for auditing. They also need to be able to revoke access to the data by disabling the key. Which configuration should they implement?

Accepted Answer

Use Customer-Managed Encryption Keys (CMEK) for BigQuery, and enable Cloud KMS audit logs.. Customer-Managed Encryption Keys (CMEK) for BigQuery allow you to use your own keys in Cloud KMS to encrypt data at rest. Enabling Cloud KMS audit logs records all key usage, satisfying the auditing requirement. Disabling the key revokes access to the data. This configuration meets all security requirements.

Answer

Use BigQuery default encryption and enable Cloud Audit Logs for BigQuery.

Answer

Use Customer-Supplied Encryption Keys (CSEK) for BigQuery, and store the keys in a secure vault.

Answer

Use Cloud HSM to generate keys, and configure BigQuery to use those keys for encryption.

Question 5

A financial services company runs a regulated workload on Compute Engine in a single project. Auditors require that all data written to persistent disks, including boot disks, is encrypted with keys the company controls and can revoke on demand, without the company operating its own key management infrastructure. The security lead must choose an encryption approach that satisfies this requirement with the least operational overhead. What should the security lead do?

Accepted Answer

Configure customer-managed encryption keys (CMEK) in Cloud KMS and set the project-level default key so new persistent disks are encrypted with the company's key.. CMEK in Cloud KMS is the correct fit because the company retains ownership and control of the key while Google operates the HSM-backed key infrastructure. Setting a project-level default key ensures new persistent disks and boot disks use the company's key automatically, and disabling a key version immediately makes the data inaccessible, meeting the revocability requirement with minimal operational effort.

Answer

Enable Confidential VM on all instances so that memory and disk contents are protected by encryption keys generated and held inside the hardware.

Answer

Rely on Google-managed encryption keys, which rotate automatically, and use Cloud External Key Manager to wrap the keys after the fact.

Answer

Use customer-supplied encryption keys (CSEK) passed to the Compute Engine API so the company holds the raw key material outside of Google Cloud.

Question 6

A healthcare company stores protected health information in Cloud Storage and BigQuery. Compliance requires that access to this data be auditable and that no single administrator can both modify data and erase the audit trail. The security architect is designing the logging and access model. Which two actions should the architect take? (Choose two.)

Accepted Answer

Create a dedicated log bucket with a locked retention policy and grant the security team roles/logging.viewer on it while removing Logging Admin from data project owners.. Auditability and separation of duties require capturing Data Access logs for the services holding PHI and storing them where data administrators cannot alter them. Routing logs to a separate project's log bucket with a locked retention policy makes the trail immutable, and limiting the security team to Logging Viewer while removing Logging Admin from data owners ensures no single person can both change data and erase the evidence.

Answer

Use BigQuery row-level security to restrict which rows each analyst can read, and rely on that as the sole audit mechanism for PHI access.

Answer

Grant project owners the Logging Admin role so they can manage log sinks and adjust retention as operational needs change.

Answer

Store audit logs in the same Cloud Storage bucket as the PHI so that access reviews cover both data and logs in a single IAM policy.

Question 7

A healthcare organization is designing a Google Cloud environment to comply with HIPAA. They need to ensure that all access to sensitive data is logged and that only authorized personnel can access it. They plan to use Cloud Audit Logs and IAM. Which two configurations should they implement? (Choose two.)

Accepted Answer

Enable Data Access audit logs for all services that store or process ePHI.. Enabling Data Access audit logs ensures that all access to ePHI is recorded, which is a HIPAA requirement. Using IAM Conditions restricts access based on context, ensuring only authorized personnel from trusted environments can access data. Together, these provide both logging and access control. The other options either over-provision access or address different security concerns not directly tied to the stated needs.

Answer

Set the organization policy constraint `iam.disableServiceAccountKeyCreation` to prevent key leakage.

Answer

Enable VPC Service Controls to create a service perimeter around the project containing ePHI.

Answer

Grant the `roles/iam.securityReviewer` role to all employees who need to view audit logs.

Question 8

A startup runs a public API on Compute Engine behind an external HTTP(S) load balancer. The security team wants to block common web attacks such as SQL injection and cross-site scripting at the edge, with minimal changes to the application, and they want the protection rules to be managed centrally and updated as new signatures are released. What should the architect recommend?

Accepted Answer

Deploy Cloud Armor security policies with preconfigured WAF rules and attach the policy to the backend service of the external HTTP(S) load balancer.. Cloud Armor is Google Cloud's edge security service that attaches to external HTTP(S) load balancer backend services. Its preconfigured WAF rules, derived from the ModSecurity core rule set, detect and block SQL injection, cross-site scripting, and other OWASP-style attacks. Because Google manages the rule signatures and policies are configured once at the load balancer, the application needs no changes and protection is centralized.

Answer

Enable Identity-Aware Proxy on the backend service and require Google account authentication for all API calls.

Answer

Install a third-party WAF on each Compute Engine instance and configure it to read request bodies before the application does.

Answer

Create VPC firewall rules that deny traffic containing suspicious URL patterns to the load balancer's forwarding rule.

Question 9

A company runs a public-facing web application on Compute Engine instances behind an external HTTP(S) load balancer. They want to protect the application from common web attacks such as SQL injection and cross-site scripting, and they also want to restrict access to known IP ranges. Which Google Cloud service should they use?

Accepted Answer

Cloud Armor security policy with preconfigured WAF rules and IP allowlist rules.. Cloud Armor is the correct choice because it provides both WAF protection against common web attacks and IP-based access control. It is designed to work with external HTTP(S) load balancers, making it the appropriate service for securing a public web application. The other options either lack WAF capabilities or are intended for different use cases such as performance or identity-based access.

Answer

VPC firewall rules to allow only specific IP ranges and block malicious traffic.

Answer

Cloud CDN with signed URLs to restrict access and cache content.

Answer

Identity-Aware Proxy (IAP) to authenticate users and enforce access policies.

Question 10

A healthcare company stores sensitive patient data in Cloud Storage. They must ensure that data is encrypted at rest with a key that they manage, and that the key is automatically rotated every 90 days. They also need to be able to audit key usage. Which approach should they take?

Accepted Answer

Create a Cloud KMS key with a rotation period of 90 days, grant the Cloud Storage service account encrypt/decrypt permissions on the key, and configure the bucket to use that key as the default encryption key.. Cloud KMS provides automatic key rotation and audit logging. By setting a bucket default key, all objects are encrypted with the CMEK. Granting the Cloud Storage service account encrypt/decrypt permissions is required for the bucket to use the key. This approach meets encryption, rotation, and auditing requirements with minimal overhead.

Answer

Use a Cloud HSM key with a rotation period of 90 days, and configure the bucket with a retention policy that enforces encryption.

Answer

Use Customer-Supplied Encryption Keys (CSEK) with a 90-day rotation managed by the application, and enable Cloud Audit Logs for Cloud Storage.

Answer

Create a Cloud KMS key with a rotation period of 90 days, and use an organization policy constraint to require CMEK on all Cloud Storage buckets.

Question 11

An organization runs workloads in multiple Google Cloud projects and wants a single, consistent way to detect and respond to threats such as compromised service accounts and anomalous API calls across all of them. The security operations team needs findings aggregated in one place and wants to reduce the effort of correlating events from Cloud Audit Logs, VPC Flow Logs, and Cloud DNS logs. Which Google Cloud service should the architect recommend?

Accepted Answer

Security Command Center with the Premium tier enabled at the organization level, using its built-in detectors and Event Threat Detection.. Security Command Center Premium is the centralized security posture and threat detection service for Google Cloud. Enabled at the organization level, it continuously evaluates resources across projects and Event Threat Detection consumes Cloud Audit Logs, VPC Flow Logs, and Cloud DNS logs to identify compromised service accounts, anomalous API calls, and similar threats, consolidating findings so the security operations team does not have to correlate sources manually.

Answer

VPC Service Controls perimeters around each project with access levels tied to the corporate network.

Answer

Cloud Logging with log-based metrics and alerting policies that trigger when error rates exceed a threshold.

Answer

Cloud Monitoring dashboards combined with uptime checks on each project's API endpoints.

Question 12

A multinational corporation needs to ensure that data stored in Cloud Storage buckets in their Google Cloud organization cannot be accessed from outside their corporate network, even if IAM policies are misconfigured. They want to enforce this at the organization level with minimal administrative overhead. What should they do?

Accepted Answer

Create a VPC Service Controls perimeter that includes the Cloud Storage service and the projects containing the buckets, and configure access levels to allow only corporate IP ranges.. VPC Service Controls provide a centralized, organization-level security perimeter that prevents access to Cloud Storage from outside authorized networks, even if IAM policies are misconfigured. By defining access levels based on corporate IP ranges, the organization can ensure that only requests from the corporate network are allowed. This is the most effective and least administrative approach compared to per-binding IAM Conditions or bucket-level constraints.

Answer

Enable Cloud Armor security policies on all Cloud Storage buckets to block external IPs.

Answer

Use IAM Conditions on all Cloud Storage IAM bindings to allow access only from corporate IP ranges.

Answer

Apply an organization policy constraint `storage.publicAccessPrevention` to all buckets.

Question 13

Your company is designing a secure architecture for a new application on Google Cloud. They need to ensure that service accounts used by the application have only the necessary permissions, and that any use of those service accounts is auditable. Which two actions should they take? (Choose two.)

Accepted Answer

Grant the service accounts predefined roles that include only the required permissions, and avoid using basic roles like Editor.. Least privilege is achieved by granting only the necessary predefined roles and avoiding basic roles. Auditability of service account usage requires enabling Data Access audit logs, which are not enabled by default. Together, these actions ensure that service accounts have minimal permissions and that their actions are logged for auditing.

Answer

Create a custom role that includes all permissions the application might need in the future, to avoid frequent updates.

Answer

Use service account keys and rotate them every 90 days to ensure secure authentication.

Answer

Assign the service accounts the Project Editor role to simplify permission management.

Question 14

A company is deploying a new application on Google Kubernetes Engine (GKE). They need to ensure that pods can only pull container images from a private Artifact Registry repository and that images are scanned for vulnerabilities before deployment. They also want to prevent pods from being scheduled if they use images from public registries. What should they do?

Accepted Answer

Use Binary Authorization with a policy that requires attestations from a vulnerability scanner, and configure the GKE cluster to only allow images from the private Artifact Registry.. Binary Authorization is the managed service for enforcing deploy-time policies on GKE, including requiring attestations from vulnerability scanners and restricting images to trusted registries. Configuring the cluster to only allow images from the private Artifact Registry ensures that public images cannot be used. Together, they meet the security requirements.

Answer

Enable Container Analysis API and use an admission controller to block images from public registries.

Answer

Configure a private GKE cluster and use network policies to block egress to public registries.

Answer

Use Anthos Config Management with a policy that denies pods using public images, and enable vulnerability scanning in Artifact Registry.

Question 15

A multinational corporation needs to comply with data residency requirements for EU customer data. They want to ensure that data stored in Cloud Storage, BigQuery, and Cloud SQL for EU customers never leaves the European Union, even by administrators. They also want to detect and remediate any configuration drift that could violate this policy. What should they implement?

Accepted Answer

Create an organization policy constraint 'constraints/gcp.resourceLocations' with allowed values set to EU regions, and apply it at the organization level. Use Security Command Center to monitor for violations.. The organization policy constraint 'constraints/gcp.resourceLocations' is the native Google Cloud control that restricts resource creation to specified locations. Applied at the organization level, it ensures all projects inherit the EU-only restriction, preventing administrators from creating resources outside the EU. Security Command Center provides continuous monitoring and can detect any drift or violations, enabling remediation.

Answer

Deploy all workloads in EU regions and use a custom Terraform module that validates region parameters before deployment.

Answer

Configure VPC Service Controls perimeters around EU projects and use Access Context Manager to restrict access to EU-based identities.

Answer

Use Cloud KMS with EU-based key rings to encrypt all EU customer data, and rely on key location to enforce data residency.