Google PCA Design for security and compliance — 20 Questions

Question 1

Which THREE are valid methods to protect sensitive data in BigQuery?

Accepted Answer

Enable customer-managed encryption keys (CMEK) to encrypt sensitive columns.. Customer-managed encryption keys (CMEK) provide encryption at rest for BigQuery data, including sensitive columns, by using keys managed by the customer. Cloud DLP de-identification transforms can be applied during data ingestion to automatically mask or tokenize sensitive data. BigQuery column-level security allows restricting access to sensitive columns at the table level. These three methods directly protect sensitive data in BigQuery.

Answer

Create authorized views that query only non-sensitive columns.

Answer

Use IAM roles to grant access at the dataset level, which automatically masks sensitive data.

Question 2

A company wants to automatically rotate cryptographic keys on a schedule without manual intervention. Which service should they use?

Accepted Answer

Cloud Key Management Service (KMS). Cloud KMS provides built-in key rotation capabilities that allow you to automatically rotate cryptographic keys on a schedule (e.g., every 90 days) without manual intervention. You define a rotation period, and KMS automatically generates a new primary key version while retaining older versions for decryption of existing data. This is the correct service because it is specifically designed for managing encryption keys with automated lifecycle policies.

Answer

Secret Manager

Answer

Cloud Audit Logs

Answer

Cloud IAM

Question 3

A company hosts a web application on Google Kubernetes Engine (GKE) and wants to protect against SQL injection attacks. Which service should they configure?

Accepted Answer

Cloud Armor. Cloud Armor is the correct choice because it provides web application firewall (WAF) capabilities that can inspect HTTP/HTTPS traffic and block SQL injection attempts using preconfigured rules (e.g., the OWASP Top 10 rule set). It integrates directly with GKE via HTTP(S) Load Balancing, allowing you to enforce security policies at the edge before requests reach your application.

Answer

Identity-Aware Proxy (IAP)

Answer

Cloud Audit Logs

Answer

Container Analysis

Question 4

A company wants to restrict access to a Cloud Storage bucket so that only objects encrypted with a specific Cloud KMS key can be read. Which approach should they use?

Accepted Answer

Set a bucket policy that denies access if the object's encryption type is not CMEK.. Using a bucket policy with a condition on the encryption type (`request.object.encryption.type`) denies access to objects not encrypted with CMEK. This ensures that only objects encrypted with a customer-managed key (Cloud KMS) can be read. While the requirement mentions a specific key, the bucket policy can be further refined with a condition on the key resource name, but Option B is the only option that correctly uses encryption type checking. Option C is incorrect because `resource.hasTag` is not a valid IAM condition attribute for Cloud Storage objects; the correct attribute is `request.object.encryption.key_name`.

Answer

Enable Key Access Justifications on the Cloud KMS key and allow access only for justified requests.

Answer

Use IAM conditions with the resource name condition 'resource.name.startsWith("projects/_/buckets/example-bucket/objects/")' and 'resource.hasTag("kmsKeyName", "projects/p/locations/l/keyRings/kr/cryptoKeys/ck")'.

Answer

Configure VPC Service Controls to include the bucket and the Cloud KMS key resource.

Question 5

A company wants to use Cloud Armor to protect their HTTP load balancer from SQL injection attacks. Which rule action should they configure to block malicious requests?

Accepted Answer

Use a pre-configured WAF rule that includes 'evaluatePreconfiguredExpr('sqli-stable')' with action 'deny(403)'.. Cloud Armor's pre-configured WAF rules include 'evaluatePreconfiguredExpr('sqli-stable')', which specifically detects SQL injection patterns in HTTP requests. Applying the 'deny(403)' action blocks malicious requests by returning a 403 Forbidden status, preventing the attack from reaching the backend. This is the correct approach because Cloud Armor WAF rules are purpose-built for application-layer threats like SQL injection.

Answer

Configure a rate-limiting rule with action 'rateLimit' to throttle traffic from suspicious IPs.

Answer

Create a rule that redirects traffic to a reCAPTCHA challenge for validation.

Answer

Set a security policy rule with action 'deny(403)' and a simple condition on the user-agent header.

Question 6

A company is using Cloud SQL with automatic backups enabled. They want to ensure that backups are encrypted with a customer-managed key (CMEK) and that the key used for backups is different from the one used for the database itself. How can they achieve this?

Accepted Answer

When creating the Cloud SQL instance, specify a CMEK for the database using 'root.encryptionKeyName' and a different CMEK for backups using 'backup.encryptionKeyName'.. Cloud SQL supports specifying separate CMEKs for the database and its backups via the `root.encryptionKeyName` and `backup.encryptionKeyName` fields when creating the instance. This allows you to use a customer-managed key for the database and a different customer-managed key for automatic backups, meeting the requirement for key separation.

Answer

Create a Cloud KMS key ring with two keys, and use one key for the database and the other for backups, but Cloud SQL does not support separate keys.

Answer

Use the same CMEK for both the database and backups, as separate keys are not supported.

Answer

Enable CMEK on the Cloud SQL instance, and the backups will automatically use the same key.

Question 7

Which TWO security best practices should be applied when configuring Cloud Functions that process sensitive data? (Choose two.)

Accepted Answer

Enable VPC connector and set ingress to internal to avoid public internet exposure.. Enabling a VPC connector and setting ingress to 'internal' ensures that the Cloud Function can only be invoked from resources within the same VPC network, eliminating exposure to the public internet. This is a critical security best practice for functions processing sensitive data, as it enforces network isolation and reduces the attack surface.

Answer

Disable all inbound network traffic to the function.

Answer

Enable Cloud KMS customer-managed encryption for the function's environment variables.

Answer

Use the default Compute Engine default service account for simplicity.

Question 8

A company is migrating sensitive customer data to Google Cloud. They need to ensure data is encrypted at rest and in transit. Which Google Cloud service provides a centralized way to manage encryption keys used by Google Cloud services?

Accepted Answer

Cloud Key Management Service (Cloud KMS). Cloud KMS is the correct choice because it provides a centralized, managed service for creating, rotating, and destroying encryption keys used by Google Cloud services. It integrates directly with services like Cloud Storage, BigQuery, and Compute Engine to enforce encryption at rest, and it supports customer-managed encryption keys (CMEK) for granular control. For data in transit, Cloud KMS can be used to manage keys for TLS or application-level encryption, though Google Cloud automatically encrypts all network traffic by default.

Answer

Cloud HSM

Answer

Cloud External Key Manager (Cloud EKM)

Answer

Secret Manager

Question 9

A financial services company runs a multi-tier application on Compute Engine. They need to restrict network access so that only the web tier can communicate with the application tier, and only the application tier can access the database tier. All VMs are in the same VPC network. What is the most secure way to implement this?

Accepted Answer

Use VPC firewall rules with target tags to allow traffic between specific tiers.. VPC firewall rules with target tags allow you to precisely control ingress and egress traffic between VM instances based on their assigned tags. By tagging web tier VMs with a tag like 'web-tier' and application tier VMs with 'app-tier', you can create a firewall rule that allows traffic from 'web-tier' to 'app-tier' on the required port (e.g., TCP 8080) and another rule allowing traffic from 'app-tier' to 'db-tier' on the database port (e.g., TCP 3306). This approach enforces the principle of least privilege within a single VPC network without introducing unnecessary complexity or breaking network isolation.

Answer

Use Identity-Aware Proxy (IAP) to manage network access between tiers.

Answer

Create separate VPC networks for each tier and use VPC peering.

Answer

Assign a unique service account to each tier and use IAM conditions to restrict traffic.

Question 10

A healthcare organization uses Cloud Storage to store protected health information (PHI). They have a compliance requirement to ensure that all objects in the bucket are encrypted with a customer-managed key (CMK) that is rotated every 90 days. They also need to log all access to the bucket and detect anomalous access patterns. Which combination of Google Cloud services should they use?

Accepted Answer

Cloud Storage with CMEK via Cloud KMS, Cloud Audit Logs, and Chronicle. Cloud Storage with CMEK via Cloud KMS allows the organization to use a customer-managed key that can be rotated every 90 days, meeting the compliance requirement. Cloud Audit Logs capture all access to the bucket, and Chronicle provides advanced security analytics to detect anomalous access patterns, fulfilling the logging and detection needs.

Answer

Cloud Storage with default encryption, Cloud Audit Logs, and Security Command Center

Answer

Cloud Storage with CMEK via Cloud HSM, Cloud Audit Logs, and Cloud DLP

Answer

Cloud Storage with CSEK, Cloud Audit Logs, and Security Command Center

Question 11

An e-commerce platform uses Cloud SQL for MySQL to store user profiles and order history. The security team wants to ensure that database administrators (DBAs) cannot view plaintext credit card numbers stored in the database. They also want to minimize application changes. What should they do?

Accepted Answer

Use Cloud DLP with de-identification and re-identification transforms on the Cloud SQL database.. Cloud DLP can be used to de-identify sensitive data like credit card numbers at rest in Cloud SQL, using deterministic or reversible transformations (e.g., format-preserving encryption or tokenization) that allow re-identification only by authorized applications. This approach minimizes application changes because DLP can scan and transform the data directly in the database, and the application can use re-identification transforms via the DLP API when needed, without modifying existing queries or schema.

Answer

Implement column-level encryption using Cloud KMS in the application layer.

Answer

Grant DBAs the Cloud SQL Viewer role to restrict access to data.

Answer

Use Cloud SQL Proxy to encrypt connections and limit DBA access.

Question 12

A company wants to ensure that only Compute Engine instances with a specific service account can access a Cloud Storage bucket. Which IAM condition should they use?

Accepted Answer

Condition: 'iam.serviceAccount == "sa@project.iam.gserviceaccount.com"'. The `iam.serviceAccount` condition attribute in IAM conditions allows you to restrict access based on the service account identity of the caller. When a Compute Engine instance uses a service account, the condition `iam.serviceAccount == "sa@project.iam.gserviceaccount.com"` ensures that only requests authenticated with that specific service account are allowed to access the Cloud Storage bucket. This is the standard IAM condition attribute for matching the service account of the requesting principal.

Answer

Condition: 'request.auth == "serviceAccount:sa@project.iam.gserviceaccount.com"'

Answer

Condition: 'origin.serviceAccount == "sa@project.iam.gserviceaccount.com"'

Answer

Condition: 'resource.serviceAccount == "sa@project.iam.gserviceaccount.com"'

Question 13

A multinational corporation operates in multiple regions and must comply with GDPR. They use Cloud Load Balancing to distribute traffic across regional backends. Their security team wants to block traffic from specific countries (e.g., non-EU countries) at the edge. What should they use?

Accepted Answer

Use Cloud Armor security policies with geographic-based denylist rules.. Cloud Armor security policies support geographic-based access control using denylist or allowlist rules that match client IP addresses against country-level geolocation data. This allows the security team to block traffic from specific countries at the edge, before it reaches the backend, which is the most efficient and compliant approach for GDPR enforcement.

Answer

Configure Cloud CDN to serve content only to EU-based users.

Answer

Set VPC firewall rules to allow traffic only from EU IP ranges.

Answer

Configure Identity-Aware Proxy (IAP) to require user authentication from allowed countries.

Question 14

Which TWO are recommended practices for securing a Kubernetes Engine (GKE) cluster?

Accepted Answer

Enable Binary Authorization to ensure only signed container images are deployed.. Binary Authorization enforces that only container images signed by trusted authorities (e.g., during a CI/CD pipeline) can be deployed to the cluster. This integrates with Google Cloud's Attestation Authority and ensures supply chain security by verifying signatures against a policy before admission.

Answer

Disable HTTP load balancing to reduce attack surface.

Answer

Use the default Compute Engine service account for all GKE nodes.

Answer

Enable basic authentication for easier access management.

Question 15

Your company runs a multi-region web application on Google Kubernetes Engine (GKE) with pods that process sensitive user data. The application uses Cloud SQL for PostgreSQL as the backend database. Your security team has implemented the following controls: 1) All traffic to the database is encrypted using SSL/TLS. 2) The GKE cluster uses Workload Identity to bind Kubernetes service accounts to IAM service accounts. 3) The Cloud SQL instance is configured with a public IP address and authorized networks to allow only the GKE cluster's node IP ranges. 4) The database credentials are stored in Secret Manager and mounted as volumes in the pods. Recently, a security audit revealed that a pod was compromised due to a container vulnerability. The attacker was able to exfiltrate sensitive data directly from the Cloud SQL database using the credentials from Secret Manager. The security team wants to prevent such exfiltration in the future while minimizing changes to the application code. Which course of action should you recommend?

Accepted Answer

Deploy Cloud SQL Auth Proxy as a sidecar container in each pod, and configure IAM database authentication to replace static credentials.. Deploying Cloud SQL Auth Proxy as a sidecar container enforces IAM-based authentication, eliminating static credentials that can be exfiltrated. The proxy also handles SSL/TLS encryption automatically and allows fine-grained access control via IAM permissions, so even if a pod is compromised, the attacker cannot reuse stolen credentials because they are tied to the pod's identity via Workload Identity. This approach requires minimal code changes since the application connects to localhost instead of the Cloud SQL public IP.

Answer

Migrate the database to Cloud Spanner, which has built-in IAM integration and automatic encryption.

Answer

Rotate the database password and store the new password in Secret Manager, then update the application to fetch the password from Secret Manager at startup.

Answer

Change the Cloud SQL instance to use a private IP address and disable public access, ensuring only the GKE cluster can reach it via VPC peering.

Question 16

A company is migrating its on-premises workloads to Google Cloud. They have strict compliance requirements that all data at rest must be encrypted with customer-managed encryption keys (CMEK). Which Google Cloud service should they use to manage the lifecycle of these keys?

Accepted Answer

Cloud Key Management Service (Cloud KMS). Cloud KMS is the correct service because it provides centralized management of customer-managed encryption keys (CMEK) for Google Cloud services. It allows you to create, rotate, destroy, and set permissions on symmetric and asymmetric keys, and integrates directly with services like Cloud Storage, BigQuery, and Compute Engine to enforce encryption at rest with keys you control.

Answer

Secret Manager

Answer

Cloud External Key Manager (Cloud EKM)

Answer

Cloud Hardware Security Module (Cloud HSM)

Question 17

Which TWO of the following are valid methods to control access to Google Cloud resources using Identity and Access Management (IAM)?

Accepted Answer

Attach an IAM policy to an organization. Attaching an IAM policy to an organization (option A) is a valid method because it allows you to set organization-wide policies that apply to all projects and resources within that organization. This is a fundamental feature of Google Cloud's hierarchical resource management, where policies can be inherited from the organization node down to folders and projects, enabling centralized control over access.

Answer

Attach an IAM policy to a user

Answer

Assign an IAM role directly to a user

Answer

Attach an IAM policy to a service account

Question 18

An organization has set the IAM policy constraint 'constraints/iam.allowedPolicyMemberDomains' with the values shown. Which of the following users can be granted an IAM role on a project in this organization? (Choose all that apply.)

Accepted Answer

service-account@project-id.iam.gserviceaccount.com. The constraint 'constraints/iam.allowedPolicyMemberDomains' restricts IAM role grants to members from specified domains. The correct answer includes both A and D. Option A: service-account@project-id.iam.gserviceaccount.com is allowed because service accounts ending in 'gserviceaccount.com' are Google-managed and implicitly exempt from the constraint. Option D: user@example.com is allowed because 'example.com' is one of the domains specified in the constraint (as implied by the correct marking). The constraint explicitly lists allowed domains, and 'example.com' is included. Options B and C are from domains not in the allowed list, so they cannot be granted roles.

Answer

external@otherdomain.com

Answer

admin@another-customer-domain.com

Question 19

Your company has a production environment on Google Cloud that includes Compute Engine instances, Cloud Storage buckets, and BigQuery datasets. Security policies require that all data at rest is encrypted with CMEK, and audit logs must be retained for 7 years. The current configuration uses Google-managed encryption keys. You have been asked to transition to CMEK for all resources. After enabling CMEK for new resources, you discover that the existing resources are not re-encrypted. To comply with the policy, you need to re-encrypt the existing data. What should you do?

Accepted Answer

For Compute Engine: create new disks with CMEK, attach them, and copy data. For Cloud Storage: rewrite objects with CMEK. For BigQuery: copy datasets to new datasets with CMEK.. CMEK is applied at the resource creation level for Compute Engine disks, Cloud Storage buckets, and BigQuery datasets. Existing resources encrypted with Google-managed keys cannot be re-encrypted in place; you must create new resources with CMEK enabled and migrate the data. For Compute Engine, this means creating new disks with CMEK, attaching them, and copying data. For Cloud Storage, you rewrite objects to a new bucket or use the rewrite API with CMEK. For BigQuery, you copy datasets to new datasets that have CMEK configured.

Answer

Enable CMEK on the existing resources by modifying the resource's encryption settings. This will automatically re-encrypt the data.

Answer

Delete the existing resources and recreate them with CMEK enabled. Then restore data from backups.

Answer

Enable Data Loss Prevention (DLP) API to scan and re-encrypt data automatically.

Question 20

A company is deploying a multi-tier web application on Google Cloud. The application must comply with PCI DSS. Which combination of Google Cloud services should be used to restrict access to the database tier to only the application tier, while also encrypting data at rest and in transit?

Accepted Answer

Use Cloud SQL with private IP and SSL/TLS, and enable Cloud Key Management Service (KMS) to create a key ring and customer-managed encryption key (CMEK). It meets all PCI DSS requirements: Cloud SQL with private IP ensures the database tier is not exposed to the public internet, restricting access to only the application tier within the same VPC. SSL/TLS encrypts data in transit, and using Cloud KMS with a customer-managed encryption key (CMEK) provides control over encryption keys for data at rest, which is often required for compliance.

Answer

Use Cloud Spanner with private IP and SSL/TLS, and enable Google-managed encryption keys

Answer

Use Cloud SQL with public IP and SSL/TLS, and enable Google-managed encryption keys

Answer

Use Cloud Datastore with secure WebSocket connections and enable customer-managed encryption keys