Google PCA Design for security and compliance — 40 Questions

Question 1

An e-commerce platform uses Cloud SQL for MySQL to store user profiles and order history. The security team wants to ensure that database administrators (DBAs) cannot view plaintext credit card numbers stored in the database. They also want to minimize application changes. What should they do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use Cloud DLP with de-identification and re-identification transforms on the Cloud SQL database.. Cloud DLP can be used to de-identify sensitive data like credit card numbers at rest in Cloud SQL, using deterministic or reversible transformations (e.g., format-preserving encryption or tokenization) that allow re-identification only by authorized applications. This approach minimizes application changes because DLP can scan and transform the data directly in the database, and the application can use re-identification transforms via the DLP API when needed, without modifying existing queries or schema.

Answer

Implement column-level encryption using Cloud KMS in the application layer.

Answer

Grant DBAs the Cloud SQL Viewer role to restrict access to data.

Answer

Use Cloud SQL Proxy to encrypt connections and limit DBA access.

Question 2

A company wants to ensure that only Compute Engine instances with a specific service account can access a Cloud Storage bucket. Which IAM condition should they use?

Accepted Answer

Condition: 'iam.serviceAccount == "sa@project.iam.gserviceaccount.com"'. The `iam.serviceAccount` condition attribute in IAM conditions allows you to restrict access based on the service account identity of the caller. When a Compute Engine instance uses a service account, the condition `iam.serviceAccount == "sa@project.iam.gserviceaccount.com"` ensures that only requests authenticated with that specific service account are allowed to access the Cloud Storage bucket. This is the standard IAM condition attribute for matching the service account of the requesting principal.

Answer

Condition: 'request.auth == "serviceAccount:sa@project.iam.gserviceaccount.com"'

Answer

Condition: 'origin.serviceAccount == "sa@project.iam.gserviceaccount.com"'

Answer

Condition: 'resource.serviceAccount == "sa@project.iam.gserviceaccount.com"'

Question 3

Which THREE are valid methods to protect sensitive data in BigQuery?

Accepted Answer

Enable customer-managed encryption keys (CMEK) to encrypt sensitive columns.. Customer-managed encryption keys (CMEK) provide encryption at rest for BigQuery data, including sensitive columns, by using keys managed by the customer. Cloud DLP de-identification transforms can be applied during data ingestion to automatically mask or tokenize sensitive data. BigQuery column-level security allows restricting access to sensitive columns at the table level. These three methods directly protect sensitive data in BigQuery.

Answer

Create authorized views that query only non-sensitive columns.

Answer

Use IAM roles to grant access at the dataset level, which automatically masks sensitive data.

Question 4

Your company runs a multi-region web application on Google Kubernetes Engine (GKE) with pods that process sensitive user data. The application uses Cloud SQL for PostgreSQL as the backend database. Your security team has implemented the following controls: 1) All traffic to the database is encrypted using SSL/TLS. 2) The GKE cluster uses Workload Identity to bind Kubernetes service accounts to IAM service accounts. 3) The Cloud SQL instance is configured with a public IP address and authorized networks to allow only the GKE cluster's node IP ranges. 4) The database credentials are stored in Secret Manager and mounted as volumes in the pods. Recently, a security audit revealed that a pod was compromised due to a container vulnerability. The attacker was able to exfiltrate sensitive data directly from the Cloud SQL database using the credentials from Secret Manager. The security team wants to prevent such exfiltration in the future while minimizing changes to the application code. Which course of action should you recommend?

Accepted Answer

Deploy Cloud SQL Auth Proxy as a sidecar container in each pod, and configure IAM database authentication to replace static credentials.. Deploying Cloud SQL Auth Proxy as a sidecar container enforces IAM-based authentication, eliminating static credentials that can be exfiltrated. The proxy also handles SSL/TLS encryption automatically and allows fine-grained access control via IAM permissions, so even if a pod is compromised, the attacker cannot reuse stolen credentials because they are tied to the pod's identity via Workload Identity. This approach requires minimal code changes since the application connects to localhost instead of the Cloud SQL public IP.

Answer

Migrate the database to Cloud Spanner, which has built-in IAM integration and automatic encryption.

Answer

Rotate the database password and store the new password in Secret Manager, then update the application to fetch the password from Secret Manager at startup.

Answer

Change the Cloud SQL instance to use a private IP address and disable public access, ensuring only the GKE cluster can reach it via VPC peering.

Question 5

An organization has set the IAM policy constraint 'constraints/iam.allowedPolicyMemberDomains' with the values shown. Which of the following users can be granted an IAM role on a project in this organization? (Choose all that apply.)

Accepted Answer

service-account@project-id.iam.gserviceaccount.com. The constraint 'constraints/iam.allowedPolicyMemberDomains' restricts IAM role grants to members from specified domains. The correct answer includes both A and D. Option A: service-account@project-id.iam.gserviceaccount.com is allowed because service accounts ending in 'gserviceaccount.com' are Google-managed and implicitly exempt from the constraint. Option D: user@example.com is allowed because 'example.com' is one of the domains specified in the constraint (as implied by the correct marking). The constraint explicitly lists allowed domains, and 'example.com' is included. Options B and C are from domains not in the allowed list, so they cannot be granted roles.

Answer

external@otherdomain.com

Answer

admin@another-customer-domain.com

Question 6

Your company has a production environment on Google Cloud that includes Compute Engine instances, Cloud Storage buckets, and BigQuery datasets. Security policies require that all data at rest is encrypted with CMEK, and audit logs must be retained for 7 years. The current configuration uses Google-managed encryption keys. You have been asked to transition to CMEK for all resources. After enabling CMEK for new resources, you discover that the existing resources are not re-encrypted. To comply with the policy, you need to re-encrypt the existing data. What should you do?

Accepted Answer

For Compute Engine: create new disks with CMEK, attach them, and copy data. For Cloud Storage: rewrite objects with CMEK. For BigQuery: copy datasets to new datasets with CMEK.. CMEK is applied at the resource creation level for Compute Engine disks, Cloud Storage buckets, and BigQuery datasets. Existing resources encrypted with Google-managed keys cannot be re-encrypted in place; you must create new resources with CMEK enabled and migrate the data. For Compute Engine, this means creating new disks with CMEK, attaching them, and copying data. For Cloud Storage, you rewrite objects to a new bucket or use the rewrite API with CMEK. For BigQuery, you copy datasets to new datasets that have CMEK configured.

Answer

Enable CMEK on the existing resources by modifying the resource's encryption settings. This will automatically re-encrypt the data.

Answer

Delete the existing resources and recreate them with CMEK enabled. Then restore data from backups.

Answer

Enable Data Loss Prevention (DLP) API to scan and re-encrypt data automatically.

Question 7

An engineer runs the above command and sees two firewall rules that allow SSH access. A security review requires that SSH access be allowed only from the bastion subnet 10.0.1.0/24. What should the engineer do to meet the requirement?

Accepted Answer

Delete the allow-ssh-ingress rule. The allow-ssh-ingress rule has a higher priority (lower number) than the allow-ssh-from-bastion rule, allowing SSH from any source IP. Deleting this rule ensures that only the lower-priority rule (allow-ssh-from-bastion) remains, which restricts SSH access to the bastion subnet 10.0.1.0/24. In Google Cloud VPC firewall rules, lower priority numbers indicate higher precedence, so the allow-ssh-ingress rule (priority 1000) overrides the allow-ssh-from-bastion rule (priority 2000) for any traffic matching both.

Answer

Add a firewall rule with priority 500 that denies SSH from all IPs

Answer

Change the priority of allow-ssh-ingress to 2000

Answer

Remove the target tag 'ssh-allowed' from allow-ssh-from-bastion

Question 8

A company needs to ensure that only approved machine images can be used to create Compute Engine instances to meet security compliance. Which two methods should they use? (Choose two.)

Accepted Answer

Use a custom role with permissions restricted to specific image families. A custom IAM role can be created with permissions restricted to specific image families (e.g., `compute.images.list` and `compute.instances.create` with conditions), ensuring that only approved image families can be used to launch instances. This directly enforces compliance by preventing the use of unapproved images at the IAM level.

Answer

Use VPC Service Controls to prevent creation from unauthorized images

Answer

Use Cloud Asset Inventory to detect non-compliant images and trigger remediation

Answer

Use IAM conditions on compute.instances.create to require a specific family label

Question 9

What is the effective access of the service account sa@project.iam.gserviceaccount.com to the bucket?

Accepted Answer

Full admin access to objects. The service account sa@project.iam.gserviceaccount.com is a Google Cloud IAM service account. When it is granted the 'Storage Admin' role (roles/storage.admin) at the project level, it gains full admin access to all buckets in the project, including the ability to create, delete, and manage objects. This role provides full control over objects, equivalent to 'Full admin access to objects'.

Answer

Owner access

Answer

Read-only access

Answer

No access

Question 10

A firewall rule is configured to allow inbound TCP traffic on ports 80 and 443 from the IP ranges 203.0.113.0/24 and 198.51.100.0/24 to instances with the tag 'web-server'. Which traffic will this rule allow?

Accepted Answer

Inbound TCP traffic on ports 80 and 443 from IP ranges to instances with tag 'web-server'. The rule in question is an inbound firewall rule that allows TCP traffic on ports 80 and 443 from specific IP ranges to instances with the tag 'web-server'. Therefore, option D correctly describes the traffic allowed by this rule.

Answer

Outbound TCP traffic on ports 80 and 443 from instances with tag 'web-server' to IP ranges

Answer

Inbound TCP traffic on ports 80 and 443 from IP ranges to all instances

Answer

Inbound TCP traffic on ports 80 and 443 from any IP address to instances with tag 'web-server'

Question 11

When will the key be automatically rotated?

Accepted Answer

Every 90 days. In Google Cloud, customer-managed encryption keys (CMEK) can be configured for automatic rotation with a default period of 90 days. This is enforced by Cloud Key Management Service (Cloud KMS) to limit the exposure window if a key is compromised.

Answer

Every 180 days

Answer

Only when manually triggered

Answer

Every 30 days

Question 12

A financial institution deploys a containerized application on GKE with Binary Authorization enabled. They want to ensure that only images signed by their internal CI/CD pipeline are deployed, and they also need to allow a break-glass procedure using a specific image from a curated registry. How should they configure Binary Authorization?

Accepted Answer

Create a policy with a default deny rule, and add a custom rule to allow images from the curated registry.. Binary Authorization policies are deny-by-default, so you must create a custom rule to allow specific images (e.g., from a curated registry) while keeping the default deny rule in place. This satisfies both the requirement to enforce signed images from the CI/CD pipeline and the break-glass procedure using a trusted registry image.

Answer

Create a policy with an evaluation mode to allow all images, but use a whitelist of approved registries.

Answer

Use Cloud Run instead, which has built-in image verification.

Answer

Create a policy with an evaluation mode to require all images to be signed, and configure a Cloud Build attestor.

Question 13

A security architect is designing a zero-trust network for applications running on Compute Engine. They want to enforce that all traffic between VMs must be encrypted and authenticated, regardless of the VPC network. Which approach meets this requirement?

Accepted Answer

Deploy Anthos Service Mesh with mTLS enabled.. Anthos Service Mesh with mTLS (mutual TLS) encrypts and authenticates all traffic between workloads at the application layer, regardless of the underlying VPC network. This meets the zero-trust requirement because mTLS ensures both encryption and mutual authentication for every request, without needing to manage per-VM tunnels or rely on network-layer constructs.

Answer

Configure each VM to use IPsec tunnels to every other VM.

Answer

Use Cloud VPN to encrypt all inter-VM traffic.

Answer

Enable VPC Flow Logs and use firewall rules to allow only encrypted traffic.

Question 14

A company manages secrets for multiple microservices using Secret Manager. They need to ensure that each service can access only its own secrets, and that all access is logged. What is the best IAM architecture?

Accepted Answer

Create custom roles with secrets.get permission and bind to each service account at the individual secret resource.. It follows the principle of least privilege by binding custom roles with the `secrets.get` permission at the individual secret resource level, ensuring each microservice can only access its own secrets. This also enables fine-grained access control and logging, as Secret Manager audit logs capture each access attempt per secret and service account. By using a custom role, you avoid granting unnecessary permissions like `list` or `create`, which are included in predefined roles.

Answer

Grant each service account the roles/secretmanager.secretAccessor role at the project level.

Answer

Use a single service account for all microservices with access to all secrets.

Answer

Grant each service account the roles/secretmanager.admin role at the secret level.

Question 15

Which TWO methods can be used to encrypt data at rest in BigQuery?

Accepted Answer

Use Customer-Managed Encryption Keys (CMEK) via Cloud KMS.. Customer-Managed Encryption Keys (CMEK) allow you to manage the encryption keys used to protect BigQuery data at rest via Cloud KMS. This gives you control over key rotation, access, and lifecycle, while BigQuery handles the encryption and decryption transparently. It is a supported method for encrypting data at rest in BigQuery.

Answer

Use a Cloud Storage bucket with bucket-level default encryption.

Answer

Use Cloud SQL with encryption at rest.

Answer

Use Cloud Bigtable with encryption at rest.

Question 16

Which TWO practices improve the security of a Cloud Run service?

Accepted Answer

Enable Cloud Armor for the service.. A is correct because Cloud Armor provides web application firewall (WAF) capabilities that protect Cloud Run services from common web attacks like SQL injection and cross-site scripting (XSS). B is correct because Identity-Aware Proxy (IAP) verifies user identity and context before allowing access, enforcing authentication at the Google Cloud edge before requests reach the Cloud Run service.

Answer

Run the service in a VPC with firewall rules.

Answer

Use a canary deployment strategy.

Answer

Require client-side TLS certificates.

Question 17

Which THREE services can be used to audit changes to resources in a Google Cloud project?

Accepted Answer

Security Command Center. Security Command Center (A) is correct because it provides a centralized view of security risks, including audit capabilities for resource changes via its 'Event Threat Detection' and 'Asset Inventory' features, which log and alert on modifications to Google Cloud resources. It integrates with Cloud Audit Logs to surface security-relevant changes, making it a valid service for auditing changes.

Answer

Cloud Monitoring

Answer

Cloud Endpoints

Question 18

Alice needs to read objects in the bucket 'secret-bucket'. Based on the IAM policy, what is her effective access?

Accepted Answer

Alice can read objects because objectAdmin grants read access and is not denied.. The IAM policy grants Alice the objectAdmin role, which includes read access to objects in the bucket. The deny rule specifically removes the objectViewer role, but objectAdmin is a separate role that provides its own read permissions. Since the deny does not explicitly target objectAdmin, the allow binding for objectAdmin remains effective, giving Alice read access.

Answer

Alice cannot read objects because the deny rule overrides all allow bindings.

Answer

Alice can read objects only if she also has objectCreator role.

Answer

Alice cannot read objects because the deny rule removes objectViewer and she has no other read access.

Question 19

A company is deploying a web application on Google Kubernetes Engine (GKE) and needs to ensure that the application's service account can only pull images from a specific Container Registry repository. What is the best practice to enforce this?

Accepted Answer

Use Workload Identity and grant the Kubernetes service account's associated Google service account the roles/storage.objectViewer role on the registry bucket.. Workload Identity allows you to map a Kubernetes service account to a Google service account and grant that Google service account the roles/storage.objectViewer role on the specific Container Registry bucket. This ensures that only pods using that Kubernetes service account can pull images from the designated repository, following the principle of least privilege.

Answer

Grant the Compute Engine default service account the roles/storage.objectViewer role on the registry bucket.

Answer

Set an IAM policy on the pod directly using the 'gke-default' service account.

Answer

Create an IAM condition on the node pool's service account that limits access to the registry bucket.

Question 20

A company wants to allow developers to create service accounts in a project but prevent them from granting the 'roles/iam.serviceAccountUser' role to any user. Which organization policy constraint should they set?

Accepted Answer

Set the constraint 'iam.restrictGrantableRoles' to ['roles/iam.serviceAccountUser'].. The 'iam.restrictGrantableRoles' organization policy constraint limits which roles can be granted to principals. By setting this constraint to include only 'roles/iam.serviceAccountUser', developers are allowed to create service accounts but are prevented from granting that specific role to any user. This constraint operates at the organization, folder, or project level and restricts the set of roles that can be granted in IAM policies, effectively blocking the assignment of the listed roles.

Answer

Set the constraint 'iam.allowedPolicyMemberDomains' to include only the company's domain.

Answer

Set the constraint 'iam.disableServiceAccountKeyCreation' to True.

Answer

Set the constraint 'iam.workloadIdentityPoolProviders' to deny all.