Google PCA Design for security and compliance Practice Test 2 — 15 Questions

Question 1

An engineer runs the above command and sees two firewall rules that allow SSH access. A security review requires that SSH access be allowed only from the bastion subnet 10.0.1.0/24. What should the engineer do to meet the requirement?

Accepted Answer

Delete the allow-ssh-ingress rule. The correct answer is C because the allow-ssh-ingress rule has a higher priority (lower number) than the allow-ssh-from-bastion rule, allowing SSH from any source IP. Deleting this rule ensures that only the lower-priority rule (allow-ssh-from-bastion) remains, which restricts SSH access to the bastion subnet 10.0.1.0/24. In Google Cloud VPC firewall rules, lower priority numbers indicate higher precedence, so the allow-ssh-ingress rule (priority 1000) overrides the allow-ssh-from-bastion rule (priority 2000) for any traffic matching both.

Answer

Add a firewall rule with priority 500 that denies SSH from all IPs

Answer

Change the priority of allow-ssh-ingress to 2000

Answer

Remove the target tag 'ssh-allowed' from allow-ssh-from-bastion

Question 2

Drag and drop the steps to configure a Cloud Load Balancer with a backend service consisting of Compute Engine instances into the correct order.

Question 3

Drag and drop the steps to set up a shared VPC in Google Cloud for a multi-project environment into the correct order.

Question 4

Match each GCP compute service to its characteristic.

Question 5

Match each GCP data processing service to its use case.

Question 6

A company is deploying a web application on Compute Engine. They want to ensure that only authenticated users can access the application. Which Google Cloud service should they use?

Accepted Answer

Identity-Aware Proxy. Identity-Aware Proxy (IAP) is the correct choice because it enforces access control at the edge of Google's network, verifying user identity and context before allowing traffic to reach the Compute Engine instance. IAP uses OAuth 2.0 and signed headers to authenticate users, ensuring only authorized requests are forwarded to the backend, without requiring any changes to the application itself.

Answer

Cloud Load Balancing

Answer

Cloud CDN

Answer

Cloud DNS

Question 7

A company stores sensitive customer data in Cloud Storage buckets. They want to ensure that access to these buckets is only allowed from within their VPC network. Which configuration should they use?

Accepted Answer

VPC Service Controls with a service perimeter. VPC Service Controls can restrict access to Cloud Storage to authorized VPC networks, preventing data exfiltration and public internet access. IAM alone does not enforce network restrictions; Private Google Access is for on-prem; Cloud Armor is for HTTP LB.

Answer

Bucket IAM policies with condition on service account

Answer

Cloud Armor WAF rules

Answer

Private Google Access for on-premises

Question 8

A multinational corporation must comply with GDPR and requires that all customer data stored in BigQuery be encrypted using customer-managed encryption keys (CMEK) and that the keys are stored in a specific region. Which combination of steps should they take?

Accepted Answer

Create a Cloud KMS key ring and crypto key in the desired region, then associate the BigQuery dataset with the CMEK key using DDL. BigQuery CMEK requires creating a Cloud KMS key in the desired region and associating it with the dataset using DDL. Default encryption uses Google-managed keys; Cloud DLP is for de-identification; EKM is for on-prem key integration.

Answer

Enable default encryption at rest in BigQuery and use Organization Policies to restrict key location

Answer

Create a Cloud HSM key, then use Cloud DLP to automatically encrypt the data before loading into BigQuery

Answer

Use Cloud External Key Manager (EKM) to integrate with an on-premises key management system

Question 9

A startup wants to grant a new employee read-only access to view all Compute Engine instances in a project. What is the minimum IAM role they should assign?

Accepted Answer

roles/compute.viewer. roles/compute.viewer provides read-only access to Compute Engine resources. compute.admin is full access; iam.securityReviewer gives read access to a wider set of resources; owner has full control.

Answer

roles/owner

Answer

roles/iam.securityReviewer

Answer

roles/compute.admin

Question 10

A company runs a Kubernetes cluster on GKE. They need to ensure that pods cannot access Google Cloud APIs unless explicitly allowed through a service account. Which GKE feature should they use?

Accepted Answer

Workload Identity. Workload Identity allows each pod to have its own IAM service account, preventing use of the node's default service account. Pod Security Policies control container security contexts; Network Policies control pod traffic; Audit Logs are for tracking.

Answer

Network Policies

Answer

Pod Security Policies

Answer

Cloud Audit Logs

Question 11

An organization has a security policy that prohibits the use of external IP addresses on Compute Engine instances to reduce attack surface. They want to enforce this policy across all new and existing projects. Which approach should they use?

Accepted Answer

Use Organization Policy with constraint compute.vmExternalIpAccess. Organization policy with constraint constraints/compute.vmExternalIpAccess can be set to block external IPs. IAM conditions are not effective for this; firewall rules do not prevent the IP assignment; and SCC only detects violations after creation.

Answer

Use IAM conditions to prevent creation of instances with external IPs

Answer

Use Cloud Security Command Center to detect and alert on external IPs

Answer

Use VPC Firewall rules to block traffic to external IPs

Question 12

A company wants to ensure that all access to their Cloud Storage bucket is logged for compliance purposes. Which type of audit log should they enable?

Accepted Answer

Data Access audit logs. Data Access audit logs record every access to user data. Admin Activity logs record administrative actions; System Event logs record GCP actions; Access Transparency logs record Google support access.

Answer

Admin Activity audit logs

Answer

System Event audit logs

Answer

Access Transparency logs

Question 13

A company is using Cloud Load Balancing to expose a web application. They want to protect against common web attacks like SQL injection and cross-site scripting. Which Google Cloud service should they configure?

Accepted Answer

Cloud Armor. Cloud Armor provides WAF rules that can detect and block SQLi and XSS. Cloud CDN is for caching; IAP is for authentication; VPC Firewall rules work at IP/port level.

Answer

VPC Firewall rules

Answer

Identity-Aware Proxy

Answer

Cloud CDN

Question 14

A financial services company must comply with PCI DSS. They use Cloud SQL for MySQL for transaction processing. They need to ensure that all data at rest is encrypted with keys generated and stored in a Hardware Security Module (HSM) and that key rotation occurs every 90 days. Which configuration should they use?

Accepted Answer

Use Cloud SQL with CMEK backed by Cloud HSM, and set automatic rotation period of 90 days. Cloud SQL CMEK with Cloud HSM allows HSM-backed keys and automatic rotation. Default encryption uses Google-managed keys; CSEK is for disks; EKM is for external KMS but adds complexity.

Answer

Use Cloud External Key Manager (EKM) to integrate with on-premises HSM

Answer

Use Cloud SQL with customer-supplied encryption keys (CSEK) and automate rotation with Cloud Scheduler

Answer

Use Cloud SQL's default encryption with organization policy requiring rotation

Question 15

A company needs to ensure that only approved machine images can be used to create Compute Engine instances to meet security compliance. Which two methods should they use? (Choose two.)

Accepted Answer

Use a custom role with permissions restricted to specific image families. The organization policy constraint compute.trustedImageProjects restricts allowed image projects. Creating a custom role with permissions limited to specific image projects also works. IAM conditions on instance creation are not effective; VPC Service Controls don't apply to images; detection alone is not prevention.

Answer

Use VPC Service Controls to prevent creation from unauthorized images

Answer

Use Cloud Asset Inventory to detect non-compliant images and trigger remediation

Answer

Use IAM conditions on compute.instances.create to require a specific family label