Google PCA Design for security and compliance Practice Test 3 — 15 Questions

Question 1

A company uses Cloud KMS to encrypt sensitive data. They need to ensure that encryption key usage is audited and that keys are rotated automatically every 30 days. Which two actions should they take? (Choose two.)

Accepted Answer

Enable Data Access audit logs for the Cloud KMS API. Option A is correct because enabling Data Access audit logs for the Cloud KMS API captures detailed information about every encryption key usage, including who accessed the key, when, and what operation was performed. This meets the auditing requirement by recording all key usage events in Cloud Audit Logs, which can be reviewed for compliance and security analysis.

Answer

Create a Cloud Trigger to manually rotate the key every month

Answer

Enable Cloud Key Management Service's key usage monitoring

Answer

Use Cloud External Key Manager to rotate keys externally

Question 2

A company is designing a data processing pipeline in Google Cloud that must be HIPAA compliant. Which three security features should they implement? (Choose three.)

Accepted Answer

Encrypt data in transit using TLS. HIPAA requires encryption of data in transit and at rest. Using Cloud HSM for CMEK provides strong encryption at rest. VPC Service Controls help restrict data access. DLP is useful for identifying PHI but not mandatory; CDN is not a security feature.

Answer

Enable Data Loss Prevention (DLP) for data classification

Answer

Use Cloud CDN for faster delivery

Question 3

What is the effective access of the service account sa@project.iam.gserviceaccount.com to the bucket?

Accepted Answer

Full admin access to objects. The service account is a member of roles/storage.objectAdmin, which grants full control (read, write, delete) over objects. It is not in the viewer or owner roles.

Answer

Owner access

Answer

Read-only access

Answer

No access

Question 4

Which traffic will this rule allow?

Accepted Answer

Inbound TCP traffic on ports 80 and 443 from IP ranges to instances with tag 'web-server'. The rule allows inbound TCP on ports 80 and 443 from the specified IP ranges to instances tagged 'web-server'. It does not apply to all instances and is not outbound.

Answer

Outbound TCP traffic on ports 80 and 443 from instances with tag 'web-server' to IP ranges

Answer

Inbound TCP traffic on ports 80 and 443 from IP ranges to all instances

Answer

Inbound TCP traffic on ports 80 and 443 from any IP address to instances with tag 'web-server'

Question 5

When will the key be automatically rotated?

Accepted Answer

Every 90 days. The rotationPeriod is 7776000 seconds, which equals 90 days. The nextRotationTime is set to 2024-04-01, 90 days after creation, confirming automatic rotation every 90 days.

Answer

Every 180 days

Answer

Only when manually triggered

Answer

Every 30 days

Question 6

A company wants to restrict data exfiltration from its Google Cloud projects by preventing resources from copying data to external IP addresses. Which service should they use?

Accepted Answer

VPC Service Controls. VPC Service Controls provide a security perimeter to reduce data exfiltration risk. Option A is wrong because Cloud Armor is for DDoS/ WAF protection. Option B is wrong because Cloud NAT allows outbound connectivity, not restriction. Option D is wrong because HTTPS load balancers do not prevent data exfiltration.

Answer

HTTPS Load Balancer

Answer

Cloud Armor

Answer

Cloud NAT

Question 7

A data scientist needs read-only access to a Cloud Storage bucket containing training data. What is the least privileged IAM role to grant at the bucket level?

Accepted Answer

roles/storage.objectViewer. The roles/storage.objectViewer role grants read access to objects without listing or other permissions. Option A is too broad (project-level). Option C allows listing but is more than read-only. Option D includes identity and access management permissions.

Answer

roles/storage.objectAdmin

Answer

roles/storage.objectCreator

Answer

roles/storage.admin

Question 8

A company wants to automatically rotate cryptographic keys on a schedule without manual intervention. Which service should they use?

Accepted Answer

Cloud Key Management Service (KMS). Cloud KMS supports automatic key rotation. Option A is for managing secrets. Option C is for access control. Option D is for auditing.

Answer

Secret Manager

Answer

Cloud Audit Logs

Answer

Cloud IAM

Question 9

A company has a fleet of Compute Engine instances that need to access a Cloud Storage bucket. The security team requires that only instances in specific VPC networks can access the bucket, and that the data is encrypted in transit. How can this be achieved?

Accepted Answer

Create a VPC Service Controls perimeter with access levels, and require HTTPS for the bucket.. VPC Service Controls with perimeter rules and usage of HTTPS for Cloud Storage ensures in-transit encryption. Option A provides encryption but not network restriction. Option C provides encryption but not network restriction. Option D provides network restriction but not encryption in transit.

Answer

Use a Cloud Storage bucket with encryption at rest using CSEK.

Answer

Use Cloud Armor with IP allowlists and enable TLS for the bucket.

Answer

Use a Cloud Storage bucket with encryption at rest using CMEK.

Question 10

A company hosts a web application on Google Kubernetes Engine (GKE) and wants to protect against SQL injection attacks. Which service should they configure?

Accepted Answer

Cloud Armor. Cloud Armor with WAF rules can block SQL injection. Option B is for identity. Option C is for container scanning. Option D is for audit logs.

Answer

Identity-Aware Proxy (IAP)

Answer

Cloud Audit Logs

Answer

Container Analysis

Question 11

A data engineer needs to analyze data in BigQuery but must mask personally identifiable information (PII) based on user roles. Which service should they use?

Accepted Answer

BigQuery column-level security. BigQuery column-level security with data masking allows conditional masking. Option A provides classification but not role-based masking. Option B is for tokenization but not integrated with BigQuery. Option D is for data catalog.

Answer

Cloud Key Management Service

Answer

Cloud Data Catalog

Answer

Cloud Data Loss Prevention (DLP)

Question 12

A financial institution deploys a containerized application on GKE with Binary Authorization enabled. They want to ensure that only images signed by their internal CI/CD pipeline are deployed, and they also need to allow a break-glass procedure using a specific image from a curated registry. How should they configure Binary Authorization?

Accepted Answer

Create a policy with a default deny rule, and add a custom rule to allow images from the curated registry.. Binary Authorization allows a default deny rule with an exception for the curated registry. Option A does not allow break-glass. Option B would allow all unsigned images. Option D is not a valid attestor.

Answer

Create a policy with an evaluation mode to allow all images, but use a whitelist of approved registries.

Answer

Use Cloud Run instead, which has built-in image verification.

Answer

Create a policy with an evaluation mode to require all images to be signed, and configure a Cloud Build attestor.

Question 13

A security architect is designing a zero-trust network for applications running on Compute Engine. They want to enforce that all traffic between VMs must be encrypted and authenticated, regardless of the VPC network. Which approach meets this requirement?

Accepted Answer

Deploy Anthos Service Mesh with mTLS enabled.. Mutual TLS (mTLS) with service mesh provides encryption and authentication at application level. Option A only encrypts, not authenticates. Option B encrypts but not authenticates. Option D is not a standard approach.

Answer

Configure each VM to use IPsec tunnels to every other VM.

Answer

Use Cloud VPN to encrypt all inter-VM traffic.

Answer

Enable VPC Flow Logs and use firewall rules to allow only encrypted traffic.

Question 14

A company manages secrets for multiple microservices using Secret Manager. They need to ensure that each service can access only its own secrets, and that all access is logged. What is the best IAM architecture?

Accepted Answer

Create custom roles with secrets.get permission and bind to each service account at the individual secret resource.. Using custom roles with fine-grained permissions and audit logs on the secret level provides least privilege. Option A grants too much access (project-wide). Option B gives full access. Option D does not control access per service.

Answer

Grant each service account the roles/secretmanager.secretAccessor role at the project level.

Answer

Use a single service account for all microservices with access to all secrets.

Answer

Grant each service account the roles/secretmanager.admin role at the secret level.

Question 15

Which TWO methods can be used to encrypt data at rest in BigQuery?

Accepted Answer

Use Customer-Managed Encryption Keys (CMEK) via Cloud KMS.. BigQuery supports both CMEK (Cloud KMS key) and CSEK (customer-supplied encryption key) for data at rest encryption. Option C is for Cloud Storage, not BigQuery. Option D is for Cloud SQL. Option E is for Bigtable.

Answer

Use a Cloud Storage bucket with bucket-level default encryption.

Answer

Use Cloud SQL with encryption at rest.

Answer

Use Cloud Bigtable with encryption at rest.