Google PCA Design for security and compliance Practice Test 3 — 15 Questions

Question 1

A company runs a Kubernetes cluster on GKE. They need to ensure that pods cannot access Google Cloud APIs unless explicitly allowed through a service account. Which GKE feature should they use?

Accepted Answer

Workload Identity. Workload Identity is the correct choice because it allows pods in GKE to authenticate to Google Cloud APIs using a specific Google service account, rather than the default Compute Engine service account. This ensures that pods cannot access any Google Cloud APIs unless explicitly granted permission via IAM roles bound to that service account, meeting the requirement for least-privilege access.

Answer

Network Policies

Answer

Pod Security Policies

Answer

Cloud Audit Logs

Question 2

An organization has a security policy that prohibits the use of external IP addresses on Compute Engine instances to reduce attack surface. They want to enforce this policy across all new and existing projects. Which approach should they use?

Accepted Answer

Use Organization Policy with constraint compute.vmExternalIpAccess. The Organization Policy constraint `compute.vmExternalIpAccess` is the correct approach because it allows you to set a policy at the organization, folder, or project level that denies the assignment of external IP addresses to Compute Engine instances. This policy is enforced at resource creation time and applies to all new and existing VM instances, ensuring compliance with the security policy across the entire resource hierarchy. It directly prevents the use of external IPs, reducing the attack surface without requiring per-project or per-instance configuration.

Answer

Use IAM conditions to prevent creation of instances with external IPs

Answer

Use Cloud Security Command Center to detect and alert on external IPs

Answer

Use VPC Firewall rules to block traffic to external IPs

Question 3

A company wants to ensure that all access to their Cloud Storage bucket is logged for compliance purposes. Which type of audit log should they enable?

Accepted Answer

Data Access audit logs. Data Access audit logs (Option B) are required to log every API call that reads, writes, or deletes data in a Cloud Storage bucket, such as object GETs and PUTs. Admin Activity logs only record configuration changes, not data access, so they would not capture the read/write operations needed for compliance logging.

Answer

Admin Activity audit logs

Answer

System Event audit logs

Answer

Access Transparency logs

Question 4

A company is using Cloud Load Balancing to expose a web application. They want to protect against common web attacks like SQL injection and cross-site scripting. Which Google Cloud service should they configure?

Accepted Answer

Cloud Armor. Cloud Armor is the correct service because it provides Web Application Firewall (WAF) capabilities that can inspect HTTP/HTTPS traffic and filter out common web attacks such as SQL injection and cross-site scripting (XSS). It integrates directly with Cloud Load Balancing to apply pre-configured or custom rules at the edge, blocking malicious requests before they reach the backend.

Answer

VPC Firewall rules

Answer

Identity-Aware Proxy

Answer

Cloud CDN

Question 5

A financial services company must comply with PCI DSS. They use Cloud SQL for MySQL for transaction processing. They need to ensure that all data at rest is encrypted with keys generated and stored in a Hardware Security Module (HSM) and that key rotation occurs every 90 days. Which configuration should they use?

Accepted Answer

Use Cloud SQL with CMEK backed by Cloud HSM, and set automatic rotation period of 90 days. Cloud SQL with CMEK backed by Cloud HSM meets the requirement for keys generated and stored in an HSM, and Cloud HSM supports automatic key rotation with a configurable period, including 90 days. CMEK allows you to manage and rotate the key used to encrypt data at rest, while Cloud HSM provides FIPS 140-2 Level 3 validated HSM for key storage. The automatic rotation period can be set to 90 days via the key rotation policy in Cloud KMS, satisfying the compliance mandate.

Answer

Use Cloud External Key Manager (EKM) to integrate with on-premises HSM

Answer

Use Cloud SQL with customer-supplied encryption keys (CSEK) and automate rotation with Cloud Scheduler

Answer

Use Cloud SQL's default encryption with organization policy requiring rotation

Question 6

A company needs to ensure that only approved machine images can be used to create Compute Engine instances to meet security compliance. Which two methods should they use? (Choose two.)

Accepted Answer

Use a custom role with permissions restricted to specific image families. A custom IAM role can be created with permissions restricted to specific image families (e.g., `compute.images.list` and `compute.instances.create` with conditions), ensuring that only approved image families can be used to launch instances. This directly enforces compliance by preventing the use of unapproved images at the IAM level.

Answer

Use VPC Service Controls to prevent creation from unauthorized images

Answer

Use Cloud Asset Inventory to detect non-compliant images and trigger remediation

Answer

Use IAM conditions on compute.instances.create to require a specific family label

Question 7

A company uses Cloud KMS to encrypt sensitive data. They need to ensure that encryption key usage is audited and that keys are rotated automatically every 30 days. Which two actions should they take? (Choose two.)

Accepted Answer

Enable Data Access audit logs for the Cloud KMS API. Enabling Data Access audit logs for the Cloud KMS API captures detailed information about every encryption key usage, including who accessed the key, when, and what operation was performed. This meets the auditing requirement by recording all key usage events in Cloud Audit Logs, which can be reviewed for compliance and security analysis.

Answer

Create a Cloud Trigger to manually rotate the key every month

Answer

Enable Cloud Key Management Service's key usage monitoring

Answer

Use Cloud External Key Manager to rotate keys externally

Question 8

A company is designing a data processing pipeline in Google Cloud that must be HIPAA compliant. Which three security features should they implement? (Choose three.)

Accepted Answer

Encrypt data in transit using TLS. Encrypting data in transit using TLS is a mandatory security control for HIPAA compliance because it protects electronic protected health information (ePHI) from interception during transmission over networks. TLS 1.2 or higher ensures that data moving between clients, services, and Google Cloud endpoints is encrypted, meeting the HIPAA Security Rule requirement for integrity and confidentiality of ePHI in transit.

Answer

Enable Data Loss Prevention (DLP) for data classification

Answer

Use Cloud CDN for faster delivery

Question 9

What is the effective access of the service account sa@project.iam.gserviceaccount.com to the bucket?

Accepted Answer

Full admin access to objects. The service account sa@project.iam.gserviceaccount.com is a Google Cloud IAM service account. When it is granted the 'Storage Admin' role (roles/storage.admin) at the project level, it gains full admin access to all buckets in the project, including the ability to create, delete, and manage objects. This role provides full control over objects, equivalent to 'Full admin access to objects'.

Answer

Owner access

Answer

Read-only access

Answer

No access

Question 10

A firewall rule is configured to allow inbound TCP traffic on ports 80 and 443 from the IP ranges 203.0.113.0/24 and 198.51.100.0/24 to instances with the tag 'web-server'. Which traffic will this rule allow?

Accepted Answer

Inbound TCP traffic on ports 80 and 443 from IP ranges to instances with tag 'web-server'. The rule in question is an inbound firewall rule that allows TCP traffic on ports 80 and 443 from specific IP ranges to instances with the tag 'web-server'. Therefore, option D correctly describes the traffic allowed by this rule.

Answer

Outbound TCP traffic on ports 80 and 443 from instances with tag 'web-server' to IP ranges

Answer

Inbound TCP traffic on ports 80 and 443 from IP ranges to all instances

Answer

Inbound TCP traffic on ports 80 and 443 from any IP address to instances with tag 'web-server'

Question 11

When will the key be automatically rotated?

Accepted Answer

Every 90 days. In Google Cloud, customer-managed encryption keys (CMEK) can be configured for automatic rotation with a default period of 90 days. This is enforced by Cloud Key Management Service (Cloud KMS) to limit the exposure window if a key is compromised.

Answer

Every 180 days

Answer

Only when manually triggered

Answer

Every 30 days

Question 12

A company wants to restrict data exfiltration from its Google Cloud projects by preventing resources from copying data to external IP addresses. Which service should they use?

Accepted Answer

VPC Service Controls. VPC Service Controls is the correct choice because it creates a security perimeter around Google Cloud resources, such as BigQuery or Cloud Storage, and prevents data exfiltration by blocking access from outside the perimeter or to external IP addresses. It enforces context-aware access policies that can deny egress traffic to non-permitted destinations, directly addressing the requirement to restrict copying data to external IPs.

Answer

HTTPS Load Balancer

Answer

Cloud Armor

Answer

Cloud NAT

Question 13

A data scientist needs read-only access to a Cloud Storage bucket containing training data. What is the least privileged IAM role to grant at the bucket level?

Accepted Answer

roles/storage.objectViewer. Roles/storage.objectViewer grants read-only access to objects in a Cloud Storage bucket without allowing any write or administrative actions. This is the least privileged role that satisfies the requirement for read-only access to training data at the bucket level, as it only permits storage.objects.get and storage.objects.list permissions.

Answer

roles/storage.objectAdmin

Answer

roles/storage.objectCreator

Answer

roles/storage.admin

Question 14

A company has a fleet of Compute Engine instances that need to access a Cloud Storage bucket. The security team requires that only instances in specific VPC networks can access the bucket, and that the data is encrypted in transit. How can this be achieved?

Accepted Answer

Create a VPC Service Controls perimeter with access levels, and require HTTPS for the bucket.. VPC Service Controls allows you to define a security perimeter around Cloud Storage, restricting access to only requests originating from specific VPC networks. By configuring an access level that requires HTTPS, you enforce encryption in transit, meeting both the network restriction and data-in-transit encryption requirements.

Answer

Use a Cloud Storage bucket with encryption at rest using CSEK.

Answer

Use Cloud Armor with IP allowlists and enable TLS for the bucket.

Answer

Use a Cloud Storage bucket with encryption at rest using CMEK.

Question 15

A data engineer needs to analyze data in BigQuery but must mask personally identifiable information (PII) based on user roles. Which service should they use?

Accepted Answer

BigQuery column-level security. BigQuery column-level security allows you to apply fine-grained access controls to specific columns containing PII, such as by using policy tags to restrict access based on user roles. This directly meets the requirement to mask sensitive data in BigQuery without moving or duplicating data, as it integrates with Cloud IAM to enforce role-based access at query time.

Answer

Cloud Key Management Service

Answer

Cloud Data Catalog

Answer

Cloud Data Loss Prevention (DLP)