Google PCA Design for security and compliance Practice Test 4 — 15 Questions

Question 1

A financial institution deploys a containerized application on GKE with Binary Authorization enabled. They want to ensure that only images signed by their internal CI/CD pipeline are deployed, and they also need to allow a break-glass procedure using a specific image from a curated registry. How should they configure Binary Authorization?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a policy with a default deny rule, and add a custom rule to allow images from the curated registry.. Binary Authorization policies are deny-by-default, so you must create a custom rule to allow specific images (e.g., from a curated registry) while keeping the default deny rule in place. This satisfies both the requirement to enforce signed images from the CI/CD pipeline and the break-glass procedure using a trusted registry image.

Answer

Create a policy with an evaluation mode to allow all images, but use a whitelist of approved registries.

Answer

Use Cloud Run instead, which has built-in image verification.

Answer

Create a policy with an evaluation mode to require all images to be signed, and configure a Cloud Build attestor.

Question 2

A security architect is designing a zero-trust network for applications running on Compute Engine. They want to enforce that all traffic between VMs must be encrypted and authenticated, regardless of the VPC network. Which approach meets this requirement?

Accepted Answer

Deploy Anthos Service Mesh with mTLS enabled.. Anthos Service Mesh with mTLS (mutual TLS) encrypts and authenticates all traffic between workloads at the application layer, regardless of the underlying VPC network. This meets the zero-trust requirement because mTLS ensures both encryption and mutual authentication for every request, without needing to manage per-VM tunnels or rely on network-layer constructs.

Answer

Configure each VM to use IPsec tunnels to every other VM.

Answer

Use Cloud VPN to encrypt all inter-VM traffic.

Answer

Enable VPC Flow Logs and use firewall rules to allow only encrypted traffic.

Question 3

A company manages secrets for multiple microservices using Secret Manager. They need to ensure that each service can access only its own secrets, and that all access is logged. What is the best IAM architecture?

Accepted Answer

Create custom roles with secrets.get permission and bind to each service account at the individual secret resource.. It follows the principle of least privilege by binding custom roles with the `secrets.get` permission at the individual secret resource level, ensuring each microservice can only access its own secrets. This also enables fine-grained access control and logging, as Secret Manager audit logs capture each access attempt per secret and service account. By using a custom role, you avoid granting unnecessary permissions like `list` or `create`, which are included in predefined roles.

Answer

Grant each service account the roles/secretmanager.secretAccessor role at the project level.

Answer

Use a single service account for all microservices with access to all secrets.

Answer

Grant each service account the roles/secretmanager.admin role at the secret level.

Question 4

Which TWO methods can be used to encrypt data at rest in BigQuery?

Accepted Answer

Use Customer-Managed Encryption Keys (CMEK) via Cloud KMS.. Customer-Managed Encryption Keys (CMEK) allow you to manage the encryption keys used to protect BigQuery data at rest via Cloud KMS. This gives you control over key rotation, access, and lifecycle, while BigQuery handles the encryption and decryption transparently. It is a supported method for encrypting data at rest in BigQuery.

Answer

Use a Cloud Storage bucket with bucket-level default encryption.

Answer

Use Cloud SQL with encryption at rest.

Answer

Use Cloud Bigtable with encryption at rest.

Question 5

Which TWO practices improve the security of a Cloud Run service?

Accepted Answer

Enable Cloud Armor for the service.. A is correct because Cloud Armor provides web application firewall (WAF) capabilities that protect Cloud Run services from common web attacks like SQL injection and cross-site scripting (XSS). B is correct because Identity-Aware Proxy (IAP) verifies user identity and context before allowing access, enforcing authentication at the Google Cloud edge before requests reach the Cloud Run service.

Answer

Run the service in a VPC with firewall rules.

Answer

Use a canary deployment strategy.

Answer

Require client-side TLS certificates.

Question 6

Which THREE services can be used to audit changes to resources in a Google Cloud project?

Accepted Answer

Security Command Center. Security Command Center (A) is correct because it provides a centralized view of security risks, including audit capabilities for resource changes via its 'Event Threat Detection' and 'Asset Inventory' features, which log and alert on modifications to Google Cloud resources. It integrates with Cloud Audit Logs to surface security-relevant changes, making it a valid service for auditing changes.

Answer

Cloud Monitoring

Answer

Cloud Endpoints

Question 7

After executing the command, a security review reveals that the service account sa-bucket-reader can also list buckets in the project, which was not intended. What is the most likely cause?

Accepted Answer

The service account has a project-level role that includes storage.list.. The service account sa-bucket-reader was able to list buckets in the project, which requires the storage.buckets.list permission. This permission is included in several predefined project-level roles, such as roles/storage.objectViewer or roles/storage.legacyBucketReader. If the service account was granted a project-level role that includes storage.buckets.list, it would have the unintended ability to list all buckets in the project, even if bucket-level IAM was configured to restrict access to specific buckets.

Answer

The etag was incorrect, causing a concurrent modification.

Answer

The policy update failed due to a missing condition.

Answer

The service account also has bucket-level IAM roles.

Question 8

Alice needs to read objects in the bucket 'secret-bucket'. Based on the IAM policy, what is her effective access?

Accepted Answer

Alice can read objects because objectAdmin grants read access and is not denied.. The IAM policy grants Alice the objectAdmin role, which includes read access to objects in the bucket. The deny rule specifically removes the objectViewer role, but objectAdmin is a separate role that provides its own read permissions. Since the deny does not explicitly target objectAdmin, the allow binding for objectAdmin remains effective, giving Alice read access.

Answer

Alice cannot read objects because the deny rule overrides all allow bindings.

Answer

Alice can read objects only if she also has objectCreator role.

Answer

Alice cannot read objects because the deny rule removes objectViewer and she has no other read access.

Question 9

The firewall rule 'allow-ssh' was not created. According to the audit log, what is the most likely reason?

Accepted Answer

The user does not have the compute.firewalls.create permission.. The audit log indicates the firewall rule 'allow-ssh' was not created because the user lacks the specific permission required to create firewall rules in Google Cloud. The correct permission is `compute.firewalls.create`, which is part of the `compute.securityAdmin` role but not automatically granted with it; the `compute.securityAdmin` role includes `compute.firewalls.create`, so Option B is factually incorrect. The most likely reason is that the user does not have the `compute.firewalls.create` permission, which is a prerequisite for creating firewall rules.

Answer

The user is not authenticated.

Answer

The user has the compute.securityAdmin role but not compute.firewalls.create.

Answer

The firewall rule already exists and cannot be duplicated.

Question 10

A security engineer is configuring VPC Service Controls to protect a project containing BigQuery datasets with PII. They want to prevent data exfiltration while allowing authorized users to query the data from outside the perimeter. Which configuration meets these requirements?

Accepted Answer

Create a perimeter that includes the project, and use an access level from Access Context Manager to grant access to authorized users.. VPC Service Controls use Access Context Manager (ACM) access levels to define granular, identity-based access conditions. By including the project in a perimeter and applying an access level that specifies authorized users (e.g., based on IP ranges, device state, or identity), you can allow those users to query BigQuery from outside the perimeter while blocking all other external traffic, preventing data exfiltration.

Answer

Create a perimeter that includes the project, and set the 'allowed external access' flag to true.

Answer

Create a perimeter and enable the 'exfiltration exception' for BigQuery.

Answer

Create a perimeter that includes only Compute Engine instances, and use a separate perimeter for BigQuery.

Question 11

A company is deploying a web application on Google Kubernetes Engine (GKE) and needs to ensure that the application's service account can only pull images from a specific Container Registry repository. What is the best practice to enforce this?

Accepted Answer

Use Workload Identity and grant the Kubernetes service account's associated Google service account the roles/storage.objectViewer role on the registry bucket.. Workload Identity allows you to map a Kubernetes service account to a Google service account and grant that Google service account the roles/storage.objectViewer role on the specific Container Registry bucket. This ensures that only pods using that Kubernetes service account can pull images from the designated repository, following the principle of least privilege.

Answer

Grant the Compute Engine default service account the roles/storage.objectViewer role on the registry bucket.

Answer

Set an IAM policy on the pod directly using the 'gke-default' service account.

Answer

Create an IAM condition on the node pool's service account that limits access to the registry bucket.

Question 12

A healthcare organization is storing sensitive patient data in Cloud Storage. They need to ensure that all objects are encrypted with a key managed by their on-premises HSM. Which encryption approach should they use?

Accepted Answer

Use Cloud External Key Manager (EKM) with a key hosted on the on-premises HSM.. Cloud External Key Manager (EKM) allows you to use an external key management system, such as an on-premises HSM, to manage encryption keys for Google Cloud services. This approach meets the requirement because the key never leaves the HSM, and Cloud Storage uses the key via the EKM integration, ensuring the organization retains full control over the key lifecycle.

Answer

Use Customer-Supplied Encryption Keys (CSEK) and store the key in a Secret Manager accessible only from the on-premises HSM.

Answer

Use Customer-Managed Encryption Keys (CMEK) with a Cloud KMS key that is generated from the on-premises HSM.

Answer

Encrypt each object client-side with a key from the on-premises HSM before uploading to Cloud Storage.

Question 13

An organization is implementing a data loss prevention (DLP) strategy for Cloud Storage. They want to automatically scan new objects uploaded to a specific bucket and redact sensitive data. Which service and configuration should they use?

Accepted Answer

Use Cloud Functions triggered by Cloud Storage events to call Cloud DLP API for each new object, and then store the redacted version.. It uses Cloud Functions as an event-driven compute service that triggers on Cloud Storage object finalize events. The function then calls the Cloud DLP API to inspect and redact sensitive data from the new object, and writes the redacted version back to the bucket. This provides automatic, near-real-time scanning and redaction for each uploaded object, aligning with the requirement for an automated DLP strategy.

Answer

Configure Cloud Armor with a WAF rule to inspect and redact data as it enters the bucket.

Answer

Enable Security Command Center (SCC) premium tier and configure it to scan the bucket for sensitive data.

Answer

Use Cloud DLP with a BigQuery external table to scan the bucket contents periodically.

Question 14

A company wants to allow developers to create service accounts in a project but prevent them from granting the 'roles/iam.serviceAccountUser' role to any user. Which organization policy constraint should they set?

Accepted Answer

Set the constraint 'iam.restrictGrantableRoles' to ['roles/iam.serviceAccountUser'].. The 'iam.restrictGrantableRoles' organization policy constraint limits which roles can be granted to principals. By setting this constraint to include only 'roles/iam.serviceAccountUser', developers are allowed to create service accounts but are prevented from granting that specific role to any user. This constraint operates at the organization, folder, or project level and restricts the set of roles that can be granted in IAM policies, effectively blocking the assignment of the listed roles.

Answer

Set the constraint 'iam.allowedPolicyMemberDomains' to include only the company's domain.

Answer

Set the constraint 'iam.disableServiceAccountKeyCreation' to True.

Answer

Set the constraint 'iam.workloadIdentityPoolProviders' to deny all.

Question 15

A security team wants to receive alerts when a user attempts to grant the 'roles/owner' role to a member outside of the organization's domain. Which log filter should they use to create a log-based metric?

Accepted Answer

Filter on Admin Activity log type with 'protoPayload.methodName="SetIamPolicy" AND protoPayload.serviceName="cloudresourcemanager.googleapis.com" AND NOT protoPayload.request.policy.bindings: member: "example.com"'.. It uses the Admin Activity audit log type, which captures IAM policy changes, and filters for the SetIamPolicy method on the cloudresourcemanager service. The condition NOT protoPayload.request.policy.bindings: member: "example.com" ensures alerts are triggered only when the owner role is granted to a member outside the organization's domain, matching the security requirement exactly.

Answer

Filter on Data Access log type with 'protoPayload.methodName="google.iam.v1.IAMPolicy.SetIamPolicy"'.

Answer

Filter on Admin Activity logs for 'resource.type="gce_instance" AND protoPayload.methodName="compute.instances.setServiceAccount"'.

Answer

Filter on System Event logs with a query for 'resource.type="project" AND protoPayload.response.status.code=7'.