Courseiva

CCNA Trust and security with Google Cloud Questions

75 of 89 questions · Page 1/2 · Trust and security with Google Cloud · Answers revealed

Practice these questionsDomain overviewAll questions
1
MCQeasy

A startup is building a web application and wants to protect it from common web attacks like SQL injection and cross-site scripting. Which Google Cloud product provides web application firewall (WAF) capabilities?

A.Cloud Firewall, which controls network-level traffic based on IP and port rules
B.Cloud Armor, which provides WAF rules to detect and block SQL injection, XSS, and other OWASP Top 10 attacks
C.VPC Service Controls, which prevent data exfiltration from Google Cloud services
D.Security Command Center, which detects security misconfigurations across Google Cloud resources
AnswerB

Cloud Armor is Google Cloud's WAF. It includes preconfigured rule sets for OWASP Top 10 vulnerabilities including SQL injection and XSS, and operates at the application layer (Layer 7) where it can inspect HTTP requests. It also provides DDoS protection.

Why this answer

Cloud Armor is Google Cloud's web application firewall (WAF) service that provides pre-configured rules to detect and block common web attacks, including SQL injection and cross-site scripting (XSS), as well as other OWASP Top 10 threats. It integrates with Cloud Load Balancing and allows you to create custom security policies with rate limiting, IP allow/deny lists, and managed rule sets. This makes it the correct choice for protecting a web application at the application layer.

Exam trap

The trap here is confusing network-layer firewalls (Cloud Firewall) with application-layer WAFs (Cloud Armor), leading candidates to choose Option A because both contain 'Firewall' in the name, but they operate at completely different layers of the OSI model.

How to eliminate wrong answers

Option A is wrong because Cloud Firewall operates at the network layer (Layer 3/4) controlling traffic based on IP addresses, ports, and protocols, and does not inspect application-layer payloads for SQL injection or XSS. Option C is wrong because VPC Service Controls are designed to prevent data exfiltration by creating perimeters around Google Cloud services, not to inspect HTTP/HTTPS traffic for web attacks. Option D is wrong because Security Command Center is a security management and vulnerability detection platform that identifies misconfigurations and threats across resources, but it does not provide inline WAF rule enforcement to block malicious requests in real time.

Practice this question →
2
MCQhard

A company is moving a regulated workload to Google Cloud and must ensure that their encryption keys are stored in a hardware security module (HSM) that meets FIPS 140-2 Level 3 validation. Which Google Cloud key management option satisfies this requirement?

A.Cloud KMS software-backed keys, which are managed by Google and stored in Google's secure key management infrastructure
B.Customer-supplied encryption keys (CSEK), where the customer provides the key with each API request
C.Cloud HSM, which stores and manages keys in FIPS 140-2 Level 3 validated hardware security modules
D.Secret Manager, which stores API keys and credentials with automatic rotation
AnswerC

Cloud HSM specifically addresses the FIPS 140-2 Level 3 requirement. Keys generated and stored in Cloud HSM never leave the HSM in plaintext form, and all cryptographic operations occur within the certified hardware. This is the correct answer for workloads requiring hardware-backed key storage at the highest FIPS level.

Why this answer

Cloud HSM is the correct choice because it provides a dedicated HSM service that stores and manages encryption keys in FIPS 140-2 Level 3 validated hardware security modules. This directly meets the regulatory requirement for a hardware security module with that specific validation level, as opposed to software-backed or customer-supplied key options.

Exam trap

The trap here is that candidates often confuse Cloud KMS software-backed keys (which are FIPS 140-2 Level 1) with Cloud HSM (Level 3), or they assume that any Google-managed key service automatically meets high-level FIPS validation, ignoring the specific Level 3 requirement for hardware-based protection.

How to eliminate wrong answers

Option A is wrong because Cloud KMS software-backed keys are stored in Google's secure key management infrastructure but are not backed by a dedicated HSM, and they do not meet FIPS 140-2 Level 3 validation (they meet Level 1). Option B is wrong because Customer-Supplied Encryption Keys (CSEK) are provided by the customer with each API request and are not stored in a Google-managed HSM; they are used for client-side encryption and do not satisfy the requirement for HSM-based key storage. Option D is wrong because Secret Manager is designed for storing secrets like API keys and passwords, not for managing encryption keys in an HSM, and it does not provide FIPS 140-2 Level 3 validated hardware security modules.

Practice this question →
3
MCQmedium

An enterprise's security team is implementing a strategy to protect against 'credential stuffing' attacks — where attackers use lists of username/password combinations from previous data breaches to try to log in to the company's applications. Which authentication control most effectively mitigates this threat?

A.Requiring longer, more complex passwords to make credentials harder to guess
B.Multi-Factor Authentication (MFA/2SV), which requires a second verification factor beyond the password that attackers don't have even when they possess the stolen credentials
C.Encrypting passwords in the company's database using bcrypt to prevent the stolen passwords from being usable
D.Implementing HTTPS on the login page to prevent credentials from being intercepted in transit
AnswerB

MFA is the definitive defense against credential stuffing. The stolen credentials work for the first factor (password), but the attack fails at the second factor (authenticator app TOTP, push notification, hardware security key). Attackers would need both the credentials AND access to the user's second factor device — a much higher bar.

Why this answer

Multi-Factor Authentication (MFA/2SV) is the most effective control against credential stuffing because it requires an additional verification factor (e.g., a one-time code from an authenticator app, a hardware token, or a biometric) that the attacker does not possess, even if they have valid username/password pairs from a breach. This renders the stolen credentials useless for authentication, as the attacker cannot complete the second factor challenge. In Google Cloud, this is commonly enforced via Identity Platform or Cloud Identity with security keys or TOTP.

Exam trap

The GCDL exam often tests the misconception that password hashing (like bcrypt) or encryption protects against credential stuffing, but candidates must recognize that the attacker already has the plaintext passwords from a prior breach, so hashing the database is irrelevant to this attack vector.

How to eliminate wrong answers

Option A is wrong because requiring longer, more complex passwords does not prevent credential stuffing; attackers already have the exact passwords from breaches, so complexity does not stop them from using those stolen credentials. Option C is wrong because encrypting passwords with bcrypt protects the database from offline cracking, but in a credential stuffing attack, the attacker already possesses the plaintext passwords from a previous breach and does not need to crack the database. Option D is wrong because HTTPS protects credentials in transit from interception, but credential stuffing uses stolen credentials that the attacker already has, so encrypting the login channel does not prevent the attacker from submitting them.

Practice this question →
4
MCQeasy

A company wants to ensure that their confidential data stored in BigQuery cannot be shared outside the company's Google Cloud organization. Which Google Cloud security capability prevents data from being shared with external Google accounts (outside the organization)?

A.Enabling BigQuery data encryption with CMEK to prevent external parties from decrypting shared data
B.The 'Domain Restricted Sharing' organization policy constraint, which prevents IAM policies from granting access to users outside specified trusted domains
C.BigQuery row-level security policies that restrict rows based on user email domain
D.Disabling external IP addresses on all Google Cloud resources to prevent data from leaving the organization's network
AnswerB

Domain Restricted Sharing is the correct control. It's an org policy constraint that makes it impossible to add external users (gmail.com accounts or accounts from other Google Cloud organizations) to any IAM policy in the organization. This prevents accidental or intentional sharing of resources outside the company's domain.

Why this answer

The 'Domain Restricted Sharing' organization policy constraint (constraints/iam.allowedPolicyMemberDomains) explicitly prevents IAM policies from granting access to principals outside of specified trusted domains. This directly blocks sharing BigQuery data with external Google accounts by enforcing that all IAM members belong to the allowed domains, such as the company's own Google Workspace domain.

Exam trap

The trap here is that candidates often confuse data-at-rest encryption (CMEK) or data filtering (row-level security) with access control, failing to realize that only an organization policy constraint can prevent the initial IAM grant that shares data with external accounts.

How to eliminate wrong answers

Option A is wrong because CMEK (Customer-Managed Encryption Keys) controls encryption at rest but does not prevent data sharing; it only ensures that external parties cannot decrypt the data if they already have access, but it does not block the IAM grant that shares the data. Option C is wrong because BigQuery row-level security policies restrict which rows a user can see within a table based on user attributes like email domain, but they do not prevent the table from being shared with external accounts via IAM; they only filter data after access is granted. Option D is wrong because disabling external IP addresses prevents network-level egress but does not affect data sharing through BigQuery's API or IAM; data can still be shared with external accounts via authorized views, datasets, or IAM roles without any external IP traffic.

Practice this question →
5
MCQhard

A security team wants to get a comprehensive, organization-wide view of security misconfigurations (such as publicly accessible storage buckets, VMs without firewalls, and IAM overprivilege), vulnerabilities in container images, and active threats across all Google Cloud projects. Which Google Cloud service provides this unified security posture management?

A.Cloud Monitoring — it detects security anomalies through metric analysis.
B.Security Command Center (SCC) — unified security posture management across all GCP projects.
C.Cloud Audit Logs — they show all API calls that could indicate security issues.
D.Cloud DLP — it scans all resources for sensitive data exposure.
AnswerB

Security Command Center is Google Cloud's native security and risk management platform, aggregating asset inventory, vulnerability findings, misconfiguration detections, threat event data, and compliance violations across every project in an organization. It automatically evaluates each resource against CIS and PCI-DSS benchmarks and surfaces actionable findings in a unified dashboard, making it the definitive single pane of glass for cloud security posture.

Why this answer

Security Command Center (SCC) is the correct answer because it is Google Cloud's native, unified security and risk management platform that provides continuous monitoring for misconfigurations (e.g., publicly accessible storage buckets, VMs without firewalls, IAM overprivilege), vulnerability scanning for container images, and threat detection across all projects in an organization. It aggregates findings from services like Cloud Asset Inventory, Web Security Scanner, and Event Threat Detection into a single dashboard, enabling comprehensive security posture management.

Exam trap

The GCDL exam often tests the distinction between a security monitoring service (Cloud Monitoring) and a dedicated security posture management service (Security Command Center), leading candidates to pick Cloud Monitoring because they confuse metric-based anomaly detection with comprehensive security posture assessment.

How to eliminate wrong answers

Option A is wrong because Cloud Monitoring is focused on collecting metrics, logs, and events for performance and availability monitoring, not on scanning for security misconfigurations, vulnerabilities, or active threats; it lacks the built-in security findings engine and posture management capabilities of SCC. Option C is wrong because Cloud Audit Logs record API call activity for compliance and forensic analysis but do not actively scan for misconfigurations, vulnerabilities, or provide a unified security posture dashboard; they are a data source, not a management service. Option D is wrong because Cloud DLP specializes in discovering, classifying, and protecting sensitive data (e.g., PII, credit card numbers) using inspection and de-identification techniques, not in assessing security misconfigurations, container vulnerabilities, or active threats across cloud resources.

Practice this question →
6
MCQmedium

A company uses Cloud SQL for MySQL and wants to ensure that data is encrypted at rest using customer-managed keys. They also need to rotate the key every 90 days. What should they do?

A.Use customer-supplied encryption keys (CSEK) with Cloud SQL
B.Use default Google-managed encryption and rotate the key using Cloud KMS
C.Enable CMEK on the Cloud SQL instance and rotate the key in Cloud KMS
D.Bring your own key (BYOK) without using Cloud KMS
AnswerC

Enabling CMEK on a Cloud SQL instance lets you associate a customer-managed key from Cloud KMS with the instance at creation time. You can rotate the key in Cloud KMS by creating a new key version and setting it as the primary version; Cloud SQL automatically uses the new primary version without reconfiguring the instance. This gives you full control over key lifecycle and rotation, meeting the requirement.

Why this answer

Cloud SQL supports Customer-Managed Encryption Keys (CMEK) via integration with Cloud KMS. By enabling CMEK on the Cloud SQL instance, you can use a key you create and manage in Cloud KMS, and you can set a rotation period (e.g., 90 days) on that key in Cloud KMS. This ensures data at rest is encrypted with a key you control and that is automatically rotated according to your schedule.

Exam trap

The trap here is that candidates confuse CSEK (Compute Engine/Cloud Storage) with CMEK (Cloud SQL, BigQuery, etc.) and assume any customer-managed key option works for Cloud SQL, or they think default Google-managed keys can be rotated by the customer.

How to eliminate wrong answers

Option A is wrong because Cloud SQL does not support customer-supplied encryption keys (CSEK); CSEK is a feature of Compute Engine and Cloud Storage, not Cloud SQL. Option B is wrong because default Google-managed encryption cannot be rotated by the customer; rotation of Google-managed keys is handled internally by Google and not configurable by the user. Option D is wrong because BYOK without Cloud KMS is not a supported mechanism for Cloud SQL; Cloud SQL requires the use of Cloud KMS to manage customer-managed keys for encryption at rest.

Practice this question →
7
MCQmedium

A company's security policy requires that when an employee is terminated, their access to all cloud resources must be revoked immediately — including any active sessions. Which approach most comprehensively achieves this in a Google Cloud environment integrated with Google Workspace?

A.Manually reviewing and removing the employee's IAM bindings across all Google Cloud projects one by one
B.Disabling the employee's Google Workspace account (which immediately invalidates all active sessions and prevents new authentication), then auditing for and revoking any service account keys they created
C.Changing the employee's password immediately — they can no longer log in with the old password
D.Waiting until the end of the business day to revoke access to avoid disrupting active workflows
AnswerB

This is the comprehensive approach. Disabling the Workspace identity immediately invalidates all active OAuth tokens and prevents new sign-ins — all GCP access based on that identity stops instantly. Auditing for service account keys they created closes the remaining gap (keys are separate credentials not tied to the user account).

Why this answer

Disabling the Google Workspace account immediately invalidates all active sessions and prevents new authentication because Google Cloud IAM relies on the Workspace identity for user-based access. This single action revokes access across all Google Cloud projects and services that use that identity, including Cloud Console, gcloud CLI, and API sessions. Auditing and revoking service account keys the user created is necessary because those keys are not tied to the user's Workspace account and remain valid until explicitly deleted.

Exam trap

The GCDL exam often tests the misconception that changing a password or removing IAM roles is sufficient for immediate session termination, when in fact only disabling the identity account (or revoking tokens) stops active sessions — OAuth tokens are not invalidated by password changes or role removals.

How to eliminate wrong answers

Option A is wrong because manually reviewing and removing IAM bindings across projects is slow, error-prone, and does not terminate active sessions — the user's existing tokens and sessions remain valid until they expire. Option C is wrong because changing the password only prevents new logins; it does not invalidate existing OAuth 2.0 access tokens or refresh tokens, so active sessions and API calls continue until token expiry (typically 1 hour). Option D is wrong because waiting until the end of the business day violates the security policy requirement for immediate revocation and leaves a window for unauthorized access or data exfiltration.

Practice this question →
8
MCQmedium

A company's application stores user passwords. Their security team says passwords must be stored as hashes, never in plaintext. They want to ensure this requirement is met even if a database is compromised. Why is password hashing (with salt) the correct approach?

A.Hashing passwords allows the application to recover the original password when users forget it.
B.Hashing with salt makes stored passwords irreversible — even if the database is stolen, attackers cannot recover the original passwords without computationally intensive per-user brute force.
C.Storing passwords as hashes allows sharing them between systems for single sign-on.
D.Google Cloud automatically encrypts all database contents, making password hashing unnecessary.
AnswerB

Salted hashing converts a password into a fixed-length digest using a random per-user salt, making the stored value irreversible and preventing attackers from using precomputed rainbow tables to reverse many hashes at once. Even after a database breach, an attacker must guess or brute-force each user's password independently and recompute the hash with that user's salt, a computationally expensive process that becomes infeasible for strong, high-entropy passwords—thereby protecting users even when other security layers fail.

Why this answer

Password hashing with salt is the correct approach because it transforms passwords into irreversible digests. Even if the database is compromised, an attacker cannot recover the original passwords without performing a computationally expensive brute-force attack on each salted hash individually. This ensures the plaintext password is never stored or recoverable, meeting the security requirement.

Exam trap

The trap here is that candidates may confuse encryption (which is reversible) with hashing (which is one-way), or assume that cloud encryption alone satisfies the requirement, ignoring the application's own storage logic.

How to eliminate wrong answers

Option A is wrong because hashing is a one-way function; the application cannot recover the original password from the hash — it can only verify a candidate password by re-hashing and comparing. Option C is wrong because password hashes are not designed for sharing between systems for single sign-on; SSO typically uses tokens or federated identity protocols (e.g., SAML, OAuth), not raw password hashes. Option D is wrong because Google Cloud's encryption-at-rest protects data in storage but does not prevent the application from storing plaintext passwords; the requirement is about the application's own storage practice, not infrastructure encryption.

Practice this question →
9
MCQhard

A security architect is evaluating Google Cloud's approach to securing customer data against both external attackers and potential internal Google personnel access. She identifies four distinct controls: (1) encryption at rest by default, (2) Access Transparency logs, (3) Customer-Managed Encryption Keys (CMEK), and (4) Access Approval. How do these four controls work together to provide layered data protection?

A.All four controls are redundant and address the same threat — customers only need to enable one of them
B.The four controls form complementary layers: default encryption protects physical storage, CMEK gives cryptographic customer control (revocable), Access Transparency provides visibility into Google personnel access, and Access Approval gives customers veto power — together addressing infrastructure attacks, insider threats, and provider access concerns
C.These controls are only relevant for government or military workloads; commercial enterprises don't need this level of protection
D.CMEK alone provides complete data protection — the other three controls are unnecessary if customer-managed keys are in use
AnswerB

This correctly describes the layered defense. Default encryption: protects against physical media theft. CMEK: customer controls the key — can cryptographically revoke Google's ability to decrypt. Access Transparency: audit trail of provider access. Access Approval: proactive veto before access. Together they provide defense at every layer of the provider access concern.

Why this answer

These four controls form a defense-in-depth strategy for data protection on Google Cloud. Default encryption at rest secures data on physical storage, CMEK provides cryptographic control with the ability to revoke access, Access Transparency logs offer visibility into Google personnel actions, and Access Approval gives customers the ability to veto access requests. Together, they address threats from infrastructure attacks, insider threats, and provider access concerns, creating a layered security model.

Exam trap

Google Cloud often tests the misconception that encryption alone is sufficient for data protection, ignoring the need for access transparency and approval mechanisms to address insider threats and provider access concerns.

How to eliminate wrong answers

Option A is wrong because the controls are not redundant; each addresses a distinct threat vector (e.g., encryption at rest protects against physical theft, while Access Approval controls administrative access). Option C is wrong because these controls are applicable to all workloads, not just government or military; Google Cloud recommends them for any organization needing compliance or data sovereignty. Option D is wrong because CMEK alone does not provide complete protection; it lacks visibility (Access Transparency) and veto capability (Access Approval) for Google personnel access, and does not cover default encryption for all data.

Practice this question →
10
MCQeasy

A startup is building a mobile health app that stores sensitive patient data in Cloud Storage. They want to ensure data is encrypted at rest using a key they manage themselves and rotate monthly. Which encryption approach should they use?

A.Use customer-supplied encryption keys (CSEK)
B.Use default Google-managed encryption keys
C.Use customer-managed encryption keys (CMEK) with Cloud KMS
D.Use server-side encryption with customer-provided keys (SSE-C)
AnswerC

CMEK with Cloud KMS gives you direct control over the encryption key, including the ability to set automatic rotation every 30 days via the rotation period parameter and to manually rotate at any time. Data in Cloud Storage is encrypted with a data encryption key (DEK), which itself is wrapped by a key encryption key (KEK) managed in Cloud KMS, and you can grant or revoke IAM permissions to enforce separation of duties.

Why this answer

Cloud Key Management Service (Cloud KMS) with a customer-managed encryption key (CMEK) allows customers to control and rotate keys. CSEK is deprecated and less flexible. SSE-C is not available in Cloud Storage.

Default encryption is Google-managed and cannot be rotated by the customer.

Practice this question →
11
MCQmedium

A company stores encryption keys in Cloud KMS to protect sensitive data. What does Cloud KMS provide that standard application-layer encryption does not?

A.Faster encryption performance because Google's hardware is optimized for cryptographic operations.
B.Centralized key lifecycle management with IAM-controlled access, audit logs, rotation policies, and optional HSM-backed key protection.
C.The ability to encrypt data without any performance impact on the application.
D.Free unlimited encryption for all data stored in Google Cloud.
AnswerB

Cloud KMS provides key governance: who can use which key is IAM-controlled and audited; keys can be automatically rotated; HSM protection ensures keys never leave secure hardware. These are enterprise security requirements that application-layer encryption cannot provide.

Why this answer

Cloud KMS provides centralized key lifecycle management, including IAM-based access control, audit logging, automatic key rotation, and optional HSM-backed key protection. Standard application-layer encryption typically embeds keys within the application code or configuration, lacking these governance and security controls. This separation of key management from application logic is a core security best practice.

Exam trap

The trap here is that candidates assume Cloud KMS is just a faster or cheaper way to do encryption, when the real value is the centralized governance, auditability, and HSM-backed security that standard application-layer encryption lacks.

How to eliminate wrong answers

Option A is wrong because Cloud KMS does not inherently provide faster encryption performance; in fact, using a remote key management service can introduce network latency compared to local encryption, and Google's hardware optimization is not a primary benefit over application-layer encryption. Option C is wrong because any encryption, including Cloud KMS, introduces some performance overhead due to cryptographic operations and network calls; it cannot be completely free of performance impact. Option D is wrong because Cloud KMS is not free; it has a pay-per-use pricing model based on key operations and storage, and there is no unlimited free tier for encryption.

Practice this question →
12
MCQeasy

A company is migrating its on-premises applications to Google Cloud. The security team requires that all data be encrypted both in transit and at rest. Which approach meets these requirements with minimal operational overhead?

A.Use HTTPS for all traffic and enable default encryption at rest with Google-managed keys.
B.Implement a third-party encryption tool for both transit and at rest.
C.Set up a VPN between on-premises and Google Cloud and rely on that for encryption.
D.Restrict physical access to Google Cloud data centers.
AnswerA

Enabling HTTPS ensures all data in transit is protected via TLS, preventing eavesdropping and tampering between clients and Google Cloud services. Google Cloud automatically encrypts data at rest at the storage layer using AES-256, managed by Google's key infrastructure, without requiring customer configuration. This approach satisfies both encryption requirements with minimal operational overhead because the customer only needs to configure HTTPS endpoints while relying on Google's default, transparent encryption for stored data.

Why this answer

HTTPS provides encryption in transit using TLS, and default encryption at rest with Google-managed keys encrypts data stored in Google Cloud services like Cloud Storage and Compute Engine disks without requiring any manual key management. This approach meets the security requirements with minimal operational overhead since Google handles key rotation and lifecycle management automatically.

Exam trap

Google Cloud often tests the misconception that a VPN alone satisfies both encryption in transit and at rest requirements, but candidates must remember that VPNs only cover transit encryption and do not address data at rest within the cloud provider's infrastructure.

How to eliminate wrong answers

Option B is wrong because implementing a third-party encryption tool introduces additional complexity, cost, and operational overhead for both transit and at rest encryption, which contradicts the requirement for minimal operational overhead. Option C is wrong because a VPN only encrypts traffic between on-premises and Google Cloud but does not provide encryption at rest for data stored within Google Cloud services. Option D is wrong because restricting physical access to data centers addresses physical security but does not provide any encryption for data in transit or at rest.

Practice this question →
13
MCQeasy

Which Google Cloud feature provides reports on how Google processes government requests for customer data and how often Google challenges overly broad requests?

A.Cloud Audit Logs — they record all API calls including government data requests.
B.Google's Transparency Report — publishing data about government requests and legal compliance.
C.Security Command Center — it alerts when government agencies access customer data.
D.Access Transparency logs — they record every time any external entity accesses customer data.
AnswerB

Google's Transparency Report is a public-facing repository that aggregates and discloses government requests for user data, including compliance rates, legal process types, and Google's challenge history. Unlike real-time logs or alerts, it is authoritative because it shows aggregated, legally verified data across jurisdictions. It is the correct answer because it directly documents government-request activity and legal compliance in a verifiable form for the public.

Why this answer

Google's Transparency Report is the correct answer because it specifically publishes data on government requests for user data, including how Google processes these requests and how often it challenges overly broad or legally questionable demands. This report is designed to provide public visibility into government actions, not to log individual API calls or access events.

Exam trap

The GCDL exam often tests the distinction between internal access logs (Access Transparency) and external government request reporting (Transparency Report), so the trap here is confusing operational audit trails with public transparency reporting about legal demands.

How to eliminate wrong answers

Option A is wrong because Cloud Audit Logs record API calls made within a Google Cloud project, not government data requests to Google as a company; they are for internal auditing of customer resources. Option C is wrong because Security Command Center is a security and risk management platform that detects threats and vulnerabilities in cloud resources, not a tool for reporting on government requests for customer data. Option D is wrong because Access Transparency logs record every time a Google Cloud employee or support engineer accesses customer data, not external government entities; they are about internal access, not government requests.

Practice this question →
14
MCQeasy

The principle of least privilege is a fundamental security concept applied to IAM in Google Cloud. Which statement best describes this principle?

A.All users should have read-only access to prevent accidental changes.
B.Users and services should be granted only the minimum permissions required for their specific function, nothing more.
C.Administrators should have full access so they can respond to any emergency quickly.
D.All employees should share the same IAM role to simplify permission management.
AnswerB

Least privilege means assigning IAM roles to users and service accounts that contain exactly the permissions needed for their job function and nothing extra. For example, a developer who deploys a Cloud Run app needs roles like roles/run.invoker or roles/run.developer, not broader roles like roles/bigquery.admin. This minimizes the attack surface and blast radius if a credential is compromised, and it aligns with Google Cloud's policy of scoping roles to specific resources, conditions, and identities. It is not about being maximally restrictive; it is about being exactly restrictive enough.

Why this answer

The principle of least privilege in Google Cloud IAM dictates that identities (users, groups, or service accounts) should be granted only the permissions necessary to perform their intended tasks. This minimizes the attack surface and limits the blast radius of a compromised credential. In Google Cloud, this is implemented by assigning predefined or custom roles with the exact set of permissions required, rather than using broad roles like Owner or Editor.

Exam trap

Google Cloud often tests the misconception that 'least privilege' means 'everyone gets read-only' or that 'administrators need full access for emergencies,' but the correct interpretation is granular, role-specific permissions with temporary elevation for break-glass scenarios.

How to eliminate wrong answers

Option A is wrong because read-only access is not universally appropriate; some users or services need write, create, or delete permissions to perform their functions, and enforcing read-only for all would break operational workflows. Option C is wrong because granting administrators full access at all times violates least privilege; emergency access should be obtained through just-in-time (JIT) or break-glass mechanisms, such as using Google Cloud's Access Approval or temporary privilege elevation, not standing permissions. Option D is wrong because sharing the same IAM role across all employees ignores the need for role-based access control (RBAC); different job functions require different permissions, and a single role would either over-permission some users or under-permission others, creating security or operational gaps.

Practice this question →
15
MCQeasy

A company is concerned about which security responsibilities belong to Google versus which belong to them when using Google Cloud's managed database service (Cloud SQL). In the shared responsibility model, which security tasks does Google handle?

A.Google controls who can access the database and what data can be stored.
B.Google handles physical security, hardware maintenance, and OS and database software patching.
C.Google is responsible for backing up customer data and ensuring data recovery.
D.Google determines which compliance certifications the customer's application must meet.
AnswerB

This is the correct description of the shared responsibility model for managed database services like Cloud SQL. Google is responsible for data center physical security (e.g., biometric access controls, armed guards), hardware lifecycle management (failed disk replacement), and patching the underlying operating system and database engine. For example, Cloud SQL automatically applies minor version updates and security patches; customers can schedule maintenance windows for major upgrades. These infrastructure-level tasks are handled entirely by Google, which is what distinguishes a fully managed service from a self-managed Compute Engine VM.

Why this answer

In the shared responsibility model for Google Cloud services like Cloud SQL, Google is responsible for security 'of' the cloud, which includes physical security of data centers, hardware maintenance, and patching the underlying operating system and database software. This ensures the infrastructure hosting Cloud SQL instances is secure, while the customer remains responsible for securing their data, access policies, and application-level configurations.

Exam trap

The trap here is that candidates often confuse Google's responsibility for patching the database software (which Google handles) with the customer's responsibility for managing database access controls and backup configurations, leading them to incorrectly select options A or C.

How to eliminate wrong answers

Option A is wrong because Google does not control who accesses the database or what data is stored; those are customer responsibilities under IAM and data classification. Option C is wrong because while Google provides backup and recovery capabilities as a feature, the customer is responsible for configuring and enabling backups, and for verifying recovery procedures. Option D is wrong because Google does not determine which compliance certifications the customer's application must meet; the customer must assess their own compliance requirements and choose Google Cloud services that align with those certifications.

Practice this question →
16
Drag & Dropmedium

Drag and drop the steps to set up a Cloud NAT for private Compute Engine instances to access the internet in the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4

Why this order

The setup requires a VPC, Cloud Router, NAT gateway, appropriate firewall rules, and verification.

Practice this question →
17
MCQhard

A CISO is evaluating Google Cloud's security posture and asks about independent third-party validation of Google's security practices. Which types of certifications and audit reports most directly provide this independent assurance?

A.Google's internal security policies and self-assessment reports published on its website
B.Third-party audit certifications such as ISO 27001, SOC 2 Type II, PCI DSS, and FedRAMP, which independently verify that Google's security controls meet defined international and industry standards
C.Google's Bug Bounty program, which shows that the public can report security vulnerabilities
D.Customer testimonials from large enterprises that use Google Cloud for sensitive workloads
AnswerB

These certifications are the gold standard for independent assurance. ISO 27001 and SOC 2 Type II involve rigorous independent audits. PCI DSS is required for payment data handling. FedRAMP provides US government-validated cloud security. A CISO can review these certifications as credible evidence that Google's security controls have been independently verified.

Why this answer

Independent third-party validation of Google Cloud's security posture is most directly provided by certifications and audit reports such as ISO 27001, SOC 2 Type II, PCI DSS, and FedRAMP. These are issued by accredited external auditors who verify that Google's security controls, processes, and infrastructure meet rigorous, internationally recognized standards. This gives customers objective assurance beyond Google's own claims.

Exam trap

Google Cloud often tests the distinction between internal self-assessments or informal programs (like bug bounties or testimonials) and formal, independent third-party audit certifications that provide legally defensible assurance of security controls.

How to eliminate wrong answers

Option A is wrong because internal security policies and self-assessment reports are not independent; they lack external verification and are considered first-party attestations, not third-party validation. Option C is wrong because the Bug Bounty program is a vulnerability disclosure mechanism that encourages ethical hacking, but it does not provide a systematic, audited certification of overall security controls or compliance with standards like ISO 27001 or SOC 2. Option D is wrong because customer testimonials, while valuable for reputation, are anecdotal and not a formal, audited certification; they do not constitute independent third-party validation of security practices.

Practice this question →
18
MCQmedium

A company's security team wants to detect and remediate public exposure of Cloud SQL instances. Which service should they use?

A.Cloud Armor
B.Security Command Center
C.Cloud Data Loss Prevention (DLP)
D.VPC Service Controls
AnswerB

Security Command Center is Google Cloud's security and risk management platform that continuously monitors resources for vulnerabilities, threats, and misconfigurations. It includes built-in detectors that flag publicly exposed Cloud SQL instances by checking assigned IP addresses and IAM policies against best practices. This makes it the correct choice for identifying and remediating the public exposure described in the scenario.

Why this answer

Security Command Center (SCC) is the correct service because it provides centralized visibility and monitoring of Google Cloud resources, including the ability to detect and alert on public exposure of Cloud SQL instances. SCC's built-in vulnerability and threat detection findings, such as 'Public SQL instance,' directly identify misconfigured Cloud SQL instances that are accessible from the internet, enabling the security team to remediate the exposure.

Exam trap

The trap here is that candidates often confuse services that enforce security (like VPC Service Controls or Cloud Armor) with services that detect and alert on misconfigurations, leading them to pick a tool that blocks or filters traffic rather than one that provides visibility and detection.

How to eliminate wrong answers

Option A is wrong because Cloud Armor is a web application firewall (WAF) and DDoS protection service that operates at the edge of Google Cloud, protecting HTTP(S) load-balanced applications, not detecting or remediating public exposure of Cloud SQL instances. Option C is wrong because Cloud Data Loss Prevention (DLP) is a service for inspecting, classifying, and de-identifying sensitive data within content, not for detecting network-level exposure of Cloud SQL instances. Option D is wrong because VPC Service Controls is a security perimeter service that prevents data exfiltration from managed services by defining perimeters around VPC networks, but it does not actively detect or alert on public exposure of Cloud SQL instances; it enforces access boundaries but does not provide visibility into existing public configurations.

Practice this question →
19
MCQmedium

A company uses Cloud Load Balancing to distribute traffic to Compute Engine VMs. They want to protect against SQL injection and cross-site scripting attacks. Which service should they enable?

A.Identity-Aware Proxy (IAP)
B.Cloud Armor
C.Cloud CDN
D.VPC Service Controls
AnswerB

Cloud Armor is a web application firewall (WAF) and DDoS protection service that works natively with Cloud Load Balancing to filter inbound traffic. It provides preconfigured rules to block common attacks like SQLi, XSS, and OWASP Top 10 threats, as well as custom rules for IP and geolocation-based blocking, making it the correct tool for defending against web attacks.

Why this answer

Cloud Armor is the correct service because it provides web application firewall (WAF) capabilities that can inspect HTTP/S traffic for malicious patterns, including SQL injection and cross-site scripting (XSS) signatures. It integrates directly with Cloud Load Balancing to filter requests before they reach backend Compute Engine VMs, using pre-configured rules from the ModSecurity Core Rule Set (CRS) to block these common OWASP Top 10 threats.

Exam trap

The trap here is that candidates confuse Identity-Aware Proxy (IAP) with a security filter for application-layer attacks, but IAP only authenticates and authorizes users, not inspects traffic for malicious payloads like SQL injection or XSS.

How to eliminate wrong answers

Option A is wrong because Identity-Aware Proxy (IAP) controls access based on user identity and context (e.g., OAuth, device state), but it does not inspect HTTP request payloads for attack patterns like SQL injection or XSS. Option C is wrong because Cloud CDN caches content at edge locations to improve latency and reduce load, but it does not provide a WAF or inspect traffic for malicious payloads. Option D is wrong because VPC Service Controls create a security perimeter around Google Cloud APIs and services (e.g., preventing data exfiltration via VPC peering), but they do not filter application-layer attacks like SQL injection or XSS.

Practice this question →
20
MCQmedium

A healthcare company must store PHI in Cloud Storage. They require encryption at rest and in transit, and need to comply with HIPAA. Which combination of Google Cloud features should they implement?

A.Cloud Storage with SSE-C, HTTP for in-transit, and enable HIPAA compliance flag.
B.Use Cloud Storage with CSEK and disable public access.
C.Cloud Storage with SSE-GCP and use HTTPS, sign BAA with Google.
D.Use Cloud Storage with CMEK and use VPN for transit.
AnswerC

This is the correct combination because it addresses all three HIPAA requirements. SSE-GCP is Google's default encryption for data at rest, automatically applied without additional key management overhead. HTTPS (TLS) encrypts all data in transit between clients and Cloud Storage, preventing eavesdropping. Signing a Business Associate Agreement (BAA) with Google establishes the necessary legal framework for handling Protected Health Information, making this solution fully HIPAA compliant.

Why this answer

Cloud Storage with server-side encryption (SSE-GCP) provides encryption at rest by default, HTTPS ensures encryption in transit, and signing a Business Associate Agreement (BAA) with Google is a mandatory contractual requirement for HIPAA compliance. This combination satisfies all stated requirements: encryption at rest, encryption in transit, and HIPAA compliance.

Exam trap

The trap here is that candidates often confuse encryption mechanisms (SSE-C, CSEK, CMEK, SSE-GCP) with HIPAA compliance requirements, mistakenly thinking that any encryption method plus disabling public access or using a VPN is sufficient, when in fact a signed BAA is the non-negotiable contractual requirement for HIPAA compliance with Google Cloud.

How to eliminate wrong answers

Option A is wrong because SSE-C (Server-Side Encryption with Customer-Provided Keys) is a valid encryption-at-rest option, but HTTP does not encrypt data in transit, and there is no 'HIPAA compliance flag' to enable in Cloud Storage—HIPAA compliance requires a signed BAA. Option B is wrong because CSEK (Customer-Supplied Encryption Keys) is a valid encryption-at-rest method, but disabling public access alone does not ensure encryption in transit (HTTPS is required) and does not address HIPAA compliance (a signed BAA is needed). Option D is wrong because CMEK (Customer-Managed Encryption Keys) provides encryption at rest, but using a VPN for transit does not guarantee HTTPS for Cloud Storage access; Cloud Storage requires HTTPS for encryption in transit, and a VPN alone does not satisfy the HIPAA requirement for a signed BAA.

Practice this question →
21
MCQhard

A company's risk management team wants to understand Google Cloud's approach to supply chain security — specifically, how Google ensures that the hardware and firmware running in its data centers have not been tampered with. Which Google security initiative addresses hardware supply chain integrity?

A.Google uses third-party antivirus software to scan all hardware components for tampering before installation
B.Google's Titan security chip, embedded in Google's servers, cryptographically attests boot firmware integrity and machine identity — providing hardware-level supply chain security assurance
C.Google relies on hardware manufacturers' security certifications to ensure supply chain integrity
D.Google encrypts all hardware components with AES-256 to prevent tampering
AnswerB

Titan is Google's hardware root of trust for supply chain security. It generates a cryptographic identity for the machine, verifies boot firmware hasn't been tampered with (preventing firmware attacks), and provides attestation that can be verified throughout the machine's lifecycle. This is a core component of Google's defense-in-depth security architecture.

Why this answer

Google's Titan security chip is a dedicated hardware root of trust that cryptographically verifies the boot firmware integrity and machine identity at every startup. This ensures that only Google-signed firmware runs on servers, preventing tampering during manufacturing, shipping, or deployment. Titan provides a hardware-anchored attestation chain that validates the entire supply chain from chip fabrication to rack installation.

Exam trap

The trap here is that candidates often confuse supply chain security with data protection mechanisms (like encryption) or rely on third-party certifications, missing that Google's proprietary hardware root of trust (Titan) is the specific initiative for hardware integrity.

How to eliminate wrong answers

Option A is wrong because Google does not use third-party antivirus software to scan hardware components; antivirus software operates at the OS level and cannot verify hardware or firmware integrity at the supply chain level. Option C is wrong because Google does not rely solely on hardware manufacturers' security certifications; instead, Google implements its own hardware security controls like Titan to independently verify integrity, as manufacturer certifications can be compromised or insufficient. Option D is wrong because AES-256 encryption protects data at rest or in transit, not hardware components themselves; encrypting hardware components would not prevent tampering with firmware or the physical device.

Practice this question →
22
MCQmedium

A company is evaluating Google Cloud and wants to know: what is Access Transparency, and how does it benefit customers with stringent governance requirements?

A.Access Transparency shows customers which Google Cloud services are available in their region.
B.Access Transparency logs when Google Cloud personnel access customer content, providing an audit trail for governance.
C.Access Transparency is a feature that makes all customer data visible to Google for quality improvement.
D.Access Transparency provides customers with real-time dashboards of their application's security vulnerabilities.
AnswerB

Access Transparency generates near-real-time audit logs whenever Google Cloud employees or support engineers access customer content, capturing the specific action, the data involved, the business justification (e.g., support ticket or legal request), and the timestamp. These logs are delivered to the customer's own Cloud Audit Logs bucket, so they can be stored, queried, and retained under the customer's governance policies. This provides independent, cryptographic evidence that Google respects data residency and access controls, which is critical for regulated industries like finance, healthcare, and public sector.

Why this answer

Access Transparency logs are a Google Cloud feature that provides customers with near real-time logs whenever Google personnel access their data. This creates a detailed audit trail, which is essential for customers with stringent governance or compliance requirements, as it allows them to monitor and verify that access is only for authorized purposes.

Exam trap

The GCDL exam often tests the distinction between 'logging access' and 'providing visibility into data' — the trap here is confusing Access Transparency (an audit log of Google personnel actions) with a feature that exposes or shares customer data with Google.

How to eliminate wrong answers

Option A is wrong because Access Transparency does not show which Google Cloud services are available in a region; that is the function of the Google Cloud region and service listing pages. Option C is wrong because Access Transparency does not make customer data visible to Google for quality improvement; it logs when Google personnel access data, and customers must opt in to share data for quality improvement through separate programs. Option D is wrong because Access Transparency does not provide real-time dashboards of security vulnerabilities; that is the role of services like Security Command Center or Web Security Scanner.

Practice this question →
23
MCQmedium

A company is moving its financial reporting application to Google Cloud. The CFO asks: 'If Google Cloud experiences a data breach and our financial data is exposed, who is financially liable?' How should the cloud architect answer this question?

A.Google Cloud bears full financial liability for all data breaches involving customer data on its platform
B.Liability depends on where the breach originated: Google is responsible for failures in its infrastructure security; the customer is responsible for breaches resulting from misconfiguration, application vulnerabilities, or inadequate access controls in areas under their responsibility
C.The customer bears all liability for any breach because they chose to use cloud services
D.No party is liable because data breaches in cloud are force majeure events similar to natural disasters
AnswerB

This accurately describes the shared responsibility reality. If Google's physical security or hypervisor is breached, Google bears responsibility. If a misconfigured IAM policy exposes data (customer responsibility), the customer bears the consequences. The customer should also have cyber insurance to manage residual risk.

Why this answer

The Google Cloud Shared Responsibility Model explicitly delineates liability: Google is responsible for the security of the cloud (e.g., physical infrastructure, hypervisor, network controls), while the customer is responsible for security in the cloud (e.g., IAM policies, application code, data encryption). In a breach, liability is determined by where the failure occurred—if Google’s infrastructure (e.g., GKE node isolation) fails, Google bears liability; if the customer misconfigures a Cloud Storage bucket or leaves a Compute Engine firewall open, the customer bears liability. This aligns with the CFO’s question about financial liability, which is not absolute but contingent on the breach’s origin.

Exam trap

The trap here is that candidates assume Google Cloud automatically assumes all liability for any data breach, ignoring the Shared Responsibility Model’s clear division of accountability based on the breach’s origin (infrastructure vs. customer-managed layers).

How to eliminate wrong answers

Option A is wrong because Google Cloud does not bear full financial liability; the Shared Responsibility Model assigns liability based on the breach’s origin, and customers retain responsibility for their own configurations, applications, and access controls. Option C is wrong because the customer does not bear all liability; Google is liable for breaches caused by failures in its infrastructure security (e.g., hypervisor escapes, physical data center breaches). Option D is wrong because data breaches are not force majeure events; they are foreseeable risks addressed in Google Cloud’s SLA and contractual terms, and liability is governed by the Cloud Terms of Service, not natural disaster clauses.

Practice this question →
24
MCQhard

A CISO is designing an identity strategy for Google Cloud that follows Zero Trust principles. She proposes that no long-lived credentials (API keys, service account keys) should be used for any automated workloads. What Google Cloud mechanism replaces service account keys for authenticating workloads running on Google Cloud infrastructure?

A.Using long-lived API keys stored in Secret Manager instead of environment variables — the keys are the same but stored more securely
B.Attaching a service account to the Compute Engine VM or GKE workload, allowing the workload to obtain short-lived access tokens from the metadata server automatically — no key files required
C.Rotating service account keys every 24 hours to minimize the exposure window
D.Using OAuth 2.0 user accounts instead of service accounts for all automated workloads
AnswerB

This is the correct Zero Trust-aligned approach. A service account is attached to the VM or GKE pod. The workload calls the metadata server (169.254.169.254) to get a short-lived (1-hour) access token automatically. No key file is created, stored, or managed — eliminating the key compromise risk entirely. Workload Identity in GKE extends this to Kubernetes service accounts.

Why this answer

Google Cloud's default service account attached to Compute Engine VMs or GKE nodes uses the metadata server to automatically obtain short-lived OAuth 2.0 access tokens (typically valid for 1 hour). This eliminates the need for any long-lived key files, aligning with Zero Trust principles by reducing credential exposure and enabling automatic rotation.

Exam trap

The GCDL exam often tests the misconception that rotating keys or storing them securely (e.g., in Secret Manager) is sufficient for Zero Trust, when the core principle is to eliminate long-lived credentials entirely by using metadata-server-based token generation.

How to eliminate wrong answers

Option A is wrong because it still relies on long-lived API keys (even if stored in Secret Manager), which violates the Zero Trust requirement of no long-lived credentials. Option C is wrong because rotating service account keys every 24 hours still uses long-lived key files that can be exfiltrated and reused within that window, failing to eliminate the underlying risk. Option D is wrong because OAuth 2.0 user accounts are designed for interactive human users, not automated workloads, and would require storing user credentials or refresh tokens, which introduces security and manageability issues.

Practice this question →
25
MCQmedium

A security team is reviewing a developer's request to be granted the 'Owner' role on a production Google Cloud project 'just in case they need broad access.' The security team rejects this and instead grants a more specific role. Which security principle does the security team's decision enforce?

A.Defense in depth, by ensuring multiple security layers protect the project
B.Separation of duties, by ensuring no single person has too many responsibilities
C.Principle of least privilege, by granting only the minimum permissions necessary for the developer's specific role and tasks
D.Zero trust networking, by treating the developer's device as untrusted
AnswerC

The Principle of Least Privilege is the core concept here. Owner role is far broader than necessary. By granting a specific role matching actual requirements, the security team limits the blast radius if the developer's account is compromised and reduces the risk of accidental destructive actions.

Why this answer

The security team's decision to reject the overly broad 'Owner' role and grant a more specific role directly enforces the principle of least privilege. This principle dictates that users should be granted only the minimum permissions necessary to perform their job functions, reducing the risk of accidental or malicious misuse of elevated access. In Google Cloud, this is implemented by assigning predefined or custom IAM roles with precisely scoped permissions rather than broad roles like Owner.

Exam trap

Google Cloud often tests the principle of least privilege by presenting a scenario where a broad role is requested 'just in case,' and candidates may confuse it with separation of duties or defense in depth, but the key is that the decision limits permissions to the minimum needed for the task.

How to eliminate wrong answers

Option A is wrong because defense in depth involves multiple layers of security controls (e.g., firewalls, encryption, monitoring) across the infrastructure, not the granularity of a single IAM role assignment. Option B is wrong because separation of duties ensures that critical tasks are divided among multiple individuals to prevent fraud or error, whereas this scenario is about limiting permissions for a single developer, not splitting responsibilities. Option D is wrong because zero trust networking focuses on verifying every request as if it originates from an untrusted network, often through device authentication and network segmentation, not on the scope of IAM roles granted to a user.

Practice this question →
26
MCQeasy

A small e-commerce company runs its website on Compute Engine instances behind a Global External HTTP(S) Load Balancer. They are concerned about application-layer DDoS attacks, such as SQL injection and cross-site scripting (XSS), that could compromise customer data and degrade performance. The company wants a managed solution that provides both DDoS protection and web application firewall (WAF) capabilities without requiring constant manual updates. They have a limited budget and prefer a solution that is easy to configure and does not require extensive infrastructure changes. What should they implement?

A.Enable Cloud Armor with preconfigured WAF rules and configure it on the load balancer.
B.Configure VPC firewall rules to block suspicious IP addresses.
C.Set up Cloud NAT to route all traffic through a single IP address.
D.Use Cloud VPN to connect users to the load balancer.
AnswerA

Cloud Armor is a Google Cloud managed security service that provides DDoS protection and a web application firewall (WAF). By enabling preconfigured WAF rules and attaching Cloud Armor policies to the external load balancer, the service inspects incoming HTTP(S) traffic at the edge, blocking common application-layer attacks such as SQL injection and cross-site scripting (XSS) before they reach backend instances. This is exactly what the e-commerce site needs for L7 protection and volumetric attack mitigation.

Why this answer

Cloud Armor is a managed, Google Cloud-native service that provides both DDoS protection and a web application firewall (WAF) with preconfigured rules for SQL injection and XSS. It integrates directly with the Global External HTTP(S) Load Balancer, requires no manual updates (rules are maintained by Google), and is cost-effective because it charges based on policy usage rather than infrastructure overhead. This meets the company's need for easy configuration, minimal infrastructure changes, and managed security.

Exam trap

The trap here is that candidates confuse network-layer security tools (VPC firewall rules, Cloud NAT, Cloud VPN) with application-layer security, assuming any Google Cloud networking feature can block web attacks, but only Cloud Armor provides managed WAF and DDoS protection at the application layer.

How to eliminate wrong answers

Option B is wrong because VPC firewall rules operate at the network layer (Layer 3/4) and cannot inspect application-layer payloads like SQL injection or XSS; they only block IP addresses, not malicious content. Option C is wrong because Cloud NAT is used for outbound internet access from private instances, not for inbound traffic protection or application-layer filtering; it does not provide DDoS or WAF capabilities. Option D is wrong because Cloud VPN creates an encrypted tunnel for site-to-site connectivity, not for protecting public-facing web traffic from application-layer attacks; it does not inspect HTTP/HTTPS payloads or mitigate DDoS.

Practice this question →
27
MCQeasy

Google Cloud encrypts all customer data at rest by default without any configuration required. A customer asks: 'Do we need to do anything special to encrypt our data stored in Cloud Storage?' What is the correct answer?

A.Yes, customers must enable encryption in the Cloud Storage bucket settings for each bucket.
B.No, Google Cloud encrypts all data at rest automatically using AES-256 — no configuration is needed.
C.Only data in premium storage tiers is encrypted; Standard storage requires manual encryption.
D.Customers must purchase the Security Command Center Premium tier to enable data encryption.
AnswerB

Google Cloud automatically encrypts all data at rest using AES-256, and this is enabled by default for every service, including Cloud Storage. No configuration, bucket settings, or key provision steps are needed to activate encryption. If a customer wants more control, they can optionally use Cloud KMS with CMEK or CSEK, but that enhances key management rather than providing encryption, which already exists.

Why this answer

Google Cloud automatically encrypts all customer data at rest using AES-256 encryption, with no configuration required. This default encryption applies to all Cloud Storage buckets, regardless of storage class or region, and the encryption keys are managed by Google Cloud unless the customer chooses to use Customer-Managed Encryption Keys (CMEK) or Customer-Supplied Encryption Keys (CSEK).

Exam trap

The trap here is that candidates may assume encryption requires explicit action (like enabling a setting or purchasing an add-on) because many cloud providers or on-premises systems require manual configuration, but Google Cloud encrypts all data at rest by default with no customer effort.

How to eliminate wrong answers

Option A is wrong because it implies that encryption must be manually enabled per bucket, but Google Cloud encrypts all data at rest by default without any bucket-level configuration. Option C is wrong because it falsely claims that only premium storage tiers are encrypted; in reality, all storage tiers—including Standard, Nearline, Coldline, and Archive—are encrypted at rest by default. Option D is wrong because it suggests that encryption requires purchasing Security Command Center Premium, which is a security and threat detection service, not a prerequisite for data encryption.

Practice this question →
28
MCQmedium

A company stores its data in Google Cloud. The security team asks: can Google employees access our customer data without our knowledge or consent? What does Google's commitment ensure?

A.Google employees have unrestricted access to all customer data as part of the infrastructure service agreement.
B.Google commits that customer data is not accessed without authorization, with access logged via Access Transparency and governed by contractual data processing commitments.
C.Google uses customer data to train its global AI models to improve services.
D.Customer data stored in Google Cloud is automatically accessible by government agencies on request.
AnswerB

Google's contractual data processing commitments, including the Cloud Data Processing Addendum, state that Google will not access or use customer data without authorization, and will only do so for the purposes of providing the services. Access Transparency provides customers with near-real-time logs of all system access by Google Cloud personnel, including the reason for access. Combined with Access Approval, which lets customers approve or deny select access requests, these tools ensure data is accessed only as permitted. This makes the statement accurate and correct.

Why this answer

Google Cloud's Access Transparency feature logs all data access attempts by Google personnel, and contractual data processing commitments under the Cloud Data Processing Addendum (CDPA) prohibit unauthorized access. This ensures that customer data is not accessed without explicit authorization, and any access is logged and auditable, aligning with the security team's concern about knowledge and consent.

Exam trap

The GCDL exam often tests the misconception that cloud providers have unfettered access to customer data or use it for model training, but the correct answer hinges on understanding that Google Cloud's contractual and technical controls (like Access Transparency) explicitly prevent unauthorized access and do not use customer data for AI training.

How to eliminate wrong answers

Option A is wrong because Google employees do not have unrestricted access; access is strictly controlled, logged via Access Transparency, and governed by contractual commitments. Option C is wrong because Google Cloud explicitly prohibits using customer data to train its global AI models; this is a common misconception, and Google's AI training uses publicly available data or data with explicit consent, not customer data. Option D is wrong because customer data is not automatically accessible by government agencies; any government request must follow legal processes, and Google provides transparency reports and notifies customers where legally permitted.

Practice this question →
29
MCQmedium

A company wants to allow a third-party security firm to conduct a penetration test against their Google Cloud environment to identify vulnerabilities. What is Google Cloud's policy on penetration testing?

A.Customers must submit a formal request to Google and wait for written approval before any penetration testing.
B.Customers are authorized to penetration test their own GCP resources without prior Google approval, within the Acceptable Use Policy.
C.Penetration testing is illegal in cloud environments and customers should use vulnerability scanners instead.
D.Google automatically performs penetration testing on all customer resources monthly and shares the report.
AnswerB

Google Cloud's Penetration Testing Policy explicitly permits customers to conduct security tests on their own GCP resources—including Compute Engine VMs, GKE clusters, Cloud Functions, and App Engine applications—without prior notification or approval. This self-service authorization is subject to the Acceptable Use Policy (AUP), which prohibits testing that targets other customers' environments, Google's core infrastructure, or services outside the customer's own project boundaries. You are accountable for staying within your own resource scope and ensuring your tests do not degrade or disrupt Google's shared infrastructure, but you do not need to file a request or wait for permission before starting an assessment.

Why this answer

Google Cloud's policy explicitly authorizes customers to conduct penetration testing on their own GCP resources without prior approval from Google, as long as the testing complies with the Acceptable Use Policy. This is because Google treats the customer's environment as their own responsibility, and the shared responsibility model places security testing under the customer's control. Option B correctly reflects this policy, which is documented in Google Cloud's security testing guidelines.

Exam trap

The trap here is that candidates may assume all cloud providers require prior approval (like AWS's old policy), but Google Cloud explicitly allows testing without approval, making Option A a common distractor.

How to eliminate wrong answers

Option A is wrong because Google Cloud does not require customers to submit a formal request or wait for written approval before penetration testing; instead, testing is authorized as long as it adheres to the Acceptable Use Policy. Option C is wrong because penetration testing is not illegal in cloud environments; Google Cloud explicitly permits it for customer resources, and vulnerability scanners are a complementary tool, not a replacement. Option D is wrong because Google does not automatically perform penetration testing on all customer resources monthly; the shared responsibility model means customers are responsible for testing their own resources, and Google does not share such reports with customers.

Practice this question →
30
MCQeasy

A company's security policy requires that all cloud-to-cloud communication between services must be encrypted in transit. An auditor asks how Google Cloud handles encryption for network traffic between Google services within its network. What is Google's default approach to encryption in transit within its infrastructure?

A.Google does not encrypt internal traffic by default; customers must configure TLS for all service-to-service communication
B.Google encrypts all traffic between its data centers and internal services by default, with no customer configuration required
C.Google only encrypts traffic that crosses the public internet; internal network traffic is unencrypted for performance
D.Encryption in transit is the customer's responsibility for all traffic, including traffic within Google's network
AnswerB

Google uses Application Layer Transport Security (ALTS) to authenticate and encrypt all traffic between Google services and between data centers by default. This is a core Google infrastructure security commitment, not an optional feature customers must enable.

Why this answer

Google Cloud encrypts all network traffic between its data centers and internal services by default, using application-layer (e.g., gRPC with TLS) and link-layer encryption (e.g., MACsec or similar). This is a foundational security measure that requires no customer configuration, ensuring data is protected in transit even within Google's own infrastructure.

Exam trap

The trap here is that candidates often assume internal cloud provider networks are unencrypted for performance reasons, but Google Cloud encrypts all inter-service traffic by default, making options that require customer action or that claim no encryption incorrect.

How to eliminate wrong answers

Option A is wrong because Google does encrypt internal traffic by default; customers do not need to configure TLS for service-to-service communication within Google's network. Option C is wrong because Google encrypts not only traffic crossing the public internet but also internal network traffic between data centers and services, so performance is not a reason to leave it unencrypted. Option D is wrong because encryption in transit within Google's network is Google's responsibility and is handled automatically, not the customer's.

Practice this question →
31
MCQeasy

When data is transmitted between a user's browser and a Google Cloud-hosted web application over HTTPS, which security protection does this provide?

A.It prevents unauthorized users from accessing the Google Cloud Console.
B.It encrypts data in transit between the user's browser and the server, preventing eavesdropping and tampering.
C.It encrypts data stored in the server's database.
D.It authenticates the user and verifies their permissions to use the application.
AnswerB

HTTPS (TLS) establishes an encrypted tunnel between the user's browser and the web server, negotiating a session key through a handshake that authenticates the server using its certificate. This ensures that any data exchanged—such as form submissions or cookies—cannot be read (confidentiality) or altered (integrity) by an eavesdropper or man-in-the-middle. That is precisely the purpose of HTTPS on a web application: protecting data while it is in transit.

Why this answer

HTTPS (HTTP over TLS) encrypts the communication channel between the user's browser and the web server using Transport Layer Security (TLS). This ensures that any data transmitted, such as login credentials or API requests, is protected from eavesdropping and tampering while in transit. It does not protect data at rest or control access to cloud management interfaces.

Exam trap

The GCDL exam often tests the distinction between encryption in transit (HTTPS) and encryption at rest (database encryption), leading candidates to incorrectly select an option about stored data or access control.

How to eliminate wrong answers

Option A is wrong because HTTPS does not control access to the Google Cloud Console; that is managed by IAM (Identity and Access Management) policies and authentication mechanisms like OAuth 2.0. Option C is wrong because HTTPS only encrypts data in transit, not data stored in the server's database; database encryption is handled by techniques like Cloud SQL encryption at rest or customer-managed encryption keys (CMEK). Option D is wrong because HTTPS does not authenticate the user or verify their permissions; user authentication and authorization are handled by the application layer (e.g., using Firebase Authentication or IAM), not by the TLS protocol itself.

Practice this question →
32
MCQmedium

A company's security architect wants to implement 'privacy by design' principles when building a new customer data platform on Google Cloud. What does privacy by design mean in this context?

A.Privacy by design means the platform must refuse to collect any personal data from customers.
B.Privacy by design means privacy protections (encryption, data minimization, access controls, retention policies) are architected into the system from the start, not added after deployment.
C.Privacy by design is a legal requirement that mandates using only on-premises systems for customer data.
D.Privacy by design means storing all data in an encrypted format and using a VPN for all access.
AnswerB

Privacy by design makes privacy a foundational design principle: choosing which data to collect, how to protect it, who can access it, and when to delete it are designed before the first line of code — not discovered at audit time.

Why this answer

Privacy by design is a foundational principle that requires embedding privacy controls—such as encryption, data minimization, access controls, and retention policies—into the architecture of a system from the initial design phase, rather than retrofitting them after deployment. In the context of Google Cloud, this means using services like Cloud KMS for encryption, IAM for fine-grained access control, and data lifecycle policies to minimize data collection and enforce retention limits from the start. Option B correctly captures this proactive, integrated approach.

Exam trap

The trap here is that candidates often confuse privacy by design with a single technical control (like encryption or VPNs) or assume it prohibits data collection entirely, when in fact it is a holistic architectural approach that integrates multiple privacy controls from the outset.

How to eliminate wrong answers

Option A is wrong because privacy by design does not mandate refusing to collect any personal data; rather, it emphasizes collecting only the minimum necessary data (data minimization) and implementing protections around it. Option C is wrong because privacy by design is not a legal requirement that mandates on-premises systems; Google Cloud supports privacy by design through cloud-native services like Confidential VMs and Data Loss Prevention (DLP) that comply with regulations like GDPR. Option D is wrong because privacy by design is broader than just encryption and VPNs; it encompasses data minimization, purpose limitation, retention policies, and access controls, not just technical safeguards.

Practice this question →
33
MCQmedium

A healthcare company must comply with HIPAA and store all protected health information (PHI) only in the United States. They use Google Cloud and want to prevent any accidental data storage outside the US. Which two services should they implement?

A.VPC Service Controls and Organization Policies
B.Data Loss Prevention API
C.Identity-Aware Proxy
D.Cloud Armor
AnswerA

VPC Service Controls create a data security perimeter that restricts access to Google Cloud resources and prevents data exfiltration through context-aware enforcement. Organization Policies, when configured with location constraints, explicitly limit resource creation to approved geographic regions, ensuring HIPAA data residency requirements are met. Together, they enforce both the boundary and the storage location for regulated data.

Why this answer

VPC Service Controls create a security perimeter around Google Cloud resources, preventing data from being copied or moved outside allowed regions. Organization Policies allow you to set a constraint (e.g., `gcp.resourceLocations`) that restricts where resources like Cloud Storage buckets or BigQuery datasets can be created, ensuring PHI remains in the US. Together, they enforce both data exfiltration prevention and location-based resource creation restrictions.

Exam trap

Google Cloud often tests the distinction between data *protection* (DLP, IAP, Cloud Armor) and data *residency enforcement* (VPC Service Controls, Organization Policies), leading candidates to confuse content inspection or access control with geographic restriction.

How to eliminate wrong answers

Option B (Data Loss Prevention API) is wrong because it is a content inspection and redaction tool, not a data residency enforcement mechanism; it scans for sensitive data patterns but does not prevent storage outside a geographic boundary. Option C (Identity-Aware Proxy) is wrong because it controls user access to applications based on identity and context, not data location or storage restrictions. Option D (Cloud Armor) is wrong because it is a web application firewall (WAF) that protects against DDoS and OWASP Top 10 threats, with no capability to enforce data residency or prevent storage in non-US regions.

Practice this question →
34
MCQeasy

A company's security team wants to ensure that only approved corporate devices can access Google Cloud resources, regardless of whether the user has valid credentials. Which Google Cloud security capability enforces device-level access requirements?

A.Cloud Armor, which filters incoming requests based on IP allowlists and denylists
B.Access Context Manager, which enforces device-level access requirements as part of context-aware access control policies
C.Identity-Aware Proxy (IAP), which provides application-level authentication but without device checks
D.VPC Service Controls, which restrict access to Google APIs based on network perimeter membership
AnswerB

Access Context Manager is precisely the service for this. It allows security teams to define access levels (policies) that include device attribute requirements — managed/enrolled devices, disk encryption, screen lock. These conditions must be met in addition to valid credentials for access to be granted.

Why this answer

Access Context Manager is the correct choice because it allows security teams to define context-aware access policies that include device-level attributes such as device OS type, device ID, and whether the device is managed (e.g., via endpoint verification or third-party EMM). This enforces device-level access requirements even if the user has valid credentials, directly addressing the scenario.

Exam trap

The trap here is that candidates confuse IAP's role in user authentication with device-level enforcement, not realizing that IAP delegates device context checks to Access Context Manager via access levels.

How to eliminate wrong answers

Option A is wrong because Cloud Armor filters traffic based on IP addresses (allowlists/denylists) and other network-layer attributes, not device-level identity or management status. Option C is wrong because Identity-Aware Proxy (IAP) provides authentication and authorization at the application layer but does not natively enforce device-level checks; it relies on Access Context Manager for such context. Option D is wrong because VPC Service Controls restrict access to Google APIs based on network perimeter (e.g., VPC, IP ranges) and do not evaluate device-level attributes.

Practice this question →
35
MCQmedium

A company wants to ensure that even if an attacker compromises an employee's password and passes MFA, the attacker cannot access sensitive Google Cloud resources from an unmanaged personal laptop. Which Google security feature enforces device trust as part of access decisions?

A.Cloud Armor — it inspects device fingerprints on incoming requests.
B.Access Context Manager with device policy conditions requiring managed, compliant devices.
C.Cloud Firewall rules that allow only corporate office IP ranges.
D.Two-step verification — the second factor proves the device is trusted.
AnswerB

Access Context Manager lets you define access levels as a set of device policy conditions—for example, requiring the device to be enrolled in an endpoint verification service, have full disk encryption, and run a minimum OS version. These access levels can be attached to IAP or VPC Service Controls, which then enforce the policy at the application or network perimeter. This is the only option that explicitly evaluates device trust and compliance before granting access.

Why this answer

Access Context Manager allows you to define device policy conditions that require devices to be managed (e.g., via endpoint verification) and compliant with corporate security policies. When an attacker attempts to access sensitive Google Cloud resources from an unmanaged personal laptop, the access level will not be satisfied, and access is denied even if the user's password and MFA are valid. This enforces device trust as a distinct attribute in the access decision, separate from user authentication.

Exam trap

The GCDL exam often tests the distinction between authentication (MFA) and device trust, so the trap here is that candidates confuse two-step verification (MFA) with device trust, thinking that a second factor inherently proves the device is trusted, when in reality MFA only proves the user's identity, not the device's security posture.

How to eliminate wrong answers

Option A is wrong because Cloud Armor is a web application firewall that inspects HTTP/S traffic and can use device fingerprints (e.g., via reCAPTCHA or WAF rules), but it does not enforce device trust as a condition for access to Google Cloud resources; it operates at the network edge, not as an identity-aware access control. Option C is wrong because Cloud Firewall rules that allow only corporate office IP ranges restrict access based on network origin, not device trust; an attacker could still use a managed laptop from a corporate IP if they compromise it, and an unmanaged personal laptop from a corporate IP would bypass the intent. Option D is wrong because two-step verification (MFA) verifies the user's identity via a second factor (e.g., TOTP, push notification), but it does not prove the device is trusted; an attacker who has compromised the password and MFA (e.g., via session hijacking or phishing) can still access resources from any device.

Practice this question →
36
MCQmedium

A healthcare company needs to store patient data in Google Cloud and must comply with HIPAA (Health Insurance Portability and Accountability Act). Which statement correctly describes how Google Cloud helps them achieve HIPAA compliance?

A.Storing data in Google Cloud automatically makes an application HIPAA-compliant.
B.Google offers HIPAA-eligible services and signs a Business Associate Agreement (BAA), but customers must implement their own technical safeguards and access controls.
C.HIPAA compliance is impossible on public cloud; healthcare data must stay on-premises.
D.Google Cloud's automatic data encryption fully satisfies all HIPAA technical safeguard requirements.
AnswerB

Google Cloud participates in HIPAA compliance by providing a BAA and offering infrastructure that addresses physical, environmental, and certain technical safeguards. However, the Shared Responsibility Model makes the customer accountable for configuring services correctly, managing access controls, enabling audit logging, encrypting data where required, and implementing contingency plans. Without these customer-side actions, even a signed BAA does not render a workload compliant.

Why this answer

Google Cloud provides HIPAA-eligible services and offers a Business Associate Agreement (BAA) to covered entities, but compliance is a shared responsibility. Customers must configure their own technical safeguards, such as access controls, audit logging, and encryption key management, to meet HIPAA requirements. Google Cloud does not automatically make an application compliant; the customer must implement the necessary controls.

Exam trap

The GCDL exam often tests the shared responsibility model by presenting options that imply full vendor responsibility (like automatic compliance) or full customer responsibility (like impossibility), and the trap here is assuming that encryption alone satisfies all HIPAA technical safeguards, ignoring access control and audit requirements.

How to eliminate wrong answers

Option A is wrong because storing data in Google Cloud does not automatically make an application HIPAA-compliant; compliance requires the customer to implement technical safeguards and access controls, and to sign a BAA. Option C is wrong because HIPAA compliance is achievable on public cloud platforms like Google Cloud when using HIPAA-eligible services and signing a BAA, and many healthcare organizations successfully run workloads in the cloud. Option D is wrong because Google Cloud's automatic data encryption addresses only one aspect of HIPAA's technical safeguards; it does not satisfy all requirements, such as access control, audit controls, and integrity controls, which the customer must implement.

Practice this question →
37
MCQhard

A CISO is implementing a Zero Trust security architecture for the company's Google Cloud environment. Under Zero Trust, which fundamental assumption about network traffic changes compared to traditional perimeter-based security?

A.Zero Trust assumes that internal network traffic is more secure than external traffic because it has passed through the corporate firewall
B.Zero Trust assumes no traffic is trusted by default regardless of network origin — every request must be explicitly authenticated and authorized based on identity, device posture, and context
C.Zero Trust assumes all traffic is malicious and blocks all requests by default, requiring explicit allowlisting for each connection
D.Zero Trust eliminates the need for encryption since all traffic is assumed to be on secure internal networks
AnswerB

This is the core Zero Trust principle: 'never trust, always verify.' A request from inside the VPC receives the same verification scrutiny as a request from the public internet. This model is more appropriate for cloud environments where the network perimeter no longer has clear meaning — employees, services, and attackers can all be inside the 'perimeter.'

Why this answer

Zero Trust fundamentally shifts from implicit trust based on network location to explicit verification of every request. In Google Cloud, this means every API call, regardless of whether it originates from within the VPC or the internet, must be authenticated (e.g., using OAuth 2.0 or service account keys) and authorized based on identity, device posture, and context, as enforced by tools like Identity-Aware Proxy (IAP) and VPC Service Controls.

Exam trap

The trap here is that candidates often confuse Zero Trust's 'never trust, always verify' with a blanket denial of all traffic (Option C), when in reality it requires explicit verification for each request, not static allowlisting.

How to eliminate wrong answers

Option A is wrong because Zero Trust explicitly rejects the assumption that internal network traffic is more secure; it treats all traffic as untrusted, including traffic within the same VPC or subnet, and does not rely on a corporate firewall for trust. Option C is wrong because Zero Trust does not assume all traffic is malicious and block by default; it assumes no implicit trust but allows traffic after explicit authentication and authorization, not via static allowlisting. Option D is wrong because Zero Trust does not eliminate the need for encryption; in fact, it mandates encryption in transit (e.g., TLS 1.3) and at rest for all traffic, as internal networks are no longer considered trusted boundaries.

Practice this question →
38
MCQmedium

A company's compliance team asks what evidence they can provide to regulators to demonstrate that Google Cloud services meet industry security standards. Which type of documentation most directly provides this evidence?

A.Google Cloud's marketing materials and product documentation describing security features
B.Third-party audit reports and compliance certifications (SOC 2 Type II, ISO 27001, PCI DSS) available through Google Cloud's Compliance Reports Manager, which provide independent verification of security controls
C.The company's own internal security policies that reference using Google Cloud
D.A Google Cloud support ticket confirming that the company's account is in good standing
AnswerB

These reports are the correct evidence. SOC 2 Type II demonstrates security controls operated effectively over a period. ISO 27001 certification shows a comprehensive ISMS is in place. PCI DSS attestation covers payment card security. These are issued by qualified independent auditors and accepted by regulators globally.

Why this answer

Compliance reports and audit certifications from independent third parties (SOC 2 Type II reports, ISO 27001 certificates, PCI DSS attestation) are the most credible evidence for regulators. These documents represent independent auditors certifying that specific controls were in place and operating effectively during the audit period. Google Cloud makes these reports available to customers through the Compliance Reports Manager.

Practice this question →
39
MCQeasy

A company stores customer data in Google Cloud and wants to ensure data confidentiality in the event that hardware is decommissioned and returned by Google. How does Google protect customer data when storage hardware reaches end of life?

A.Google transfers customer data to new hardware first, then ships the old hardware to the customer for self-destruction.
B.Google uses approved data erasure and physical destruction processes (shredding, degaussing) for decommissioned storage media before hardware leaves its facilities.
C.Customer data on decommissioned hardware is automatically encrypted, making it safe to discard without wiping.
D.Customers must pay a data destruction fee to ensure their data is wiped from decommissioned hardware.
AnswerB

This is the correct answer. Google follows NIST 800-88-compliant sanitization procedures for storage media, combining cryptographic erase (secure key destruction) with physical destruction methods such as shredding and degaussing. These steps are performed inside Google's data centers before any hardware leaves the premises, and the process is independently audited to verify effectiveness. This guarantees that customer data cannot be reconstructed from decommissioned media.

Why this answer

Google Cloud follows strict data destruction policies for decommissioned storage media. Before any hardware leaves Google's facilities, it undergoes approved data erasure (e.g., NIST SP 800-88 compliant wiping) followed by physical destruction (e.g., shredding, degaussing) to ensure customer data cannot be recovered. This process guarantees data confidentiality even if the hardware is returned or recycled.

Exam trap

The trap here is that candidates assume encryption alone (Option C) is sufficient for decommissioned hardware, but Google's policy requires physical destruction or verified erasure to prevent data recovery from encrypted drives if keys are later compromised.

How to eliminate wrong answers

Option A is wrong because Google does not ship decommissioned hardware to customers; instead, Google retains and destroys the hardware internally to prevent any data leakage. Option C is wrong because while data at rest is encrypted, encryption alone is not sufficient for decommissioned hardware—Google still performs secure erasure and physical destruction to protect against future decryption or key compromise. Option D is wrong because data destruction is included as a standard part of Google's hardware lifecycle management at no additional cost to customers.

Practice this question →
40
MCQmedium

A security architect wants to implement a 'never trust, always verify' security approach where no user or service is assumed to be trustworthy based on network location alone. Every access request must be authenticated and authorized regardless of whether it comes from inside or outside the corporate network. Which security model describes this approach?

A.Perimeter security model
B.Zero Trust security model
C.Defense in depth model
D.Principle of least privilege
AnswerB

The Zero Trust security model fundamentally eliminates implicit trust based on network location, mandating continuous authentication, authorization, and encryption for every request, regardless of whether the source is inside or outside the corporate boundary. It operationalizes the 'never trust, always verify' principle through identity-centric policies, device posture checks, and microsegmentation, ensuring that even compromised internal hosts cannot move laterally without re-verification.

Why this answer

The Zero Trust security model (Option B) is correct because it explicitly enforces the 'never trust, always verify' principle, requiring authentication and authorization for every access request regardless of network location. In Google Cloud, this aligns with BeyondCorp, which uses identity-aware proxy (IAP) and context-aware access to verify each request based on user identity, device posture, and other attributes, rather than trusting based on IP address or network perimeter.

Exam trap

The trap here is that candidates often confuse 'defense in depth' (Option C) with Zero Trust because both involve multiple security layers, but defense in depth does not inherently require every request to be verified regardless of network location, which is the defining characteristic of Zero Trust.

How to eliminate wrong answers

Option A is wrong because the perimeter security model assumes trust inside the corporate network (e.g., VPN or firewall boundaries), which violates the 'never trust, always verify' approach. Option C is wrong because defense in depth is a layered security strategy (e.g., firewalls, IDS, encryption) but does not inherently require every request to be authenticated and authorized regardless of network location; it can still rely on perimeter trust. Option D is wrong because the principle of least privilege limits permissions to the minimum necessary but does not address the core requirement of verifying every access request based on location independence; it is a complementary concept, not the model described.

Practice this question →
41
Multi-Selectmedium

Which TWO Google Cloud services help prevent data exfiltration from virtual machines?

Select 2 answers
A.Access Transparency
B.Security Command Center
C.Cloud Armor
D.Cloud Data Loss Prevention (DLP)
E.VPC Service Controls
AnswersD, E

Cloud Data Loss Prevention (DLP) uses content inspection with built-in detectors to identify sensitive elements like credit card numbers, PII, or credentials, and can apply transformations such as redaction, masking, tokenization, and encryption. When integrated into data pipelines or egress workflows, it can block or de-identify sensitive content before it leaves your organization, directly preventing data exfiltration at the data layer.

Why this answer

Cloud Data Loss Prevention (DLP) is correct because it enables inspection of data at rest and in motion for sensitive content (e.g., PII, credit card numbers) using predefined or custom infoTypes. When integrated with VPC Service Controls, it can block or redact sensitive data before it leaves the virtual machine's network boundary, directly preventing data exfiltration.

Exam trap

Google Cloud often tests the distinction between monitoring/logging services (like Access Transparency and Security Command Center) and active data exfiltration prevention controls (like VPC Service Controls and Cloud DLP), leading candidates to select options that only provide visibility rather than enforcement.

Practice this question →
42
MCQmedium

A company has migrated sensitive customer data to Google Cloud. The legal team asks: 'If Google is hosting our data, who is responsible for ensuring that data is not improperly accessed by unauthorized users through our application?' Under the shared responsibility model, how should the CTO answer?

A.Google is fully responsible because they host the data and control the infrastructure
B.The customer is responsible for application access controls, authentication, and IAM policies that protect data from unauthorized application-layer access, while Google secures the underlying infrastructure
C.Both Google and the customer share equal 50/50 responsibility for all data access controls
D.No one is responsible because cloud computing inherently cannot prevent unauthorized access
AnswerB

This is the correct shared responsibility answer. Google secures the infrastructure layer — physical hardware, network, hypervisor. The customer must secure their application layer: who can access the application, how they authenticate, what permissions their service accounts have, and whether the application has vulnerabilities.

Why this answer

Under the Google Cloud shared responsibility model, the customer is responsible for securing access to their application and data, including authentication, authorization, and IAM policies, while Google is responsible for the security of the underlying infrastructure (physical security, network, hypervisor). The legal team's question specifically asks about unauthorized access through the customer's application, which falls under the customer's responsibility for application-layer controls.

Exam trap

The trap here is that candidates often assume the cloud provider is fully responsible for all security aspects, but the shared responsibility model explicitly places application-layer access controls, authentication, and IAM on the customer, especially when the question specifies 'through our application'.

How to eliminate wrong answers

Option A is wrong because it incorrectly states Google is fully responsible for all data access; Google secures the infrastructure but the customer must manage application-layer access controls, IAM, and authentication. Option C is wrong because responsibility is not a fixed 50/50 split; it is a shared model where Google secures the infrastructure and the customer secures their data, applications, and access policies. Option D is wrong because cloud computing can prevent unauthorized access through proper implementation of security controls like IAM, encryption, and network policies; it is not inherently incapable of preventing unauthorized access.

Practice this question →
43
MCQhard

A company has a requirement from their security auditor to demonstrate that all administrative actions performed in Google Cloud (such as creating VMs, modifying IAM policies, and deleting storage buckets) are logged and tamper-evident. Which Cloud Logging log type fulfills this requirement?

A.Data Access audit logs — they capture all read and write operations.
B.Admin Activity audit logs — always-on, tamper-resistant logs of all administrative API calls.
C.System Event audit logs — they capture all Google Cloud operations.
D.Cloud Monitoring logs — they track all changes to monitored resources.
AnswerB

Admin Activity audit logs are automatically enabled for all Google Cloud projects and cannot be disabled or deleted by any user, including project owners or Org admins. They record all control-plane API calls such as resource creation, modification, and deletion, along with the calling principal, the request parameters, and the response status. Because these logs are immutable and stored independently of user access, they provide a tamper-resistant, authoritative record that satisfies audit requirements.

Why this answer

Admin Activity audit logs are always-on, tamper-resistant logs that record all administrative API calls, such as creating VMs, modifying IAM policies, and deleting storage buckets. They cannot be disabled or modified by users, ensuring tamper-evident logging for security auditor requirements.

Exam trap

The trap here is that candidates confuse Data Access audit logs (which require enabling and capture data-level operations) with Admin Activity audit logs (which are always-on and capture administrative actions), leading them to incorrectly select option A.

How to eliminate wrong answers

Option A is wrong because Data Access audit logs capture read and write operations on user data, not administrative actions like creating VMs or modifying IAM policies, and they are not always-on (they must be explicitly enabled). Option C is wrong because System Event audit logs capture Google Cloud system events (e.g., automatic maintenance), not administrative actions performed by users. Option D is wrong because Cloud Monitoring logs track metrics and alerts for resource performance, not administrative API calls, and they are not tamper-resistant logs.

Practice this question →
44
MCQhard

An organization's security team reviews their Google Cloud environment and finds that several Cloud Storage buckets have `allAuthenticatedUsers` bindings, and multiple service accounts have the Owner role. Which Google Cloud tool automatically identifies these types of high-risk IAM configurations?

A.Cloud Audit Logs — reviewing all recent IAM changes.
B.Security Command Center (SCC) with IAM Recommender and Security Health Analytics.
C.Cloud Billing reports — they flag expensive configurations that indicate security issues.
D.Cloud Monitoring — it alerts when IAM policies are modified.
AnswerB

Security Command Center (SCC) with Security Health Analytics and IAM Recommender is the correct choice because it provides continuous, automated scanning for high-risk IAM misconfigurations such as public Cloud Storage buckets, overly broad roles like Owner or Editor, and over-permissive service accounts. Security Health Analytics uses built-in detectors to evaluate the current state of your GCP resources, while IAM Recommender analyzes actual usage patterns to generate actionable recommendations for reducing permissions to least privilege. This combination proactively surfaces existing weaknesses and delivers concrete remediation steps, making it a comprehensive and proactive security posture management tool.

Why this answer

Security Command Center (SCC) with Security Health Analytics and IAM Recommender is the correct tool because it automatically scans for high-risk IAM configurations, such as `allAuthenticatedUsers` bindings on Cloud Storage buckets and service accounts with the Owner role. Security Health Analytics detects misconfigurations against CIS benchmarks and Google Cloud best practices, while IAM Recommender provides actionable recommendations to reduce excessive permissions. This combination proactively identifies and helps remediate these specific security risks without requiring manual log review or billing analysis.

Exam trap

The trap here is that candidates often confuse Cloud Audit Logs or Cloud Monitoring with proactive security scanning tools, not realizing that those services only provide raw data or alerts on changes, whereas SCC with Security Health Analytics and IAM Recommender actively analyzes the configuration state to detect high-risk IAM bindings.

How to eliminate wrong answers

Option A is wrong because Cloud Audit Logs only record historical IAM changes and require manual review to identify high-risk configurations; they do not automatically detect or flag misconfigurations like `allAuthenticatedUsers` bindings. Option C is wrong because Cloud Billing reports focus on cost analysis and do not have the capability to identify IAM security misconfigurations or excessive permissions. Option D is wrong because Cloud Monitoring can alert on policy changes via logs-based metrics, but it does not natively analyze the content of IAM policies to detect high-risk bindings like `allAuthenticatedUsers` or Owner roles on service accounts.

Practice this question →
45
MCQmedium

A multinational company must ensure that personal data of European citizens stored in Google Cloud cannot be accessed by or transferred to systems outside the European Union, as required by GDPR data residency requirements. Which Google Cloud controls most directly enforce this?

A.Enabling HTTPS for all data transmission to ensure data is encrypted during transfer
B.Configuring organization policy to restrict resource creation to EU regions, using VPC Service Controls to prevent data movement outside the EU perimeter, and establishing a GDPR-compliant Data Processing Agreement with Google
C.Using Customer-Managed Encryption Keys (CMEK) where the encryption keys are stored outside Google's infrastructure
D.Training developers about GDPR requirements and requiring manual approval for any cross-region data transfers
AnswerB

This combination addresses GDPR data residency: org policy constraints prevent resources from being created outside EU regions; VPC Service Controls prevent data from being read out of the EU perimeter; the DPA provides contractual compliance assurance. Together they form a comprehensive GDPR data residency control framework.

Why this answer

It combines three essential controls that directly enforce GDPR data residency: Organization Policies restrict resource creation to EU regions, VPC Service Controls create a data perimeter preventing exfiltration outside the EU, and a GDPR-compliant Data Processing Agreement (DPA) establishes the legal framework for data handling. These controls work together to ensure data at rest and in transit remains within the EU boundary, directly addressing the residency requirement.

Exam trap

Google Cloud often tests the misconception that encryption (HTTPS or CMEK) alone satisfies data residency requirements, when in fact residency is about geographic location of data, not its confidentiality during transit or at rest.

How to eliminate wrong answers

Option A is wrong because HTTPS only encrypts data in transit; it does not restrict where data is stored or prevent it from being transferred to systems outside the EU, so it fails to enforce data residency. Option C is wrong because CMEK controls encryption key management, not data location; keys stored outside Google's infrastructure do not prevent data from being moved or stored outside the EU, and GDPR residency is about physical location, not key custody. Option D is wrong because training and manual approval are procedural controls, not technical enforcement mechanisms; they rely on human compliance and cannot guarantee that data never leaves the EU, especially at scale or in automated environments.

Practice this question →
46
MCQeasy

A company wants to grant a data analyst read-only access to specific BigQuery datasets, but only if the request comes from within the corporate network. Which two Google Cloud tools should they combine to enforce this?

A.IAM and VPC Service Controls
B.IAM and Cloud IAP
C.Cloud Armor and IAM
D.Organization Policies and Cloud Audit Logs
AnswerA

IAM is the foundation for granting read-only access: roles like roles/bigquery.dataViewer authorize a data analyst to query datasets and tables. VPC Service Controls add an additional, network-level boundary by wrapping BigQuery in a service perimeter that only permits API calls originating from allowed IP addresses (e.g., the corporate network). IAM answers 'who has permission', while VPC-SC answers 'from where the request is allowed' — this combination prevents authorized credentials from being used outside the trusted environment, addressing both authentication and data exfiltration.

Why this answer

IAM defines the read-only role (e.g., roles/bigquery.dataViewer) for the data analyst, while VPC Service Controls create a security perimeter that restricts access to the BigQuery API from only the corporate network IP range. Together, they ensure the request is both authorized by IAM and originates from within the allowed VPC perimeter, blocking any access from outside the corporate network even if the IAM role is granted.

Exam trap

Google Cloud often tests the distinction between network-level access control (VPC Service Controls) and identity-level access control (IAP), leading candidates to incorrectly pair IAM with IAP for API-based services like BigQuery.

How to eliminate wrong answers

Option B is wrong because Cloud IAP (Identity-Aware Proxy) is designed for controlling access to web applications and SSH/RDP to VMs, not for restricting API-level access to BigQuery datasets based on network origin. Option C is wrong because Cloud Armor is a web application firewall (WAF) that protects HTTP(S) load-balanced applications, not a tool for enforcing network-level access control to BigQuery APIs. Option D is wrong because Organization Policies are used to set constraints on Google Cloud resources (e.g., resource location), and Cloud Audit Logs are for logging and monitoring, not for enforcing network-based access restrictions.

Practice this question →
47
MCQmedium

A security team is conducting a threat model for their Google Cloud environment. They identify 'insider threat' — a malicious authorized employee who intentionally exfiltrates or destroys data — as a key risk. Which combination of Google Cloud controls most effectively mitigates this risk?

A.Strong external firewall rules, because insider threats come from internal network actors who must be blocked at the perimeter
B.Least privilege IAM (limiting access to only necessary resources), comprehensive audit logging (detecting anomalous access), VPC Service Controls (preventing data exfiltration to external projects), and separation of duties for critical actions
C.Encrypting all data at rest with CMEK, since encryption prevents authorized users from reading data
D.Requiring all employees to pass annual security training to prevent insider threats
AnswerB

This layered approach addresses insider threat from multiple angles: least privilege limits what a malicious insider can access; audit logs detect anomalous behavior (bulk data access, unusual hours); VPC Service Controls prevent copying data to personal or competitor GCP projects; separation of duties requires collusion for the most dangerous actions.

Why this answer

It combines least privilege IAM to limit the blast radius, comprehensive audit logging (e.g., Cloud Audit Logs) to detect anomalous access patterns, VPC Service Controls to prevent data exfiltration via VPC perimeter enforcement, and separation of duties (e.g., using Cloud IAM Conditions) to ensure no single insider can perform critical actions alone. This layered defense addresses both prevention and detection of malicious insider activity.

Exam trap

The trap here is that candidates often assume encryption (CMEK) or training alone can stop insider threats, but they fail to realize that an authorized insider can still read or exfiltrate data unless data exfiltration controls (like VPC Service Controls) and audit logging are in place.

How to eliminate wrong answers

Option A is wrong because strong external firewall rules block external traffic but do not mitigate an insider threat, which originates from within the network and already has valid credentials. Option C is wrong because encrypting data at rest with CMEK does not prevent an authorized user with decryption keys from reading or exfiltrating data; encryption protects against unauthorized access, not insider misuse. Option D is wrong because annual security training is a preventative awareness measure but does not provide technical controls to stop or detect a determined malicious insider who already has access.

Practice this question →
48
MCQeasy

What compliance certification verifies that an organization's Information Security Management System (ISMS) meets internationally recognized standards for managing information security risks?

A.SOC 2 Type II
B.ISO/IEC 27001
C.PCI DSS
D.FedRAMP
AnswerB

ISO/IEC 27001 is an internationally recognized standard that specifies the requirements for establishing, implementing, maintaining, and continually improving an information security management system (ISMS). It is a voluntary certification standard, and Google Cloud has achieved ISO/IEC 27001 certification through independent third-party audits, demonstrating alignment with global best practices for information security management. This certification provides customers with assurance that Google Cloud has systematic, risk-based processes for managing sensitive information, making it the correct answer.

Why this answer

ISO/IEC 27001 is the international standard that specifies the requirements for establishing, implementing, maintaining, and continually improving an Information Security Management System (ISMS). It provides a systematic approach to managing sensitive company information, ensuring it remains secure through risk management processes. This certification is recognized globally and is the primary standard for ISMS compliance.

Exam trap

The trap here is that candidates often confuse SOC 2 Type II (which focuses on service organization controls) with ISO/IEC 27001 (which is the specific international standard for an ISMS), leading them to select SOC 2 Type II when the question explicitly asks for an ISMS certification.

How to eliminate wrong answers

Option A is wrong because SOC 2 Type II is an auditing procedure that evaluates a service organization's controls related to security, availability, processing integrity, confidentiality, and privacy based on the AICPA Trust Services Criteria, not an ISMS standard. Option C is wrong because PCI DSS is a security standard specifically for organizations that handle branded credit cards, focusing on cardholder data protection, not a general ISMS framework. Option D is wrong because FedRAMP is a U.S. government program that provides a standardized approach to security assessment, authorization, and continuous monitoring for cloud products and services, not an international ISMS certification.

Practice this question →
49
MCQeasy

A company wants to enforce that all Cloud Storage buckets in a project have uniform bucket-level access enabled. Which Google Cloud tool should they use?

A.Use Cloud Audit Logs to monitor and alert on non-compliant buckets.
B.Define an Organization Policy with a constraint on uniform bucket-level access.
C.Set an IAM policy to deny access to buckets without uniform access.
D.Use Cloud Key Management Service to rotate keys.
AnswerB

An Organization Policy with the constraint *storage.uniformBucketLevelAccess* enforces that every bucket in a given hierarchy must have uniform bucket-level access enabled. When set to True, this list constraint blocks any request to create or update a bucket that does not have uniform access, effectively acting as an immutable compliance guardrail. This is the correct because it is a prerequisite enforcement method provided by Google Cloud's organization policy service.

Why this answer

Organization Policies in Google Cloud allow administrators to enforce constraints across the entire resource hierarchy. The constraint `constraints/storage.uniformBucketLevelAccess` can be applied at the project, folder, or organization level to require uniform bucket-level access on all Cloud Storage buckets, preventing any bucket from being created or updated without it.

Exam trap

Google Cloud often tests the distinction between monitoring/logging tools (like Audit Logs) and enforcement tools (like Organization Policies), leading candidates to choose a reactive solution instead of a proactive, policy-based one.

How to eliminate wrong answers

Option A is wrong because Cloud Audit Logs only provide logging and monitoring for historical or real-time events; they cannot enforce or prevent non-compliant configurations, only alert after the fact. Option C is wrong because IAM policies grant or deny access to resources based on identities and roles, but they cannot enforce a configuration setting like uniform bucket-level access on a bucket itself. Option D is wrong because Cloud Key Management Service (KMS) manages encryption keys, not access control policies for bucket-level access settings.

Practice this question →
50
Matchingmedium

Match each Google Cloud storage class to its use case.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Frequently accessed data, low latency

Data accessed less than once a month

Data accessed less than once a quarter

Data accessed less than once a year

Automatic placement of objects into appropriate classes

Why these pairings

The correct matches are: Standard for frequently accessed data, Nearline for data accessed less than once a month, Coldline for data accessed less than once a quarter, and Archive for data accessed less than once a year. Common confusions involve misremembering the access frequency thresholds.

Practice this question →
51
MCQmedium

A security engineer notices that a Compute Engine instance is running a VM with a public IP that should not be accessible from the internet. They want to ensure this configuration is prevented by default for all future projects in the organization. What should they do?

A.Set an IAM policy to deny compute.instances.create with public IP
B.Define an Organization Policy with the constraint compute.vmExternalIpAccess
C.Create a VPC firewall rule to deny all traffic from the internet to the VM
D.Use Cloud Security Scanner to identify and remediate
AnswerB

The Organization Policy constraint compute.vmExternalIpAccess is a list constraint that can be applied at the organization, folder, or project level to explicitly block the creation of Compute Engine VMs with external IP addresses. This is a preventive, infrastructure-level guardrail enforced by the Resource Manager at request time, regardless of the IAM roles held by the caller. It can be configured to deny all external IPs or to allow only a set of specific IP ranges, and it propagates hierarchically to all child resources.

Why this answer

Organization Policies in Google Cloud allow you to set constraints at the organization, folder, or project level to enforce security controls. The `compute.vmExternalIpAccess` constraint specifically prevents VMs from being created with external IP addresses, ensuring that no future Compute Engine instances in the organization can have public IPs by default. This is a preventive control that applies to all new VM creations, unlike IAM policies or firewall rules which are more granular or reactive.

Exam trap

The trap here is that candidates often confuse IAM policies with Organization Policies, thinking that IAM can restrict resource configurations (like public IPs) when it only controls who can perform actions, not the attributes of the resources created.

How to eliminate wrong answers

Option A is wrong because IAM policies control who can perform actions (like `compute.instances.create`), but they cannot restrict the configuration of a resource (such as whether a public IP is assigned) — IAM does not support conditional constraints on resource attributes like external IP assignment. Option C is wrong because a VPC firewall rule can block traffic to the VM, but it does not prevent the VM from having a public IP address; the VM would still be reachable from the internet if the firewall rule is misconfigured or not applied, and it does not enforce a default policy for future projects. Option D is wrong because Cloud Security Scanner is a tool for finding vulnerabilities in web applications (like XSS or CSRF), not for enforcing organizational policies on VM public IP assignment; it is a detective control, not a preventive one.

Practice this question →
52
MCQhard

A healthcare company runs its critical application on Google Cloud. The application uses Cloud SQL for patient records, Cloud Storage for medical images, and Pub/Sub for data ingestion. The security team requires that all data at rest be encrypted with a key that is managed and rotated by their on-premises HSM. They also need to ensure that any potential data exfiltration is immediately detected and prevented. Recently, a vulnerability scan revealed that a Cloud SQL instance had a public IP. The team wants to enforce that no Cloud SQL instance can be created with a public IP across the entire organization. Additionally, they need to implement a solution to monitor and alert on any suspicious activity, such as a large download from Cloud Storage. They have a limited budget and cannot afford complex custom solutions. Which combination of Google Cloud services should they use to meet these requirements?

A.Use CMEK with Cloud KMS for encryption, set an Organization Policy to restrict public IPs on Cloud SQL, and configure Cloud Audit Logs with alerting via Cloud Monitoring to detect data exfiltration.
B.Use Cloud External Key Manager (EKM) for encryption, define an Organization Policy constraint to prohibit public IPs on Cloud SQL, deploy Security Command Center with Event Threat Detection to monitor for data exfiltration, and implement VPC Service Controls to limit data access.
C.Use default encryption with Google-managed keys, set an IAM condition to deny public IP on Cloud SQL, and configure Cloud Data Loss Prevention to detect sensitive data exfiltration.
D.Use Cloud HSM for encryption, create a VPC firewall rule to block all incoming traffic to Cloud SQL, and use Cloud Armor to protect against data exfiltration.
AnswerB

This is the correct answer because Cloud External Key Manager (EKM) integrates with an on-premises HSM, enabling the healthcare company to maintain control of encryption keys outside Google Cloud, satisfying the key management requirement. An Organization Policy constraint that prohibits public IPs on Cloud SQL is the proper resource-level enforcement mechanism. Security Command Center with Event Threat Detection monitors network and API activity for signs of data exfiltration, while VPC Service Controls creates a security perimeter that prevents data from being copied or transferred out of authorized services, addressing both detection and prevention.

Why this answer

Cloud External Key Manager (EKM) allows you to use an external key management system (on-premises HSM) for encrypting data at rest in Google Cloud services like Cloud SQL, Cloud Storage, and Pub/Sub. The Organization Policy constraint `constraints/sql.restrictPublicIp` can enforce that no Cloud SQL instance is created with a public IP. Security Command Center with Event Threat Detection provides out-of-the-box monitoring and alerting for suspicious activities like large downloads from Cloud Storage, while VPC Service Controls adds a data exfiltration prevention layer by restricting data movement outside a defined service perimeter.

Exam trap

Google Cloud often tests the distinction between key management options (CMEK vs. EKM vs. Cloud HSM) and the difference between detection (Cloud Audit Logs, Event Threat Detection) and prevention (VPC Service Controls), leading candidates to choose a solution that only detects but does not prevent data exfiltration.

How to eliminate wrong answers

Option A is wrong because CMEK with Cloud KMS uses keys managed within Google Cloud, not an on-premises HSM, and Cloud Audit Logs with Cloud Monitoring alone cannot prevent data exfiltration—they only provide logging and alerting, not active prevention. Option C is wrong because default encryption uses Google-managed keys, not customer-managed keys from an on-premises HSM, and IAM conditions cannot enforce a restriction on Cloud SQL public IPs at the organization level (that requires an Organization Policy). Option D is wrong because Cloud HSM is a Google-managed HSM service, not an on-premises HSM, and VPC firewall rules cannot block public IP assignment on Cloud SQL (they control network traffic, not resource configuration), while Cloud Armor is a web application firewall, not a data exfiltration detection or prevention tool.

Practice this question →
53
MCQmedium

A technology company runs its containerized microservices on Google Kubernetes Engine (GKE). The development team frequently pushes new container images to Container Registry, and those images are deployed to a production cluster. The security team recently discovered that a few running containers have critical vulnerabilities from outdated base images. They want to enforce a policy that only vulnerability-scanned and approved images can be deployed in the production cluster. The team uses Cloud Build for CI/CD and Container Analysis for vulnerability scanning. Which solution should they implement to meet this requirement?

A.Use Cloud Security Scanner to scan the production cluster for vulnerabilities.
B.Enable Cloud Asset Inventory to monitor image vulnerabilities across projects.
C.Configure Cloud Build to run a vulnerability scan step before pushing images to Container Registry.
D.Enable Binary Authorization with a policy that requires attestations from Container Analysis for all deployments in the production cluster.
AnswerD

Binary Authorization enforces a supply-chain policy at deployment time by requiring trusted attestations for every container image deployed to the GKE cluster. You can configure Container Analysis (e.g., on-demand scanning) to generate attestations for images that pass a vulnerability threshold, and an Attestor can be set to require those attestations. Because this is enforced by the Kubernetes admission controller in the cluster, any attempt to deploy an unverified image is blocked — providing the actual enforcement that the other options lack.

Why this answer

Binary Authorization enforces deployment-time policies that require signed attestations from trusted authorities (like Container Analysis) before an image can be deployed on GKE. By configuring a policy that mandates an attestation from Container Analysis (which performs vulnerability scanning), only images that have been scanned and approved can be deployed, directly meeting the requirement to block containers with critical vulnerabilities.

Exam trap

The trap here is that candidates confuse scanning images (which only identifies vulnerabilities) with enforcing a policy that blocks deployment of vulnerable images, leading them to choose a scanning-only option (like C) instead of the policy enforcement mechanism (Binary Authorization).

How to eliminate wrong answers

Option A is wrong because Cloud Security Scanner is designed to find web application vulnerabilities (e.g., XSS, SQLi) in App Engine, Compute Engine, and GKE services, not to enforce deployment policies or scan container images for OS-level vulnerabilities. Option B is wrong because Cloud Asset Inventory provides a historical view of cloud resources and their metadata (including vulnerability findings from Container Analysis), but it cannot enforce a policy that blocks deployments; it is a monitoring and inventory tool, not a policy enforcement mechanism. Option C is wrong because running a vulnerability scan step before pushing images to Container Registry only ensures images are scanned at build time, but it does not prevent a developer from bypassing the scan or deploying an older, unscanned image; it lacks the deployment-time enforcement that Binary Authorization provides.

Practice this question →
54
MCQhard

An organization stores sensitive data in BigQuery. They need to restrict access to specific columns based on user role, while allowing analysis at the dataset level. Which feature should they use?

A.BigQuery row-level security
B.Column-level access control using authorized views or taxonomy policies
C.IAM roles at the dataset level with fine-grained permissions
D.Cloud Data Loss Prevention (DLP) to mask data
AnswerB

BigQuery column-level access control can be implemented via authorized views that expose only designated columns while hiding sensitive ones, or via taxonomy policies in Data Catalog that tag columns and enforce fine-grained ACLs. Authorized views allow you to share a filtered projection without granting access to the underlying table, and taxonomies with policy tags enforce column-level restrictions at query time. These mechanisms directly satisfy the need to protect sensitive data in specific columns.

Why this answer

BigQuery column-level access control, implemented through authorized views or taxonomy policies (via Data Catalog), allows restricting access to specific columns while preserving dataset-level analysis permissions. Authorized views use SQL logic to expose only permitted columns, and taxonomy policies apply fine-grained access controls at the column level without requiring separate datasets.

Exam trap

Google Cloud often tests the distinction between row-level and column-level access controls, and the trap here is that candidates confuse row-level security (which filters rows) with column-level security (which restricts columns), or mistakenly think IAM dataset-level roles can achieve fine-grained column restrictions.

How to eliminate wrong answers

Option A is wrong because BigQuery row-level security restricts access to specific rows based on filters, not columns, and does not address column-level restrictions. Option C is wrong because IAM roles at the dataset level provide coarse-grained access to entire tables or datasets, but cannot restrict access to individual columns within a table. Option D is wrong because Cloud Data Loss Prevention (DLP) is used for data discovery, classification, and masking of sensitive data, but it does not enforce persistent column-level access control for ongoing query access; it is a scanning and transformation tool, not an access control mechanism.

Practice this question →
55
MCQeasy

A developer accidentally commits an application's Google Cloud service account key to a public GitHub repository. The key is valid and grants access to production resources. What is the correct immediate response?

A.Delete the commit from GitHub history using git rebase; the key is safe once removed from the repository
B.Immediately revoke/delete the exposed service account key in Google Cloud IAM, review Cloud Audit Logs for unauthorized access, and generate a new key distributed through secure channels
C.Change the service account's permissions to read-only to limit the damage from potential misuse
D.Send an internal email informing the security team and wait for their guidance before taking any action
AnswerB

This is the complete correct response: (1) Revoke the key immediately to stop any ongoing unauthorized access. (2) Review Admin Activity and Data Access audit logs to determine if the key was used after exposure. (3) Issue a new key through a secure distribution channel (ideally Secret Manager, not environment variables). Time to revocation is critical.

Why this answer

The immediate priority is to invalidate the exposed credential to prevent unauthorized access to production resources. Revoking the key in Google Cloud IAM ensures it can no longer be used for authentication, while reviewing Cloud Audit Logs helps identify any potential misuse. Generating a new key and distributing it securely restores access for legitimate applications.

Exam trap

The trap here is that candidates may think removing the key from the repository (Option A) is sufficient, but they overlook that the key remains valid in Google Cloud and can still be used by anyone who already obtained it.

How to eliminate wrong answers

Option A is wrong because deleting the commit from GitHub history does not invalidate the key; anyone who already cloned or forked the repository still has access to the key, and the key remains valid in Google Cloud until explicitly revoked. Option C is wrong because changing the service account's permissions to read-only does not prevent an attacker from using the key to authenticate; the key itself is still valid and could be used for any action the service account is allowed, including reading sensitive data. Option D is wrong because waiting for guidance delays the critical step of revoking the exposed key, increasing the window of opportunity for unauthorized access; immediate action is required to contain the breach.

Practice this question →
56
MCQhard

An organization uses Security Command Center (SCC) premium tier and wants to automatically remediate a specific finding type by disabling public access to Cloud Storage buckets. What is the recommended approach?

A.Use Cloud Pub/Sub alone to listen for SCC findings and then manually remediate
B.Use IAM to deny all users except project owners from making buckets public
C.Set up a Cloud Function triggered by SCC findings to remove public access
D.Configure a Cloud Scheduler job to run a script that checks and removes public access
AnswerC

This is the correct event-driven pattern: SCC publishes findings to Cloud Pub/Sub via a notification config, and a Cloud Function can be subscribed to that Pub/Sub topic using the background-trigger mechanism. The function receives the finding JSON, parses the bucket name, and uses the Cloud Resource Manager or Cloud Asset API to remove the public IAM binding or the public ACL. This happens within milliseconds of detection, is fully automated, and scales naturally with findings, making it the right fit for real-time security remediation.

Why this answer

Security Command Center (SCC) premium tier can publish findings to Cloud Pub/Sub, which can trigger a Cloud Function via a push subscription. The Cloud Function can then use the Google Cloud Storage API (specifically, the `storage.buckets.setIamPolicy` method) to remove the `allUsers` or `allAuthenticatedUsers` bindings that grant public access, enabling automated, event-driven remediation without manual intervention.

Exam trap

Google Cloud often tests the distinction between event-driven automation (Cloud Functions + Pub/Sub) and scheduled or manual approaches, so candidates mistakenly choose Cloud Scheduler or IAM deny policies because they think 'automation' means periodic checks or preventive controls, rather than reactive, real-time remediation.

How to eliminate wrong answers

Option A is wrong because using Cloud Pub/Sub alone only delivers the finding notification; it does not perform any remediation action, so manual steps are still required, which defeats the goal of automation. Option B is wrong because IAM deny policies cannot retroactively remove public access from buckets that already have public bindings; they only prevent future grants, and they do not automatically remediate existing public buckets. Option D is wrong because Cloud Scheduler runs on a fixed schedule, not in response to SCC findings, so it introduces latency and cannot provide real-time remediation when a finding is generated.

Practice this question →
57
MCQmedium

A company uses Google Workspace for identity. They want employees to use their Google Workspace credentials to access third-party applications (Salesforce, Slack, etc.) without separate passwords for each app. Which technology enables this?

A.VPN — employees connect to the corporate VPN which provides access to all apps.
B.Single Sign-On (SSO) using SAML 2.0 or OIDC with Google Workspace as the Identity Provider.
C.Cloud Armor — blocks unauthorized access attempts to applications.
D.Shared service account — all employees use the same credential.
AnswerB

Google Workspace acts as the identity provider (IdP), authenticating the employee once and then passing a SAML 2.0 assertion or OIDC ID token to each SaaS application, which acts as a service provider. Because the assertion/token is cryptographically signed and trusted by the application, the user is granted access without needing to re-enter credentials or create a separate password. This is the correct approach because it decouples authentication from application access, enabling centralized lifecycle management and enforcing corporate MFA policies across all federated apps.

Why this answer

Single Sign-On (SSO) using SAML 2.0 or OIDC allows Google Workspace to act as the Identity Provider (IdP), issuing authentication tokens that third-party applications (like Salesforce and Slack) trust. This eliminates the need for separate passwords, as users authenticate once with Google Workspace and the IdP handles subsequent access via security assertions or ID tokens.

Exam trap

Google Cloud often tests the distinction between network-level access (VPN) and identity-level federation (SSO), so candidates mistakenly choose VPN because they think it 'provides access to all apps' without realizing it does not solve the separate-password problem.

How to eliminate wrong answers

Option A is wrong because a VPN provides network-layer access to corporate resources but does not eliminate separate application passwords; users still need to authenticate to each app individually. Option C is wrong because Cloud Armor is a web application firewall and DDoS protection service that blocks malicious traffic at the edge, not an identity federation or SSO technology. Option D is wrong because a shared service account violates the principle of least privilege and non-repudiation; all employees using the same credential would create severe security and audit issues, and it does not enable passwordless access to third-party apps.

Practice this question →
58
MCQmedium

Google's physical data center security includes multiple layers of protection. Which of the following is NOT a physical security measure Google uses at its data centers?

A.Biometric authentication and badge access controls at multiple security perimeters.
B.24/7 on-site security personnel who monitor the facility continuously.
C.Customers can schedule tours of Google data centers to verify security practices directly.
D.Secure hardware destruction procedures for decommissioned storage devices.
AnswerC

Google does not offer customer-scheduled tours of its data centers; these facilities are highly restricted and access is limited to authorized personnel. Instead, Google provides independent third-party audit reports such as ISO 27001 and SOC 2 as verification of security controls. This statement is false as a physical security measure, making it the correct answer to a question asking which described practice does not actually exist.

Why this answer

Google does not offer public tours of its data centers. Allowing customers to schedule tours would introduce unnecessary security risks and is not part of Google's physical security model. Instead, Google provides transparency through third-party audit reports and certifications (e.g., SOC 2, ISO 27001) to verify security practices.

Exam trap

The GCDL exam often tests the misconception that Google offers data center tours as a transparency measure, but in reality, Google relies on independent third-party audits and certifications rather than allowing physical access to customers.

How to eliminate wrong answers

Option A is wrong because biometric authentication and badge access controls are indeed used by Google at multiple security perimeters, including the outer fence, building entrance, and server floor doors. Option B is wrong because 24/7 on-site security personnel are a standard physical security measure at Google data centers, monitoring CCTV and responding to incidents. Option D is wrong because secure hardware destruction procedures, such as degaussing, shredding, or pulverizing decommissioned storage devices, are a critical part of Google's data sanitization process to prevent data recovery.

Practice this question →
59
MCQmedium

A company wants to know: if Google Cloud experiences a data breach that exposes customer data, what are Google's notification obligations under standard Cloud service terms?

A.Google has no obligation to notify customers of data breaches — customers must discover breaches themselves.
B.Google will notify affected customers of personal data breaches without undue delay per its Data Processing Addendum, enabling customers to meet their own regulatory notification obligations.
C.Google will notify all media outlets immediately upon breach detection to maximize transparency.
D.Breach notification is only available to customers with Premium support tier.
AnswerB

Under the Google Cloud DPA, Google acts as a data processor for customer personal data, so it must notify the customer 'without undue delay' after becoming aware of a personal data breach. This contractual commitment allows customers to meet their own regulatory deadlines, such as GDPR's 72-hour notification to supervisory authorities. The notification must include details like the nature of the incident, categories of data, and mitigation measures, giving the customer enough information to assess risk and notify affected individuals if needed.

Why this answer

Google Cloud's standard Data Processing Addendum (DPA) contractually obligates Google to notify affected customers of personal data breaches without undue delay after confirmation. This enables customers to fulfill their own regulatory notification requirements under laws like GDPR or CCPA, as the customer remains the data controller responsible for end-user notifications.

Exam trap

The trap here is that candidates assume breach notification is optional or premium-only, but Google Cloud's standard DPA makes it a contractual right for all customers, regardless of support tier.

How to eliminate wrong answers

Option A is wrong because Google Cloud's DPA explicitly includes breach notification obligations, so customers are not left to discover breaches themselves. Option C is wrong because Google notifies affected customers, not media outlets; notifying media is not a standard contractual obligation and would violate data confidentiality. Option D is wrong because breach notification is a standard feature included in the DPA for all customers, not gated behind a Premium support tier.

Practice this question →
60
MCQeasy

A startup wants to automatically rotate encryption keys used for Cloud Storage objects every 90 days. Which service should they use?

A.Use Cloud Secret Manager to store and rotate encryption keys
B.Use default Cloud Storage encryption (SSE-GCP)
C.Use Cloud HSM to store keys and rotate manually
D.Use Cloud Key Management Service (KMS) with automatic rotation schedule
AnswerD

Cloud KMS enables you to set an automatic rotation schedule for customer-managed keys; for example, you can set a rotation period of 90 days to align with your compliance policy. Once configured, KMS automatically generates a new key version at that interval and uses it to encrypt new data, while continuing to allow decryption of data encrypted with previous versions using the key's version history. Cloud Storage supports integration with KMS through customer-managed encryption keys (CMEK), giving you control over key lifecycle and rotation while meeting the 'automatic' requirement.

Why this answer

Cloud KMS supports automatic key rotation with a configurable rotation period (e.g., every 90 days). When you create a key ring and key in Cloud KMS, you can set a rotation schedule, and Cloud KMS will automatically generate a new key version on the specified date. This allows the startup to meet the 90-day rotation requirement without manual intervention, and the new key version is used for encrypting new Cloud Storage objects while old versions remain available for decrypting existing data.

Exam trap

The trap here is that candidates often confuse Cloud Secret Manager (which stores secrets but does not rotate encryption keys automatically) with Cloud KMS (which provides automatic key rotation), or they assume that default Google-managed encryption (SSE-GCP) allows customer-controlled rotation schedules, which it does not.

How to eliminate wrong answers

Option A is wrong because Cloud Secret Manager is designed to store and manage secrets (e.g., API keys, passwords), not to rotate encryption keys for Cloud Storage objects; it lacks native automatic rotation scheduling for encryption keys. Option B is wrong because default Cloud Storage encryption (SSE-GCP) uses Google-managed keys that are rotated automatically by Google, but the customer cannot control or schedule the rotation period (e.g., 90 days); the rotation frequency is not configurable. Option C is wrong because Cloud HSM provides hardware-backed key storage but does not support automatic rotation; keys stored in Cloud HSM must be rotated manually, which contradicts the requirement for automatic rotation every 90 days.

Practice this question →
61
MCQeasy

A cloud architect wants to ensure that only certain users in the finance team can access a Cloud Storage bucket containing invoices. They also want to log all access attempts. Which two services should they use?

A.IAM and Cloud Audit Logs
B.Cloud NAT and Cloud Audit Logs
C.Cloud NAT and Cloud Load Balancing
D.IAM and Cloud CDN
AnswerA

IAM is the native Google Cloud service for fine-grained identity and access management; it binds principals to roles that contain permissions, letting you define exactly which users can perform specific actions on specific resources. Cloud Audit Logs records Admin Activity and Data Access logs, and the Data Access logs specifically capture data reads and modifications, so together they provide both enforcement of the 'only certain users' restriction and the audit trail to verify and investigate that restriction. This combination satisfies the access-control requirement and the logging requirement simultaneously, which is why it is correct.

Why this answer

IAM (Identity and Access Management) is used to grant specific users (e.g., finance team members) granular access to the Cloud Storage bucket via roles like roles/storage.objectViewer. Cloud Audit Logs (specifically Admin Activity and Data Access audit logs) capture all access attempts, including who accessed the bucket, when, and from which IP address, meeting the logging requirement.

Exam trap

Google Cloud often tests the distinction between network-level services (like Cloud NAT, Cloud Load Balancing, Cloud CDN) and identity/audit services (IAM, Cloud Audit Logs), so candidates mistakenly choose networking options when the question explicitly asks about user access control and logging.

How to eliminate wrong answers

Option B is wrong because Cloud NAT (Network Address Translation) is used to enable outbound internet connectivity for private instances, not for controlling user access to Cloud Storage or logging access attempts. Option C is wrong because Cloud NAT and Cloud Load Balancing are networking services that do not provide identity-based access control or audit logging for Cloud Storage. Option D is wrong because Cloud CDN (Content Delivery Network) is used to cache content for low-latency delivery, not to restrict access to a bucket based on user identity or to log access attempts.

Practice this question →
62
MCQmedium

A financial services company is subject to regulations requiring them to demonstrate that their cloud provider's employees cannot access customer data without the customer's explicit approval. Which Google Cloud feature most directly addresses this requirement?

A.Customer-Managed Encryption Keys (CMEK), where the customer controls the encryption key and can revoke access
B.Access Transparency and Access Approval, which log and require explicit customer approval for Google personnel access to customer content
C.Cloud Audit Logs, which record all customer actions within Google Cloud
D.VPC Service Controls, which prevent Google employees from accessing resources inside the service perimeter
AnswerB

Access Transparency logs all Google personnel access to customer content with justification codes. Access Approval requires Google to request explicit customer approval before accessing customer data. Together they directly address the regulatory requirement for customer oversight of provider access to their data.

Why this answer

Access Transparency and Access Approval directly address the regulatory requirement by providing near real-time logs of Google personnel actions on customer content and requiring explicit customer approval before such access can occur. Access Transparency logs every access attempt by Google employees, while Access Approval allows customers to approve or deny those requests, ensuring no unauthorized access without customer consent.

Exam trap

The GCDL exam often tests the distinction between encryption key control (CMEK) and access governance (Access Transparency/Approval), leading candidates to mistakenly choose CMEK because they conflate key management with personnel access control.

How to eliminate wrong answers

Option A is wrong because Customer-Managed Encryption Keys (CMEK) give customers control over encryption keys but do not log or require approval for Google personnel access to customer content; they protect data at rest but do not govern access by Google employees. Option C is wrong because Cloud Audit Logs record actions taken by customers within their own projects, not actions by Google personnel accessing customer content. Option D is wrong because VPC Service Controls create a security perimeter to prevent data exfiltration by customers or their resources, but they do not prevent Google employees from accessing resources inside the perimeter; they are designed to control data movement, not Google personnel access.

Practice this question →
63
Multi-Selectmedium

Which TWO statements about Cloud Identity-Aware Proxy (IAP) are correct?

Select 2 answers
A.IAP encrypts data at rest by default
B.IAP can be used to protect access to Compute Engine VMs via SSH and RDP without a VPN
C.IAP only works with Google Cloud applications
D.IAP uses the identity of the user and the context of the request to decide whether to allow access
E.IAP requires using a third-party identity provider
AnswersB, D

IAP enables secure SSH and RDP connections to Compute Engine VM instances through TCP tunneling over HTTPS, without requiring public IP addresses or a VPN. When a user initiates an SSH/RDP session, IAP validates their identity and authorizes access via IAM roles such as IAP-secured Tunnel User, then forwards the connection to the VM's internal IP. This eliminates the need for a bastion host and maintains a zero-trust posture.

Why this answer

Cloud IAP enables identity-based access to Compute Engine instances via SSH and RDP without requiring a VPN or bastion host. IAP uses the user's identity and request context to create a secure tunnel, forwarding traffic to the instance over HTTPS and verifying the user's credentials before allowing the connection.

Exam trap

Google Cloud often tests the misconception that IAP is limited to Google Cloud services or that it requires a third-party identity provider, when in fact IAP supports hybrid access and can use Google-managed identities without external IdPs.

Practice this question →
64
MCQeasy

A company's security policy requires all employees to verify their identity using more than just a password when accessing Google Cloud resources. What security feature enforces this requirement?

A.Password complexity requirements — enforcing long, complex passwords.
B.Multi-factor authentication (MFA) / Two-step verification (2SV).
C.IP allowlisting — only allowing access from office IP addresses.
D.Session timeout — automatically logging out users after 30 minutes of inactivity.
AnswerB

MFA requires a second factor—something you have (TOTP app, hardware security key) or something you are (biometric)—in addition to the password. This means that even if the password is stolen through phishing or credential stuffing, the attacker cannot authenticate without the second factor. It directly protects against the most common credential-based attacks.

Why this answer

Multi-factor authentication (MFA) / Two-step verification (2SV) is the correct answer because it explicitly requires users to provide two or more verification factors (e.g., something you know, something you have, something you are) to access Google Cloud resources. This directly enforces the policy of verifying identity beyond just a password, as MFA/2SV adds an additional layer of security by requiring a second factor such as a time-based one-time password (TOTP) from an authenticator app, a hardware security key (e.g., FIDO2), or a push notification. Google Cloud Identity Platform supports this via security key enforcement and 2SV policies, ensuring that password compromise alone is insufficient for access.

Exam trap

The trap here is that candidates confuse 'stronger authentication' with 'stronger passwords' (Option A) or 'access restrictions' (Option C), failing to recognize that the core requirement is adding an independent second factor, not just hardening the single password factor.

How to eliminate wrong answers

Option A is wrong because password complexity requirements only enforce stronger passwords (e.g., length, character types) but do not add a second verification factor; they still rely solely on something you know, which does not meet the 'more than just a password' requirement. Option C is wrong because IP allowlisting restricts access based on network origin (e.g., office IP addresses) but does not verify the user's identity beyond the password; it is a network-level control, not an authentication factor. Option D is wrong because session timeout automatically ends an inactive session after a set period (e.g., 30 minutes) but does not require any additional identity verification beyond the initial password-based login; it addresses session management, not authentication strength.

Practice this question →
65
MCQhard

A company wants to ensure that sensitive data (credit card numbers, SSNs) stored in BigQuery is automatically identified and protected. They also want ongoing scanning to detect if any new data violates their data governance policies. Which Google Cloud service provides these capabilities?

A.Security Command Center — it scans BigQuery for sensitive data automatically.
B.Cloud Data Loss Prevention (Cloud DLP) with BigQuery inspection jobs.
C.Cloud Monitoring custom dashboards with SQL queries that search for PII patterns.
D.Cloud Audit Logs — they record all BigQuery queries and can identify when sensitive columns are accessed.
AnswerB

Cloud Data Loss Prevention (Cloud DLP) is the correct service because it natively integrates with BigQuery to run inspection jobs on tables and columns, using over 150 built-in infoTypes (e.g., credit card numbers, email addresses, government IDs) plus custom infoTypes for organization-specific data. Scheduled inspection jobs enable continuous governance monitoring, ensuring new sensitive data is detected as it is added. DLP also offers de-identification transforms—such as masking, tokenization, and encryption—to protect the identified sensitive data, making it the only option that directly scans and classifies data content at scale.

Why this answer

Cloud DLP with BigQuery inspection jobs is the correct choice because it provides both automated identification of sensitive data (such as credit card numbers and SSNs) within BigQuery tables and ongoing scanning capabilities via scheduled inspection jobs. Cloud DLP uses built-in infoType detectors to match patterns like credit card numbers (Luhn check) and SSNs, and can trigger actions or alerts when new data violates governance policies.

Exam trap

The trap here is that candidates confuse Security Command Center's broad security scanning with Cloud DLP's specific data-level inspection, or assume that logging or monitoring tools can perform content analysis without specialized pattern-matching engines.

How to eliminate wrong answers

Option A is wrong because Security Command Center does not natively scan BigQuery for sensitive data; it provides security posture and threat detection for cloud resources, not data-level inspection. Option C is wrong because Cloud Monitoring custom dashboards with SQL queries cannot automatically identify PII patterns; they rely on manual query construction and lack the built-in pattern matching and classification capabilities of Cloud DLP. Option D is wrong because Cloud Audit Logs record access and query activity, not the content of the data; they cannot identify or protect sensitive data within BigQuery tables.

Practice this question →
66
MCQhard

A company runs a multi-tenant SaaS application on Google Cloud where each customer's data must be strictly isolated from other customers'. A security architect is evaluating approaches: (A) logical isolation using application-level tenant IDs in a shared database, (B) IAM-based separation using separate service accounts per tenant, or (C) infrastructure-level isolation with separate Google Cloud projects per tenant. Which approach provides the strongest isolation guarantee?

A.Logical isolation using application-level tenant IDs, because it is the most cost-efficient and sufficient for regulated workloads
B.Separate Google Cloud projects per tenant, which provides the strongest isolation: separate IAM boundaries, separate resource namespaces, separate audit logs, and no shared database instances with other tenants
C.IAM-based separation using separate service accounts per tenant within a shared project, because IAM provides cryptographically enforced access control
D.All three approaches provide equivalent isolation because Google Cloud's hypervisor ensures complete tenant separation at the hardware level
AnswerB

Project-level isolation is the gold standard for multi-tenant isolation. Each project is a completely independent security boundary. Separate IAM means no privilege escalation between tenants. Separate databases mean no shared infrastructure where bugs could leak data. Separate audit logs make compliance reporting per-tenant straightforward.

Why this answer

Separate Google Cloud projects provide the strongest isolation guarantee by creating independent IAM boundaries, resource namespaces, audit logs, and network configurations. This approach ensures that no shared database instances or other resources exist between tenants, eliminating any risk of cross-tenant data leakage through application bugs or misconfigurations. In contrast, logical isolation (A) relies on application-level tenant IDs which can be bypassed by software vulnerabilities, and IAM-based separation (C) still shares the underlying project infrastructure, including the same database and network.

Exam trap

The GCDL exam often tests the misconception that logical isolation (e.g., tenant IDs) or IAM alone is sufficient for multi-tenant data separation, when in reality only infrastructure-level isolation (separate projects) provides the strongest guarantee against cross-tenant data breaches in a shared cloud environment.

How to eliminate wrong answers

Option A is wrong because logical isolation using application-level tenant IDs in a shared database does not provide strong isolation; it is vulnerable to SQL injection, application bugs, or misconfigured queries that could expose one tenant's data to another, and it is not sufficient for regulated workloads that require strict data separation. Option C is wrong because IAM-based separation using separate service accounts per tenant within a shared project still shares the same resource namespace, database instances, and audit logs, meaning a compromised service account or a misconfigured IAM policy could allow cross-tenant access, and IAM does not enforce data-level isolation. Option D is wrong because Google Cloud's hypervisor ensures VM-level isolation but does not provide tenant separation for shared services like Cloud SQL, Cloud Storage, or application-level data; the hypervisor does not isolate data within a shared database or application layer.

Practice this question →
67
MCQhard

A multinational corporation must comply with data residency requirements that prohibit storing data outside specific geographic regions. They plan to use BigQuery for analytics. How can Google Cloud help enforce this requirement?

A.Use Cloud Audit Logs to detect and alert on cross-region data storage
B.Use Cloud Data Loss Prevention to redact cross-region data
C.Use VPC Service Controls to block access to BigQuery APIs from other regions
D.Use BigQuery’s location parameter to set dataset location and enforce via Organization Policy
AnswerD

In BigQuery, every dataset is created with a `location` parameter (e.g., `US`, `EU`, or a specific region like `asia-south1`) that determines where all tables and temporary storage are physically held. The Organization Policy constraint `gcp.resourceLocations` can be applied at the organization, folder, or project level to define an allowlist of regions; any attempt to create a dataset outside that allowlist is immediately denied. This dual approach gives you both the granularity to assign a dataset to a compliant region and a preventive policy guardrail that enforces residency across all projects.

Why this answer

BigQuery datasets are created with a specific location parameter (e.g., `us-central1` or `EU`), and Google Cloud Organization Policies can be used to restrict where datasets can be created. By defining a constraint like `constraints/bigquery.locationRestriction`, administrators can enforce that datasets must reside only in approved geographic regions, preventing any data from being stored outside those boundaries. This directly addresses data residency requirements without relying on detection or blocking mechanisms that don't control storage location.

Exam trap

Google Cloud often tests the misconception that VPC Service Controls can enforce data residency by blocking cross-region API calls, but in reality, VPC Service Controls control network access, not where data is physically stored, making it ineffective for this requirement.

How to eliminate wrong answers

Option A is wrong because Cloud Audit Logs only record actions after they occur; they cannot prevent data from being stored in a prohibited region, only alert on it after the fact, which fails to enforce a proactive residency requirement. Option B is wrong because Cloud Data Loss Prevention (DLP) is designed to inspect and redact sensitive data (e.g., PII) within content, not to control or restrict the geographic location where data is stored. Option C is wrong because VPC Service Controls block API access from specified networks or identities, but they do not restrict the physical location of data storage; a dataset could still be created in a non-compliant region if the API call originates from an allowed network.

Practice this question →
68
MCQeasy

A company classifies its data into four sensitivity levels: Public, Internal, Confidential, and Restricted. Which type of data would typically be classified as 'Restricted' and require the highest level of security controls?

A.Public press releases and marketing materials published on the company website.
B.Customer Social Security Numbers, payment card numbers, and employee health records.
C.Internal meeting notes and project status reports shared among employees.
D.Product roadmap documents shared only with the product team.
AnswerB

Customer Social Security Numbers are PII regulated under data privacy laws; payment card numbers fall under PCI DSS; employee health records are PHI under HIPAA. These are classified as Restricted because they contain regulated data types that impose mandatory safeguards, breach-notification obligations, and strict access controls; any mishandling creates severe compliance, legal, and reputational risk.

Why this answer

Restricted data, under Google Cloud's data classification framework, includes personally identifiable information (PII) such as Social Security Numbers, payment card numbers (PCI DSS), and protected health information (PHI). These require the highest security controls, including encryption at rest and in transit, strict IAM policies, and Data Loss Prevention (DLP) API scanning to prevent unauthorized access or leakage.

Exam trap

Google Cloud often tests the distinction between Confidential and Restricted data, where candidates mistakenly assume that any sensitive business document (like a product roadmap) qualifies as Restricted, but Restricted is reserved for data with legal or regulatory compliance requirements (e.g., PII, PHI, PCI).

How to eliminate wrong answers

Option A is wrong because public press releases and marketing materials are classified as Public data, which requires no access controls and is intended for unrestricted distribution. Option C is wrong because internal meeting notes and project status reports are typically classified as Internal data, which may require basic access controls but not the highest security level. Option D is wrong because product roadmap documents shared only with the product team are typically Confidential data, which requires access restrictions but not the stringent controls (e.g., encryption, DLP, audit logging) mandated for Restricted data.

Practice this question →
69
MCQmedium

A retail company uses Google Cloud to run an online store. They have a security requirement that all API calls to Cloud Storage must come from the company's on-premises network only. Which Google Cloud security feature should they implement?

A.IAM conditions with source IP constraint
B.VPC Service Controls
C.Cloud Armor
D.Identity-Aware Proxy (IAP)
AnswerB

VPC Service Controls creates security perimeters around Google Cloud services like Cloud Storage, allowing access only from approved VPC networks or IP ranges. It enforces context-aware policies based on client identity, network, and device at the API layer, and can deny data exfiltration to unauthorized networks. This makes it the precise, comprehensive solution for limiting storage API access from known networks.

Why this answer

VPC Service Controls allow you to define perimeters that restrict access to Google Cloud services from specified VPC networks or IP ranges. Cloud Armor is for DDoS and WAF. IAM conditions are for attribute-based access control within a policy.

Identity-Aware Proxy protects web applications, not storage APIs.

Practice this question →
70
MCQeasy

A company's employees use Google Workspace for email, documents, and collaboration. The IT team wants to require all employees to use a physical security key (like a YubiKey) as their second authentication factor when signing in — eliminating phishing-vulnerable SMS and authenticator app codes. Which Google Workspace security capability supports this requirement?

A.Google Workspace Advanced Protection Program, which enforces hardware security key requirements for high-risk users
B.Google Workspace 2-Step Verification policy configured to require hardware security keys (FIDO2/WebAuthn) for all employees, making it impossible to sign in without a physical key
C.Google Cloud Identity-Aware Proxy, which enforces hardware key authentication for all Google Workspace apps
D.Cloud Armor, which blocks sign-in attempts that don't come from corporate IP addresses, eliminating the need for 2FA
AnswerB

Google Workspace administrators can configure the 2SV enrollment and method requirements in the Admin Console. Setting the policy to require security keys (and disabling other 2SV methods) enforces hardware key use organization-wide. Hardware keys are phishing-resistant because they cryptographically verify the site they're authenticating to.

Why this answer

Google Workspace's 2-Step Verification policy allows administrators to enforce the use of hardware security keys (FIDO2/WebAuthn) as the sole second factor. This policy can be configured to require a physical security key for all employees, effectively blocking sign-ins that use SMS or authenticator app codes, which are vulnerable to phishing. The policy directly meets the IT team's requirement to eliminate phishing-vulnerable authentication methods.

Exam trap

Google Cloud often tests the distinction between a user-level program (Advanced Protection Program) and an organization-wide policy (2-Step Verification policy), leading candidates to choose Option A because it mentions hardware security keys, but they miss that it is not a blanket enforcement for all employees.

How to eliminate wrong answers

Option A is wrong because the Advanced Protection Program is designed for high-risk users (e.g., executives, IT admins) and enforces hardware security keys, but it is not a policy that can be applied to all employees by default; it requires manual enrollment per user. Option C is wrong because Cloud Identity-Aware Proxy (IAP) controls access to applications based on identity and context, but it does not enforce hardware key authentication for Google Workspace apps themselves; it is used for securing access to custom or cloud-hosted apps behind a load balancer. Option D is wrong because Cloud Armor is a web application firewall and DDoS protection service that filters traffic based on IP addresses or other criteria, but it does not enforce multi-factor authentication or eliminate the need for 2FA; it cannot replace a second authentication factor.

Practice this question →
71
Multi-Selecteasy

A company stores sensitive customer data in Cloud Storage buckets. The security team wants to ensure that only authorized users can access the data, and access is logged for audit. Which two practices should they implement? (Choose two.)

Select 2 answers
A.Use Storage Transfer Service to replicate data to a secured bucket.
B.Apply IAM conditions to restrict access based on user attributes like IP address or time of day.
C.Use Cloud Audit Logs to record all access attempts.
D.Set up Private Google Access to restrict access to the bucket.
E.Enable default encryption on all buckets using CMEK.
AnswersB, C

IAM conditions allow you to bind an IAM role with a condition expression based on attributes such as source IP, date/time, or resource tags. For instance, you can grant the Storage Object Viewer role only for requests coming from a corporate CIDR block and during business hours. This directly enforces attribute-based access control on the bucket, limiting who can read or write sensitive customer data. It is the appropriate method for restricting access at the user and request level.

Why this answer

IAM conditions allow fine-grained, attribute-based access control, such as restricting access to Cloud Storage buckets based on the requester's IP address or time of day, ensuring only authorized users can access the data under specific contexts. Option C is correct because Cloud Audit Logs record all access attempts (including successful and denied requests) to the bucket, providing the necessary audit trail for security and compliance.

Exam trap

Google Cloud often tests the distinction between data protection (encryption) and access control (IAM), leading candidates to mistakenly choose encryption options like CMEK when the question asks about restricting access and logging.

Practice this question →
72
MCQhard

A multinational corporation uses Cloud Identity-Aware Proxy (IAP) to secure access to applications. They notice that some users outside the corporate network can still reach the applications. What is the most likely misconfiguration?

A.IAP is set to 'allUsers' instead of 'allAuthenticatedUsers'.
B.The firewall rules allow ingress from 0.0.0.0/0.
C.IAP is not enabled on the backend service.
D.The OAuth 2.0 client ID is misconfigured.
AnswerA

In Cloud IAP, the IAM policy on the protected resource determines who can pass through. Setting the member to 'allUsers' includes any unauthenticated individual, so IAP does not require a Google identity and effectively disables authentication. The correct configuration is 'allAuthenticatedUsers', which mandates a valid Google login and verifies the user's identity.

Why this answer

Setting IAP to 'allUsers' allows unauthenticated access from any user on the internet, bypassing IAP's authentication and authorization checks. IAP should be configured with 'allAuthenticatedUsers' or a more specific set of principals to enforce identity verification before granting access to the application.

Exam trap

Google Cloud often tests the distinction between 'allUsers' (anyone, including unauthenticated users) and 'allAuthenticatedUsers' (any authenticated Google identity), which is a common source of confusion for candidates who assume IAP always requires authentication regardless of the IAM setting.

How to eliminate wrong answers

Option B is wrong because firewall rules allowing ingress from 0.0.0.0/0 are not the root cause; IAP works by intercepting requests at the Google Cloud load balancer level, and firewall rules do not affect IAP's authentication enforcement. Option C is wrong because if IAP were not enabled on the backend service, no IAP authentication would occur at all, but the question states that some users can still reach the applications, implying IAP is partially working. Option D is wrong because a misconfigured OAuth 2.0 client ID would cause authentication failures for all users, not allow some external users to bypass IAP.

Practice this question →
73
MCQmedium

A company uses Google Cloud and has a compliance requirement to store certain data only within the European Union and ensure it cannot be accessed from outside the EU, even by Google operations personnel. Which Google Cloud offering specifically addresses this level of data sovereignty?

A.Selecting EU regions for all resources in the Cloud Console.
B.Sovereign Controls offerings (e.g., T-Systems Sovereign Cloud) or Assured Workloads with data residency and personnel access controls.
C.VPC Service Controls — they prevent data from leaving the VPC boundary.
D.Cloud Armor — it blocks requests originating from outside the EU.
AnswerB

Google's sovereign offerings, including Assured Workloads and partner-based solutions like T-Systems Sovereign Cloud, combine EU data residency, restricted personnel access, and contractual jurisdictional commitments. Assured Workloads enforces org policy constraints and controls for compliance, while Sovereign Cloud runs on dedicated infrastructure with EU-based operations staff. These are the technically appropriate choices when the requirement is full algorithmic and operational sovereignty, not merely network or storage controls.

Why this answer

Sovereign Controls offerings (such as T-Systems Sovereign Cloud) and Assured Workloads with data residency and personnel access controls are specifically designed to meet strict data sovereignty requirements. These solutions ensure that data remains within the EU and that Google operations personnel cannot access it, addressing both geographic storage and access restrictions mandated by compliance frameworks like GDPR.

Exam trap

The trap here is that candidates often confuse geographic storage (selecting EU regions) with full data sovereignty, failing to realize that personnel access controls are required to prevent internal Google staff from accessing data from outside the EU.

How to eliminate wrong answers

Option A is wrong because simply selecting EU regions for resources ensures data is stored in the EU, but it does not prevent Google operations personnel from accessing the data from outside the EU, as Google retains administrative access. Option C is wrong because VPC Service Controls restrict data exfiltration by creating security perimeters around VPC resources, but they do not enforce geographic data residency or block access by Google personnel; they focus on preventing unauthorized data movement within Google Cloud. Option D is wrong because Cloud Armor is a web application firewall that filters incoming traffic based on IP addresses or geographic regions, but it does not control data storage location or restrict access by internal Google operations staff; it only blocks external requests at the network edge.

Practice this question →
74
MCQmedium

A CISO asks why Google Cloud's security model is described as a 'defense-in-depth' approach. Which explanation best describes this concept in the context of Google Cloud's infrastructure security?

A.Defense in depth means that Google uses a single, very strong encryption algorithm to protect all customer data
B.Defense in depth means security is implemented as multiple independent layers — physical security, hardware attestation, network encryption, hypervisor isolation, and application-level IAM — so that bypassing any single layer does not compromise the entire system
C.Defense in depth means Google deploys security controls only at the network perimeter, creating a strong outer boundary
D.Defense in depth means customers are responsible for all security layers, with Google providing only the physical infrastructure
AnswerB

This correctly describes defense in depth. Google's infrastructure security has independent layers: secure physical facilities, Titan security chips for hardware attestation, hypervisor isolation between tenants, encrypted network traffic, and IAM at the application layer. An attacker must bypass all relevant layers simultaneously — dramatically harder than defeating a single control.

Why this answer

Google Cloud's defense-in-depth model implements security at multiple independent layers: physical security (e.g., tamper-evident cages), hardware attestation (e.g., Titan chips verifying boot integrity), network encryption (e.g., mTLS between all services), hypervisor isolation (e.g., gVisor or KVM-based sandboxing), and application-level IAM (e.g., Cloud IAM policies). This layered approach ensures that if an attacker bypasses one layer, other layers remain intact to protect the system, aligning with the core principle of defense in depth.

Exam trap

The trap here is that candidates often confuse defense in depth with a single strong control (like encryption) or a perimeter-only approach, failing to recognize that Google Cloud's model requires multiple independent layers that each provide a distinct security function.

How to eliminate wrong answers

Option A is wrong because defense in depth is not about a single encryption algorithm; it relies on multiple overlapping controls, not a single strong mechanism. Option C is wrong because defense in depth extends beyond the network perimeter to include internal controls like hypervisor isolation and IAM, not just a strong outer boundary. Option D is wrong because Google Cloud's shared responsibility model means Google secures the infrastructure (physical, hardware, network, hypervisor), while customers secure their data and access; defense in depth applies to Google's layers, not solely customer responsibility.

Practice this question →
75
MCQmedium

An organization uses Google Cloud Identity and Access Management (IAM). A new employee is a data engineer who needs to read BigQuery datasets and run queries but should NOT be able to create new datasets, delete tables, or modify IAM policies. Which IAM role should be assigned?

A.`roles/bigquery.admin`
B.`roles/bigquery.dataViewer` (with `roles/bigquery.jobUser` if needed to run queries)
C.`roles/viewer` (project-level Viewer)
D.`roles/bigquery.dataEditor`
AnswerB

The `dataViewer` role grants read-only access to BigQuery datasets and tables, allowing the engineer to inspect schema and data. However, it does not include permission to create query jobs, so to actually run SELECT statements via the console or API, the `jobUser` role is also required. This pairing gives the engineer exactly the read-and-query capability needed, without write, delete, or administrative permissions, adhering to least privilege.

Why this answer

The `roles/bigquery.dataViewer` role grants read access to BigQuery datasets and their contents, while `roles/bigquery.jobUser` allows the user to run query jobs. Together, they satisfy the requirement to read datasets and run queries without permitting dataset creation, table deletion, or IAM policy modification.

Exam trap

The trap here is that candidates often assume the project-level `roles/viewer` (Option C) is sufficient for running queries, but it lacks the `bigquery.jobs.create` permission, causing query execution to fail even though the user can see the data.

How to eliminate wrong answers

Option A is wrong because `roles/bigquery.admin` grants full administrative control over BigQuery resources, including creating and deleting datasets, tables, and modifying IAM policies, which exceeds the required permissions. Option C is wrong because the project-level `roles/viewer` role provides read-only access to all resources in the project, but it does not include the `bigquery.jobs.create` permission needed to run queries, so the user would be unable to execute query jobs. Option D is wrong because `roles/bigquery.dataEditor` allows editing existing datasets and tables (e.g., inserting, updating, deleting data), but it does not include the `bigquery.jobs.create` permission for running queries, and it still permits modifications that the user should not be allowed to perform.

Practice this question →
Page 1 of 2 · 89 questions totalNext →

Ready to test yourself?

Try a timed practice session using only Trust and security with Google Cloud questions.

Start 20-question session