CCNA Trust and security with Google Cloud Questions — Page 2 of 2

MCQmedium

A company's application stores sensitive customer information in Cloud Storage. A security audit finds that one bucket has 'allUsers' access granted (making it publicly accessible on the internet). The security team wants to prevent this from happening in the future. Which control prevents public access from being granted to Cloud Storage buckets?

A.Enable Cloud Armor on all Cloud Storage buckets to block public internet access

B.Apply the 'storage.publicAccessPrevention' organization policy constraint, which prevents allUsers and allAuthenticatedUsers from being granted in Cloud Storage IAM policies organization-wide

C.Enable VPC Service Controls around Cloud Storage to prevent public internet access

D.Configure Cloud Monitoring to alert the security team when a bucket is made public so they can revert it

AnswerB

Public Access Prevention is the correct control. Applied as an org policy, it makes it impossible to grant allUsers or allAuthenticatedUsers access to any bucket in the organization. Attempts to set such policies are rejected by the API. This is the definitive preventive control for accidental public bucket exposure.

Why this answer

The 'storage.publicAccessPrevention' organization policy constraint is a Google Cloud IAM constraint that, when enforced at the organization, folder, or project level, prevents any IAM policy binding that grants access to 'allUsers' or 'allAuthenticatedUsers' on Cloud Storage buckets. This is a preventive control that blocks the action before it can occur, directly addressing the security team's requirement to prevent public access from being granted in the future.

Exam trap

Google Cloud often tests the distinction between preventive, detective, and corrective controls, and the trap here is that candidates confuse VPC Service Controls (which restrict network-level access) with IAM policy controls (which govern identity-based access), leading them to choose option C instead of the correct preventive IAM constraint.

How to eliminate wrong answers

Option A is wrong because Cloud Armor is a web application firewall (WAF) and DDoS protection service for HTTP(S) load balancers, not a service that can be applied to Cloud Storage buckets or block IAM-based public access. Option C is wrong because VPC Service Controls create a security perimeter around Google Cloud services to prevent data exfiltration over the internet, but they do not prevent a bucket from being made publicly accessible via IAM policy changes; they restrict access from outside the perimeter but do not block the 'allUsers' grant itself. Option D is wrong because Cloud Monitoring alerts are a detective control, not a preventive control; they notify the team after the public access has already been granted, which does not prevent the incident from happening.

Practice this question →

MCQmedium

A company uses service accounts to allow their application running on a Compute Engine VM to access Cloud Storage. Which is the most secure way to configure this service account access?

A.Download the service account key JSON file and store it in the application's source code repository.

B.Attach the service account to the Compute Engine VM; the application obtains credentials automatically via the metadata server with no key files needed.

C.Grant all users the Storage Admin role so the application can access Cloud Storage through their credentials.

D.Create a shared service account key file accessible to all VMs via a Cloud Storage bucket.

AnswerB

Attaching a service account to a Compute Engine VM is the recommended pattern for Google Cloud workloads. The metadata server automatically provides short-lived OAuth2 access tokens to the VM, and Application Default Credentials (ADC) discovers these tokens without any key file, secret, or environment variable. This approach eliminates the need to create, distribute, or rotate long-lived service account key files, reducing the attack surface and administrative overhead. Because credentials are obtained automatically from the metadata server, the application can also transparently run on any VM with the attached identity.

Why this answer

Attaching a service account to a Compute Engine VM allows the application to automatically obtain short-lived OAuth 2.0 access tokens from the instance metadata server (http://169.254.169.254). This eliminates the need to download, store, or manage any long-lived service account key files, which are a significant security risk. The metadata server provides credentials that are automatically rotated and scoped to the service account's IAM roles, making this the most secure method for accessing Cloud Storage from a VM.

Exam trap

The GCDL exam often tests the misconception that storing keys in a repository or bucket is acceptable for automation, but the trap here is that any long-lived key file, even if stored in a bucket, is less secure than the automatic, short-lived credentials provided by the Compute Engine metadata server.

How to eliminate wrong answers

Option A is wrong because storing a service account key JSON file in the application's source code repository exposes the private key to anyone with repository access, violating the principle of least privilege and creating a persistent credential that can be leaked. Option C is wrong because granting all users the Storage Admin role is a gross over-privilege that violates the principle of least privilege and does not provide a service account for the application; it relies on user credentials which are not designed for automated workloads and introduces unnecessary security exposure. Option D is wrong because placing a shared service account key file in a Cloud Storage bucket still requires managing long-lived private keys, and any VM or user with read access to that bucket can exfiltrate the key, negating the security benefits of using service accounts on Compute Engine.

Practice this question →

MCQhard

A security team wants to ensure that only container images built by their approved CI/CD pipeline can run in their GKE cluster. Images built outside the approved process — even by internal engineers — should be blocked. Which Google Cloud security feature enforces this?

A.Cloud Armor — it blocks unauthorized container images at the load balancer.

B.Binary Authorization — requiring cryptographic attestations for container images before they can be deployed to GKE.

C.Cloud IAM — restricting `container.pods.create` permission to only the CI/CD service account.

D.Artifact Registry vulnerability scanning — blocking images with CVEs from being deployed.

AnswerB

Binary Authorization integrates with GKE admission control to require that every container image deployed carries a valid cryptographic attestation, typically issued by your CI/CD pipeline using Cloud KMS keys. If an image lacks a signed attestation, or the attestor isn't authorized, the deployment is rejected at admission time—before the pod is created. This is specifically build provenance enforcement, not vulnerability checking.

Why this answer

Binary Authorization is the correct answer because it enforces deployment-time policy by requiring that container images have a valid cryptographic attestation (e.g., from a trusted CI/CD pipeline) before they can be scheduled on GKE. This ensures that only images built and signed by the approved process are allowed to run, blocking all others regardless of who built them.

Exam trap

The trap here is that candidates confuse access control (IAM) with image provenance enforcement, mistakenly thinking that restricting who can create pods (Option C) is sufficient to block unauthorized images, when in reality a CI/CD service account could still deploy an unsigned image if not prevented by Binary Authorization.

How to eliminate wrong answers

Option A is wrong because Cloud Armor is a web application firewall and DDoS protection service that operates at the load balancer layer, not a container image admission controller; it cannot inspect or block container images at the pod-creation level. Option C is wrong because restricting `container.pods.create` permission to only the CI/CD service account would prevent engineers from directly creating pods, but it would not block images built outside the approved pipeline if those images were pushed to a registry and referenced by a pod created by the CI/CD service account; it controls who can create pods, not which images can be used. Option D is wrong because Artifact Registry vulnerability scanning identifies CVEs in images but does not enforce admission policies; it provides security insights but does not block deployment of images lacking attestations.

Practice this question →

MCQeasy

A company is concerned that employees might accidentally or maliciously upload sensitive personal data (such as credit card numbers or Social Security Numbers) to Cloud Storage buckets. Which Google Cloud product can automatically scan uploaded files and identify sensitive data patterns?

A.Cloud Armor, which inspects incoming HTTP requests for sensitive data patterns

B.Cloud DLP (Data Loss Prevention), which scans Cloud Storage objects for sensitive data types like credit card numbers and SSNs using built-in pattern detection

C.Cloud Logging, which records all file upload events to Cloud Storage

D.Security Command Center, which audits Cloud Storage bucket permissions

AnswerB

Cloud DLP is the correct answer. It has 150+ built-in infoTypes for detecting sensitive data patterns (credit card numbers matching Luhn algorithm, SSN format detection, etc.) and can scan Cloud Storage objects on a scheduled or triggered basis, flagging or de-identifying findings.

Why this answer

Cloud DLP (Data Loss Prevention) is the correct service because it is specifically designed to inspect and classify sensitive data within Cloud Storage objects. It uses built-in detectors (infoTypes) to identify patterns like credit card numbers (Luhn check) and Social Security Numbers, and can trigger automated actions such as redaction or logging when sensitive data is found.

Exam trap

The trap here is confusing a security monitoring or perimeter defense service (Cloud Armor, Security Command Center) with a content-aware data classification service (Cloud DLP), leading candidates to pick a service that audits permissions or logs events rather than one that inspects file contents for sensitive patterns.

How to eliminate wrong answers

Option A is wrong because Cloud Armor is a web application firewall (WAF) that protects against DDoS and OWASP Top 10 threats by inspecting HTTP/S traffic at the edge, not by scanning stored files for sensitive data patterns. Option C is wrong because Cloud Logging captures and stores audit logs of events (e.g., object uploads) but does not perform content inspection or pattern matching on the uploaded data. Option D is wrong because Security Command Center provides a centralized view of security risks and misconfigurations (e.g., public bucket permissions) but does not scan object contents for sensitive data patterns.

Practice this question →

Multi-Selecthard

Which THREE are required to achieve HIPAA compliance on Google Cloud?

Select 3 answers

A.Sign a Business Associate Agreement (BAA) with Google

B.Enable Cloud Audit Logs for tracking access to ePHI

C.Use only GCP services that are covered under the BAA

D.Use a dedicated project for all PHI workloads

E.Configure multi-factor authentication for all users

AnswersA, B, C

HIPAA mandates that covered entities and business associates enter into a Business Associate Agreement that guarantees the business associate will safeguard PHI. Google Cloud provides a BAA for covered services, making it a contractual prerequisite for any ePHI processing. Without a signed BAA, the legal liability for a breach remains with the covered entity, and Google's protected health information processing terms do not apply.

Why this answer

HIPAA requires covered entities and their business associates to have a written agreement that establishes the permitted and required uses of protected health information (PHI). Google Cloud provides a standard Business Associate Agreement (BAA) that customers must sign to contractually bind Google to HIPAA obligations, including safeguarding ePHI and reporting breaches. Without a signed BAA, Google is not legally liable as a business associate under HIPAA, making this a foundational requirement for compliance.

Exam trap

Google Cloud often tests the misconception that HIPAA requires dedicated infrastructure (like a separate project) or specific security controls (like MFA), when in fact HIPAA focuses on contractual agreements (BAA), data access logging, and using only services that are contractually covered under the BAA.

Practice this question →

MCQhard

An organization wants to ensure that Google Cloud services used by its employees cannot be used to exfiltrate data to a competitor's Google Cloud project. For example, they want to prevent copying data from their Cloud Storage bucket to a Storage bucket owned by a competitor. Which Google Cloud security control most directly prevents this type of insider data exfiltration?

A.IAM permissions that restrict users from accessing competitor projects

B.Cloud DLP, by scanning and redacting sensitive data before it can be stored

C.VPC Service Controls, which create a security perimeter around Google Cloud APIs so data cannot be moved to projects outside the defined perimeter

D.Organization Policy constraints that prevent resource creation in competitor accounts

AnswerC

VPC Service Controls are precisely designed for this. A service perimeter defines which projects can exchange data with each other. Even if a user has valid credentials, the API enforces that data cannot be read from inside the perimeter and written outside it — blocking the insider exfiltration pattern described.

Why this answer

VPC Service Controls (C) directly prevent data exfiltration by creating a security perimeter around Google Cloud APIs. This perimeter blocks any data movement to resources outside the defined perimeter, such as a competitor's Cloud Storage bucket, regardless of the user's IAM permissions. It works at the API layer, intercepting requests that attempt to copy data to an unauthorized project.

Exam trap

The trap here is that candidates often confuse IAM permissions with network-level controls, assuming that restricting IAM access to competitor projects is sufficient, but VPC Service Controls are the only mechanism that enforces a boundary at the API layer regardless of user identity.

How to eliminate wrong answers

Option A is wrong because IAM permissions control access to resources within a project, but they do not prevent a user with legitimate access to a source bucket from copying data to a destination bucket in a different project if the user has permissions on that destination. Option B is wrong because Cloud DLP scans and redacts sensitive data but does not block the transfer of data to an external project; it only modifies the content. Option D is wrong because Organization Policy constraints can restrict resource creation in competitor accounts, but they do not prevent data exfiltration from existing resources to already-created competitor projects.

Practice this question →

Matchingmedium

Match each Google Cloud data service to its primary function.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Managed relational database (MySQL, PostgreSQL, SQL Server)

Globally distributed, strongly consistent relational database

NoSQL document database for mobile and web apps

NoSQL wide-column database for large analytical workloads

Managed in-memory cache (Redis/Memcached)

Why these pairings

Cloud SQL is for traditional relational databases, Cloud Spanner for globally distributed ones, BigQuery for analytics, and Firestore for NoSQL document storage.

Practice this question →

MCQmedium

A company has employees who use personal (unmanaged) devices to access corporate applications. The security team wants to prevent sensitive Google Workspace documents from being downloaded to personal devices. Which Google control most directly addresses this data loss prevention requirement for device-based scenarios?

A.Cloud Armor, by blocking requests from IP addresses associated with personal devices

B.Google Workspace context-aware access and endpoint management controls that restrict actions (such as downloads) for users accessing from unmanaged personal devices

C.Enabling two-factor authentication for all users, which prevents unauthorized access

D.Encrypting all Google Drive files so they cannot be read on personal devices

AnswerB

Google Workspace provides device-level context-aware access. Organizations can define policies that restrict capabilities based on device enrollment status — allowing read-only web access on unmanaged devices while blocking downloads, or requiring device enrollment to access sensitive content.

Why this answer

Google Workspace context-aware access combined with endpoint management allows administrators to create access level policies that restrict specific actions—such as downloading, printing, or copying—based on device trust signals. When a user accesses Google Workspace from an unmanaged personal device, the policy can block the download of sensitive documents directly, addressing the data loss prevention requirement at the action level rather than just the access level.

Exam trap

The trap here is that candidates often confuse network-level controls (like Cloud Armor) or authentication controls (like 2FA) with device-level data loss prevention, failing to recognize that only context-aware access with endpoint management can enforce granular action restrictions based on device trust status.

How to eliminate wrong answers

Option A is wrong because Cloud Armor is a network security service that filters traffic at the edge based on IP addresses or geographic regions, but it cannot distinguish between managed and unmanaged devices or control application-level actions like downloads within Google Workspace. Option C is wrong because two-factor authentication (2FA) only verifies user identity at login; it does not enforce device-based restrictions or prevent a legitimate authenticated user from downloading sensitive documents to a personal device. Option D is wrong because encrypting Google Drive files protects data at rest and in transit, but it does not prevent a user with valid decryption keys from downloading and saving those files to an unmanaged device; encryption alone does not enforce download policies.

Practice this question →

MCQeasy

An organization wants to use Google Cloud for processing healthcare data subject to HIPAA regulations in the United States. Which contractual document must the organization obtain from Google before storing Protected Health Information (PHI) in Google Cloud?

A.A Non-Disclosure Agreement (NDA) to prevent Google from disclosing the existence of the healthcare application

B.A Business Associate Agreement (BAA), which is legally required by HIPAA before any covered entity can process Protected Health Information with a cloud provider

C.A Data Processing Agreement (DPA) as required under GDPR for European data subjects

D.An ISO 27001 certificate issued by Google Cloud demonstrating information security compliance

AnswerB

The BAA is non-negotiable for HIPAA compliance. Google Cloud offers a BAA that covers specific services for HIPAA workloads. Without a BAA in place, any PHI stored in Google Cloud constitutes a HIPAA violation — technical security controls alone do not satisfy the legal requirement.

Why this answer

Under HIPAA, a covered entity or business associate must obtain a Business Associate Agreement (BAA) from any cloud service provider that will create, receive, maintain, or transmit Protected Health Information (PHI). Google Cloud offers a BAA that contractually binds Google to comply with HIPAA Security and Privacy Rules, including safeguarding PHI and reporting breaches. Without a signed BAA, storing PHI in Google Cloud would violate HIPAA regulations.

Exam trap

The trap here is that candidates confuse a generic data protection document (like a DPA or NDA) with the HIPAA-specific BAA, or mistakenly believe that a security certification alone satisfies the contractual requirement for handling PHI.

How to eliminate wrong answers

Option A is wrong because a Non-Disclosure Agreement (NDA) only prevents disclosure of confidential information, but it does not impose the specific HIPAA-required safeguards, breach notification obligations, or permitted use restrictions that a BAA provides. Option C is wrong because a Data Processing Agreement (DPA) is mandated under GDPR for processing personal data of European data subjects, not for HIPAA compliance in the United States; HIPAA requires a BAA, not a DPA. Option D is wrong because an ISO 27001 certificate demonstrates that Google Cloud has an information security management system, but it is a certification, not a contractual document, and does not fulfill the HIPAA requirement for a signed BAA that includes specific privacy and security provisions.

Practice this question →

MCQhard

A regulated financial services firm must ensure that its data never leaves a specific geographic region (EU) for compliance with GDPR data residency requirements. Which Google Cloud features help enforce this requirement?

A.Select EU regions for all resources and apply the `gcp.resourceLocations` org policy to restrict resource creation to EU regions only.

B.Enable Cloud Armor on all load balancers to block non-EU traffic.

C.Use HTTPS for all connections to ensure data is encrypted when it leaves the EU.

D.Enable Google Workspace's regional storage settings to restrict where emails are stored.

AnswerA

Selecting EU regions for every resource ensures that data at rest is physically stored within EU boundaries, directly meeting residency requirements. Applying the gcp.resourceLocations organization policy adds a preventive control that blocks creation of any resource outside the allowed EU regions, even by accident or through a misconfigured deployment. This combination of explicit region selection and org-level policy enforcement is the accepted GCP method for guaranteeing data residency across all projects in an organization.

Why this answer

The `gcp.resourceLocations` organization policy constraint explicitly restricts the physical location where Google Cloud resources can be created. By setting this policy to allow only EU regions, the organization ensures that no compute, storage, or database resources can be provisioned outside the EU, directly enforcing GDPR data residency requirements. This policy is evaluated at resource creation time and applies to all projects under the organization, providing a hard enforcement boundary.

Exam trap

The GCDL exam often tests the distinction between network-level controls (like Cloud Armor) and data residency controls (like org policies), leading candidates to mistakenly choose a security tool that blocks traffic rather than a policy that restricts resource location.

How to eliminate wrong answers

Option B is wrong because Cloud Armor is a web application firewall that filters HTTP/S traffic based on IP addresses or geo-location, but it does not prevent data from being stored or processed outside the EU; it only controls incoming network requests, not where data resides. Option C is wrong because HTTPS encrypts data in transit, but encryption does not control the geographic location of data at rest or processing; data can still leave the EU while encrypted, violating residency requirements. Option D is wrong because Google Workspace's regional storage settings apply only to Workspace data (e.g., Gmail, Drive), not to the customer's own applications or data stored in Google Cloud services like Compute Engine or Cloud Storage, and the question is about a regulated financial services firm using Google Cloud, not Workspace.

Practice this question →

MCQhard

A financial services company is designing a multi-cloud architecture with Google Cloud and AWS. They need to encrypt data at rest in Google Cloud using a key stored in their on-premises Hardware Security Module (HSM). What is the best approach?

A.Use default encryption

B.Use Cloud External Key Manager (Cloud EKM)

C.Use Cloud HSM

D.Use Cloud Key Management Service (Cloud KMS) with CMEK

AnswerB

Cloud EKM integrates the Cloud KMS API with an external key management system or on-premises HSM, allowing Google Cloud services to encrypt and decrypt data at rest using keys that never leave the external HSM in plaintext. This preserves customer control and satisfies the requirement for keys to be stored outside the cloud provider's environment.

Why this answer

Cloud External Key Manager (Cloud EKM) is the correct approach because it allows you to manage encryption keys in an external key management system, such as an on-premises HSM, while using those keys to encrypt data at rest in Google Cloud. This meets the requirement of storing the key in the on-premises HSM, as Cloud EKM integrates with supported external key management partners or directly with your HSM via a key management proxy, ensuring that Google Cloud never has direct access to the raw key material.

Exam trap

The trap here is that candidates often confuse Cloud HSM (which provides hardware-backed keys but within Google's infrastructure) with the ability to use an external on-premises HSM, leading them to select Cloud HSM instead of Cloud EKM.

How to eliminate wrong answers

Option A is wrong because default encryption uses Google-managed keys, which do not allow you to control or store the key in your on-premises HSM. Option C is wrong because Cloud HSM is a Google Cloud service that provides hardware-backed key storage within Google's infrastructure, not in your on-premises HSM, so it does not satisfy the requirement of using a key stored on-premises. Option D is wrong because Cloud KMS with CMEK allows you to manage your own keys, but those keys are stored in Google Cloud (either in Cloud KMS software or Cloud HSM), not in an external on-premises HSM, and CMEK does not support direct integration with external key stores.

Practice this question →

Drag & Dropmedium

Drag and drop the steps to configure a load balancer for an HTTP application on Compute Engine into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

The correct order is: instance group, health check, backend service, URL map, then target proxy and forwarding rule.

Practice this question →

MCQeasy

A company's security team wants to be alerted when someone with administrative permissions changes an IAM policy in their Google Cloud organization. Which Google Cloud capability enables this detection?

A.Data Access audit logs, which record when data is read from Cloud Storage buckets

B.Admin Activity audit logs combined with Cloud Monitoring log-based alerting, which records and alerts on IAM policy modifications by any principal

C.Cloud Armor, which blocks unauthorized IAM policy changes at the network layer

D.VPC flow logs, which capture all network traffic including IAM API calls

AnswerB

Admin Activity audit logs record all IAM policy changes (SetIamPolicy calls) automatically and cannot be disabled. A log-based metric in Cloud Monitoring can count these events, and an alerting policy triggers a notification whenever an IAM change is detected. This is the standard approach for IAM change monitoring.

Why this answer

Admin Activity audit logs record all changes to IAM policies and other configuration changes in Google Cloud. By combining these logs with Cloud Monitoring log-based alerting, the security team can create a specific alert that triggers whenever an IAM policy is modified by a principal with administrative permissions, enabling real-time detection of unauthorized changes.

Exam trap

The GCDL exam often tests the distinction between audit log types (Admin Activity vs. Data Access) and the specific services that handle control-plane vs. data-plane operations, leading candidates to mistakenly choose Data Access logs or VPC flow logs for IAM policy changes.

How to eliminate wrong answers

Option A is wrong because Data Access audit logs record read/write operations on user-provided data (e.g., Cloud Storage objects), not IAM policy modifications, which are configuration changes. Option C is wrong because Cloud Armor is a web application firewall that protects against network-layer attacks like DDoS and SQL injection; it does not monitor or block IAM policy changes, which are control-plane operations. Option D is wrong because VPC flow logs capture metadata about network traffic (e.g., source/destination IP, ports, protocols) but do not log IAM API calls, which are control-plane operations logged separately in Admin Activity audit logs.

Practice this question →

Multi-Selecthard

Which THREE practices are recommended for securing a Kubernetes cluster in Google Kubernetes Engine (GKE)?

Select 3 answers

A.Use Binary Authorization to ensure only trusted container images are deployed

B.Enable node auto-repair to automatically fix security vulnerabilities in nodes

C.Enable GKE Sandbox for untrusted workloads to provide an additional layer of isolation

D.Expose the cluster control plane via a public endpoint to allow monitoring

E.Enable Workload Identity to manage access to Google Cloud APIs

AnswersA, C, E

Binary Authorization is a supply-chain security control that requires all container images to be signed by an approved authority before admission to the cluster. It integrates with Artifact Analysis and your CI/CD pipeline, using attestors to verify signatures and enforce policies like 'only images signed for production' at deployment time. This blocks unverified or tampered images from running, directly closing a key attack vector.

Why this answer

Binary Authorization is correct because it enforces deployment-time policy validation, ensuring that only container images signed by trusted authorities (e.g., via KMS) are allowed to run in GKE. This prevents the deployment of untrusted or tampered images, directly addressing supply chain security.

Exam trap

Google Cloud often tests the distinction between operational features (like node auto-repair) and security features, so candidates mistakenly assume auto-repair patches vulnerabilities when it only restores node health, not applies security updates.

Practice this question →