Cloud Digital Leader Trust and security with Google Cloud Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Customers must submit a formal request to Google and wait for written approval before any penetration testing.

  Why it's wrong here

  Google Cloud does not require prior approval for customers penetration testing their own resources. This is a common misconception — many cloud providers previously required advance notice, but GCP allows self-authorized testing of owned resources.

• ✓

  Customers are authorized to penetration test their own GCP resources without prior Google approval, within the Acceptable Use Policy.

  Why this is correct

  Google Cloud's Penetration Testing Policy explicitly permits customers to conduct security tests on their own GCP resources—including Compute Engine VMs, GKE clusters, Cloud Functions, and App Engine applications—without prior notification or approval. This self-service authorization is subject to the Acceptable Use Policy (AUP), which prohibits testing that targets other customers' environments, Google's core infrastructure, or services outside the customer's own project boundaries. You are accountable for staying within your own resource scope and ensuring your tests do not degrade or disrupt Google's shared infrastructure, but you do not need to file a request or wait for permission before starting an assessment.

• ✗

  Penetration testing is illegal in cloud environments and customers should use vulnerability scanners instead.

  Why it's wrong here

  Penetration testing is neither illegal nor discouraged in cloud environments; Google Cloud explicitly permits customers to test their own resources and even offers documentation and best practices to help structure such assessments. The legality and authorization depend entirely on the target and your relationship to it—testing resources that you own or that you have explicit written permission to attack is lawful, while probing another tenant's environment or Google's shared infrastructure without authorization is prohibited. Vulnerability scanners are useful automated tools for identifying known misconfigurations and CVEs, but they do not replace the manual, objective-focused verification and attack-path validation that a skilled penetration test provides; both approaches are complementary parts of a robust security program.

• ✗

  Google automatically performs penetration testing on all customer resources monthly and shares the report.

  Why it's wrong here

  This statement inverts Google's actual responsibilities under the shared responsibility model. Google rigorously tests and monitors its own infrastructure, including data-center hardware, networking, and underlying hypervisors, but it does not perform penetration tests on each customer's individual workloads, applications, or configurations. Customers are responsible for assessing the security of their own deployed resources and data; Google does not schedule monthly tests or produce private vulnerability reports for every customer, as that would not only violate the isolation between tenants but would also require access to customer-controlled assets that Google is explicitly barred from inspecting without customer authorization.

Go deeper

Related to this question