Match each Google Cloud security concept to its description.
Drag a concept onto its matching description — or click a concept then click the description.
Identity and Access Management – fine-grained access control
Key Management Service for encryption keys
DDoS protection and web application firewall
Perimeter security to prevent data exfiltration
Centralized vulnerability and threat monitoring
Answer choices
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
Cloud IAM: Unified access control for Google Cloud resources
The correct matches are Cloud IAM (access control), Cloud KMS (key management), Cloud Security Command Center (threat detection), and Cloud DLP (data loss prevention). Common confusions include mixing up IAM with Security Command Center or KMS with Cloud Armor.
Answer analysis
For each option: why learners choose it and why it is or isn't the right answer here.
Cloud IAM: Unified access control for Google Cloud resources
Why this is correct
Cloud IAM is Google Cloud's primary identity and access management layer, where you define who (principal) has what (role) on which resource. It uses allow policies composed of bindings that attach to resources in a hierarchy, enabling fine-grained, least-privilege access control and centralized policy management across projects, folders, and organizations.
Cloud KMS: Managed service for encryption key management
Why this is correct
Cloud KMS is a key management service that lets you create, rotate, and destroy cryptographic keys used to protect data at rest and in transit. It integrates with products like Cloud Storage and BigQuery, and can be backed by Cloud HSM for FIPS 140-2 validated hardware protection, allowing customers to manage their own key hierarchy.
Cloud Security Command Center: Security monitoring and threat detection
Why this is correct
Cloud Security Command Center (SCC) serves as a central security and risk management dashboard that continuously discovers active assets and detects threats, misconfigurations, and vulnerabilities. It aggregates findings from services like Cloud Armor and Security Health Analytics, and supports export to SIEM tools for deeper monitoring and automated response.
Cloud DLP: Data Loss Prevention for sensitive data inspection
Why this is correct
Cloud DLP is a data classification service that uses content inspection and contextual analysis to discover sensitive data such as PII, PHI, and payment card information. It provides native de-identification transformations like masking, tokenization, and encryption, plus the ability to create custom detectors for domain-specific data, all through a REST API.
Cloud IAM: Security monitoring and threat detection
Why it's wrong here
Cloud IAM is fundamentally about authorization — deciding whether a Principal can perform an action on a resource — not about collecting telemetry or detecting security threats. Monitoring and threat detection is instead the role of Cloud Security Command Center, which ingests activity logs, scans for misconfigurations, and surfaces findings; IAM policies alone never observe real-time events.
Cloud KMS: Web application firewall and DDoS protection
Why it's wrong here
Cloud KMS doesn't filter inbound web traffic or mitigate volumetric attacks; it's a cryptographic key management service that handles key generation, rotation, and encryption operations. Web application firewall and DDoS protection are provided by Cloud Armor, which enforces security policies at the edge of Google's network, a completely different layer of the security stack.
Go deeper
Learn chapter
Cloud Digital Transformation
Key term
Data Loss Prevention
Data Loss Prevention (DLP) is a set of tools and processes that help organizations stop sensitive information from being shared, leaked, or stolen, whether accidentally or on purpose.
Key term
Cloud IAM
Cloud IAM (Identity and Access Management) is a framework of policies and technologies that ensures the right individuals have appropriate access to cloud resources at the right time and for the right reasons.
About these practice questions
Courseiva writes every GCDL question from scratch — 829 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This GCDL practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCDL exam.