960 questions total · 13pages · All types, answers revealed
Page 1 of 13
Page 2An organization wants to restrict access to a Cloud Storage bucket so that only resources in a specific VPC network can reach it, without using public IP addresses. Which solution should they implement?
Private Google Access enables VMs with internal IPs to reach Google APIs and services without internet, using the VPC network.
A company wants to use Cloud Armor to block traffic from specific countries to comply with data sovereignty requirements. They have a global HTTP Load Balancer configured. Where should they configure the Cloud Armor policy?
Cloud Armor policies are applied to backend services.
Why this answer
Cloud Armor policies must be attached to a backend service (or backend bucket) of a global HTTP(S) Load Balancer to filter traffic at the edge. This allows the policy to evaluate incoming requests based on geographic location before they reach the backend, enforcing data sovereignty rules without modifying VPC networking or firewall rules.
Exam trap
Google Cloud often tests the misconception that Cloud Armor is a VPC-level firewall feature, leading candidates to choose VPC firewall rules or network-level attachments, when in fact it is a load balancer backend service security policy that operates at the application layer on Google's global edge.
How to eliminate wrong answers
Option A is wrong because Cloud Armor policies are not attached to VPC networks; they are applied to load balancer backend services or backend buckets, not to the underlying network infrastructure. Option C is wrong because Organization Policy constraints are used for governance controls (e.g., restricting resource locations) and cannot filter traffic by country at the application layer. Option D is wrong because firewall rules operate at the network layer (IP/port) within a VPC and cannot inspect HTTP request attributes like geographic origin; Cloud Armor uses Google's global edge infrastructure for geolocation-based filtering.
Refer to the exhibit. A user tries to create a Compute Engine instance using a custom image from another project. What is the most likely cause of the error?
The error message directly indicates that the image family does not exist in the project.
Why this answer
The error message explicitly states that the image family does not exist in the specified project. Option A would result in a permission denied error, not this error. Option C is incorrect because if the project ID were wrong, the error would indicate an invalid project.
Option D is incorrect because the error specifically mentions the image family, not a misspelling.
During an incident, a security engineer finds this audit log entry. What action was taken and by whom?
methodName is delete and principal is admin@example.com.
Why this answer
MethodName is 'v1.compute.instances.delete', indicating a delete operation, and the principal is admin@example.com. Option A is incorrect because the method is delete, not create. Option B is incorrect because the method is delete, not modify.
Option C is incorrect because the method is delete, not update.
A healthcare organization is migrating to Google Cloud and needs to achieve HIPAA compliance. Which THREE actions are required to meet HIPAA requirements on GCP? (Choose THREE.)
HIPAA requires audit controls to record access to ePHI; Cloud Audit Logs meet this requirement.
Why this answer
Enabling Cloud Audit Logs for all services handling ePHI is a direct requirement under HIPAA's Security Rule (45 CFR § 164.312(b)), which mandates audit controls to record and examine activity in systems that contain or use electronic protected health information. Cloud Audit Logs provide immutable, tamper-evident logs of admin activities, data access, and system events, which are essential for demonstrating compliance during audits or breach investigations. Without these logs, the organization cannot meet the audit control standard for ePHI environments on GCP.
Exam trap
Google Cloud often tests the distinction between mandatory HIPAA requirements (audit logs, BAA, encryption) and optional or unrelated networking features (VPC Flow Logs, Cloud NAT), leading candidates to mistakenly select VPC Flow Logs as an audit control when it only provides network telemetry, not access logging for ePHI.
A company stores sensitive customer data in Cloud Storage and uses CMEK with Cloud KMS. They want to ensure that data in transit to the storage bucket is always encrypted using TLS 1.2 or higher. Which configuration should they implement?
This enforces TLS 1.2+ for all requests to the bucket.
Why this answer
Setting the bucket's 'requireTls' transport security setting to 'true' in the bucket's IAM policy enforces that all requests to the bucket must use TLS 1.2 or higher. This is a bucket-level policy condition that directly controls the encryption of data in transit, ensuring that any HTTP request without TLS 1.2+ is denied.
How to eliminate wrong answers
Option A is wrong because Cloud Armor is a web application firewall and DDoS protection service that operates at the HTTP(S) load balancer level, not at the Cloud Storage bucket level, and it cannot enforce transport encryption directly on storage bucket requests. Option C is wrong because CMEK with Cloud HSM encrypts data at rest using customer-managed keys, not data in transit; it does not enforce TLS version requirements. Option D is wrong because there is no 'sslEnabled' condition in Cloud Storage IAM policies; the correct condition is 'requireTls' in the bucket's transport security settings, not a deny policy with a non-existent attribute.
A company is implementing data loss prevention (DLP) for BigQuery. Which THREE capabilities are provided by Cloud DLP? (Choose THREE.)
DLP can redact sensitive data in real-time during queries.
Why this answer
Cloud DLP can inspect and redact sensitive data directly in BigQuery query results. When you configure a DLP job or use the DLP API with BigQuery, you can specify infoTypes to detect and then redact matching values before returning the results to the user, preventing exposure of sensitive information like credit card numbers or PII.
Exam trap
Google Cloud often tests the distinction between DLP's de-identification capabilities and BigQuery's native encryption or auditing features, so candidates mistakenly select options like auditing or CMEK because they associate them with data protection, but DLP does not handle those functions.
A company is migrating a legacy on-premises application to Google Compute Engine. The application requires a static IP address for compliance with a regulatory requirement that outbound connections to a partner's IP whitelist must originate from a known, fixed IP. The application will run in a managed instance group (MIG) for high availability. Which of the following solutions meets the compliance requirement?
Correct. Cloud NAT with a static IP provides a fixed egress IP for all instances in the MIG, meeting the compliance requirement while maintaining high availability.
Why this answer
Cloud NAT with a static NAT IP address provides a fixed source IP for all outbound traffic from instances in the managed instance group (MIG). This meets the compliance requirement for a known, static IP for partner whitelisting. Cloud NAT is designed for outbound connectivity and works seamlessly with MIGs for high availability.
Option B is incorrect because a regional external HTTPS load balancer is designed for inbound traffic, not outbound routing; it cannot serve as a forward proxy for egress traffic.
Exam trap
A common trap is assuming a load balancer can handle outbound traffic. Cloud NAT with a static IP is the correct service for providing a static egress IP from a MIG.
How to eliminate wrong answers
Option A is wrong because VPC Service Controls are designed to restrict data exfiltration from Google Cloud services (e.g., BigQuery, Cloud Storage) by defining perimeters, not to control egress IP addresses for general compute instances; they do not provide a static IP for outbound connections. Option C is wrong because assigning static external IPs to each instance in a MIG would require the partner to whitelist multiple IPs, which violates the requirement for a single known, fixed IP and adds management complexity; also, MIG autoscaling could change the number of instances, making IP whitelisting impractical. Option D is wrong because Cloud NAT with a static NAT IP provides a fixed source IP for outbound traffic, but it is designed for instances without external IPs and does not inherently integrate with a load balancer for outbound routing; the question specifies using a load balancer for high availability, and Cloud NAT alone does not satisfy the requirement to route traffic through a load balancer.
Which THREE of the following are recommended practices for managing secrets in Google Cloud?
Reduces risk if a secret is compromised.
Why this answer
Options A, B, and E are correct. A is correct because automatic rotation and short-lived secrets limit exposure. B is correct because Cloud Secret Manager is the recommended service for storing and accessing secrets programmatically.
E is correct because granting access using IAM roles (e.g., Secret Manager Secret Accessor) follows the principle of least privilege. Option C is incorrect because storing secrets in Cloud Storage, even encrypted, is less secure than using Secret Manager, which is purpose-built for secret management. Option D is incorrect because embedding secrets as environment variables in source code is a security risk and not a recommended practice.
A financial services company needs to inspect all inbound and outbound packets from a subnet containing highly sensitive data for compliance. They have enabled VPC Flow Logs on that subnet, which record metadata such as source and destination IP, ports, and protocol. However, the security team requires the actual packet payload to perform deep packet inspection (DPI) for malicious patterns. They want to capture the packets without disrupting network traffic. Which additional configuration should be implemented to meet this requirement?
Packet Mirroring captures full packet payloads without affecting live traffic.
Why this answer
Packet Mirroring clones all packets (including payload) from a source instance in the subnet and forwards them to a collector instance for deep packet inspection, without disrupting the original traffic flow. VPC Flow Logs only capture metadata (headers, timestamps) and cannot include payload content, making Packet Mirroring the only solution that meets the requirement for actual packet payload capture.
Exam trap
Google Cloud often tests the distinction between metadata logging (VPC Flow Logs) and full packet capture (Packet Mirroring), and the trap here is assuming VPC Flow Logs can be configured to include payloads, which is technically impossible in GCP.
How to eliminate wrong answers
Option A is wrong because Cloud Armor only inspects and logs HTTP/HTTPS traffic at the edge, not all inbound/outbound packets from the subnet, and it cannot capture payloads for non-HTTP protocols or for traffic that does not pass through the Cloud Armor proxy. Option B is wrong because VPC Flow Logs do not support a 'include payload' setting; they are limited to metadata such as IP addresses, ports, and protocol numbers, and never capture packet payloads. Option D is wrong because Cloud NAT logging only records metadata about outbound connections (source/destination IPs, ports) and does not capture packet payloads; it is designed for connection tracking, not deep packet inspection.
A company wants to automate patching of operating system vulnerabilities on their Compute Engine instances. They need a solution that supports both Windows and Linux and can schedule patch deployments with rolling updates. Which service should they use?
VM Manager provides patch management with scheduling and rolling updates.
Why this answer
VM Manager is the OS management service that includes patch management. It supports both Windows and Linux, allows scheduling, and can perform rolling updates. OS Config Management and Cloud Scheduler are not patch management solutions.
Drag and drop the steps to set up a Cloud VPN with a static route in the correct order.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
A company is implementing a data retention policy for Cloud Storage buckets. They need to ensure that objects cannot be deleted before a specified retention period. Which THREE features can they use? (Choose THREE.)
Retention policies prevent deletion before the retention period ends.
Why this answer
A is correct because a Retention Policy on a Cloud Storage bucket enforces a minimum retention period for all objects in the bucket. Once set, objects cannot be deleted or overwritten until the retention period expires, directly meeting the requirement to prevent deletion before a specified time.
Exam trap
Google Cloud often tests the distinction between features that prevent deletion (Retention Policy, Bucket Lock, Object holds) versus features that manage deletion (Lifecycle rules) or provide recovery after deletion (Object versioning), leading candidates to confuse lifecycle rules with retention controls.
A company is deploying a web application behind an external HTTPS load balancer. They want to protect against common web attacks such as XSS, SQLi, and LFI using preconfigured rules. They also need to allowlist specific IP addresses that belong to partners. Which three Cloud Armor features should they use? (Choose three.)
Required for the policy to take effect.
Why this answer
Cloud Armor provides preconfigured WAF rules (OWASP ModSecurity CRS) for XSS, SQLi, LFI, etc. It also supports custom rules for allowlisting IPs. The correct features are: using preconfigured rule sets for OWASP CRS, creating custom rules with IP allowlisting, and then applying the policy to the load balancer.
The question asks for three, so the answers are the OWASP CRS rule set, custom rules, and security policy attachment.
A company's security policy requires that all traffic to a Google Cloud load balancer use TLS 1.2 or higher and only accept strong ciphers. They want to enforce this using a Google Cloud resource. Which resource should they configure?
SSL policies define allowed TLS versions and cipher suites for load balancers.
Why this answer
SSL policies on HTTPS load balancers allow you to specify the minimum TLS version and cipher profile (e.g., RESTRICTED for strong ciphers). This enforces encryption requirements at the load balancer level.
A company wants to enforce that all VPC firewall rules in an organization must be centrally managed and cannot be overridden by lower-level projects. Which approach should they use?
Hierarchical firewall policies can be applied at the org level and are inherited by all folders and projects; they can be set to not be overridden.
Why this answer
Hierarchical firewall policies are applied at the organization, folder, or project level and are inherited downward. They can be set to have higher priority than network firewall rules, and lower-level rules cannot override them if the policy is set accordingly.
Your organization uses Cloud CDN to distribute static content. Recently, users in a specific geographic region are experiencing high latency. What is the most likely cause?
Without a local edge, requests are routed to the nearest available edge or origin, increasing latency.
Why this answer
If there is no CDN edge node in that region, traffic must travel directly to the origin, increasing latency.
A company has a VPC network named 'production' with subnets in us-central1 and europe-west1. They have on-premises data centers in New York and London connected via two HA VPN gateways to the respective regions. The on-premises networks use BGP with Cloud Routers in each region. The company also has a Shared VPC with service projects. Recently, they migrated a critical application to Google Cloud, which runs on Compute Engine instances in the europe-west1 subnet. The application needs to communicate with an on-premises database in London reachable via the London VPN. After the migration, the application fails to connect to the database. The Cloud Router in europe-west1 shows that it is receiving the on-premises routes. The instance has a default route to the internet via Cloud NAT. The firewall rules allow all traffic from the instance to the on-premises IP range. What is the most likely cause of the connectivity issue?
Correct: without dynamic route import, learned BGP routes are not added to the VPC route table.
Why this answer
The Cloud Router in europe-west1 is receiving the on-premises routes via BGP, but if dynamic route import from BGP is disabled, those routes are not installed into the VPC route table. Without the specific route for the London on-premises database subnet, traffic from the Compute Engine instance will not be forwarded to the VPN tunnel, causing the connection failure. The default route via Cloud NAT only handles internet-bound traffic, not traffic destined for on-premises IP ranges.
Exam trap
Google Cloud often tests the distinction between BGP session establishment (routes received) and route installation (routes imported into the VPC route table), leading candidates to assume that receiving BGP routes automatically means they are usable for forwarding.
How to eliminate wrong answers
Option A is wrong because the on-premises firewall blocking Google Cloud IP ranges would cause a symmetric issue, but the problem is that traffic never reaches the on-premises network due to missing routes in the VPC. Option B is wrong because Cloud NAT is used for outbound internet access and does not affect traffic destined for on-premises IP ranges; it only translates private IPs to public IPs for internet-bound packets. Option C is wrong because Shared VPC does not prevent service project instances from using VPC routes; service project instances can use routes from the host project as long as they are in the same VPC network, and the route import issue is independent of Shared VPC.
A security engineer is designing a solution to monitor and detect anomalous IAM role usage across multiple Google Cloud projects. The engineer wants to create a centralized logging solution that captures all IAM policy changes and access attempts. Which THREE services should the engineer use together to achieve this?
Used to store and analyze logs forwarded from Cloud Logging via log sinks.
Why this answer
BigQuery is correct because it serves as the centralized analytics destination for Cloud Audit Logs, enabling the security engineer to run SQL queries across IAM policy changes and access attempts from multiple Google Cloud projects. By exporting audit logs to BigQuery, you can perform complex aggregations and anomaly detection at scale, which is essential for monitoring IAM role usage across a fleet of projects.
Exam trap
Google Cloud often tests the distinction between logging/audit services (Cloud Logging, Cloud Audit Logs, BigQuery) and monitoring/alerting services (Cloud Monitoring), so candidates mistakenly choose Cloud Monitoring for log analysis when it is only for metrics and dashboards.
An organization wants to grant a CI/CD pipeline (running on GitHub Actions) access to deploy resources in a GCP project without storing long-lived service account keys. Which approach is recommended?
Workload Identity Federation allows keyless authentication from external IdPs.
Why this answer
Workload Identity Federation allows binding an external identity provider (like GitHub Actions) to a GCP service account. The GitHub Actions workflow can exchange a GitHub OIDC token for a GCP access token, no static keys needed.
A company uses Cloud Armor security policies to protect their HTTP load balancer. They need to block requests from a specific geographic region (country X) and also limit requests from any IP to 1000 requests per second. They also want to use preconfigured rules for SQL injection prevention. What is the correct way to combine these requirements in a single security policy?
This is the correct approach: separate rules for different actions, with priorities ensuring evaluation order.
Why this answer
Cloud Armor rules are evaluated in order of priority (lowest number first). Preconfigured rules (like SQLi) have a priority of 1000 by default. Geographic and rate limiting rules can be added with custom priorities.
The rule order matters: typically, you want to block/rate-limit before applying WAF rules to reduce processing. However, the question is about combining them correctly: all rule types can coexist in a single policy. The key is that each rule type has its own configuration; you can't set rate limiting in the same rule as geo-blocking; they must be separate rules.
A DevOps team wants to centralize logging and monitoring for a GKE cluster that runs hundreds of microservices. They need to view logs, metrics, and traces in a single dashboard. Which approach should they use?
Cloud Logging and Cloud Monitoring provide native integration, automatic metrics, log collection, and trace capabilities for GKE.
Why this answer
Cloud Logging and Cloud Monitoring natively integrate with GKE to provide logs, metrics, and traces in a unified dashboard without additional setup. Option A uses outdated service names (Stackdriver) and the question expects current terminology. Option B involves third-party tools like Splunk or Elastic, which add complexity and lack native GKE integration.
Option C (Prometheus and Grafana) requires manual configuration and is not a native Google Cloud solution, making it less suitable for a centralized, fully-managed approach.
Drag and drop the steps to set up a binary authorization policy for a GKE cluster in the correct order.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Why this order
Binary Authorization requires authority creation, attestor setup, policy creation, cluster enablement, and testing.
Refer to the exhibit. An organization has the above IAM policy on a project. The user user@example.com is trying to view a list of objects in a bucket from IP address 10.1.1.1. What will be the result?
The source IP is in the allowed range, so the role is granted.
Why this answer
The IAM policy grants the `storage.objects.list` permission to `user@example.com` with a condition that requires the request to come from an IP address within the `10.0.0.0/8` range. Since the user is accessing from `10.1.1.1`, which falls within that CIDR block, the condition evaluates to true, allowing the list operation.
Exam trap
Google Cloud often tests the misconception that IAM conditions cannot restrict by IP address, or that a condition that appears to be a deny will automatically block access, when in fact the condition must be evaluated against the actual request context.
How to eliminate wrong answers
Option A is wrong because the condition is actually satisfied (10.1.1.1 is within 10.0.0.0/8), so it evaluates as true, not false. Option B is wrong because IAM conditions do support IP-based restrictions using the `aws:SourceIp` condition key (or in GCP, `gcp:sourceIp`), contrary to the claim. Option C is wrong because the user is not inheriting permissions from an admin role; the policy explicitly grants `storage.objectViewer` (or equivalent) to the user directly, not via inheritance.
An organization wants to enforce a security policy that denies all egress traffic to the internet from all projects in the organization, except for traffic from a specific set of VMs tagged with 'allow-egress'. Which approach should be used?
Hierarchical firewall policies apply across projects and cannot be overridden, ensuring baseline enforcement.
Why this answer
Hierarchical firewall policies are inherited down the resource hierarchy and can be enforced at the organization or folder level. They cannot be overridden at lower levels, making them suitable for organization-wide baseline rules.
A security team needs to detect anomalous outbound traffic from Compute Engine instances. They want to enable logging and analyze the data. Which three steps should they take? (Choose three.)
VPC Flow Logs capture IP traffic, including outbound flows.
Why this answer
To detect anomalous outbound traffic, you need to enable VPC Flow Logs (which log outbound traffic), export them to BigQuery for analysis (using a log sink), and query the data. Cloud NAT is for outbound connectivity with NAT, but not logging. Packet Mirroring copies traffic but is not necessary for flow logs.
Firewall Rules logging logs firewall hits, not all outbound traffic.
A security engineer is troubleshooting an issue where a Compute Engine VM cannot connect to a Cloud SQL instance that has a private IP address. Both resources are in the same VPC network. The VM's firewall rules allow egress to any destination, and the Cloud SQL instance's authorized networks include the VPC network. What is the most likely cause of the connection failure?
Private services access requires a VPC peering connection to route traffic to Google-managed services like Cloud SQL.
Why this answer
Cloud SQL instances with private IP addresses require a private services access connection (VPC peering) between the VPC network and the Service Networking API's managed tenant project. Without this VPC peering, the VM cannot route traffic to the Cloud SQL instance's private IP, even if both are in the same VPC network. Option C directly identifies this missing prerequisite.
Exam trap
Google Cloud often tests the misconception that being in the same VPC network guarantees Layer 3 connectivity, but private Cloud SQL instances require an explicit VPC peering to the Service Networking API, which is a separate configuration step.
How to eliminate wrong answers
Option A is wrong because Private Google Access enables VMs without external IPs to reach Google APIs and services (like Cloud Storage) via the default internet gateway, but it is not required for VPC-internal traffic to a Cloud SQL private IP. Option B is wrong because the VM's firewall rules allow egress to any destination, so they do not block traffic to the Cloud SQL IP range; the issue is at the routing/peering layer, not firewall. Option D is wrong because the Cloud SQL Auth proxy is an optional tool for encrypting connections and managing IAM-based authentication, but it is not required for connectivity when using a private IP within the same VPC; the proxy is typically used for public IP connections or to avoid managing SSL certificates.
A large enterprise is using Cloud Data Loss Prevention (DLP) to inspect a Cloud Storage bucket containing millions of files for sensitive data like credit card numbers and health information. The DLP inspection job is configured to scan the entire bucket with a schedule. Recently, the job has been failing with a 'Quota exceeded' error for the DLP inspect requests quota. The team needs to continue inspecting all files without increasing the quota limit, as the quota increase request would take weeks. They cannot skip any files due to compliance requirements. What should they do to work around the quota limit while inspecting all files?
Sampling reduces per-job usage, and more frequent runs ensure eventual full coverage within quota.
Why this answer
By reducing the per-job scan volume (e.g., via 'bytesLimitPerFile' or 'filesLimitPercent'), the job stays within the DLP inspect requests quota while still covering all files over multiple scheduled runs. This approach respects the quota ceiling without skipping any files, as the sampling is applied per job execution, not per file permanently. The team can increase the job frequency to ensure the entire bucket is eventually inspected, meeting compliance requirements.
Exam trap
Google Cloud often tests the misconception that reducing per-job sampling means permanently skipping files, but the key is that sampling is per execution, and multiple runs over time can cover all files without exceeding quota.
How to eliminate wrong answers
Option A is wrong because switching to content inspection (items) and sending each file individually via the API would still consume the same or more inspect requests quota per file, and the quota limit applies to API calls as well, not just file store inspection jobs. Option B is wrong because creating de-identification templates does not reduce the need for inspection; de-identification occurs after inspection, and the quota issue is about the inspection step itself, not redaction. Option C is wrong because submitting a quota increase request and pausing the job would leave files uninspected during the weeks-long wait, violating the requirement to continue inspecting all files without skipping any.
A company uses BigQuery to store sensitive customer data. They want to restrict access to certain columns (e.g., email and SSN) so that only authorized users see the actual values, while other users see a masked version. Which approach should they use?
This allows setting access controls and masking policies directly on columns, providing dynamic masking based on the user's role.
Why this answer
BigQuery column-level security using policy tags and data masking rules allows you to define fine-grained access controls and masking policies on specific columns. This is the recommended approach for column-level access and masking in BigQuery.
A security team wants to ensure that a Cloud KMS key is rotated automatically every 30 days and that previous key versions are available for decryption for at least 6 months. Which THREE steps should they take? (Choose three.)
By default, old versions are not destroyed; they remain available.
Why this answer
To meet the requirements: 1) Set rotation period to 30 days on the key; 2) Do not destroy old key versions until after 6 months; 3) The default destruction policy does not automatically destroy old versions, so they remain available. Setting a primary version is not required for rotation, and disabling rotation is contrary.
Refer to the exhibit. A Security Engineer runs the command to grant Alice access to view objects in a Cloud Storage bucket. Later, Alice reports she can no longer access the bucket after January 1, 2024. What is the most likely reason?
The condition checks request.time < timestamp, so after the timestamp, access is denied.
Why this answer
The IAM condition attached to the binding includes a timestamp condition that expires on January 1, 2024. When the condition is no longer satisfied, the binding becomes ineffective, and Alice loses access to the bucket. This is a common use of IAM conditions to grant time-limited access.
Exam trap
Google Cloud often tests the distinction between IAM conditions and permission scoping, where candidates mistakenly think the issue is a missing permission or a policy replacement rather than a time-based condition expiring.
How to eliminate wrong answers
Option A is wrong because the command explicitly grants the 'storage.objectViewer' role, which includes the 'storage.objects.get' permission, so Alice had the necessary permission. Option B is wrong because the command uses 'gcloud storage buckets add-iam-policy-binding', which adds a new binding without removing existing ones; it does not replace all bindings. Option C is wrong because the command successfully applied (Alice had access initially), and the error would have been reported immediately if the service account lacked permission to modify IAM policies.
A GKE cluster runs workloads that need to access Cloud Storage. The security team wants to avoid using service account keys and ensure each pod has a unique identity. What is the best practice?
Workload Identity allows pod-level identity without keys.
Why this answer
Workload Identity for GKE binds a Kubernetes service account to a Google service account. Pods that use the KSA automatically authenticate as the GSA without keys. This provides fine-grained pod-level identity.
Attaching the GSA to the node is coarse-grained. Using the default compute SA is insecure. Creating keys defeats the purpose.
A company has a Cloud Storage bucket containing CSV files with sensitive data. They want to use Cloud DLP to scan the files for personally identifiable information (PII) and automatically redact (replace) any detected credit card numbers before the data is used by downstream analytics. What type of job should they create?
A de-identification job can apply transforms (e.g., masking) to redact sensitive data.
Why this answer
Cloud DLP's de-identification jobs are designed to automatically transform sensitive data, such as redacting credit card numbers using a masking transform. This job type directly applies the redaction to the CSV files in Cloud Storage without requiring external triggers or custom functions, making it the most efficient and native solution for automated redaction before downstream analytics.
Exam trap
Google often tests the distinction between inspection-only jobs (detection) and de-identification jobs (transformation), and the trap here is that candidates confuse 'inspection' with 'redaction' or assume a custom function is needed when DLP's native transforms suffice.
How to eliminate wrong answers
Option A is wrong because an Inspection job only scans and classifies data; it does not perform redaction, and calling a Cloud Function via the API adds unnecessary complexity and latency. Option B is wrong because a bucketing transform is used for generalizing values (e.g., replacing exact ages with age ranges), not for redacting specific patterns like credit card numbers. Option C is wrong because an Inspection job with a Pub/Sub notification still only detects PII; the redaction would require an external Cloud Function to read, modify, and rewrite the files, which is less reliable and not a native DLP de-identification feature.
A GKE cluster has Workload Identity enabled. A Kubernetes service account is bound to a GCP service account named 'sa-gcs'. A pod using the Kubernetes service account fails to list objects in a Cloud Storage bucket. The GCP service account has the Storage Object Viewer role. What is the most likely cause?
This role is required for the KSA to impersonate the GCP SA.
Why this answer
The pod must use the Kubernetes service account, but the GCP service account may not have the required permission (storage.objects.list). However, with Workload Identity, the pod authenticates as the GCP SA. The issue could be that the GCP SA does not have the role on the specific bucket, or the binding is misconfigured.
But the most common cause is missing the iam.workloadIdentityUser role on the GCP SA for the Kubernetes service account to impersonate it. Without that, the pod cannot use the GCP SA.
A company uses Assured Workloads to meet FedRAMP High compliance in the US. They need to ensure that data cannot be moved outside the US region. Which control should they use?
Assured Workloads can enforce location constraints via organization policies.
Why this answer
Assured Workloads enforces compliance boundaries through organization policies, and the `gcp.resourceLocations` constraint specifically restricts where Google Cloud resources can be created. By configuring this policy as part of the Assured Workloads configuration, you ensure that all resources are provisioned only within the US region, preventing data from being stored or processed outside that boundary. This directly meets the FedRAMP High requirement to keep data within the US.
Exam trap
The trap here is that candidates confuse data exfiltration controls (like VPC Service Controls) with data residency controls (like organization policy constraints), leading them to choose a tool that prevents data from leaving a network rather than one that restricts where resources can be physically located.
How to eliminate wrong answers
Option A is wrong because VPC Service Controls are designed to prevent data exfiltration by controlling data movement between VPCs and external networks, but they do not enforce geographic location restrictions on where resources are created or stored. Option B is wrong because IAM conditions can restrict access based on resource location, but they do not prevent the creation of resources outside the US region; they only control who can access resources, not where resources are provisioned. Option D is wrong because Cloud DLP is a data loss prevention tool that scans and classifies sensitive data, but it does not block data movement based on geographic region; it is not a mechanism to enforce resource location constraints.
Which TWO actions should a security engineer take to protect sensitive data in Cloud Storage buckets from accidental public exposure? (Choose two.)
Prevents public ACLs at the org level.
Why this answer
Setting the organization policy constraint 'iam.disableBucketPolicyOnlyGrantedByDefault' enforces uniform bucket-level access across the organization, preventing the use of fine-grained ACLs that can accidentally expose data. This policy ensures that all new buckets default to IAM-based access control, reducing the risk of misconfigured public ACLs.
Exam trap
Google Cloud often tests the distinction between detection tools (like DLP) and preventive controls (like organization policy constraints), leading candidates to mistakenly choose DLP as a protective measure against public exposure.
Refer to the exhibit. An auditor notices this log entry. Which of the following is true about this event?
A successful decrypt operation implies the service account has the decrypter role.
Why this answer
The log entry indicates a successful decryption operation ("decrypt" action with a success status). For a service account to successfully decrypt data using Cloud KMS, it must have the Cloud KMS CryptoKey Decrypter role (roles/cloudkms.cryptoKeyDecrypter) on the key. The log shows the caller is a service account, and the operation succeeded, confirming it has the necessary permissions.
Option B correctly identifies this.
Exam trap
Google Cloud often tests the distinction between a successful operation and a failure — candidates see 'decrypt' and assume it failed due to permissions, but the log's success status directly proves the service account had the correct role.
How to eliminate wrong answers
Option A is wrong because the log shows the decryption succeeded, and a disabled key version would cause the operation to fail with an error like 'key version disabled' or 'permission denied' — not a success. Option C is wrong because the log entry shows a successful decryption (status is not an error), so insufficient permissions cannot be the case; a failure would be logged with an error code. Option D is wrong because the log does not show any impersonation (e.g., no 'impersonated' field or 'iam.serviceAccounts.signBlob' action); the caller is directly the service account, and impersonation would require additional delegation steps.
Correct: higher priority rule overrides the lower-priority default allow, ensuring only tagged instances receive SSH.
Why this answer
It creates a new ingress firewall rule that explicitly allows inbound TCP port 22 traffic from any source (0.0.0.0/0) only to VM instances that have the network tag 'ssh-access'. In Google Cloud VPC, firewall rules are stateful and apply at the instance level based on target tags; a priority of 1000 ensures this rule is evaluated appropriately relative to higher-priority (lower number) deny rules. This approach preserves the default-allow-ssh rule for other instances while granting SSH access specifically to tagged VMs.
Exam trap
Google Cloud often tests the distinction between ingress and egress rules, and the trap here is that candidates may mistakenly choose an egress rule (Option C) thinking it controls incoming SSH traffic, or they may incorrectly assume that modifying the default rule (Option D) is the simplest approach without considering the impact on untagged instances.
How to eliminate wrong answers
Option A is wrong because removing the default-allow-ssh rule and creating a new rule with no target tags would apply the rule to all instances in the VPC, which is overly permissive and does not restrict SSH access to only the VM with tag 'ssh-access'. Option C is wrong because an egress rule controls outbound traffic from instances, not inbound SSH connections; the requirement is to allow inbound SSH (tcp:22) to the VM, which requires an ingress rule. Option D is wrong because modifying the existing 'default-allow-ssh' rule to add a target tag 'ssh-access' would change the rule's scope to only apply to tagged instances, but it would also remove the rule's effect on untagged instances (since the rule originally had no target tags, meaning it applied to all instances); this could inadvertently block SSH access to other VMs that previously relied on the default rule.
Your company, a global e-commerce platform, must comply with the PCI DSS requirement to secure cardholder data. You have a multi-cloud environment with workloads on Google Cloud and AWS. The Google Cloud environment consists of Compute Engine instances that process credit card transactions, and a Cloud SQL for MySQL database that stores encrypted cardholder data. The security team requires that only specific service accounts can connect to the database, and all connections must be encrypted. Additionally, you need to ensure that the database is not publicly accessible and that all access is logged. You have configured the Cloud SQL instance with a private IP and enabled SSL/TLS. However, a recent audit revealed that a Compute Engine instance with a public IP and no service account was able to connect to the database and execute queries. The instance was not authorized in the Cloud SQL authorized networks. What is the most likely cause of this security gap, and what should you do to prevent it?
Private IP connections are allowed from any resource in the same VPC; the default service account had permission. Restricting the service account prevents unauthorized access.
Why this answer
The Compute Engine instance was in the same VPC as the Cloud SQL instance (private IP), and it used the default Compute Engine service account, which had the cloudsql.client role. This allowed the instance to connect via the Cloud SQL Proxy or directly using the private IP without being listed in authorized networks, as VPC internal connectivity bypasses authorized networks. The fix is to disable the default service account and assign a custom service account with only the necessary permissions, ensuring least privilege and preventing unauthorized access.
Exam trap
Google Cloud often tests the misconception that authorized networks or SSL/TLS are the primary controls for Cloud SQL access, when in fact IAM roles on service accounts within the same VPC can override those controls.
How to eliminate wrong answers
Option A is wrong because the database already had SSL/TLS enabled, and the instance connected successfully; the issue is not about SSL enforcement but about authentication and authorization. Option B is wrong because the Cloud SQL Proxy does not bypass network controls; it actually enforces IAM-based authentication and encryption, and removing it would weaken security. Option C is wrong because VPC Service Controls are designed to prevent data exfiltration across perimeters, not to block internal VPC connections from instances with the correct IAM roles; the connection was within the same VPC, so a service perimeter would not have prevented it.
A security engineer needs to grant a team the ability to impersonate a service account (SA) in project B from a Compute Engine instance in project A. The SA in project B has the required permissions to access Cloud Storage. What IAM configuration is required?
roles/iam.serviceAccountUser includes the 'actAs' permission. This allows the instance to impersonate the target SA, which already has the storage role.
Why this answer
It combines two necessary steps: first, the instance's service account in project A needs the roles/iam.serviceAccountUser role on the target service account in project B to gain impersonation privileges; second, the target service account in project B must have roles/storage.objectViewer to access Cloud Storage. Without both, the impersonation would either fail (no permission to use the target SA) or the target SA would lack the storage access.
Exam trap
A common mistake in Google Cloud is confusing roles/iam.serviceAccountUser (allows impersonation) with roles/iam.serviceAccountTokenCreator (generates tokens but doesn't grant impersonation). For cross-project impersonation, you need both the impersonator's SA to have serviceAccountUser on the target SA and the target SA to have the necessary resource permissions.
How to eliminate wrong answers
Option B is wrong because roles/iam.serviceAccountTokenCreator allows generating access tokens for the target SA but does not grant the ability to impersonate it for running operations; impersonation requires roles/iam.serviceAccountUser. Option C is wrong because creating a new SA in project A with storage permissions would not allow impersonating the existing SA in project B, which is the requirement; it would be a separate identity. Option D is wrong because granting roles/storage.objectViewer directly to the instance's SA in project A would only allow that SA to access storage, not impersonate the SA in project B, and the instance's SA may not have the necessary cross-project access.
A company wants to implement least privilege for a service account that needs to read objects from a Cloud Storage bucket and publish messages to a Pub/Sub topic. Which TWO IAM roles should be granted to the service account? (Choose TWO)
Provides read-only access to objects.
Why this answer
Roles/storage.objectViewer grants read-only access to objects in Cloud Storage buckets, which is the minimum permission needed for the service account to read objects. This role includes permissions like storage.objects.get and storage.objects.list, allowing the service account to retrieve object data without any write or administrative capabilities.
Exam trap
Google Cloud often tests the distinction between publisher and subscriber roles in Pub/Sub, and candidates mistakenly choose roles/pubsub.subscriber (Option B) thinking it covers publishing, when in fact it only allows consuming messages from a subscription.
A security team needs to detect and respond to a potential data exfiltration via VPC Flow Logs. They want to identify traffic to known malicious IP addresses in real-time. Which architecture should they use?
This architecture provides near real-time detection via streaming Pub/Sub and serverless processing.
Why this answer
VPC Flow Logs can be streamed via a log sink to Pub/Sub, then processed by Cloud Functions to compare against a threat feed. BigQuery is for analysis, not real-time. Dataflow could be used but is more complex.
Cloud NAT is unrelated.
A company wants to use Google Cloud resources but does not have a Google Workspace or Cloud Identity account. They want to manage identities for their users without paying for additional licenses. What is the most cost-effective identity solution?
Cloud Identity Free provides basic user identity management for accessing Google Cloud resources at no cost.
Why this answer
Cloud Identity Free edition provides identity management for users who only need to access Google Cloud resources (Compute Engine, Cloud Storage, etc.) without Gmail, Google Drive, or other Google Workspace services. It is free. Cloud Identity Premium includes additional features like device management and security policies but costs money.
Google Workspace is a paid suite of productivity apps. The Compute Engine default service account is not for user identities.
Your organization uses Cloud Armor to protect against web attacks. After a change to the security policy, legitimate traffic from certain IPs is being blocked. You need to quickly allow that traffic while preserving the security policy. What should you do?
A higher priority rule explicitly allows the traffic before the blocking rule is evaluated.
Why this answer
Adding a higher priority allow rule for the affected IPs allows the traffic without removing the security policy. Other options either remove protection or are ineffective.
A company is implementing GDPR compliance and wants to ensure that personal data is pseudonymized in BigQuery. They plan to use Cloud DLP to tokenize data before loading. Which approach should they take to minimize changes to existing SQL queries?
BigQuery's `DLP_TOKENIZE` function allows pseudonymization at query time, minimizing changes to existing SQL.
Why this answer
BigQuery has built-in functions like `DLP_TOKENIZE` that can be used in SQL queries to tokenize data on the fly without changing the schema. This allows pseudonymization while preserving the ability to query. Pre-processing with Dataflow would change the way data is stored and require modifications to queries.
Using Cloud Functions adds complexity. Cloud KMS does not tokenize.
A security engineer needs to audit all administrative actions performed by Google support engineers on their GCP project. Which service provides near-real-time logs of such access?
Access Transparency logs Google admin access to customer content, providing near-real-time visibility.
Why this answer
Access Transparency provides logs when Google personnel access customer content (e.g., support cases, internal troubleshooting). These logs are near-real-time and can be viewed in Cloud Logging. Audit Logs (Cloud Audit Logs) record user API calls, not Google admin access.
Which THREE of the following are valid requirements for using VPC Network Peering? (Choose three.)
Correct: peering exchanges subnet routes.
Why this answer
VPC Network Peering automatically exchanges subnet routes between the peered VPCs, enabling private IP connectivity without requiring additional route tables or VPN gateways. This route exchange is implicit once the peering connection is established, provided the networks do not have overlapping CIDR blocks.
A company wants to encrypt data at rest in Cloud Storage using a key that they manage and rotate periodically. They also need to ensure that the key material is stored in a FIPS 140-2 Level 3 validated HSM. Which encryption option should they use?
CMEK with Cloud HSM provides customer-managed keys stored in FIPS 140-2 Level 3 HSM.
Why this answer
CMEK with Cloud HSM uses customer-managed keys stored in a FIPS 140-2 Level 3 HSM. GMEK uses Google-managed keys, CSEK requires the customer to supply the key with each API call and Google does not store it, and Cloud HSM alone is not an encryption option; it must be used with CMEK.
Your organization has an IAM policy at the folder level that grants a user the Compute Admin role. A deny policy at the project level denies the same user the compute.instances.create permission. What is the effective access for this user on the project?
Deny policies take precedence over allow policies, so the deny at the project level blocks the inherited allow.
Why this answer
Deny policies always override allow policies. The deny at the project level explicitly denies compute.instances.create, so the user cannot create instances despite the folder-level allow.
A security engineer needs to restrict access to a Cloud Storage bucket so that only a specific set of Compute Engine instances can read objects. The instances are in the same project and VPC network. The engineer wants to use VPC firewall rules for this purpose. Which two configurations are REQUIRED? (Choose two.)
Allows the instances to reach Cloud Storage.
Why this answer
VPC firewall rules control network traffic to/from instances, but they cannot directly restrict access to Cloud Storage APIs. However, they can restrict which instances can reach the external IP of Cloud Storage. To achieve the goal, the engineer must allow egress traffic from the instances to the Cloud Storage IP ranges and deny all other egress.
But more importantly, access to Cloud Storage is controlled by IAM, not firewall rules. However, the question specifically asks about VPC firewall rules. The typical approach is to use Private Google Access and firewall rules to restrict egress to Google API IPs.
The correct answers are: allow egress to the Google API IP ranges (which include Cloud Storage) and deny all other egress. But the question might also consider using service accounts and firewall rule targets. Firewall rules can target service accounts, but that does not restrict access to Cloud Storage itself.
The most direct answer is that to limit which instances can access Cloud Storage, you can create an egress rule that allows traffic to the Cloud Storage IP ranges only from instances with a specific service account or tag, and then deny all other egress. But the question asks for two configurations. The most reasonable answers: (1) Create an egress allow rule for the Cloud Storage IP ranges with a target tag or service account that matches the instances. (2) Create a deny all egress rule with lower priority.
However, since Cloud Storage uses Google APIs, the IP ranges are from the published list. The correct choices are likely: A and D.
A developer needs to allow a specific Compute Engine instance to communicate with a Cloud SQL database instance. Both are in the same project but different VPC networks. What is the simplest secure method?
VPC peering provides a direct private connection between the two VPCs.
Why this answer
VPC peering is the simplest secure method to allow communication between two VPC networks in the same project. It establishes a private RFC 1918 connection using internal IPs, avoiding the public internet. Firewall rules alone cannot bridge separate VPCs, and Cloud SQL Proxy is unnecessary overhead for internal connectivity.
How to eliminate wrong answers
Option A is wrong because firewall rules only control traffic within a single VPC network; they cannot route traffic between different VPC networks. Option C is wrong because Cloud SQL Proxy is an extra component that adds complexity and is typically used for public IP access or from external clients, not for private VPC-to-VPC communication. Option D is wrong because granting a service account access to Cloud SQL controls authentication and authorization, not network-level connectivity between separate VPCs.
A company uses Cloud Storage buckets to store sensitive data. They want to allow a third-party auditor to list bucket contents but not download the objects. Which IAM role should be assigned?
Allows listing bucket contents without downloading objects.
Why this answer
Roles/storage.legacyBucketReader grants permission to list the contents of a bucket (via the storage.buckets.get and storage.objects.list permissions) without allowing object downloads, which require storage.objects.get. This role is specifically designed for scenarios where a user needs to enumerate objects but not read their data, aligning with the auditor's requirement.
Exam trap
The trap here is that candidates often confuse 'listing' with 'viewing' and choose roles/storage.objectViewer, not realizing that objectViewer includes the download permission (storage.objects.get), which is broader than the required list-only access.
How to eliminate wrong answers
Option B is wrong because roles/storage.objectAdmin includes storage.objects.get and storage.objects.update permissions, which allow downloading and modifying objects, exceeding the auditor's needs. Option C is wrong because roles/storage.objectViewer includes storage.objects.get, which permits downloading object data, not just listing. Option D is wrong because roles/storage.objectCreator only allows creating new objects (storage.objects.create) and does not include the storage.objects.list permission needed to list bucket contents.
A company needs to enforce data residency in the European Union for all GCP resources. Which TWO actions should they take? (Choose two.)
Assured Workloads provides compliance controls including data residency in the EU.
Why this answer
To enforce EU data residency, an organization policy constraint `gcp.resourceLocations` can restrict allowed locations to EU regions. Additionally, Assured Workloads can provide regulatory compliance for EU data boundary. VPC Service Controls prevent data exfiltration but do not enforce residency.
Audit Logs and IAM do not restrict locations.
Which Cloud DLP transform should be used to replace sensitive data with a token that preserves the format and length of the original data for reversible de-identification?
FPE preserves format and length and is reversible, making it suitable for tokenization.
Why this answer
CryptoReplaceFfxFpeConfig uses Format-Preserving Encryption (FPE) to replace data with a token that retains the original format and length, and the process is reversible with the encryption key.
Your organization uses Cloud Identity with SAML 2.0 federation from an external identity provider (IdP). You need to ensure that only users from a specific group in the IdP can access a critical application behind an HTTPS load balancer. Which combination of steps is required?
This is the correct approach: IAP enforces authentication, and the IAM role controls authorization based on group membership.
Why this answer
To restrict access to a specific group, you must first configure IAP on the backend service, then create an IAP access policy (or IAM binding) that grants the roles/iap.httpsResourceAccessor role to the Google group that corresponds to the IdP group. The IdP group must be synced to Google Cloud via directory sync or SCIM.
Drag and drop the steps to configure a security scanner to scan a web application in the correct order.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Why this order
Security scanning involves configuration, scheduling, execution, review, and remediation verification.
Deny-all (priority 2000) has higher priority (numerically lower) than default-allow-internal (priority 65534), so it overrides the allow rule.
Why this answer
The deny-all rule (priority 2000) has a higher priority (lower number) than the default-allow-internal rule (priority 65534). Since the deny-all rule blocks all TCP traffic from the 10.0.0.0/8 range, it overrides the default-allow-internal rule, blocking SSH traffic from 10.0.0.4 to 10.128.0.5. Option A is incorrect because the deny rule blocks traffic from 10.0.0.0/8, which includes 10.0.0.4, so it does block traffic, but the most likely cause is the priority ordering.
Option C is incorrect because the default-allow-internal rule covers all TCP ports, including port 22. Option D is incorrect because there is a rule (default-allow-internal) that allows SSH traffic, but the deny-all rule takes precedence due to higher priority.
An organization stores sensitive data in Cloud Storage and wants to use Cloud DLP to automatically scan new objects for PII as they are uploaded. Which two resources are needed? (Choose 2)
Why this answer
To scan objects automatically upon upload, you need a Cloud DLP job trigger that listens to Pub/Sub notifications from the storage bucket. The bucket must be configured to send Pub/Sub notifications for new objects. The job trigger will create inspect jobs when new objects are added.
A cloud architect is designing a multi-project environment in Google Cloud. They want to ensure that a specific folder-level IAM policy cannot be overridden by project-level policies. Which TWO statements about IAM policy inheritance and deny policies are correct? (Choose two.)
Deny policies take precedence over allow policies, so the deny blocks the permission regardless of lower-level allow.
Why this answer
Correct statements: 1) Organization policies (deny policies) can block permissions even if an allow policy grants them. 2) Deny policies can be applied at any level and override allow policies. The other statements are incorrect: allow policies are hierarchical with additive inheritance, but they cannot be made 'hard' to prevent override; deny policies are the mechanism for that. Project-level allow policies can override folder-level allow policies (inheritance is additive).
Deny policies can be applied at the folder level.
A company needs to store financial records for 7 years to meet regulatory requirements. They want to ensure that once written, the records cannot be modified or deleted by anyone, including cloud administrators. Which Cloud Storage feature should they enable?
Object Retention Lock enforces a WORM policy; once locked, objects cannot be deleted or overwritten for the specified duration.
Why this answer
Object Retention Lock with a retention policy enforces a WORM (Write Once, Read Many) policy. Once a retention policy is locked, objects cannot be deleted or overwritten until the retention period expires, even by project owners. Bucket Lock (which is part of Object Retention Lock) makes the retention policy immutable.
Object Versioning allows multiple versions but does not prevent deletion. CMEK provides encryption control, not immutability. Lifecycle management automates deletion, which is opposite of what is needed.
Which Google Cloud audit log captures administrator activity and is enabled by default?
Admin Activity audit logs are enabled by default and track API calls that modify resources.
Why this answer
Admin Activity audit logs (option D) are enabled by default in Google Cloud and capture all administrator actions that modify the configuration or metadata of resources, such as creating a VM or changing IAM policies. These logs are essential for compliance and security auditing because they record 'who did what, where, and when' for management activities, and they cannot be disabled.
Exam trap
Google Cloud often tests the misconception that all audit logs are enabled by default, but only Admin Activity and System Event logs are default-enabled, while Data Access logs are not, leading candidates to incorrectly choose Data Access audit logs.
How to eliminate wrong answers
Option A is wrong because Policy Denied audit logs are only generated when a Google Cloud service denies access due to a security policy (e.g., VPC firewall rules or IAP), and they are not enabled by default—they must be explicitly configured. Option B is wrong because System Event audit logs capture non-human actions, such as Google Cloud's own automated operations (e.g., automatic maintenance events), and they are enabled by default but do not cover administrator activity. Option C is wrong because Data Access audit logs track API calls that read or modify user-provided data (e.g., reading a Cloud Storage object), and they are disabled by default to avoid high volume and cost; they must be explicitly enabled per service.
A company uses VPC Service Controls in dry-run mode to test a new service perimeter that includes BigQuery. They want to monitor any violations without actually blocking access. Where can they view the logs of these dry-run violations?
Correct: VPC Service Controls violations in dry-run mode are logged to Cloud Logging and can be viewed using the appropriate filter.
Why this answer
When VPC Service Controls is in dry-run mode, violations are logged to Cloud Logging but access is not blocked. The logs can be viewed in the Logs Explorer using the filter for VPC Service Controls policy violations.
A company wants to enforce that all BigQuery datasets are created in the 'US' multi-region to comply with data residency policies. Which organization policy constraint can achieve this?
This constraint restricts resource creation to specified locations, including BigQuery datasets.
Why this answer
The 'gcp.resourceLocations' constraint restricts the locations where resources can be created. By setting the allowed locations to 'us' (or specific US regions), BigQuery datasets must be created in those locations. The other constraints: 'constraints/bigquery.restrictDatasetLocation' is not a valid organization policy. 'constraints/gcp.restrictNoncompliantResources' is not specific to locations. 'constraints/compute.trustedImageProjects' is for images.
A company is deploying a new internal application on Google Cloud. They want to ensure that VM instances in a specific subnet can only communicate with each other and with a load balancer that fronts the application. They also want to allow SSH access from a bastion host. Which TWO firewall rules should they create? (Choose two.)
This allows internal communication within the subnet.
Why this answer
To restrict communication to only internal subnet traffic and the load balancer, you need an ingress rule that allows traffic from the subnet (source) to all instances (target). To allow SSH from the bastion, you need an ingress rule allowing TCP port 22 from the bastion host (using its service account or tags). Egress rules are not needed because the default allow egress is not restrictive; but if you want to block other egress, you would need a deny egress rule, but the question asks for rules to allow, not block.
Refer to the exhibit. The output shows that Alice has the following IAM policy binding: { "role": "roles/storage.objectAdmin", "members": ["user:alice@example.com"], "condition": { "title": "storage_access_condition", "expression": "request.time < timestamp('2024-12-31T23:59:59Z') && source.ip in ['203.0.113.0/24']" } } Alice is currently working from an IP address 198.51.100.10, and the date is 2025-01-01. What is the result when Alice tries to upload an object to a bucket in this project?
The condition evaluates to false because time is after the expiration and source IP is not allowed.
Why this answer
Alice's IAM policy binding includes a condition that requires both the request time to be before 2024-12-31T23:59:59Z and the source IP to be within 203.0.113.0/24. Since the current date is 2025-01-01, the time condition fails, and her IP address 198.51.100.10 is not in the allowed range. With a condition that uses AND logic, both subconditions must be true for access to be granted; because neither is satisfied, access is denied.
Exam trap
Google Cloud often tests the misconception that a condition with multiple subconditions grants access if any one subcondition is met, but the AND logic requires all subconditions to be true simultaneously.
How to eliminate wrong answers
Option B is wrong because the role roles/storage.objectAdmin includes the storage.objects.create permission, which is required to upload an object. Option C is wrong because conditions are always evaluated for uploads when they are attached to the policy binding; there is no exception for upload operations. Option D is wrong because the IP condition is not satisfied (198.51.100.10 is not in 203.0.113.0/24), and even if it were, the time condition also fails, so access would still be denied.
An organization has a deny policy at the folder level that denies the permission resourcemanager.projects.create. A user has an allow policy at the project level granting roles/owner. What is the effective permission for the user to create projects in that project?
Correct. The folder-level deny policy explicitly denies the permission resourcemanager.projects.create, and deny policies override all allow policies regardless of the role or level.
Why this answer
Deny policies take precedence over allow policies. The folder-level deny policy explicitly denies resourcemanager.projects.create. Even though the user has Owner role at the project level, the explicit deny at the folder level blocks project creation.
Option A is correct because the deny policy explicitly denies the permission, which overrides any allow. Option B is incorrect because the deny is not effective simply because it is at a higher level; it is the explicit denial that causes the effect. A higher-level allow could grant permission in the absence of a deny, but here the explicit deny controls.
A company wants to allow their on-premises Active Directory users to access Google Cloud resources using their existing credentials. They need to synchronize user accounts and groups to Google Cloud Directory and enable federated authentication. Which TWO services should they use?
CDS syncs AD objects to Google Cloud Directory.
Why this answer
Cloud Directory Sync (CDS) synchronizes users and groups from Active Directory to Google Cloud Directory. SAML 2.0 federation with Google Workspace or Cloud Identity enables SSO using existing AD credentials.
A company wants to use Private Service Connect to publish a managed service (e.g., a custom application) so that consumers can access it privately within Google Cloud. Which THREE resources are involved in this setup?
The consumer creates a PSC endpoint to connect to the service.
Why this answer
Private Service Connect involves creating a service attachment on the producer side (the managed service), which is then accessible via a PSC endpoint in the consumer's VPC. DNS configuration is needed to resolve the endpoint's IP address. IAM roles control who can create endpoints.
A developer wants to grant a Compute Engine instance access to read objects from a Cloud Storage bucket. The instance runs under a service account. What is the best practice for granting this access?
This is the correct approach. The service account is authorized, and the instance can access the bucket using its metadata server credentials.
Why this answer
The best practice is to assign the appropriate IAM role (e.g., Storage Object Viewer) to the service account that the instance is running as. Then, the instance can use the service account's credentials automatically via the metadata server. This avoids the need to manage service account keys.
Generating keys is discouraged. Allowing the instance to use the default compute engine service account is common but less secure; a custom service account with minimal permissions is preferred.
A security engineer wants to ensure that all Compute Engine VMs in an organization use Shielded VM features. The organization uses Cloud Identity as the identity provider. What is the most efficient way to enforce this requirement?
This built-in constraint directly enforces Shielded VM at the organization level.
Why this answer
Organization policies can enforce constraints across all projects. The built-in constraint 'constraints/compute.requireShieldedVm' requires all new VMs to have Shielded VM features enabled. This is more efficient than manual audits, scripts, or custom constraints.
A company uses hierarchical firewall policies to enforce security across all VPC networks in an organization. They have an organization policy that denies egress traffic to the internet. However, a team needs to allow outbound HTTPS traffic to a specific external API (api.example.com) for a project. What is the best way to achieve this?
Hierarchical rules follow priority order; a higher priority allow rule overrides a lower priority deny.
Why this answer
Hierarchical firewall policies allow you to enforce organization-wide rules while still permitting exceptions via higher-priority rules. By creating a new rule that allows egress to the IP range of api.example.com with a priority higher than the deny rule, you override the deny for that specific traffic. This approach maintains the organization's security posture while enabling the required outbound HTTPS access.
How to eliminate wrong answers
Option B is wrong because Cloud NAT is used for outbound internet access from private instances, but it does not override an organization policy that denies egress traffic; the policy still blocks all egress regardless of NAT. Option C is wrong because removing the organization policy eliminates the baseline security control, which is unnecessary and insecure when a targeted exception can be made. Option D is wrong because VPC Service Controls are designed to restrict data exfiltration from Google Cloud services, not to control egress traffic to external APIs like api.example.com.
A security engineer is troubleshooting a VPC firewall rule that is not allowing traffic from a specific subnet to a Compute Engine instance. The target tag is set correctly. What is the most likely cause?
A deny rule with lower priority number overrides allow rules of higher priority number.
Why this answer
If a deny rule with a lower priority number (higher priority) exists, it will take precedence and block traffic despite an allow rule. Option B is incorrect because the instance's internal IP address does not affect the source range check. Option C is incorrect because the problem states the target tag is set correctly.
Option D is incorrect because the rule is in the correct network.
A company uses Cloud Identity-Aware Proxy (IAP) to secure access to an internal web application hosted on Compute Engine. After a recent security audit, the team wants to ensure that only users with specific attributes can access the app, such as belonging to the 'engineering' group and having a verified corporate email. What is the best approach to enforce this requirement?
Access levels in Context-Aware Access can enforce group membership and email verification.
Why this answer
Cloud IAP integrates with Identity-Aware Proxy access levels, which allow you to enforce attribute-based access control (ABAC) using Google Cloud's context-aware access features. By configuring an access level that requires the user to belong to the 'engineering' group (via Cloud Identity or G Suite group membership) and have a verified corporate email (e.g., using the `email_verified` attribute from the identity provider), you can precisely restrict access to the Compute Engine web application without modifying the application code.
Exam trap
Google Cloud often tests the distinction between network-level controls (VPC Service Controls) and identity-aware access (IAP), leading candidates to incorrectly choose VPC Service Controls for user attribute enforcement, when in fact IAP access levels are the correct mechanism for granular, attribute-based authorization.
How to eliminate wrong answers
Option A is wrong because VPC Service Controls are designed to prevent data exfiltration by controlling access to Google Cloud APIs and services (e.g., BigQuery, Cloud Storage) based on network perimeters and project boundaries, not to enforce user attribute-based access control for an individual web application. Option B is wrong because disabling OAuth and using a custom JWT would bypass IAP's built-in authentication and authorization mechanisms, requiring you to manually validate tokens and manage group membership claims, which is less secure and more complex than using IAP's native integration with Cloud Identity. Option C is wrong because setting up an HTTP load balancer with a custom header from the identity provider would require the application to parse and trust that header, which is insecure (headers can be spoofed) and does not leverage IAP's centralized access control; IAP itself handles authentication and injects verified identity headers (e.g., `X-Goog-Authenticated-User-Email`) after successful authorization.
A financial services company is migrating its on-premises application to Google Cloud. The application needs to access a Cloud SQL instance and a Cloud Storage bucket. Security requirements mandate that the application must use short-lived credentials and avoid storing long-lived service account keys. The application runs on Compute Engine. What should the Security Engineer do to meet these requirements?
Compute Engine automatically obtains short-lived tokens via the metadata server.
Why this answer
Attaching a service account directly to a Compute Engine instance allows the application to automatically obtain short-lived access tokens from the instance metadata server (http://169.254.169.254) for accessing Cloud SQL and Cloud Storage. This approach eliminates the need to store long-lived service account keys, meeting the security requirement for short-lived credentials.
Exam trap
Google Cloud often tests the distinction between Compute Engine's native service account attachment (which provides short-lived tokens via metadata server) and external identity federation methods, leading candidates to incorrectly choose Workload Identity Federation for internal workloads.
How to eliminate wrong answers
Option A is wrong because Workload Identity Federation is designed for workloads running outside Google Cloud (e.g., AWS, Azure, on-premises) to impersonate a service account, not for applications already running on Compute Engine. Option B is wrong because Cloud Key Management Service (KMS) manages encryption keys, not service account keys; it cannot generate or rotate service account keys. Option D is wrong because storing a service account key in Cloud Secret Manager still involves a long-lived key that must be retrieved and used, violating the requirement to avoid storing long-lived service account keys.
A company is using Cloud SQL with a private IP address in the same VPC as their Compute Engine web application server. The server can reach the Cloud SQL instance's IP address via ping, but the application is failing to connect with a permission error. The VPC firewall rules include the default allow internal rule. What is the most likely cause?
The Cloud SQL Client role is required to connect to Cloud SQL instances. The permission error aligns with missing IAM permissions.
Why this answer
The default allow internal rule permits all protocols and ports, so network connectivity is fine. The permission error indicates insufficient IAM permissions. The Cloud SQL Client role is required for connecting to Cloud SQL instances via private IP.
Page 1 of 13
Page 2Practice PCSE by domain
Target a specific domain to shore up weak areas.