Courseiva

Google Professional Cloud Security Engineer (PCSE) — Questions 826900

960 questions total · 13pages · All types, answers revealed

Page 11

Page 12 of 13

Page 13
826
MCQmedium

A security engineer is reviewing the IAM policy of a Cloud Storage bucket that contains sensitive data. The exhibit shows the current policy. A developer reports that they can read objects in the bucket using service account sa-2, but they cannot delete objects. What is the most likely reason?

A.There is an explicit deny on the bucket for sa-2
B.The service account sa-2 has roles/storage.objectAdmin, which includes delete permissions, but there might be a condition or organization policy preventing deletion
C.The bucket has uniform bucket-level access disabled, so ACLs override IAM
D.The service account sa-2 actually has roles/storage.objectViewer, not objectAdmin
AnswerB

objectAdmin includes delete, so the issue is likely an additional constraint.

Why this answer

The IAM policy shows that service account sa-2 has the roles/storage.objectAdmin role, which includes the storage.objects.delete permission. However, the presence of a condition or an organization policy (such as a VPC Service Controls perimeter or a boolean constraint) can override this permission, preventing deletion even though the role is assigned. The developer can read objects (permitted by the role) but cannot delete them, indicating that a higher-level policy is blocking the delete action.

Exam trap

Google Cloud often tests the misconception that a role with delete permissions always allows deletion, ignoring that IAM conditions or organization policies can override the permission, leading candidates to incorrectly choose a role mismatch or ACL override.

How to eliminate wrong answers

Option A is wrong because there is no explicit deny statement in the IAM policy for sa-2; explicit denies are rare and would appear as a separate 'Deny' rule, not as a missing permission. Option C is wrong because uniform bucket-level access being disabled would allow ACLs to coexist with IAM, but ACLs cannot override IAM permissions for the same principal; if sa-2 has the objectAdmin role via IAM, ACLs cannot restrict that permission unless they explicitly deny (which is not shown). Option D is wrong because the exhibit clearly shows the role is roles/storage.objectAdmin, not objectViewer; the developer can read objects, which is consistent with objectAdmin, but the inability to delete points to a condition or org policy, not a role mismatch.

827
Multi-Selecthard

An incident responder needs to collect forensic evidence from a compromised Compute Engine instance for later analysis. They want to preserve disk state and network logs. Which THREE actions should they take?

Select 3 answers
A.Export and analyze VPC Flow Logs for the instance's network traffic.
B.Delete the instance to stop billing.
C.Create a snapshot of the boot disk.
D.Power off the instance to prevent further compromise.
E.Isolate the instance by applying a firewall rule that blocks all traffic except from a forensic workstation.
AnswersA, C, E

Provides network evidence.

Why this answer

Creating a disk snapshot captures the disk state including deleted files. Analyzing VPC Flow Logs can reveal network connections. Isolating the instance with a firewall rule prevents further damage.

Powering off the instance may alter evidence. Deleting the instance loses evidence. Cloning the instance may preserve some state but is not standard forensic practice.

828
MCQmedium

A company uses Cloud Functions and wants to ensure that only authorized services can invoke them. The functions are triggered via HTTP. What is the best way to achieve this?

A.Set a VPC connector and allow only internal traffic.
B.Use Cloud Endpoints with API keys and IAM.
C.Rely on the Cloud Functions URL being unguessable.
D.Use Firebase Authentication.
AnswerB

Cloud Endpoints provides robust authentication and authorization for HTTP triggers.

Why this answer

Cloud Endpoints can authenticate and authorize requests using API keys and IAM, providing fine-grained access control for HTTP-triggered Cloud Functions. Option A is not suitable because VPC connectors are for internal network access, not for authorization. Option C is insecure as URLs can be guessed or leaked.

Option D (Firebase Authentication) is designed for mobile client authentication, not for service-to-service authorization.

829
MCQmedium

A security engineer notices that a service account has been granted the 'roles/editor' role on a project. According to least privilege, what is the best course of action?

A.Create a custom role with only the necessary permissions and reassign it to the service account.
B.Remove the service account and create a new one with a custom role containing only required permissions.
C.Change the role to 'roles/viewer' to be more restrictive.
D.Keep the role but add an access boundary using VPC Service Controls.
AnswerA

Custom roles allow precise permission assignment, adhering to least privilege.

Why this answer

Creating a custom role with only the necessary permissions and reassigning it to the service adheres to the principle of least privilege, minimizing permissions while maintaining functionality. Option B is unnecessary as the existing service account can be reused with a custom role. Option C may be too restrictive and could break functionality.

Option D does not change permissions; VPC Service Controls restrict network access, not permissions.

830
Multi-Selecthard

A company uses Shared VPC with a host project and multiple service projects. The security team wants to enforce that only specific VMs in service project A (using IP range 10.0.1.0/24) can communicate with specific VMs in service project B (tagged as 'app-b') on TCP port 443, and all other inter-service-project traffic should be blocked. Additionally, VMs should still be accessible via IAP TCP forwarding (SSH) on TCP port 22. Which three firewall rules should be created in the host project? (Choose three.)

Select 3 answers
A.Priority 1000: Allow ingress from 10.0.1.0/24 to VMs with tag 'app-b' on TCP 443.
B.Priority 2000: Deny ingress from 0.0.0.0/0 to all VMs on all protocols.
C.Priority 1000: Allow ingress from IAP forwarding ranges to all VMs on all protocols.
D.Priority 1000: Allow egress from VMs in service project A to service project B's VMs on TCP 443.
E.Priority 900: Allow ingress from IAP forwarding ranges (35.235.240.0/20) to all VMs on TCP 22.
AnswersA, B, E

This allows the desired inter-service-project traffic on TCP 443.

Why this answer

It creates an ingress firewall rule in the host project that allows traffic from the specific IP range 10.0.1.0/24 (VMs in service project A) to VMs tagged 'app-b' in service project B on TCP port 443. In Shared VPC, all firewall rules are defined in the host project and apply to all service projects, so this rule enforces the required communication while the deny rule (Option B) blocks all other inter-service-project traffic. The IAP rule (Option E) is needed to allow SSH access via IAP TCP forwarding, which uses the source range 35.235.240.0/20 on TCP port 22.

Exam trap

Google Cloud often tests the misconception that egress rules are needed for inter-service-project communication, when in fact ingress rules on the destination VMs are sufficient, and that IAP rules must be scoped to only TCP 22, not all protocols.

831
MCQmedium

A DevOps team wants to allow a CI/CD pipeline to deploy to Compute Engine using a service account. What is the best practice for managing service account keys?

A.Use a service account key distributed to each developer.
B.Generate a key and store it in Cloud Secret Manager.
C.Use workload identity federation.
D.Use a service account key stored in the source code repository.
AnswerC

Federation avoids long-lived keys and is the recommended approach.

Why this answer

Workload identity federation is the best practice because it allows the CI/CD pipeline to impersonate a service account without managing or storing any long-lived service account keys. This eliminates the risk of key leakage and rotation overhead, as authentication is done via an external identity provider (e.g., GitHub Actions, GitLab CI) using OIDC tokens. Google Cloud's workload identity federation supports OIDC (OpenID Connect) and SAML 2.0, enabling secure, keyless access from external workloads.

Exam trap

Google Cloud often tests the misconception that storing a key in a secure vault like Cloud Secret Manager is the best practice, but the trap here is that any long-lived key (even if encrypted at rest) introduces management overhead and potential for exposure, whereas workload identity federation eliminates the key entirely.

How to eliminate wrong answers

Option A is wrong because distributing a service account key to each developer violates the principle of least privilege and creates a massive security risk — any compromised developer workstation could expose the key, leading to unauthorized access to Compute Engine. Option B is wrong because while Cloud Secret Manager securely stores secrets, using a service account key at all (even stored in Secret Manager) still requires managing a long-lived credential that must be rotated and can be leaked; workload identity federation avoids keys entirely. Option D is wrong because storing a service account key in the source code repository is a critical security anti-pattern — it exposes the key to anyone with repository access, including in CI/CD logs, and violates Google Cloud's security best practices.

832
Multi-Selecteasy

A company wants to encrypt data at rest in Cloud SQL. Which TWO methods are supported? (Choose TWO.)

Select 2 answers
A.Default encryption at rest with Google-managed keys
B.Cloud HSM hardware security module for encryption
C.Cloud Key Management Service (Cloud KMS) as a standalone encryption method
D.Client-side encryption before storing data in Cloud SQL
E.Customer-managed encryption keys (CMEK) using Cloud KMS
AnswersA, E

By default, Cloud SQL encrypts data at rest using Google-managed encryption keys.

Why this answer

Cloud SQL provides default encryption at rest using AES-256 with Google-managed keys, which are automatically generated and rotated by Google. This encryption is transparent to the user and requires no additional configuration, ensuring data is encrypted before being written to disk.

Exam trap

Google Cloud often tests the distinction between default encryption (Google-managed keys) and customer-managed encryption keys (CMEK) as the two supported methods, trapping candidates who think Cloud HSM or client-side encryption are built-in Cloud SQL features.

833
MCQhard

A company uses Cloud DLP to inspect BigQuery tables for sensitive data. They want to automatically de-identify the data as it is inserted into a new table using a DLP de-identification template. Which approach should they use?

A.Use Cloud Audit Logs to monitor insertions and manually run a DLP transformation.
B.Use Cloud DLP inspection job triggers to scan the table and send notifications.
C.Create a DLP de-identification template and apply it to the BigQuery table using a DLP job.
D.Use BigQuery column-level security with data masking rules.
AnswerC

A DLP de-identification job can read from the source table, apply the template, and write the de-identified data to a destination table.

Why this answer

Cloud DLP can be used to create a de-identification template and then apply it to data in BigQuery via a DLP job or by using the DLP API to transform data on the fly. However, to automatically de-identify data as it is inserted, a common pattern is to use Cloud Functions triggered by BigQuery streaming inserts or scheduled DLP jobs that transform the data and write to a new table.

834
MCQhard

During a security incident, a forensics team needs to capture a disk snapshot of a compromised Compute Engine instance for analysis. They want to ensure the snapshot is consistent and includes data in memory. Which step should be taken before taking the snapshot?

A.Take a snapshot while the instance is running; consistency is automatic
B.Enable VPC Flow Logs on the network
C.Stop the instance before taking the snapshot
D.Create an image from the disk first
AnswerC

Stopping the instance ensures the disk is in a consistent state; the snapshot will be crash-consistent. Memory is not captured.

Why this answer

For consistent snapshots of a running instance, you should first stop the instance (or at least freeze the filesystem). To capture memory, you would need to use a tool like LiME or dump the memory via a hypervisor; standard disk snapshots do not capture memory. However, the question asks about disk snapshot consistency; the best practice is to stop the instance.

835
MCQeasy

Your organization uses Cloud Armor to protect HTTP Load Balancers. You need to block all incoming requests from a specific geographic region (country code 'XY') while allowing all other traffic. What is the correct configuration?

A.Create a custom rule with expression 'origin.region_code == "XY"' and set action to deny(403)
B.Use Cloud IDS to detect and block requests from country XY
C.Configure a firewall rule in the VPC to deny ingress from IP ranges associated with country XY
D.Add a preconfigured OWASP rule set for geolocation blocking and enable it for country XY
AnswerA

This is the correct way to block traffic from a specific country using Cloud Armor's custom rules.

Why this answer

Cloud Armor supports geolocation blocking using custom rules with expressions. The correct approach is to create a security policy rule that matches on the origin country code and sets the action to deny. The precedence (priority) ensures the deny rule is evaluated before the default allow rule.

836
Multi-Selecthard

A company is designing a PCI DSS-compliant architecture on Google Cloud. They need to ensure that the cardholder data environment (CDE) is isolated from other environments and that all access to the CDE is logged. Which THREE controls should they implement? (Choose three.)

Select 3 answers
A.Separate VPC networks for the CDE and non-CDE environments.
B.Cloud NAT to allow outbound internet access from the CDE.
C.Cloud Armor WAF to protect web applications in the CDE.
D.Cloud Audit Logs for all services in the CDE.
E.VPC Service Controls to create a perimeter around the CDE.
AnswersA, D, E

Separate VPCs provide network-level isolation.

Why this answer

VPC Service Controls provide a security perimeter around the CDE, preventing data exfiltration. VPC networks provide network isolation. Cloud Audit Logs record all access to resources.

Cloud Armor is a WAF for inbound traffic. Cloud NAT provides outbound internet. Cloud KMS manages encryption keys.

837
Drag & Dropmedium

Drag and drop the steps to respond to a data breach involving a Cloud Storage bucket in the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4

Why this order

Incident response steps are: contain, investigate, notify, remediate, and review.

838
MCQeasy

A DevOps engineer wants to use Cloud Armor to block common web application attacks like SQL injection and cross-site scripting. Which feature should they enable?

A.Preconfigured rules (OWASP CRS)
B.Rate limiting
C.Custom rules with IP allow/deny
D.Adaptive Protection
AnswerA

The OWASP CRS includes rules for SQLi, XSS, etc.

Why this answer

Cloud Armor's preconfigured WAF rules include the OWASP ModSecurity Core Rule Set, which detects SQLi, XSS, and other attacks.

839
Multi-Selecthard

A financial services company is migrating to Google Cloud and needs to enforce strict security controls. They want to ensure that: 1) No service account keys are created. 2) All Compute Engine instances must be created with Shielded VM enabled. 3) Only users from the corporate domain (example.com) can be granted IAM roles. Which THREE Organization Policy constraints must be used? (Choose three.)

Select 3 answers
A.constraints/compute.requireOsLogin
B.constraints/iam.allowedPolicyMemberDomains
C.constraints/iam.disableServiceAccountKeyCreation
D.constraints/compute.requireShieldedVm
E.constraints/compute.restrictCloudArmorPolicies
AnswersB, C, D

This restricts which domains can be used in IAM policy members.

Why this answer

The three constraints are: constraints/iam.disableServiceAccountKeyCreation (prevents key creation), constraints/compute.requireShieldedVm (requires Shielded VM), and constraints/iam.allowedPolicyMemberDomains (restricts IAM members to specific domains). The other constraints are not relevant: constraints/compute.restrictCloudArmorPolicies is about Cloud Armor policies, and constraints/compute.requireOsLogin is about OS Login.

840
MCQmedium

An organization needs to store cryptographic keys that must be protected in a FIPS 140-2 Level 3 validated hardware security module (HSM). Which Google Cloud service should they use?

A.Secret Manager
B.Cloud KMS with software-backed keys
C.Cloud External Key Manager
D.Cloud HSM
AnswerD

Cloud HSM meets FIPS 140-2 Level 3.

Why this answer

Cloud HSM provides FIPS 140-2 Level 3 validated HSM for key material. Keys are generated and stored in the HSM.

841
MCQhard

A company must process credit card transactions on Google Cloud and achieve PCI DSS compliance. They want to minimize the scope of the cardholder data environment (CDE). Which architectural approach should they take?

A.Use separate VPCs for the CDE and non-CDE workloads, and connect them using VPC peering with firewall rules to restrict traffic.
B.Use a Shared VPC with a dedicated subnet for CDE resources and apply strict firewall rules.
C.Place all workloads in a single VPC and use Cloud Armor to protect the CDE.
D.Create a separate VPC for the CDE, and route traffic through a dedicated project with VPC Service Controls and Private Google Access.
AnswerD

A separate VPC isolates the CDE network. VPC Service Controls further protect data and reduce PCI scope.

Why this answer

Network segmentation is key to minimizing PCI DSS scope. A separate VPC for the CDE, combined with VPC Service Controls, isolates cardholder data.

842
Multi-Selectmedium

A company is using Security Command Center (SCC) Premium tier and wants to automatically remediate certain high-severity findings. Which two services can be used together to achieve this? (Choose two.)

Select 2 answers
A.Pub/Sub
B.Dataflow
C.Cloud Scheduler
D.Cloud IAM
E.Cloud Functions
AnswersA, E

SCC can export findings to Pub/Sub, which then triggers Cloud Functions.

Why this answer

SCC findings can be sent to Pub/Sub, which then triggers a Cloud Function (or Cloud Run) that performs automated remediation actions. Cloud Functions can be used for lightweight automation. Cloud Scheduler is for cron jobs, not event-driven.

Dataflow is for data processing. IAM is for access control.

843
MCQhard

A financial services company is migrating to Google Cloud and needs to meet SOX compliance. They have a production project containing a Cloud SQL instance with financial transactions. They must ensure that all database changes are logged, and logs are immutable for 7 years. They enabled Cloud Audit Logs for Cloud SQL and created a log sink to export Admin Activity logs to Cloud Storage. However, during a quarterly audit, the auditor cannot find logs for some SELECT queries that accessed sensitive columns. The company expected these SELECT queries to appear in audit logs because they enabled Data Access audit logs for Cloud SQL. You discover that the Data Access audit logs were enabled at the project level, but the log sink only exports Admin Activity logs. Additionally, auditors require that logs cannot be deleted before the retention period. What should you do?

A.Enable VPC Flow Logs and export them to Cloud Storage with a 7-year retention policy.
B.Export logs to BigQuery with table expiration of 7 years and use IAM to restrict deletion.
C.Enable Data Access audit logs at the Cloud SQL instance level and export them to a separate Cloud Storage bucket with a 7-year retention policy.
D.Modify the log sink to include Data Access audit logs and update the Cloud Storage bucket to have a 7-year retention policy and object holds.
AnswerD

This ensures all audit logs are exported and immutable for the required period.

Why this answer

The root cause is that the log sink is configured to export only Admin Activity logs, while the missing SELECT queries are Data Access audit logs. By modifying the log sink to include Data Access audit logs, those queries will be exported. Additionally, setting a 7-year retention policy and object holds on the Cloud Storage bucket ensures logs are immutable and cannot be deleted before the retention period ends, meeting SOX compliance requirements.

Exam trap

Google Cloud often tests the misconception that enabling audit logs at the resource level (e.g., Cloud SQL instance) is sufficient, when in fact the log sink export filter must be explicitly configured to include the desired log types, and immutability requires both retention policy and object holds on the storage destination.

How to eliminate wrong answers

Option A is wrong because VPC Flow Logs capture network traffic metadata, not database query logs, and they do not address the missing SELECT queries or the log sink configuration. Option B is wrong because exporting to BigQuery with table expiration does not provide immutable storage; BigQuery tables can be deleted or modified by authorized users, and the requirement is for immutable logs in Cloud Storage. Option C is wrong because enabling Data Access audit logs at the instance level is unnecessary (they are already enabled at the project level), and exporting to a separate bucket does not fix the core issue that the log sink is not exporting Data Access logs; also, object holds are not mentioned, which are needed for immutability.

844
MCQmedium

A security engineer needs to ensure that all compute instances are patched with the latest security updates. What is the recommended approach?

A.Use OS Config Management with patch compliance reporting.
B.Use a configuration management tool like Chef.
C.Use the VM Manager patch deployment feature.
D.Use Cloud Scheduler to run a script that patches instances.
AnswerC

VM Manager patch deployment is the correct, native Google Cloud service for automated OS patching across Compute Engine instances.

Why this answer

The VM Manager patch deployment feature is the recommended approach for automated patching of Compute Engine instances in Google Cloud. It provides a managed, scalable solution for applying OS updates and ensuring compliance.

845
MCQeasy

A company wants to ensure that all data stored in Cloud Storage buckets is encrypted at rest using a customer-managed key that is automatically rotated every 90 days. What should they do?

A.Create a Cloud KMS key ring and a key with rotation period set to 7776000s (90 days).
B.Use customer-supplied encryption keys (CSEK) and update them manually every 90 days.
C.Use default Google-managed encryption keys.
D.Use Cloud HSM to generate a key and implement a custom rotation script.
AnswerA

Cloud KMS supports automatic rotation of customer-managed keys.

Why this answer

Cloud KMS allows you to create a customer-managed encryption key (CMEK) with an automatic rotation period of 7776000 seconds (90 days). When you set the rotation period on a key, Cloud KMS automatically rotates the key material at the specified interval, ensuring that all data encrypted with that key is protected by a new key version without manual intervention. This satisfies the requirement for customer-managed keys with automatic rotation.

Exam trap

Google Cloud often tests the distinction between automatic rotation (Cloud KMS CMEK with rotation period) and manual rotation (CSEK or custom scripts), leading candidates to choose manual or HSM-based options that lack built-in automatic rotation.

How to eliminate wrong answers

Option B is wrong because customer-supplied encryption keys (CSEK) require you to provide the key with each API call and you must manage rotation manually; there is no automatic rotation mechanism in Cloud Storage for CSEK. Option C is wrong because default Google-managed encryption keys are not customer-managed and cannot be rotated on a custom schedule; they are managed entirely by Google. Option D is wrong because Cloud HSM generates keys but does not provide built-in automatic rotation; implementing a custom rotation script introduces operational complexity and risk, and is not the recommended or simplest approach for automatic key rotation.

846
Multi-Selectmedium

An organization wants to enforce that all Compute Engine instances have Confidential Computing enabled for sensitive workloads. Which TWO steps should be taken? (Choose 2)

Select 2 answers
A.Select machine series that support AMD Secure Encrypted Virtualization (SEV).
B.Create an organization policy constraint that requires Confidential Computing for Compute Engine instances.
C.Enable VPC Flow Logs for all subnets.
D.Use Cloud IDS to detect non-confidential instances.
E.Use a hierarchical firewall policy to block non-confidential instances.
AnswersA, B

Confidential Computing requires SEV-capable machine types.

Why this answer

To enforce Confidential Computing, use an organization policy constraint to require the feature. Additionally, instance templates can be configured with Confidential Computing, but the enforcement is via policy. Also, ensuring the VM images support SEV is important.

However, the key steps: 1) Set organization policy to require `compute.requireConfidentialComputing` (or similar) and 2) Use machine series that support Confidential Computing (e.g., N2D). But the question asks for two steps. The options: creating a constraint and using appropriate machine types.

847
MCQhard

A security engineer needs to implement a logging pipeline that sends real-time Cloud Audit Logs to a third-party SIEM. They must ensure that if the SIEM is unavailable, logs are not lost. Which approach should they use?

A.Create a log sink that writes to a Pub/Sub topic, and use a subscription with a dead letter topic.
B.Configure a Cloud Run service to pull logs from Cloud Logging API and forward to SIEM.
C.Export logs to Cloud Storage via a sink, and have the SIEM ingest from there.
D.Use a log sink to BigQuery and have the SIEM query BigQuery periodically.
AnswerA

This ensures real-time delivery with retry and dead letter handling to avoid data loss.

Why this answer

Using a Pub/Sub subscription with a dead letter topic allows messages to be retried and, if delivery fails persistently, moved to a dead letter topic for later reprocessing. This prevents data loss. Cloud Storage is not real-time; BigQuery is not for streaming to SIEM; Cloud Run without Pub/Sub would miss retries.

848
Multi-Selectmedium

You are a security engineer for a healthcare organization. You need to protect sensitive patient data stored in Cloud Storage. You want to ensure that data is encrypted at rest using a customer-managed key (CMEK) and that access to the key is logged. You also need to prevent data exfiltration by limiting which service accounts can decrypt data. Which TWO steps should you take? (Choose two.)

Select 2 answers
A.Configure a VPC Service Controls perimeter that includes the Cloud Storage bucket and the KMS key.
B.Use Cloud HSM to create and manage the encryption key, and disable Cloud Audit Logs for the HSM key.
C.Enable default encryption (Google-managed key) on the bucket and use Cloud Audit Logs to monitor access.
D.Use customer-supplied encryption keys (CSEK) and store the key in Cloud Key Management Service (KMS).
E.Create a Cloud KMS key ring and key, and configure the bucket to use CMEK with that key. Enable Cloud Audit Logs for the KMS key.
AnswersA, E

VPC Service Controls restrict data exfiltration by preventing access from outside the perimeter.

Why this answer

VPC Service Controls creates a security perimeter around the Cloud Storage bucket and the KMS key, preventing data exfiltration by blocking unauthorized service accounts from decrypting data outside the perimeter. Option E is correct because creating a Cloud KMS key ring and key, configuring the bucket to use CMEK, and enabling Cloud Audit Logs for the KMS key ensures encryption at rest with a customer-managed key and logs all access to the key, meeting both requirements.

Exam trap

Google Cloud often tests the distinction between CMEK and CSEK, where candidates mistakenly think CSEK can be stored in Cloud KMS for management, but CSEK is provided per request and not stored, while CMEK is fully managed in Cloud KMS with audit logging capabilities.

849
MCQmedium

An organization wants to run a penetration test on their Google Cloud environment to validate security controls. According to Google's Acceptable Use Policy, which of the following is true regarding penetration testing?

A.Denial of Service (DoS) testing is permitted as long as it targets only customer-owned IPs.
B.All penetration tests require prior approval from Google Cloud support.
C.Customers can conduct penetration testing without prior approval, but must avoid DoS attacks.
D.Penetration testing is only allowed on Compute Engine, not on managed services like Cloud SQL.
AnswerC

Google allows penetration testing without prior approval for most services, but DoS testing is prohibited.

Why this answer

Google's Acceptable Use Policy allows customers to conduct penetration testing on their own infrastructure without prior approval for most services, but they prohibit denial of service (DoS) testing. Tests must follow the policy guidelines. No prior approval is needed, but DoS testing is forbidden.

850
Multi-Selectmedium

A company needs to enforce that all data stored in Cloud Storage and BigQuery is encrypted with customer-managed keys (CMEK). Which TWO actions should they take? (Choose two.)

Select 2 answers
A.Enable Access Transparency logs.
B.Create a Cloud HSM key to ensure FIPS 140-2 Level 3 compliance.
C.Set the organization policy constraint 'constraints/gcp.cmeKRequired' for Cloud Storage and BigQuery.
D.Use Cloud DLP to inspect and classify data.
E.Create a Cloud KMS key ring and a symmetric encryption key.
AnswersC, E

This policy ensures resources are encrypted with CMEK.

Why this answer

To enforce CMEK, a CMEK key must be created in Cloud KMS and then configured on the resources (buckets, datasets). An organization policy can also be set to require CMEK for certain services. Creating a Cloud HSM key is a type of CMEK but is not specifically required.

851
MCQmedium

An organization uses Shared VPC with a host project and several service projects. A network administrator in a service project wants to create a firewall rule that allows traffic from a specific source CIDR to a Compute Engine instance in the service project. What is the correct way to achieve this?

A.Create the firewall rule in the service project targeting the instance's tags.
B.Create a firewall rule in the service project using the instance's service account.
C.Use VPC Flow Logs to generate a recommendation and apply it in the service project.
D.Request the host project administrator to create the firewall rule in the host project.
AnswerD

In Shared VPC, the host project owns the firewall rules for the shared VPC network.

Why this answer

In a Shared VPC architecture, firewall rules are a host-project-level resource. Service project administrators cannot create or manage firewall rules that apply to resources in the shared VPC network; only the host project administrator has the necessary permissions. Therefore, to allow traffic from a specific source CIDR to a Compute Engine instance in a service project, the host project administrator must create the firewall rule in the host project, targeting the instance's tags or service account.

Exam trap

Google Cloud often tests the misconception that service project administrators have full control over networking resources in a Shared VPC, when in fact firewall rules and other network-level configurations are exclusively managed in the host project.

How to eliminate wrong answers

Option A is wrong because firewall rules in a Shared VPC must be created in the host project, not the service project; the service project lacks the authority to create rules that apply to the shared VPC network. Option B is wrong because, while service accounts can be used in firewall rules, the rule itself must still be created in the host project, not the service project. Option C is wrong because VPC Flow Logs are used for monitoring and troubleshooting network traffic, not for generating or applying firewall rules; they cannot create or recommend firewall rules automatically.

852
MCQmedium

A DevOps team uses GitHub Actions to deploy infrastructure to Google Cloud. They want to avoid storing long-lived service account keys. Which approach should they use to authenticate from GitHub Actions to Google Cloud?

A.Grant the service account token creator role to the GitHub Actions runner.
B.Download a JSON service account key and store it as a GitHub secret.
C.Use Workload Identity Federation by configuring a workload identity pool and provider for GitHub.
D.Create a Compute Engine instance with a service account and run GitHub Actions from there.
AnswerC

Workload Identity Federation enables keyless authentication from GitHub Actions to GCP using OIDC tokens.

Why this answer

Workload Identity Federation allows GitHub Actions to exchange GitHub OIDC tokens for Google Cloud service account credentials. This eliminates the need for service account keys. The team must create a workload identity pool and provider in GCP, and configure GitHub Actions to use Google's action with 'workload_identity_provider'.

Granting the service account token creator role is not the correct method. Using a Compute Engine instance is not relevant for GitHub Actions.

853
MCQhard

An organization wants to enforce that all Compute Engine instances are created with a specific service account that has only the permissions defined by a custom role. Additionally, users must not be able to override this service account. Which two mechanisms should be combined?

A.Use Cloud Audit Logs to monitor and alert on non-compliant instances.
B.VPC Service Controls to restrict the service account usage.
C.An Organization Policy with constraint constraints/compute.setServiceAccount and an IAM deny policy to deny the iam.serviceAccounts.actAs permission on other service accounts.
D.Grant users only the Compute Instance Admin v1 role and remove the actAs permission.
AnswerC

This combination enforces the service account and prevents override.

Why this answer

It combines an Organization Policy constraint (`constraints/compute.setServiceAccount`) that prevents users from specifying a different service account when creating Compute Engine instances, with an IAM deny policy that blocks the `iam.serviceAccounts.actAs` permission on all other service accounts. Together, these enforce that only the designated service account can be used, and users cannot override it.

Exam trap

Google Cloud often tests the misconception that a single mechanism (like an organization policy or IAM role restriction) is sufficient, when in reality two complementary controls are needed to both restrict the service account selection and block the actAs permission on unauthorized accounts.

How to eliminate wrong answers

Option A is wrong because Cloud Audit Logs only provide monitoring and alerting after a non-compliant instance is created; they do not prevent the creation of instances with unauthorized service accounts. Option B is wrong because VPC Service Controls are designed to restrict data exfiltration and control access to Google Cloud APIs based on context (e.g., identity, network), not to enforce which service account is attached to Compute Engine instances. Option D is wrong because granting only the Compute Instance Admin v1 role and removing the `actAs` permission does not prevent users from specifying a different service account during instance creation; it only removes the ability to use service accounts that require `actAs`, but the user could still specify a service account they do not have `actAs` on, leading to a permission error rather than enforcement of a specific service account.

854
MCQmedium

An organization wants to allow users to access a web application running on Compute Engine via HTTPS. The application requires users to authenticate with their corporate credentials (SAML 2.0 IdP). Which Google Cloud service should be used?

A.Cloud NAT
B.Cloud Armor
C.Cloud Load Balancing with SSL certificates
D.Identity-Aware Proxy (IAP) with HTTPS
AnswerD

IAP provides authentication and access control for web apps.

Why this answer

Identity-Aware Proxy (IAP) with HTTPS provides authentication and authorization for web applications. It integrates with external SAML IdPs through Cloud Identity or G Suite. Cloud Load Balancing with SSL does not authenticate.

Cloud Armor is for security policies. Cloud NAT is for outbound traffic.

855
Drag & Dropmedium

Drag and drop the steps to configure a VPC Service Controls perimeter in the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4

Why this order

VPC Service Controls perimeters are configured by first setting up an access policy, defining access levels, creating the perimeter, adding ingress/egress rules, and finally enforcing and testing.

856
MCQmedium

A company operates a hybrid cloud environment with on-premises data centers and Google Cloud Platform. They store sensitive customer data in Cloud Storage buckets and use Data Loss Prevention (DLP) to scan for and inspect sensitive content. They have automated DLP inspection jobs that run periodically, but they want to automatically redact sensitive data (e.g., Social Security numbers) in any new object as soon as it is written to a specific bucket. The redacted version should replace the original object in the same bucket. Which of the following is the most effective and recommended approach?

A.Set up a Cloud Function triggered by Cloud Storage 'finalize' events. The function calls the DLP API to inspect the object, creates a redacted version, and deletes the original object, replacing it with the redacted data.
B.Enable a bucket retention policy and use DLP to scan objects and quarantine those with sensitive data by moving them to a different bucket.
C.Use Cloud Storage Object Change Notifications to alert a Compute Engine instance that runs a DLP job to modify the object in place.
D.Use VPC Service Controls to create a secure perimeter around the bucket and then run DLP scans on a schedule.
AnswerA

This is the standard serverless pattern for automatic redaction. Cloud Functions respond to new objects, DLP inspects and redacts, and the function rewrites the object with the redacted content.

Why this answer

Triggering a Cloud Function on object finalize events, running DLP inspection, and rewriting the object with redacted data is the recommended pattern. Option B is incorrect because DLP cannot modify objects in place; it produces a new artifact. Option C is about retention, not redaction.

Option D is about perimeter security and does not address redaction.

857
MCQmedium

A security team needs to automatically respond to high-severity vulnerability findings in Security Command Center. They want to trigger a Cloud Function that quarantines the affected VM. What is the recommended way to connect SCC findings to Cloud Functions?

A.Use Cloud Scheduler to poll SCC API every minute and invoke Cloud Function.
B.Configure Cloud Logging to capture SCC findings and create a log-based metric with an alert that triggers Cloud Function.
C.Create a SCC notification config that sends findings to a Pub/Sub topic, and set up a Cloud Function to subscribe to that topic.
D.Export SCC findings to BigQuery and set up a BigQuery scheduled query to trigger Cloud Function.
AnswerC

This is the real-time event-driven approach.

Why this answer

SCC can publish findings to a Pub/Sub topic via notification configs. Cloud Functions can subscribe to that topic and execute the remediation logic. This is the recommended event-driven architecture.

858
Multi-Selectmedium

A company processes healthcare data and has signed a BAA with Google Cloud. They need to implement controls for HIPAA compliance. Which THREE actions should they take? (Choose three.)

Select 3 answers
A.Provide security awareness training to all workforce members.
B.Enable Customer-Managed Encryption Keys (CMEK) for all services.
C.Use Cloud Armor to protect the web application from DDoS attacks.
D.Ensure all covered services have access logging enabled for PHI access.
E.Use Cloud DLP to classify and de-identify PHI in Cloud Storage and BigQuery.
AnswersA, D, E

Workforce training is a requirement under the HIPAA Security Rule.

Why this answer

HIPAA requires workforce training, access logging for covered services, and data classification to identify PHI. CMEK is optional; Cloud Armor is for web application security but not specifically required by HIPAA.

859
Multi-Selecthard

A global e-commerce company must comply with GDPR and CCPA. They use BigQuery to store customer data and need to ensure that when a user requests data deletion, all copies are deleted within 30 days. Additionally, they want to minimize storage costs. Which TWO actions should they take?

Select 2 answers
A.Use the DDL statement to drop the table after 30 days using a scheduled query.
B.Create a Cloud Function to export the data before deletion.
C.Set a table retention policy of 30 days using ALTER TABLE SET OPTIONS.
D.Set the Time Travel window to 7 days and the Fail-safe storage window to 23 days.
E.Use BigQuery continuous backups with a 30-day retention.
AnswersA, D

Scheduled query to drop table after 30 days ensures data deletion while minimizing costs.

Why this answer

Using a DDL statement (e.g., DROP TABLE) in a scheduled query allows you to delete the entire table after exactly 30 days, ensuring all data copies (including storage and any snapshots) are removed. This directly meets the GDPR/CCPA deletion requirement while minimizing storage costs by not retaining data beyond the mandated period.

Exam trap

Google Cloud often tests the misconception that BigQuery has a direct table retention policy (like ALTER TABLE SET OPTIONS) when in reality, retention is managed through time travel and fail-safe storage windows, not a table-level option.

860
MCQmedium

A company wants to enforce that all GKE clusters in their organization use Binary Authorization with a specific attestor. They have multiple projects and want to set this policy centrally. Which approach should they use?

A.Use the organization policy service to set a constraint that requires Binary Authorization enforcement across all projects.
B.Create a Binary Authorization policy in each project and use a script to apply it.
C.Create a shared VPC and enable Binary Authorization on the host project.
D.Use Deployment Manager to deploy Binary Authorization configuration to all projects.
AnswerA

Organization policies can enforce that Binary Authorization is enabled and configured.

Why this answer

Organization policies can enforce constraints at the organization, folder, or project level. The Binary Authorization policy can be set at the organization level using a constraint, but the specific attestor configuration is done via the Binary Authorization API per project. However, to enforce the use of Binary Authorization, you can use an organization policy constraint 'constraints/gcp.restrictBinaryAuthorizationPolicy'.

861
MCQmedium

A company wants to enforce that all new projects have a specific set of tags to track cost centers. Which Google Cloud feature should they use?

A.Configure a Cloud Function to delete projects without tags
B.Use IAM roles to restrict project creation to users who promise to add tags
C.Create an organization policy with a custom constraint to require tags
D.Use Cloud Asset Inventory to monitor tags
AnswerC

Custom constraints allow you to enforce policies like requiring specific tags on resources.

Why this answer

Organization policies can enforce constraints on resources. However, tags are not enforced by organization policies. Instead, you can use the Resource Manager with organization policies to require tags, but there is no built-in constraint for tags.

Alternatively, you can use a custom constraint to require tags. The simplest approach is to use the `constraints/resourcemanager.tags` constraint or a custom constraint. But the question is about enforcing tags; the Organization Policy Service is the tool to set constraints.

862
Multi-Selecthard

A company wants to enforce that all access to Cloud Storage buckets in a project is encrypted with Customer-Managed Encryption Keys (CMEK). The Security Engineer needs to configure the organization policy to meet this requirement. Which THREE steps should be taken? (Choose THREE.)

Select 3 answers
A.Create an organization policy with the constraint 'constraints/storage.requireCustomerManagedEncryption'.
B.Grant the 'cloudkms.cryptoKeyEncrypterDecrypter' role to the Cloud Storage service account.
C.Apply the organization policy at the folder level to cover all projects within that folder.
D.Disable the 'storage.objects.setIamPolicy' permission for all users except the key administrators.
E.Define a list of allowed Cloud KMS keys using the 'constraints/storage.allowedEncryptionKeys' list constraint.
AnswersA, C, E

This constraint enforces CMEK on Cloud Storage.

Why this answer

The `constraints/storage.requireCustomerManagedEncryption` organization policy constraint enforces that all Cloud Storage buckets in the project must use CMEK. When this constraint is applied, any attempt to create a bucket without specifying a CMEK key is denied, ensuring compliance with the encryption requirement.

Exam trap

Google Cloud often tests the distinction between organization policy constraints and IAM roles or permissions, so candidates may mistakenly select steps that involve granting roles or modifying IAM permissions instead of focusing solely on the policy constraint configuration.

863
Multi-Selectmedium

Which TWO are benefits of using Cloud Armor with a global external HTTPS Load Balancer?

Select 2 answers
A.Automatic content caching
B.Traffic management based on latency
C.Built-in load balancing
D.DDoS protection at the edge
E.Web Application Firewall (WAF) rules
AnswersD, E

Cloud Armor offers built-in DDoS protection using Google's global infrastructure.

Why this answer

Options D and E are correct. Cloud Armor provides DDoS protection at the edge and Web Application Firewall (WAF) rules to filter malicious traffic. Option A (automatic content caching) is a feature of Cloud CDN, not Cloud Armor.

Option B (traffic management based on latency) is handled by the load balancer or Cloud CDN, not Cloud Armor. Option C (built-in load balancing) is the function of the load balancer itself, not Cloud Armor.

864
MCQhard

An organization uses BigQuery with column-level security. They have a column containing social security numbers (SSNs) that should only be visible to users with the 'PII_Viewer' role. How should they configure this?

A.Encrypt the column with CMEK and give decrypt permission only to PII_Viewer.
B.Use authorized views to filter the column.
C.Use BigQuery row-level access policies.
D.Create a policy tag on the column and bind it to the role.
AnswerD

Policy tags implement column-level security in BigQuery.

Why this answer

BigQuery column-level security uses policy tags to restrict access to sensitive columns. By creating a policy tag on the SSN column and binding it to the 'PII_Viewer' role, only users with that role can see the data; others see NULL or are denied access. This is the native, recommended approach for column-level access control in BigQuery.

Exam trap

Google Cloud often tests the distinction between encryption (which protects data at rest but does not control access by role) and policy-based access controls (which enforce visibility at query time), leading candidates to mistakenly choose encryption options for column-level restrictions.

How to eliminate wrong answers

Option A is wrong because CMEK (Customer-Managed Encryption Keys) encrypts data at rest but does not provide column-level access control; decrypt permission applies to the entire table or dataset, not to specific columns or roles. Option B is wrong because authorized views can filter rows or columns, but they require creating a separate view and granting access to it, which is more complex and less granular than native column-level security; also, authorized views do not enforce role-based access on the base table. Option C is wrong because row-level access policies control which rows a user can see, not which columns; they cannot hide a specific column like SSN from unauthorized users.

865
Multi-Selectmedium

A company is implementing PCI DSS compliance on Google Cloud. They need to ensure that cardholder data is encrypted in transit and at rest. Which TWO encryption controls are required by PCI DSS?

Select 2 answers
A.Use TLS 1.2 or higher for all data in transit
B.Enable Cloud CDN
C.Use Cloud NAT
D.Enable VPC Flow Logs
E.Use CMEK for encryption of cardholder data at rest
AnswersA, E

PCI DSS requires strong transport encryption; TLS 1.2+ is the standard.

Why this answer

PCI DSS requires strong encryption for data in transit (TLS 1.2 or higher) and for data at rest (e.g., using encryption keys managed by the customer or Google). CMEK ensures customer-managed keys for data at rest.

866
Multi-Selectmedium

An organization wants to use Identity-Aware Proxy (IAP) to secure access to a web application running on Compute Engine. They need to ensure that only users with specific email domains can access the application, and also verify that requests are coming from IAP. Which two configurations are required? (Choose two.)

Select 2 answers
A.Configure Cloud Armor to block non-IAP traffic.
B.Create a firewall rule that allows traffic only from IAP's IP ranges.
C.Configure the backend application to validate IAP-signed headers (X-Goog-Authenticated-User-Email).
D.Assign the IAP-secured Web App User role to the users.
E.Create an organization policy to enforce IAP usage.
AnswersB, C

IAP uses specific IP ranges that must be allowed in the firewall.

Why this answer

To secure access with IAP, you must allow IAP's IP ranges in the firewall (option B) and configure the backend to validate IAP-signed headers (option C). The IAP role is also needed but the question focuses on the two specific configurations for IP and header validation.

867
MCQhard

A financial institution is deploying a PCI DSS-compliant cardholder data environment (CDE) on Google Cloud. They need to segment the CDE from other environments and restrict data egress from the CDE. Which two services should they use together? (Choose the best combination.)

A.VPCs and VPC Service Controls
B.Cloud VPN and VPC Service Controls
C.VPCs and Cloud NAT
D.VPC Service Controls and Cloud Armor
AnswerA

VPCs provide network isolation, and VPC Service Controls restrict data egress from the CDE, meeting PCI DSS segmentation requirements.

Why this answer

For PCI DSS network segmentation, VPCs provide network isolation, and VPC Service Controls enforce perimeter security by preventing data egress from the CDE to unauthorized destinations. Cloud NAT provides outbound internet access but does not restrict egress. Cloud Armor is a WAF for inbound traffic.

Cloud VPN connects on-premises but does not segment.

868
MCQeasy

Your company runs a production application on Google Kubernetes Engine (GKE) with a Regional cluster. The application uses a custom domain with TLS certificates that are stored as Kubernetes secrets and mounted into the ingress. The certificates expire every 90 days and are currently renewed manually by a DevOps engineer. Last week, the certificate expired, causing an outage until it was renewed. Management requires an automated solution to renew certificates before expiration. The team wants to minimize changes to the existing architecture and avoid additional costs. What should you do?

A.Configure Cloud Load Balancing with a Google-managed SSL certificate and update the DNS to point to the load balancer IP.
B.Deploy cert-manager on the GKE cluster and configure it with an Issuer or ClusterIssuer to automatically obtain and renew certificates from Let's Encrypt.
C.Set up Cloud DNS to automatically respond to ACME HTTP-01 challenges and configure the ingress to use certificates from a public CA.
D.Store the certificate and private key in Cloud Secret Manager and configure the ingress to reference the secrets via the Secret Manager CSI driver.
AnswerB

cert-manager fully automates certificate lifecycle and stores certificates as Kubernetes secrets, matching the existing architecture.

Why this answer

Cert-manager is a native Kubernetes add-on that automates the lifecycle of TLS certificates from public CAs like Let's Encrypt. It integrates directly with GKE Ingress and can handle ACME HTTP-01 or DNS-01 challenges without altering the existing architecture or incurring additional cloud costs, as it runs within the cluster.

Exam trap

Google Cloud often tests the distinction between certificate storage solutions (like Secret Manager) and automated renewal mechanisms (like cert-manager), leading candidates to choose a storage-only option that does not solve the renewal problem.

How to eliminate wrong answers

Option A is wrong because switching to a Google-managed SSL certificate requires changing the load balancer configuration and DNS records, which modifies the existing architecture and may incur additional costs for the load balancer. Option C is wrong because Cloud DNS alone cannot automatically respond to ACME HTTP-01 challenges; the challenge response must be served by the ingress controller, and this option does not provide an automated renewal mechanism. Option D is wrong because storing certificates in Cloud Secret Manager and using the CSI driver only centralizes secret storage but does not automate the renewal process; certificates would still need to be manually updated before expiry.

869
MCQmedium

A security engineer is reviewing an IAM policy for a Cloud Storage bucket. The engineer wants to ensure that the service account 'sa@project.iam.gserviceaccount.com' can only read objects. What is the current effective permission?

A.The service account has objectCreator access by default.
B.The service account has objectViewer access as assigned.
C.The service account has no access because the policy is incomplete.
D.The service account has objectAdmin access because it is not explicitly denied.
AnswerB

The policy explicitly grants objectViewer role to the service account.

Why this answer

The service account is assigned the objectViewer role, which grants read-only access to objects in the Cloud Storage bucket. Option A is incorrect because objectCreator access is not the default and is not assigned here. Option C is incorrect because the policy is not incomplete; the viewer role is explicitly assigned.

Option D is incorrect because objectAdmin access is not granted; the viewer role only allows read actions.

870
MCQmedium

A security engineer needs to ensure that sensitive columns in BigQuery are automatically masked for certain users. For example, the email column should show only the domain for users with a specific role. Which two services must be configured together?

A.Data Catalog and BigQuery Data Policy
B.Cloud IAM and VPC Service Controls
C.Secret Manager and Cloud Functions
D.Cloud DLP and Cloud KMS
AnswerA

Data Catalog creates taxonomies and policy tags; BigQuery Data Policy uses those tags to apply data masking rules.

Why this answer

BigQuery column-level security uses policy tags attached to columns, which are defined in Data Catalog taxonomies. To apply masking, you need to use BigQuery Data Policy (also known as data masking) which uses policy tags to define masking rules. Data Catalog provides the taxonomy for policy tags, while BigQuery Data Policy applies the actual masking.

IAM roles for masking are granted via the policy tags.

871
Multi-Selecteasy

A company needs to grant a service account the ability to manage Compute Engine instances (start, stop, create) in a specific set of projects. The administrator wants to follow the principle of least privilege. Which TWO steps should the administrator take? (Choose TWO.)

Select 2 answers
A.Grant the predefined roles/compute.viewer role to the service account at the folder level.
B.Use Cloud IAP to tunnel into Compute Engine instances to perform management tasks.
C.Use IAM Conditions to restrict the service account's access to only the required projects or resources.
D.Grant the predefined roles/compute.admin role to the service account at the organization level.
E.Create a custom IAM role with compute.instances.start, compute.instances.stop, and compute.instances.create permissions and assign it to the service account at the project level.
AnswersC, E

Correct: IAM Conditions can limit access to specific projects when granting roles at a higher level.

Why this answer

IAM Conditions allow the administrator to restrict the service account's permissions to a specific set of projects or resources, enforcing least privilege by limiting the scope of the granted role. This ensures the service account can only manage Compute Engine instances in the designated projects, not all projects in the folder or organization.

Exam trap

Google Cloud often tests the distinction between IAM Conditions and folder/organization-level roles, where candidates mistakenly choose broad roles like compute.admin at the organization level instead of using conditions or custom roles to scope permissions.

872
MCQmedium

A company runs a GKE cluster in a private cluster mode (no public endpoint) in a custom VPC. The cluster nodes are in a subnet that uses a secondary IP range for pods. The company needs the pods to access an on-premises service over a Cloud VPN connection that terminates in a different region. The on-premises service IP range is 10.100.0.0/16. The VPC has a route for 10.100.0.0/16 pointing to the VPN gateway. However, pods cannot reach the on-premises service. The GKE cluster is configured with a Cloud NAT for outbound internet access. The pod IP range is 10.200.0.0/16. Which step is required to allow pod traffic to reach the on-premises network?

A.Configure Cloud NAT to also translate pod IPs to the node IPs for on-premises traffic.
B.Add a static route in the VPC for the pod IP range (10.200.0.0/16) with next hop set to the VPN gateway.
C.Disable IP masquerade in the GKE cluster to use pod IPs directly.
D.Create a firewall rule allowing traffic from the pod IP range to the on-premises IP range.
AnswerB

Correct: this ensures traffic from pods to on-premises is routed via VPN.

Why this answer

The VPC has a route for the on-premises range (10.100.0.0/16) pointing to the VPN gateway, but the GKE cluster's pod IP range (10.200.0.0/16) is not part of the VPC's primary or secondary subnet ranges. By default, GKE pods use IP addresses from a secondary IP range that is not automatically advertised over Cloud VPN. Adding a static route in the VPC for 10.200.0.0/16 with next hop set to the VPN gateway ensures that traffic from pods to the on-premises network is forwarded through the VPN tunnel, allowing the on-premises routers to learn the pod subnet and route return traffic back.

Exam trap

Google Cloud often tests the misconception that firewall rules or NAT configuration are the primary solution for connectivity issues, when in fact the missing route for the pod IP range to the VPN gateway is the root cause.

How to eliminate wrong answers

Option A is wrong because Cloud NAT is used for outbound internet access and translates pod IPs to node IPs for internet-bound traffic, not for on-premises traffic over VPN; using NAT for VPN traffic would break return routing and is unnecessary. Option C is wrong because disabling IP masquerade would cause pod traffic to use pod IPs directly, but the core issue is the lack of a route for the pod IP range to the VPN gateway, not the masquerade behavior. Option D is wrong because firewall rules control which traffic is allowed, but the problem is that traffic is not being routed to the VPN gateway at all; a firewall rule alone cannot fix a missing route.

873
MCQmedium

A company wants to allow users from a specific on-premises IP range to access a service deployed on Google Cloud, but only if the user's device is compliant with corporate security policies (e.g., has antivirus enabled). Which combination of services can achieve this?

A.VPC Service Controls with an access level that includes IP and device conditions
B.Firewall rules with source ranges and service accounts
C.Cloud Armor with geo-based access control
D.Cloud IDS with threat detection
AnswerA

Access levels can be defined with IP ranges and device policy requirements using Context-Aware Access.

Why this answer

VPC Service Controls access levels can combine IP-based conditions with device-based conditions (e.g., using BeyondCorp Enterprise). This allows restricting access to a service perimeter based on both the user's IP and device compliance.

874
MCQmedium

A company wants to expose an internal web service running on a private GKE cluster to other services within the same VPC network using a private IP address. They do not want to use a public load balancer. Which Google Cloud service should they use?

A.Cloud NAT
B.Private Service Connect
C.Cloud VPN
D.Internal load balancer
AnswerD

An Internal load balancer exposes a service on a private IP within the same VPC, meeting the requirement.

Why this answer

To expose a GKE service within the same VPC using a private IP, an Internal load balancer (ILB) is the appropriate choice. It provides a private IP address accessible from within the VPC, without a public endpoint. Private Service Connect is designed for publishing services to other VPCs or on-premises, not for same-VPC exposure.

Exam trap

Candidates may confuse Private Service Connect (cross-VPC) with Internal load balancer (same VPC).

875
MCQmedium

A security operations team is using Cloud Audit Logs to investigate a suspicious data export from a Cloud Storage bucket. They need to see which user accessed a specific object and when. Which log type should they examine?

A.Data Access logs
B.Policy Denied logs
C.System Event logs
D.Admin Activity logs
AnswerA

Data Access logs record all operations that read, write, or delete data, so they are the correct log type for viewing object access details.

Why this answer

Data Access logs capture all operations that read, write, or delete data in Cloud Storage objects, including who accessed a specific object and when. Admin Activity logs record only configuration changes, not data access events.

876
MCQmedium

An administrator wants to enforce that a user can only create virtual machines in a specific subnet of a VPC network. What IAM condition should be added to the compute.instanceAdmin role binding?

A.resource.name == "projects/PROJECT_ID/regions/us-central1/subnetworks/SUBNET"
B.resource.name == "projects/PROJECT_ID/subnetworks/SUBNET"
C.api.getAttribute("compute.googleapis.com/zone", "") != "us-central1"
D.resource.subnetwork == "projects/PROJECT_ID/subnetworks/SUBNET"
AnswerA

This condition correctly restricts to the specific subnet by its full resource name.

Why this answer

The IAM condition `resource.name` with the full resource name of the subnet (including the region) is the proper way to restrict virtual machine creation to a specific subnet. The `compute.instanceAdmin` role binding with this condition ensures that the user can only create instances whose subnet matches the specified resource name, enforcing the subnet-level constraint.

Exam trap

Google Cloud often tests the distinction between the correct IAM condition attribute (`resource.name`) and incorrect ones like `resource.subnetwork` or zone-based attributes, exploiting the common misconception that subnet restrictions can be applied via zone or subnet name alone without the full hierarchical resource path.

How to eliminate wrong answers

Option B is wrong because the resource name format for a subnet must include the region (e.g., `regions/us-central1/subnetworks/SUBNET`), not just `subnetworks/SUBNET`; omitting the region makes the condition invalid or too broad. Option C is wrong because `api.getAttribute("compute.googleapis.com/zone", "")` checks the zone, not the subnet, and the condition `!= "us-central1"` would incorrectly block instances in that zone rather than restrict to a specific subnet. Option D is wrong because `resource.subnetwork` is not a valid IAM condition attribute for Compute Engine resources; the correct attribute is `resource.name` to match the full resource name of the subnet.

877
MCQmedium

A security engineer needs to ensure that all container images deployed to a GKE cluster are signed by a trusted authority. The organization uses Cloud KMS for key management and wants to enforce the policy at admission time. Which two components are essential to implement this requirement? (Choose two.)

A.Cloud Audit Logs enabled for GKE
B.Container Analysis vulnerability scanning
C.Attestor created in Binary Authorization with Cloud KMS key
D.Binary Authorization policy set to 'Require Attestation'
E.Web Security Scanner configured to scan the GKE cluster
AnswerC, D

Attestors are used to verify signatures; Cloud KMS keys provide cryptographic signing.

Why this answer

Binary Authorization requires attestors to verify image signatures and a policy that requires at least one attestation. Attestors use Cloud KMS keys for signing, and the policy is enforced at GKE admission time.

878
Drag & Dropmedium

Drag and drop the steps to configure a Cloud NAT for private VM instances in the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4

Why this order

Cloud NAT requires a Cloud Router, NAT gateway creation, subnet assignment, private VM configuration, and testing.

879
MCQhard

A company has a Kubernetes cluster on GKE that runs a microservice. The microservice needs to read from a Cloud Spanner database. The security team requires that the microservice uses the principle of least privilege and that credentials are never stored as Kubernetes secrets. What is the recommended configuration?

A.Use the Compute Engine default service account for the node pool.
B.Enable Workload Identity, create a Kubernetes service account, and annotate it to map to a Google Cloud service account with the necessary roles.
C.Create a Kubernetes secret containing a service account key and mount it into the pod.
D.Assign the required IAM roles to the GKE node's default service account and use it from the pod.
AnswerB

Follows best practices: keyless, least privilege.

Why this answer

Using Workload Identity, you bind a Kubernetes service account to a Google Cloud service account that has the necessary Spanner roles. The GKE node's metadata server provides the credentials, and the application uses the Kubernetes service account identity.

880
MCQmedium

A Dataflow job launched by service account 'my-sa@...' fails with permission denied. The audit log shows the above entry. What missing role is causing the failure?

A.roles/iam.workloadIdentityUser on the worker service account
B.roles/iam.serviceAccountUser on the worker service account
C.roles/iam.serviceAccountAdmin on the worker service account
D.roles/iam.serviceAccountTokenCreator on the worker service account
AnswerB

This role grants the actAs permission.

Why this answer

When a Dataflow job fails with permission denied and the audit log shows the entry, the missing role is typically roles/iam.serviceAccountUser on the worker service account. This role is required because the Dataflow service (or the service account launching the job) must be able to impersonate the worker service account to execute the pipeline's tasks. Without this role, the job cannot assume the identity of the worker service account, leading to the permission denied error.

Exam trap

Google Cloud often tests the distinction between roles that grant administrative control (serviceAccountAdmin) versus roles that grant impersonation (serviceAccountUser), and candidates mistakenly choose serviceAccountAdmin thinking it includes all permissions, but impersonation requires the specific actAs permission.

How to eliminate wrong answers

Option A is wrong because roles/iam.workloadIdentityUser is used for Kubernetes workloads to authenticate as a service account, not for Dataflow worker impersonation. Option C is wrong because roles/iam.serviceAccountAdmin grants administrative permissions to manage service accounts (e.g., create, delete, set policies), which is excessive and not required for impersonation. Option D is wrong because roles/iam.serviceAccountTokenCreator allows generating OAuth2 tokens for a service account, but Dataflow's impersonation mechanism uses the IAM serviceAccountUser role to delegate access, not token creation.

881
Multi-Selectmedium

An organization wants to implement a zero-trust network security model for their Google Cloud environment. Which TWO practices should they adopt? (Choose TWO.)

Select 2 answers
A.Implement VPC Service Controls to create perimeters around sensitive APIs.
B.Use service account targets for firewall rules instead of tags.
C.Enable Private Google Access for all subnets.
D.Use network tags to group VMs for firewall rules.
E.Allow all outbound traffic and rely on intrusion detection.
AnswersA, B

Restricts API access based on identity and context.

Why this answer

Using service account targets for firewall rules aligns with identity-based security (zero-trust). VPC Service Controls restrict access to APIs based on identity and context, reducing reliance on network perimeter.

882
MCQhard

Refer to the exhibit. You are analyzing the IAM policy for a project. You need to ensure that only authenticated users can access objects in bucket1 under the prefix "reports/". Which of the following statements is correct?

A.The condition on objectViewer also prevents alice from listing objects under reports/.
B.The service account sa-1 can view objects under reports/ in bucket1.
C.Bob can view, create, and delete any object in bucket1.
D.Alice can only view objects under reports/ in bucket1.
AnswerC

Bob has the objectAdmin role at the project level without conditions, granting him full control over all objects in bucket1.

Why this answer

The IAM policy grants Bob the roles/storage.objectAdmin role on the entire bucket1, which includes permissions to view, create, and delete any object in the bucket. The condition restricting access to the "reports/" prefix applies only to the objectViewer role, not to Bob's role. Therefore, Bob has full administrative access to all objects in bucket1 without any prefix restriction.

Exam trap

Google Cloud often tests the misconception that a condition applied to one role binding automatically restricts all other role bindings for the same principal, leading candidates to incorrectly assume that Bob's objectAdmin role is limited by the condition on Alice's objectViewer role.

How to eliminate wrong answers

Option A is wrong because the condition on objectViewer restricts access to objects under the "reports/" prefix, but it does not prevent listing objects; listing is controlled by the storage.objects.list permission, which is granted by the objectViewer role, and the condition only limits the object-level actions (like get) to the prefix, not the list action itself. Option B is wrong because the service account sa-1 is not mentioned in the IAM policy exhibit; without explicit binding, sa-1 has no access to bucket1 objects. Option D is wrong because Alice is assigned the objectViewer role with a condition that limits access to objects under "reports/", but the condition also applies to listing; however, the statement says she can "only view objects under reports/" — this is partially true but misleading because the condition also restricts listing to that prefix, and the option does not mention that she cannot list objects outside the prefix, making it incorrect as a complete statement.

883
MCQeasy

Your organization has a VPC with several subnets hosting Compute Engine instances. You need to allow SSH access (port 22) to instances in the 'management' subnet from the internet, but only from the office's static IP range (203.0.113.0/24). All other ingress traffic to that subnet should be blocked. Which firewall rule configuration should you create?

A.Create an ingress rule with target tag 'management', source IP range 0.0.0.0/0, protocol tcp:22, action allow
B.Create an ingress rule with target tag 'management', source IP range 203.0.113.0/24, protocol tcp:22, action deny
C.Create an ingress rule with target tag 'management', source IP range 203.0.113.0/24, protocol tcp:22, action allow
D.Create an ingress rule with target tag 'management', source IP range 203.0.113.0/24, protocol all, action allow
AnswerC

Correct: Targets the subnet's instances via tag, allows SSH only from office IP.

Why this answer

It creates an ingress firewall rule that explicitly allows TCP port 22 traffic from the office's static IP range (203.0.113.0/24) to instances tagged 'management'. In Google Cloud VPC firewall rules, the default action is to deny all ingress traffic unless an allow rule matches, so this single allow rule satisfies the requirement: only SSH from the office IP range is permitted, and all other ingress is implicitly blocked.

Exam trap

Google Cloud often tests the misconception that you need both an allow rule and a separate deny rule to block other traffic, but in Google Cloud VPC, the implicit deny all ingress rule already blocks everything not explicitly allowed, so only the allow rule is required.

How to eliminate wrong answers

Option A is wrong because it allows SSH from any source IP (0.0.0.0/0), which violates the requirement to restrict access only to the office's static IP range. Option B is wrong because it creates a deny rule for the allowed source IP range, which would block the very traffic that should be permitted; deny rules are evaluated after allow rules, but this rule would block the intended SSH access. Option D is wrong because it allows all protocols (not just TCP:22) from the office IP range, which would permit unnecessary traffic (e.g., HTTP, RDP) and violates the requirement to block all other ingress traffic to the management subnet.

884
MCQmedium

A healthcare organization is migrating to Google Cloud and needs to ensure that all data stored in Cloud Storage is encrypted at rest with customer-managed encryption keys (CMEK) to meet HIPAA requirements. The security team wants to centrally manage key rotation and access. Which solution should they implement?

A.Use Cloud Data Loss Prevention (DLP) to de-identify data before storing.
B.Use Cloud Hardware Security Module (Cloud HSM) with CMEK.
C.Use Cloud Key Management Service (Cloud KMS) with CMEK and enable key rotation.
D.Use customer-supplied encryption keys (CSEK) stored in Cloud Storage.
AnswerC

Cloud KMS provides centralized key management, rotation, and integrates with Cloud Storage for CMEK.

Why this answer

Cloud KMS with CMEK allows the organization to centrally manage encryption keys, including automated key rotation, while maintaining customer control over the keys used to encrypt Cloud Storage data. This meets HIPAA requirements for encryption at rest with customer-managed keys, as Cloud KMS integrates directly with Cloud Storage to enforce encryption using the specified key.

Exam trap

The trap here is that candidates may confuse Cloud HSM with Cloud KMS, thinking that HSM is required for HIPAA compliance, but Cloud KMS with CMEK alone satisfies the requirement for customer-managed keys and key rotation without the added cost and complexity of HSM.

How to eliminate wrong answers

Option A is wrong because Cloud DLP is used for de-identification and masking of sensitive data, not for managing encryption keys or providing encryption at rest with customer-managed keys. Option B is wrong because Cloud HSM is a hardware-based key management service that can be used with CMEK, but it is an additional service that provides FIPS 140-2 Level 3 compliance, not a requirement for HIPAA; the question asks for a solution to centrally manage key rotation and access, which Cloud KMS alone provides without the need for HSM. Option D is wrong because CSEK requires customers to supply their own encryption keys and manage them outside of Google Cloud, which does not provide centralized key rotation and access management within Google Cloud; CSEK keys are stored in Cloud Storage, which introduces security risks and operational overhead.

885
Multi-Selectmedium

A company wants to audit all changes to IAM policies in their organization. They need to set up logging to capture these changes. Which TWO steps should they take? (Choose TWO.)

Select 2 answers
A.Enable Admin Activity audit logs for each individual project.
B.Enable System Event audit logs for the organization.
C.Enable Data Access audit logs for the organization.
D.Enable Admin Activity audit logs for the organization.
E.Configure a log sink to export these logs to BigQuery for analysis.
AnswersD, E

Admin Activity logs record IAM policy changes.

Why this answer

Admin Activity audit logs record operations that modify the configuration or metadata of resources, such as IAM policy changes. Enabling Admin Activity audit logs at the organization level captures these changes across all projects within the organization, providing a centralized audit trail. This is the correct step because IAM policy modifications are classified as admin activity, not system events or data access.

Exam trap

Google Cloud often tests the distinction between audit log types, and the trap here is that candidates confuse System Event logs (which handle infrastructure events) with Admin Activity logs, or assume that enabling logs per project is equivalent to enabling them at the organization level.

886
MCQmedium

A security engineer wants to test a web application hosted on Compute Engine for vulnerabilities. According to Google Cloud's Acceptable Use Policy, which of the following is true regarding penetration testing?

A.Penetration testing is allowed only for customers with Enterprise support plans.
B.All penetration testing requires prior written approval from Google.
C.Penetration testing is allowed without prior approval, but Denial of Service (DoS) testing is prohibited.
D.Testing must be limited to non-production environments only.
AnswerC

As per Google Cloud's Acceptable Use Policy, penetration testing is allowed without prior approval, but DoS testing is not permitted.

Why this answer

Google Cloud does not require prior approval for penetration testing of most services, but Denial of Service (DoS) testing is explicitly prohibited.

887
Multi-Selecthard

Which THREE components are required to configure VPC Flow Logs for a Compute Engine instance?

Select 3 answers
A.Enable VPC Flow Logs on the subnet
B.The VM's service account must have the compute.instances.get permission
C.A log sink to export logs to BigQuery
D.A VM with a network interface in the subnet
E.A metadata server to store logs
AnswersA, B, D

Flow logs are enabled per subnet.

Why this answer

VPC Flow Logs capture network traffic metadata at the subnet level. Enabling flow logs on the subnet (A) is the primary configuration step that activates logging for all VM instances within that subnet. The VM's service account must have the compute.instances.get permission (B) to allow the flow log agent to retrieve instance metadata required for log entries.

A VM with a network interface in the subnet (D) is necessary because flow logs are generated per network interface; without a VM in the subnet, there is no traffic to log.

Exam trap

Google Cloud often tests the misconception that a log sink or external export destination is a required component for VPC Flow Logs, when in fact the logs are natively stored in Cloud Logging and exporting is optional.

888
Drag & Dropmedium

Drag and drop the steps to rotate a customer-managed encryption key (CMEK) in Cloud KMS in the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4

Why this order

Key rotation involves creating a new version, enabling rotation, updating resource associations, verifying, and retiring old keys.

889
Multi-Selecteasy

A security engineer is configuring Cloud Armor to protect a global external HTTP(S) Load Balancer. Which TWO of the following are valid Cloud Armor security policies? (Choose two.)

Select 2 answers
A.Web Security Scanner scan rule
B.Signed URL policy
C.Preconfigured Identity-Aware Proxy (IAP) rule
D.Preconfigured OWASP Top 10 rules
E.Custom rule with rate limiting based on IP
AnswersD, E

Cloud Armor includes predefined WAF rules for OWASP vulnerabilities.

Why this answer

Cloud Armor includes preconfigured rules that map directly to the OWASP Top 10 web application vulnerabilities, such as SQL injection and cross-site scripting (XSS). These rules are managed by Google and automatically updated to protect against the latest attack patterns, making them a valid security policy for a global external HTTP(S) Load Balancer.

Exam trap

Google Cloud often tests the distinction between Cloud Armor security policies and other Google Cloud security services (like IAP, Signed URLs, or Web Security Scanner), so the trap here is confusing access control or URL signing mechanisms with the WAF-like rule engine of Cloud Armor.

890
MCQmedium

Refer to the exhibit. A developer working from a workstation with IP 203.0.113.5 cannot SSH to a VM in the my-vpc network. Which firewall rule is most likely blocking the connection?

A.allow-ssh-from-bastion
B.deny-ssh-all
C.default-allow-http
D.default-allow-ssh
AnswerB

This rule denies SSH from all IPs with a higher priority, blocking all SSH traffic.

Why this answer

The deny-ssh-all rule has a priority of 200 (higher priority than the allow rules at 500 and 1000) and blocks SSH from all IPs. The order in GCP is based on priority (lower number = higher priority), so the deny overrides the allows. The allow-ssh-from-bastion only permits SSH from 10.0.1.2, not the developer's IP.

891
MCQeasy

A security team wants to monitor for compliance drift in an Assured Workloads folder that enforces FedRAMP High controls. Which Google Cloud service should they use to detect violations of organization policies?

A.Cloud Monitoring
B.Security Command Center
C.Access Transparency
D.Cloud Audit Logs
AnswerB

Security Command Center provides compliance monitoring and can detect violations of organization policies.

Why this answer

Security Command Center includes a compliance dashboard and can detect policy violations in Assured Workloads.

892
MCQhard

A large enterprise runs a streaming data pipeline using Dataflow to process events from Pub/Sub, apply aggregations with fixed windows, and write results to BigQuery. They are experiencing high costs and long processing times. The Dataflow job uses Streaming Engine, but the workers show high CPU utilization. The pipeline has autoscaling enabled, but the number of workers rarely increases. The team wants to reduce processing time and cost. What should they do?

A.Use a larger machine type for workers, such as n1-standard-8.
B.Increase the number of workers by setting maxNumWorkers higher.
C.Optimize the windowing interval to reduce data shuffling.
D.Switch from Streaming Engine to batch mode to reduce resource overhead.
AnswerC

Shorter windows or aligning windows with data patterns can reduce state size and shuffling, lowering CPU usage and improving throughput.

Why this answer

Optimizing the windowing interval reduces data shuffling and can improve performance without adding resources. Long windows cause more state to be kept, increasing CPU and memory demands. Option A is incorrect because increasing maxNumWorkers may help but the job is already CPU-bound and not scaling; more workers might not reduce CPU per worker if the issue is data shuffling.

Option B is incorrect because larger machines increase cost and may not address the root cause. Option D is incorrect because switching to batch would not meet real-time requirements and may cause data loss.

893
MCQhard

A company has a VPC network with a default route to the internet gateway. They want all egress traffic to go through a firewall appliance instead. They create a new route with a next hop to the appliance and a priority of 500. However, traffic is still going through the internet gateway. What is the most likely reason?

A.The new route has a higher tag specification that overrides
B.The new route's destination range is not 0.0.0.0/0
C.The appliance does not have IP forwarding enabled
D.The firewall appliance is in a different network
AnswerB

The default route covers all destinations; the new route must also be 0.0.0.0/0 with a higher priority to override.

Why this answer

The default route to the internet gateway has a destination of 0.0.0.0/0. For the new route to override it, the new route must also have a destination of 0.0.0.0/0 (or a more specific prefix). If the new route's destination range is not 0.0.0.0/0, it will not match all egress traffic, and the existing default route with a lower priority (higher numerical value) will still be used for traffic that does not match the new route's destination.

Exam trap

Google Cloud often tests the misconception that a lower priority number always overrides a higher priority number, but the trap here is that the route must also have the same destination prefix (0.0.0.0/0) to override the default route; otherwise, the default route remains active for all unmatched traffic.

How to eliminate wrong answers

Option A is wrong because route tags are used for route distribution and policy-based routing, not for overriding route priority in a VPC routing table; priority (or metric) is the sole determinant of route selection among routes with the same destination prefix. Option C is wrong because IP forwarding on the appliance is required for the appliance to forward traffic, but the question states traffic is still going through the internet gateway, meaning the route to the appliance is not being used at all—IP forwarding would only matter if the route were matched. Option D is wrong because a firewall appliance in a different network would be unreachable as a next hop, but the route would still be installed; the issue is that the route's destination range does not match the traffic, not that the next hop is in a different network.

894
MCQmedium

A company wants to use Cloud Armor Managed Protection Plus to protect their HTTP(S) load balancer from DDoS attacks. They need to automatically block traffic from IP addresses that exhibit anomalous behavior based on machine learning. Which Cloud Armor feature should they enable?

A.Custom rules with CEL
B.Pre-configured WAF rules
C.Rate limiting
D.Adaptive Protection
AnswerD

Adaptive Protection uses ML models to detect anomalous traffic and generate rules.

Why this answer

Adaptive Protection uses ML to detect anomalous traffic and suggests rules to block it. Managed Protection Plus includes adaptive protection.

895
MCQeasy

Which IAM role type is recommended for granting fine-grained permissions to Google Cloud services in production?

A.Basic roles (Owner, Editor, Viewer)
B.Custom roles
C.Primitive roles
D.Predefined roles
AnswerD

Predefined roles provide service-specific permissions and are the recommended default.

Why this answer

Predefined roles are curated by Google and provide granular permissions for specific services. They are designed for production use. Basic roles (Owner/Editor/Viewer) are broad and not recommended.

Custom roles can be used if predefined roles are insufficient, but predefined are preferred for simplicity and maintainability.

896
MCQmedium

A company wants to allow users to access an internal web application running on Compute Engine behind a load balancer without requiring a VPN. The solution must authenticate users and enforce access based on user identity and context (e.g., device security). Which Google Cloud service should they use?

A.Cloud NAT
B.Identity-Aware Proxy (IAP)
C.Cloud Armor
D.VPC Service Controls
AnswerB

Correct for identity and context-aware access.

Why this answer

Identity-Aware Proxy (IAP) provides zero-trust access control for web applications, authenticating users and enforcing context-aware access policies without requiring VPN. IAP sits in front of the load balancer and verifies identity and context before allowing access.

897
Multi-Selectmedium

A company must enforce that no data can be accessed from outside a specific set of Google Cloud projects. They want to ensure that only authorized services can communicate between projects. Which TWO controls should they implement? (Choose TWO.)

Select 2 answers
A.Access Context Manager
B.VPC Service Controls
C.Cloud Armor
D.Identity-Aware Proxy (IAP)
E.Cloud NAT
AnswersA, B

Access Context Manager defines and manages context-aware access policies that can be used with VPC Service Controls to enforce access based on context.

Why this answer

VPC Service Controls create a perimeter around resources, and Access Context Manager defines context-aware access policies based on attributes like IP range, device policy, etc.

898
MCQhard

During a security incident, the forensic team needs to capture the memory and disk state of a compromised Compute Engine VM without shutting it down. The VM is running a critical application and cannot be stopped. What is the best approach to gather forensic data?

A.Clone the VM and perform forensics on the clone while the original continues running.
B.Use gcloud compute ssh to connect and run a memory capture tool, then create a disk snapshot at the same time.
C.Take a snapshot of the disk while the VM is running, and use Cloud Memorystore to capture memory.
D.Stop the VM, take a snapshot of the disk, and then start the VM.
AnswerB

Memory can be acquired using tools like 'memory capture' via SSH; disk snapshot can be taken concurrently.

Why this answer

It allows both memory and disk acquisition without stopping the VM. Using gcloud compute ssh, the forensic team can connect to the VM and run a memory capture tool (e.g., LiME or fmem) to acquire the volatile memory contents. Simultaneously, creating a disk snapshot using gcloud compute disks snapshot captures the persistent disk state, which is crash-consistent but sufficient for forensic analysis.

This approach preserves the integrity of the evidence without interrupting the critical application. Option A (cloning) does not capture memory. Option C incorrectly suggests Cloud Memorystore for memory capture, which is not applicable.

Option D stops the VM, losing memory state.

899
MCQmedium

A company wants to allow employees to access a web application running on Google Kubernetes Engine (GKE) using their corporate Active Directory credentials. The application is exposed via an HTTPS load balancer. The Security Engineer needs to integrate identity federation and ensure that only authenticated users can reach the application. Which combination of services should be used?

A.Use Cloud Armor to allow only traffic from specific IP ranges and require client certificates.
B.Set up federation between Active Directory and Google Cloud using OIDC, and enable IAP on the load balancer.
C.Enable IAP and configure it to use Active Directory as an identity provider.
D.Configure Cloud Identity as the identity provider and use IAP.
AnswerB

IAP can authenticate users from an external OIDC provider.

Why this answer

It combines OIDC federation between Active Directory and Google Cloud with Identity-Aware Proxy (IAP) on the load balancer. IAP verifies user identity via OIDC tokens issued by the federated identity provider, ensuring only authenticated users can reach the application without exposing it to the public internet.

Exam trap

Google Cloud often tests the misconception that IAP can directly use any identity provider (like raw Active Directory) without an OIDC/SAML federation bridge, leading candidates to pick option C.

How to eliminate wrong answers

Option A is wrong because Cloud Armor with IP ranges and client certificates enforces network-level and mTLS access, not identity federation with Active Directory credentials; it cannot authenticate users based on corporate AD identities. Option C is wrong because IAP does not support Active Directory directly as an identity provider; it requires an OIDC-compatible identity provider, such as Azure AD or a custom OIDC provider, not raw AD. Option D is wrong because Cloud Identity is Google's own identity service, not Active Directory; while it can be used with IAP, it does not integrate with corporate AD credentials unless federation is set up, which is not mentioned in the option.

900
MCQmedium

A financial services company is required to retain audit logs for at least 7 years to comply with PCI-DSS. They have enabled Data Access audit logs for Cloud Audit Logs. However, after 6 months they notice that older logs are being automatically deleted. What is the most likely cause?

A.The default retention period for Cloud Audit Logs is 30 days, and logs are automatically deleted after that.
B.The log sink exporting to Cloud Storage has been deleted.
C.The log sink filter is incorrectly excluding certain log entries.
D.An IAM policy has revoked the Logs Viewer role for the security team.
AnswerA

Cloud Audit Logs have a default retention of 30 days (for Admin Read and Data Access) unless exported to a longer-term storage.

Why this answer

The default retention period for Cloud Audit Logs is 30 days. After this period, logs are automatically deleted unless a custom retention policy is configured or logs are exported to a long-term storage destination like Cloud Storage. Since the company enabled Data Access audit logs but did not adjust the retention setting, the logs older than 30 days are purged, explaining the 6-month observation.

Exam trap

Google Cloud often tests the misconception that log deletion is caused by misconfigured exports or IAM permissions, when in fact the default retention period for Cloud Audit Logs is the primary reason for automatic deletion, especially for Data Access audit logs.

How to eliminate wrong answers

Option B is wrong because deleting a log sink that exports to Cloud Storage would stop new logs from being exported, but it would not cause existing logs in Cloud Audit Logs to be automatically deleted; the default retention deletion is independent of sink configuration. Option C is wrong because an incorrectly excluding sink filter would affect which logs are exported, not the retention or deletion of logs already stored in Cloud Audit Logs. Option D is wrong because revoking the Logs Viewer role for the security team would prevent them from viewing logs, but it would not cause logs to be automatically deleted; deletion is governed by retention policies, not IAM permissions.

Page 11

Page 12 of 13

Page 13