Scenario practice questions

A company has deployed an internal HTTP Load Balancer (ILB) in us-west1 within a Shared VPC. The host project contains the ILB's forwarding rule and the backend service. The backend instances are Compute Engine VMs running in a service project in us-east1. The health checks for the ILB are consistently failing with 'unhealthy' status. The firewall rules in the host project allow ingress from the Google Cloud health checker ranges (130.211.0.0/22 and 35.191.0.0/16) on TCP port 80 to all VMs in the VPC. The backend VMs are running a web server listening on port 80. What is the most likely cause of the health check failures?

Trap 1: The health checker firewall rule is not applied to the service…

Firewall rules in the host project apply to all VMs in the VPC, including those in service projects.

Trap 2: The backend VMs are not in the same project as the ILB.

Shared VPC allows backend VMs in different service projects; this is not an issue.

Trap 3: The backend VMs do not have the correct IAM permissions for the ILB.

IAM permissions are not required for backends to respond to health checks.

A
The ILB's forwarding rule and backends are in different regions.
ILB requires backends to be in the same region as the forwarding rule; otherwise health checks fail.
B
The health checker firewall rule is not applied to the service project.
Why wrong: Firewall rules in the host project apply to all VMs in the VPC, including those in service projects.
C
The backend VMs are not in the same project as the ILB.
Why wrong: Shared VPC allows backend VMs in different service projects; this is not an issue.
D
The backend VMs do not have the correct IAM permissions for the ILB.
Why wrong: IAM permissions are not required for backends to respond to health checks.

Question 2mediummultiple choice

A security engineer needs to block traffic to a set of VMs from specific IP addresses and also apply rate limiting for HTTP traffic. The VMs are behind a global external HTTPS load balancer. Which service should they use?

Trap 1: Cloud IDS

Cloud IDS detects threats but does not block traffic or rate limit.

Trap 2: VPC firewall rules

Firewall rules cannot provide rate limiting at the application layer.

Trap 3: Network firewall policies

Network firewall policies are similar to VPC firewall rules and don't support rate limiting.

A
Cloud IDS
Why wrong: Cloud IDS detects threats but does not block traffic or rate limit.
B
Cloud Armor
Cloud Armor provides IP blocking and rate limiting for HTTP(S) load balancers.
C
VPC firewall rules
Why wrong: Firewall rules cannot provide rate limiting at the application layer.
D
Network firewall policies
Why wrong: Network firewall policies are similar to VPC firewall rules and don't support rate limiting.

Question 3easymultiple choice

An organization needs to grant a contractor access to a specific project for 30 days, with the ability to start and stop Compute Engine instances but not delete them. Which IAM role should be used?

Trap 1: Compute Viewer (roles/compute.viewer)

This role is read-only and does not allow starting or stopping instances.

Trap 2: Compute OS Login (roles/compute.osLogin)

This role allows SSH access but not starting/stopping instances.

Trap 3: Compute Admin (roles/compute.admin)

This role allows full control, including deletion, which is not desired.

A
Compute Viewer (roles/compute.viewer)
Why wrong: This role is read-only and does not allow starting or stopping instances.
B
Compute OS Login (roles/compute.osLogin)
Why wrong: This role allows SSH access but not starting/stopping instances.
C
Compute Admin (roles/compute.admin)
Why wrong: This role allows full control, including deletion, which is not desired.
D
Compute Instance Admin (v1) (roles/compute.instanceAdmin.v1)
This role allows starting/stopping instances but not deleting them.

Question 4mediummultiple choice

Refer to the exhibit. A security engineer runs the gcloud command to analyze IAM policy for a user in an organization. The output shows that the user has the 'compute.instances.create' permission via a role at the organization level. However, the user is unable to create Compute Engine instances in a specific project. What is the most likely cause?

Network Topology

Trap 1: The user does not have the 'compute.instances.create' permission at…

The command shows the permission is granted at the organization level, which should be inherited.

Trap 2: The user has the permission but through a different role than…

The permission is present regardless of role.

Trap 3: The user's role is not granted at the project level.

Organization-level roles are inherited by all projects.

A
The user does not have the 'compute.instances.create' permission at the project level.
Why wrong: The command shows the permission is granted at the organization level, which should be inherited.
B
The user has the permission but through a different role than expected.
Why wrong: The permission is present regardless of role.
C
An organization policy constraint is denying the creation of Compute Engine instances.
Organization policies can deny actions even if IAM allows them.
D
The user's role is not granted at the project level.
Why wrong: Organization-level roles are inherited by all projects.

Question 5hardmulti select

A security engineer needs to restrict outbound traffic from a VPC to only allow specific external IP ranges. Which three components must be configured? (Choose three.)

Trap 1: Private Google Access

Allows access to Google APIs privately, not for general external IPs.

Trap 2: Firewall rules on the instance OS

Instance-level firewall rules are not managed by GCP and are outside the scope of VPC network configuration.

A
Cloud NAT
Required for private instances to reach the internet.
B
Private Google Access
Why wrong: Allows access to Google APIs privately, not for general external IPs.
C
Routes with next hop to a firewall instance
Forces traffic through a firewall for inspection and filtering.
D
Firewall rules on the instance OS
Why wrong: Instance-level firewall rules are not managed by GCP and are outside the scope of VPC network configuration.
E
VPC firewall rules (egress)
Egress rules control what destinations instances can reach.

Question 6mediummultiple choice

A company uses Cloud Storage buckets to store sensitive data. They want to allow a third-party auditor to list bucket contents but not download the objects. Which IAM role should be assigned?

Trap 1: roles/storage.objectAdmin

Grants full object management, including downloading.

Trap 2: roles/storage.objectViewer

Includes storage.objects.get, which allows downloading objects.

Trap 3: roles/storage.objectCreator

Only allows creating objects, not listing.

A
roles/storage.legacyBucketReader
Allows listing bucket contents without downloading objects.
B
roles/storage.objectAdmin
Why wrong: Grants full object management, including downloading.
C
roles/storage.objectViewer
Why wrong: Includes storage.objects.get, which allows downloading objects.
D
roles/storage.objectCreator
Why wrong: Only allows creating objects, not listing.

Question 7easymultiple choice

Your company runs a data analytics platform on Google Cloud that processes sensitive financial data. Data is ingested from various sources into a Cloud Storage bucket, then processed by Dataflow jobs, and final results are stored in BigQuery. You have implemented the following security controls: - VPC Service Controls perimeter around the project - Cloud KMS CMEK for all storage services - IAM conditions restricting access based on tags - Cloud Audit Logs enabled for all services

Recently, an auditor discovered that a compromised service account was able to read data from the Cloud Storage bucket even though it was outside the VPC Service Controls perimeter. The auditor reviewed the logs and found that the access came from a Compute Engine instance that was running within the same project. What is the most likely reason the VPC Service Controls perimeter did not block this access?

Trap 1: The Cloud KMS key used for encryption was not bound to the…

CMEK does not affect VPC Service Controls enforcement; it is about encryption, not access control.

Trap 2: The Cloud Audit Logs were not enabled for the Cloud Storage bucket,…

The auditor reviewed logs, so logging was enabled.

Trap 3: The VPC Service Controls perimeter was not configured to include…

If the bucket is within the perimeter, access from outside is blocked; however, the instance is inside the project, so it might still be allowed.

A
The VPC Service Controls perimeter allows access from resources within the same project, even if they are outside the perimeter.
VPC Service Controls only block access from outside the perimeter; resources within the same project are considered inside and allowed by default.
B
The Cloud KMS key used for encryption was not bound to the perimeter.
Why wrong: CMEK does not affect VPC Service Controls enforcement; it is about encryption, not access control.
C
The Cloud Audit Logs were not enabled for the Cloud Storage bucket, so the access was not logged.
Why wrong: The auditor reviewed logs, so logging was enabled.
D
The VPC Service Controls perimeter was not configured to include the Cloud Storage bucket.
Why wrong: If the bucket is within the perimeter, access from outside is blocked; however, the instance is inside the project, so it might still be allowed.