Configuring Access and Security practice questions

Add the auditor's email as a member with the Storage Admin role on the project.

Why wrong: Storage Admin is too permissive; the auditor would have full control over all buckets, including deletion.

Use a signed URL for each object the auditor needs to see.

Why wrong: Signed URLs are for temporary access to specific objects, not suitable for ongoing read-only access to a set of buckets.

Add the auditor's email as a member with the Storage Object Viewer role on each individual bucket.

Why wrong: While functionally correct, managing bucket-level roles for many buckets is cumbersome and less scalable than using project-level roles with conditions.

Create a custom role and assign it to the instance's service account through the instance metadata.

Why wrong: Metadata cannot grant IAM roles; service account roles are assigned via IAM policies, not instance metadata.

Set the project-wide default service account to the custom service account in the project settings.

Why wrong: There is no project-wide default service account setting; each instance must specify its service account.

Create a startup script that configures the instance to use the custom service account after boot.

Why wrong: The service account must be attached at instance creation; it cannot be changed after boot via startup scripts.

The firewall rule has a priority lower than 65535.

Why wrong: Lower priority numbers mean higher priority. If the rule has a priority of 1000, it is evaluated before rules with higher numbers. The default priority is 1000, which is fine.

The instance is using a VPC with a custom subnet.

Why wrong: Custom subnets do not affect firewall rule applicability. Rules apply to instances based on tags, target service accounts, or entire network.

The firewall rule is denying outbound traffic.

Why wrong: Firewall rules are stateful; if inbound is allowed, outbound return traffic is automatically allowed. A deny outbound rule would not affect inbound connections.

Cloud Router only

Why wrong: A Cloud Router alone does not provide NAT; you must also configure a NAT gateway on the router.

Cloud VPN and Cloud NAT

Why wrong: Cloud VPN is not required for NAT; Cloud NAT works with Cloud Router for dynamic routing.

Cloud Interconnect and Cloud NAT

Why wrong: Cloud Interconnect is a dedicated connection to Google, not needed for standard NAT.

gcloud iam projects describe-iam-policy PROJECT_ID --format json

Why wrong: There is no gcloud iam projects describe-iam-policy command; the correct command is under gcloud projects.

gcloud projects add-iam-policy-binding PROJECT_ID --format json

Why wrong: add-iam-policy-binding adds a binding; it does not return the full policy.

gcloud projects set-iam-policy PROJECT_ID --format json

Why wrong: set-iam-policy is used to set the policy, not get it.

Download the service account key and store it on the instance's persistent disk.

Why wrong: Downloading keys is discouraged; keys can be compromised. The instance should use the attached service account.

Use gcloud auth activate-service-account on the instance with the service account email.

Why wrong: This command requires a key file to activate the service account. Without a key, it cannot activate the account.

Store the service account email in an instance metadata and use gcloud commands.

Why wrong: Just storing the email does not grant permissions; the instance must be created with the service account attached.

Cloud Key Management Service (Cloud KMS)

Why wrong: Cloud KMS is for managing encryption keys, not secrets like passwords.

Cloud IAM

Why wrong: Cloud IAM manages access control, not secret storage.

Cloud Storage

Why wrong: Cloud Storage is for object storage; while you could store secrets in buckets, it lacks versioning and fine-grained access control for secrets.

Configure Cloud NAT to enable access to Google APIs.

Why wrong: Cloud NAT is for outbound internet, not specifically for Google API access via internal IPs.

Set up Cloud VPN tunnels to Google APIs.

Why wrong: Cloud VPN is for connecting on-premises networks to VPC, not for internal API access.

Create a VPC peering connection with the Google APIs VPC.

Why wrong: No such peering exists; Private Google Access uses Google's internal infrastructure without peering.

System Event audit logs

Why wrong: System Event logs track GCP system actions, not user data access.

Access Transparency logs

Why wrong: Access Transparency logs are for Google's access to your data, not for user data access.

Admin Activity audit logs

Why wrong: Admin Activity logs track metadata changes, not data access.

Create a rule with source tag 'subnet-a-instances', allow tcp:443, and target tag 'https-server'.

Why wrong: Source tags are not supported in firewall rules; source must be specified as IP ranges.

Create a rule with source range 0.0.0.0/0, allow tcp:443, and target the specific instance.

Why wrong: This allows traffic from anywhere, not just subnet-a, violating the requirement.

Create a rule with source range 10.0.1.0/24, allow tcp:443, and apply to all instances in subnet-b.

Why wrong: This would allow traffic to all instances in subnet-b, not just the specific one.

gcloud compute target-https-proxies create --ssl-certificates

Why wrong: This creates a target HTTPS proxy that references existing certificates, but does not create them.

gcloud compute ssl-policies create

Why wrong: ssl-policies are for configuring SSL/TLS settings, not for creating certificates.

gcloud compute ssl-certificates create --certificate example.crt --private-key example.key

Why wrong: This creates a self-managed certificate using uploaded files, not Google-managed.

gcloud iam service-accounts create and gcloud iam service-accounts add-iam-policy-binding

Why wrong: add-iam-policy-binding on the service account grants roles on the service account itself, not on the project.

gcloud projects add-iam-policy-binding only

Why wrong: This assumes the service account already exists; the question implies creating a new one.

gcloud iam service-accounts create and gcloud iam roles create

Why wrong: gcloud iam roles create is for creating custom roles, not granting existing roles.

Grant the roles/storage.admin role at the bucket level.

Why wrong: Storage.admin is too permissive; Storage Object Viewer is appropriate for read-only access.

Grant the roles/storage.objectViewer role at the project level to the service account.

Why wrong: Project-level grant would allow access to all buckets.

Use the default Compute Engine service account.

Why wrong: The default service account likely has broader permissions or requires modification.

Create a Cloud Router to advertise routes to Google.

Why wrong: Cloud Router is not needed for Private Google Access.

Configure Cloud NAT to route traffic to Google APIs.

Why wrong: Cloud NAT is for internet access, not for Private Google Access.

Use gcloud projects set-iam-policy with a policy file that includes the binding.

Why wrong: While it can work, it replaces the entire policy, making it not ideal for granting only; add-iam-policy-binding is preferred.

Use gcloud iam roles create to assign the role to the service account.

Why wrong: This creates a custom role, it does not grant it.

Use gcloud iam service-accounts add-iam-policy-binding.

Why wrong: This grants roles on the service account as a resource, not on the bucket.

roles/iam.serviceAccountDeleter

Why wrong: This is not a predefined role.

roles/iam.serviceAccountCreator

Why wrong: This is not a predefined role.

roles/iam.serviceAccountUser

Why wrong: This role allows using existing service accounts, not creating them.

gcloud compute firewall-rules create allow-http --allow tcp:80 --source-tags web-server --target-ranges 0.0.0.0/0

Why wrong: Uses incorrect flags; source-tags and target-ranges are not appropriate here.

gcloud compute firewall-rules create allow-http --allow tcp:80 --source-ranges 0.0.0.0/0 --target-tags default

Why wrong: Targets the 'default' tag, not 'web-server'.

gcloud compute firewall-rules create allow-http --allow http --source-ranges 0.0.0.0/0 --target-tags web-server

Why wrong: The --allow flag should specify tcp:80, not just 'http'.

Configure VPC Flow Logs on the VPC network

Why wrong: VPC Flow Logs capture network traffic metadata, not object access.

Set up Cloud Monitoring alerts on the bucket

Why wrong: Monitoring alerts do not produce audit logs.

Enable Admin Activity audit logs for Cloud Storage in the project

Why wrong: Admin Activity logs record configuration changes, not data access.

Create a service account and assign it to the instance using gcloud compute instances set-service-account after creation

Why wrong: The instance must be stopped to change its service account, and this is not the initial creation approach.

Use the default compute engine service account and grant it roles/storage.objectAdmin

Why wrong: The default service account has broad permissions; best practice is to create a custom one with minimal permissions.

Create a service account, download a JSON key, and store it on the instance's local disk

Why wrong: Downloading keys is discouraged; use instance metadata.

Grant roles/owner at the folder level

Why wrong: Too broad; owner grants full control over all resources.

Grant roles/compute.admin at the project level for each project

Why wrong: Too broad (includes all compute permissions) and requires multiple grants.

Grant roles/compute.networkAdmin at the folder level

Why wrong: This role does not include permissions to create firewall rules.