CCNA Ace Access Security Questions

Cloud NAT only applies to instances that do not have external IP addresses. If an instance has an external IP, it will use that IP for outbound traffic and bypass Cloud NAT.

The auditors need the roles/logging.viewer to view logs, and they should be granted access at the project level for the logs to be visible.

The default VPC includes default firewall rules that allow ingress from the internet and allow all internal traffic. To restrict communication, the engineer must first delete the default ingress rule that allows all traffic from the internet (allow-ssh, allow-icmp, allow-rdp, and allow-http/https can be deleted), then create a new rule that allows ingress only from the VPC's IP range on port 443. The default internal rule allows all traffic within the network; to restrict to port 443, a new rule with higher priority can override it, or the default rule can be deleted and a new one created.

Google-managed certificates automatically provision and renew SSL/TLS certificates, reducing manual effort and preventing expiration issues.

The roles/iam.serviceAccountUser role allows impersonation, and the roles/iam.serviceAccountAdmin role allows creating service accounts.

First, you create the service account with `gcloud iam service-accounts create`. Then, you grant a role to the service account by adding an IAM policy binding to the project.

The role 'secretmanager.secretAccessor' grants access to read secret versions.

To use CMEK on a bucket, the '--default-encryption-key' flag is used during 'gsutil mb' or 'gcloud storage buckets create'. The key must be specified as the resource name.

Firewall rules are evaluated in order of priority; lower numbers have higher priority. The deny rule (priority 500) has higher priority than the allow rule (priority 1000), so traffic from 10.0.0.1 (within 10.0.0.0/24) will be denied.

Data Access audit logs must be enabled at the organization or project level using IAM audit config, and can be scoped to specific services like Cloud Storage.

Using an organization policy with a constraint on `compute.requireOsLogin` is unrelated. The best approach is to use a custom IAM role that includes the `compute.instances.create` permission with a condition requiring the service account, or use an organization policy with the `constraints/compute.setServiceAccount` constraint to enforce that instances use a specific service account.

The 'gcloud projects get-iam-policy' command retrieves the IAM policy for a project. The '--format json' flag outputs it in JSON. The other options are for other resources or wrong scope.

When rotating a CMEK for Cloud SQL, the instance must be restarted to use the new key version. Data remains encrypted at all times.

The roles/secretmanager.admin role grants full control, including creating secrets. roles/secretmanager.secretCreator does not exist; the admin role includes create permission.

Private Google Access on a subnet allows VMs with only internal IP addresses to reach Google APIs and services through the default internet gateway.

Firewall rules are evaluated in order of priority (lower number = higher priority). Rule B with priority 500 will be evaluated first and denies the traffic, so Rule A is not applied.

Cloud NAT allows instances without external IP addresses to access the internet for outbound connections, while preventing inbound connections from the internet.

To restrict an instance to a specific bucket, create a custom service account with the Storage Object Viewer role only on that bucket (via IAM binding on the bucket), then attach that service account to the instance. Granting role at project level is too broad. Using the default service account gives broader permissions.

The most secure approach is to grant the secretmanager.secretAccessor role to the compute engine service account. This avoids downloading keys or hardcoding secrets. The role provides access to secrets without granting broader permissions.

The roles/iam.serviceAccountAdmin role grants permissions to create, update, and manage service accounts, but not delete them. roles/iam.serviceAccountUser allows using service accounts but not creating them. roles/iam.serviceAccountCreator is not a predefined role. roles/iam.serviceAccountDeleter does not exist.

Google-managed certificates are created with 'gcloud compute ssl-certificates create' with the '--domains' flag. The other commands are for different purposes.

The best practice is to attach the service account to the Compute Engine instance at creation time using the --service-account flag. This allows the instance to automatically obtain credentials via the metadata server, avoiding the need to download and manage a service account key file. Downloading keys should be avoided due to security risks.