Hard Difficulty Questions

Use a single subnet for all tiers. Assign public IPs to all instances. Use firewall rules to restrict access between tiers. Use a proxy VM for outbound internet from app/db tiers.

Why wrong: Assigning public IPs to app/db is insecure, and a proxy VM adds complexity.

Create separate VPCs for each tier. Use VPC peering to connect them. Use firewall rules to allow traffic. Use a bastion host for SSH access to app/db tiers.

Why wrong: Multiple VPCs increase complexity and management overhead.

Place all tiers in the same VPC. Use firewall rules to restrict access. Assign public IPs to web tier instances and private IPs to app/db tiers. Configure Cloud NAT for app/db tiers.

Why wrong: Assigning public IPs to web tier is correct, but app/db tiers should not have public IPs; Cloud NAT is for outbound, not inbound.

Lifecycle rules with a Delete action.

Why wrong: Lifecycle rules delete objects, not prevent deletion.

Object versioning.

Why wrong: Versioning keeps multiple versions but does not prevent deletion.

Create a service account and use Workload Identity Federation to impersonate it.

Why wrong: Workload Identity Federation is for external identities, not needed for Compute Engine.

Use Cloud Key Management Service to generate and rotate keys for the service account.

Why wrong: This still requires a long-lived key.

Create a service account key and store it in Cloud Secret Manager.

Why wrong: Service account keys are long-lived and violate the requirement.

Create a Cloud Function to export the data before deletion.

Why wrong: Export is not required and would keep data longer.

Set a table retention policy of 30 days using ALTER TABLE SET OPTIONS.

Why wrong: Retention policy prevents deletion before expiration, not enforce deletion.

Use BigQuery continuous backups with a 30-day retention.

Why wrong: Continuous backups would increase storage costs unnecessarily.

Alice does not have the 'storage.objects.get' permission required to view objects.

Why wrong: The role roles/storage.objectViewer includes that permission.

The command removed Alice's existing access because it replaced all bindings.

Why wrong: The command adds a binding; it does not replace existing ones.

The command failed to apply because the service account does not have permission to modify IAM policies.

Why wrong: The command succeeded; the issue is temporal.

Cloud VPN with dynamic routing

Why wrong: Cloud VPN uses the public internet and adds latency.

Private Service Connect

Why wrong: Used for accessing Google APIs privately, not for inter-region Pod communication.

VPC Flow Logs

Why wrong: Used for monitoring network flows, not connectivity.

Remove the default allow egress rule that allows all outbound traffic

Why wrong: Removing the default egress rule would block all outbound traffic, which could break other communications. The specific egress rule will take precedence due to higher priority if needed, but actually the default egress rule allows all, and our specific rule allows additional traffic; it doesn't conflict. We don't need to remove it.

Create a VPC firewall rule to deny all egress traffic from the VPC

Why wrong: This would block all outbound traffic, including necessary communications. The default allow egress rule can remain; we just need to ensure specific allow rules for the required traffic.

The plaintext field is not present in the log because the service does not log it.

Why wrong: The field is present but redacted.

The plaintext field contains the base64-encoded ciphertext, and the engineer needs to decode it.

Why wrong: The field is not ciphertext; it is labeled plaintext and is redacted.

The plaintext field contains the actual decrypted data in plaintext, and the engineer should restrict access to the logs.

Why wrong: The field shows 'REDACTED', not actual plaintext.

Configure VPC Service Controls to restrict access to the Cloud SQL instance.

Why wrong: VPC Service Controls prevent unauthorized access but do not log all access attempts.

Use Cloud DLP to de-identify the data before storing it in Cloud SQL.

Why wrong: De-identification reduces risk but does not fulfill audit logging requirements.

Store the CMEK keys in Cloud HSM to meet FIPS 140-2 Level 3 requirements.

Why wrong: While HSM provides hardware security, it does not address audit logging.

Add the Google service account as a member of the bucket with roles/storage.objectViewer

Why wrong: IAM bindings are defined on the resource (bucket) and specify members and roles; 'add member' is not a standard IAM operation.

Grant the Google service account roles/storage.objectViewer at the project level

Why wrong: Project-level access would allow all pods in the project to access the bucket, violating the principle of least privilege.

Bind the Kubernetes service account to the bucket IAM policy with roles/storage.objectViewer

Why wrong: Kubernetes service accounts cannot be directly used in Google Cloud IAM; they must be mapped to a Google service account via Workload Identity.

Alice has the objectViewer role but not the objectAdmin role.

Why wrong: Alice has both roles, including objectAdmin.

Alice does not have the storage.buckets.getIamPolicy permission.

Why wrong: That permission is not needed for uploading objects.

The objectAdmin role does not include the storage.objects.create permission.

Why wrong: objectAdmin includes storage.objects.create.

Set up VPC Service Controls to prevent data exfiltration and rely on access controls.

Why wrong: VPC-SC does not de-identify data.

Create a scheduled query in BigQuery that exports data using a view with de-identification functions.

Why wrong: Adds operational overhead and potential latency.

Use Cloud DLP API to scan and de-identify the export file after it is written to Cloud Storage.

Why wrong: Requires manual or scheduled calls, not real-time.

Do not use VPC Service Controls; instead, rely on IAM permissions and firewall rules to control access

Why wrong: IAM and firewalls do not prevent data exfiltration to external IPs outside the perimeter.

Create a separate perimeter that denies all traffic and apply it to the project

Why wrong: This would deny all access, including from VPN.

Add the project to a VPC Service Controls perimeter with no additional ingress rules

Why wrong: This would block access from on-premises via VPN because VPN traffic originates outside the perimeter.

Create a service account for the SaaS application and grant it the Storage Object Creator role; then add the service account to the perimeter's allowed identities.

Why wrong: VPC Service Controls does not allow identities; it uses access levels based on client context.

Create an access level that includes the SaaS application's IP addresses and use that in the perimeter's ingress policy.

Why wrong: Access levels can include IP ranges, but this would allow all traffic from those IPs, not just the specific application.

Add the SaaS application's external IP addresses to the perimeter's allowed IP ranges.

Why wrong: VPC Service Controls does not support IP-based allowlisting; it uses access levels based on identity or context.

Cloud Monitoring

Why wrong: Used for monitoring and alerting based on metrics, not for centralized log storage.

Cloud Functions

Why wrong: Can be used to process logs but is not required for centralized logging.

The VPC-A has a firewall rule that denies ICMP traffic from VPC-B.

Why wrong: The engineer verified firewall rules allow ingress from 10.1.0.0/16, so this is not the issue.

The MTU configuration on the peering connection is set too low.

Why wrong: MTU issues would cause fragmentation, not complete unreachability.

The instance in VPC-B does not have a public IP address.

Why wrong: Ping uses internal IPs; public IPs are not required for VPC peering.

Grant the user 'roles/cloudsql.viewer' on the project. In the database, grant SELECT on orders to 'analyst@example.com'.

Why wrong: cloudsql.viewer does not allow connecting to the instance.

Grant the user 'cloudsql.instances.connect' on the instance. In the database, create a user 'analyst@example.com' with 'cloudsqllogin' role and grant SELECT on orders to that user.

Why wrong: Granting IAM permission to the user individually is unnecessary if the group already has it; the group membership should be used.

Grant the group 'roles/cloudsql.instanceUser' on the instance. In the database, create a user 'analysts@example.com' (the group) and grant SELECT on orders to that group.

Why wrong: IAM group cannot be directly mapped to a database user; you need individual user mapping.

A ClusterRole that grants permissions to manage secrets across all namespaces.

Why wrong: This would grant secret access across all namespaces, which is too broad.

A RoleBinding in namespace 'tenant-alpha' that binds a Role granting secret modification to the DevOps team.

Why wrong: This would grant secret access, which is not desired.

Ingress rule on frontend: allow tcp:8080 from backend's service account; Egress rule on backend: allow all to internet

Why wrong: Ingress on frontend would allow backend to connect to frontend, which violates the requirement. Also, using service accounts is more complex but not incorrect per se, but the direction is wrong.

Ingress rule on frontend: allow tcp:8080 from subnet B; Egress rule on backend: allow all to internet

Why wrong: Ingress rule on frontend would allow backend to initiate to frontend, which is not allowed. The requirement is backend cannot initiate to frontend.

Ingress rule on backend: allow tcp:8080 from subnet A; Egress rule on frontend: deny all to internet

Why wrong: Egress rule on frontend is not needed. The rule should allow backend to access internet, not frontend.

Use IAM roles only and enable Cloud Audit Logs, but keep ACLs enabled.

Why wrong: ACLs can override IAM permissions.

Use VPC Service Controls and enable Cloud Audit Logs.

Why wrong: VPC Service Controls control network access, not bucket-level access.

Enable fine-grained access using ACLs and enable Cloud Audit Logs.

Why wrong: ACLs can allow public access unintentionally and are harder to audit.