Select Two (Multi-Select) Questions

Use Cloud NAT for outbound traffic to anonymize instance IP addresses in serial console logs.

Why wrong: Incorrect: Cloud NAT does not affect serial console logs; it only changes outbound IP addresses for internet access.

Remove the roles/iam.serviceAccountUser role from all users to prevent them from accessing serial console.

Why wrong: Incorrect: The role for serial console access is not directly tied to service account user; this would break legitimate service account usage.

Enable OS Login for the project to enforce SSH key management and prevent serial console access.

Why wrong: Incorrect: OS Login manages SSH access but does not prevent serial console access or log exposure.

Web Security Scanner scan rule

Why wrong: Web Security Scanner is a separate tool for scanning vulnerabilities.

Signed URL policy

Why wrong: Signed URLs are a Cloud CDN feature for access control.

Preconfigured Identity-Aware Proxy (IAP) rule

Why wrong: IAP is a separate feature, not a Cloud Armor security policy.

Use Cloud Data Loss Prevention (DLP) to scan buckets for public access.

Why wrong: DLP does not prevent public access; it scans for sensitive data.

Configure VPC Service Controls to restrict access to the buckets from within the VPC.

Why wrong: VPC-SC does not prevent public exposure; it restricts network paths.

Enable bucket lock on all buckets to prevent deletion of objects.

Why wrong: Bucket lock does not prevent public access.

Lifecycle rules with a Delete action.

Why wrong: Lifecycle rules delete objects, not prevent deletion.

Object versioning.

Why wrong: Versioning keeps multiple versions but does not prevent deletion.

Create a Cloud Function to export the data before deletion.

Why wrong: Export is not required and would keep data longer.

Set a table retention policy of 30 days using ALTER TABLE SET OPTIONS.

Why wrong: Retention policy prevents deletion before expiration, not enforce deletion.

Use BigQuery continuous backups with a 30-day retention.

Why wrong: Continuous backups would increase storage costs unnecessarily.

Set up a Cloud VPN tunnel and use private IP addresses to access Google Cloud services.

Why wrong: This is a network connectivity solution, not a credential mechanism.

Create a service account and use its key to generate short-lived tokens.

Why wrong: This uses the key to get short-lived tokens, but the key itself is long-lived. However, the approach is essentially the same as A. But option A already covers using the key directly. Option C is redundant and not a separate approach.

Use Workload Identity Federation to exchange on-premises credentials for Google Cloud tokens.

Why wrong: Workload Identity Federation provides short-lived tokens.

Remove the default allow egress rule that allows all outbound traffic

Why wrong: Removing the default egress rule would block all outbound traffic, which could break other communications. The specific egress rule will take precedence due to higher priority if needed, but actually the default egress rule allows all, and our specific rule allows additional traffic; it doesn't conflict. We don't need to remove it.

Create a VPC firewall rule to deny all egress traffic from the VPC

Why wrong: This would block all outbound traffic, including necessary communications. The default allow egress rule can remain; we just need to ensure specific allow rules for the required traffic.

Create custom infoTypes for all sensitive data.

Why wrong: DLP provides many built-in infoTypes; custom infoTypes are not always necessary.

Store de-identification templates in Cloud KMS.

Why wrong: De-identification templates are stored in DLP, not Cloud KMS.

Use VPC Service Controls to restrict access to the data.

Why wrong: VPC Service Controls do not classify or de-identify data.

Revoke all IAM roles granted to the service account

Why wrong: This does not prevent access via the key if the key itself is still valid; the service account still exists.

Rotate the service account key

Why wrong: Rotation creates a new key but the old key remains valid until deleted, so immediate risk persists.

Enable Cloud Audit Logs for the service account

Why wrong: This helps with investigation but does not mitigate the immediate threat.

Cloud Monitoring

Why wrong: Used for monitoring and alerting based on metrics, not for centralized log storage.

Cloud Functions

Why wrong: Can be used to process logs but is not required for centralized logging.

Private Google Access

Why wrong: Provides private access to Google APIs, not a general hybrid connectivity method.

VPC Network Peering

Why wrong: Does not encrypt traffic; relies on the underlying network.

Internal HTTPS Load Balancing

Why wrong: For load balancing within VPC, not for hybrid connectivity.

A ClusterRole that grants permissions to manage secrets across all namespaces.

Why wrong: This would grant secret access across all namespaces, which is too broad.

A RoleBinding in namespace 'tenant-alpha' that binds a Role granting secret modification to the DevOps team.

Why wrong: This would grant secret access, which is not desired.

Apply only one policy tag per column.

Why wrong: Multiple policy tags can be applied to a column.

Enable Cloud Audit Logs to track policy tag usage.

Why wrong: Audit logs are for monitoring, not for defining masking.

Configure a Cloud HSM key to generate the data encryption key.

Why wrong: Cloud HSM is not required; Cloud KMS key is sufficient.

Enable CMEK on the Cloud SQL instance.

Why wrong: CMEK encrypts the entire disk, not individual fields.

Use Cloud HSM to create and manage the encryption key, and disable Cloud Audit Logs for the HSM key.

Why wrong: Cloud HSM provides hardware-backed keys but still uses KMS; disabling audit logs contradicts the requirement for logging.

Enable default encryption (Google-managed key) on the bucket and use Cloud Audit Logs to monitor access.

Why wrong: Default encryption uses Google-managed keys, not customer-managed, so it does not meet the requirement for CMEK.

Use customer-supplied encryption keys (CSEK) and store the key in Cloud Key Management Service (KMS).

Why wrong: CSEK keys are supplied by the customer but not managed via KMS; they are provided with each request and not stored in KMS.

Use VPC Service Controls to block access to the Compute Engine metadata server to prevent credential extraction.

Why wrong: The metadata server is not a Google-managed API; VPC Service Controls protects Google-managed services.

Create a service perimeter that includes all Google Cloud projects in the organization to simplify management.

Why wrong: Including all projects would not protect the sensitive data specifically and could be overly permissive.

Use VPC Service Controls to restrict access based on network tags on Compute Engine instances.

Why wrong: VPC Service Controls does not support network tags; it uses access levels based on IP, device, or identity.

roles/storage.legacyBucketOwner

Why wrong: Legacy role that includes bucket-level permissions.

roles/storage.admin

Why wrong: Grants full bucket and object management, too broad.

Use Cloud KMS to encrypt individual columns containing personal data.

Why wrong: BigQuery does not support column-level encryption; Cloud DLP is used for de-identification.

Store data in a multi-region location like 'EU' to ensure availability across regions.

Why wrong: GDPR does not require multi-region; data can be stored in a single region.

Enable Cloud Audit Logs with export to a BigQuery dataset in the EU region.

Why wrong: Audit logs track activity but do not prevent data from leaving the EU.

Use Cloud Data Loss Prevention (DLP) to scan for sensitive data and verify it remains in the EU.

Why wrong: DLP identifies and classifies data but does not enforce geographic restrictions.

Use Customer-Managed Encryption Keys (CMEK) stored in a Cloud KMS key ring located in the EU.

Why wrong: CMEK controls encryption keys but does not restrict where data is stored or processed.

Cloud NAT must be configured in at least one VPC.

Why wrong: Incorrect: NAT not needed for peering.

An IAM role with compute.networkAdmin must be granted to all users.

Why wrong: Incorrect: IAM permissions are per user/project, not a requirement.