Courseiva

CCNA Pcse Configuring Access Questions

75 of 135 questions · Page 1/2 · Pcse Configuring Access topic · Answers revealed

Practice these questionsExam hubAll questions
1
MCQhard

An organization wants to grant a CI/CD pipeline (running on GitHub Actions) access to deploy resources in a GCP project without storing long-lived service account keys. Which approach is recommended?

A.Use a service account with the role roles/iam.serviceAccountTokenCreator.
B.Use Workload Identity Federation with GitHub as an identity provider.
C.Create a service account and store the JSON key as a GitHub secret.
D.Create a compute instance with a service account and run the pipeline from there.
AnswerB

Workload Identity Federation allows keyless authentication from external IdPs.

Why this answer

Workload Identity Federation allows binding an external identity provider (like GitHub Actions) to a GCP service account. The GitHub Actions workflow can exchange a GitHub OIDC token for a GCP access token, no static keys needed.

Practice this question →
2
MCQhard

A GKE cluster runs workloads that need to access Cloud Storage. The security team wants to avoid using service account keys and ensure each pod has a unique identity. What is the best practice?

A.Create a service account key and mount it as a secret in each pod.
B.Use the default compute engine service account for the cluster.
C.Attach a Google service account to the GKE node pool.
D.Use Workload Identity: create a Kubernetes service account and bind it to a Google service account.
AnswerD

Workload Identity allows pod-level identity without keys.

Why this answer

Workload Identity for GKE binds a Kubernetes service account to a Google service account. Pods that use the KSA automatically authenticate as the GSA without keys. This provides fine-grained pod-level identity.

Attaching the GSA to the node is coarse-grained. Using the default compute SA is insecure. Creating keys defeats the purpose.

Practice this question →
3
MCQhard

A GKE cluster has Workload Identity enabled. A Kubernetes service account is bound to a GCP service account named 'sa-gcs'. A pod using the Kubernetes service account fails to list objects in a Cloud Storage bucket. The GCP service account has the Storage Object Viewer role. What is the most likely cause?

A.The pod is using the wrong GCP service account.
B.The bucket has uniform bucket-level access disabled.
C.The Kubernetes service account does not have the iam.workloadIdentityUser role on the GCP service account.
D.The GCP service account lacks the storage.objects.list permission.
AnswerC

This role is required for the KSA to impersonate the GCP SA.

Why this answer

The pod must use the Kubernetes service account, but the GCP service account may not have the required permission (storage.objects.list). However, with Workload Identity, the pod authenticates as the GCP SA. The issue could be that the GCP SA does not have the role on the specific bucket, or the binding is misconfigured.

But the most common cause is missing the iam.workloadIdentityUser role on the GCP SA for the Kubernetes service account to impersonate it. Without that, the pod cannot use the GCP SA.

Practice this question →
4
MCQhard

A security engineer needs to grant a team the ability to impersonate a service account (SA) in project B from a Compute Engine instance in project A. The SA in project B has the required permissions to access Cloud Storage. What IAM configuration is required?

A.Grant the instance's service account the roles/iam.serviceAccountUser role on the SA in project B, and grant the SA in project B roles/storage.objectViewer.
B.Grant the instance's service account the roles/iam.serviceAccountTokenCreator role on the SA in project B.
C.Create a new service account in project A with the necessary storage permissions and use that.
D.Grant the instance's service account the roles/storage.objectViewer role directly.
AnswerA

roles/iam.serviceAccountUser includes the 'actAs' permission. This allows the instance to impersonate the target SA, which already has the storage role.

Why this answer

Option A is correct because it combines two necessary steps: first, the instance's service account in project A needs the roles/iam.serviceAccountUser role on the target service account in project B to gain impersonation privileges; second, the target service account in project B must have roles/storage.objectViewer to access Cloud Storage. Without both, the impersonation would either fail (no permission to use the target SA) or the target SA would lack the storage access.

Exam trap

Cisco often tests the distinction between roles/iam.serviceAccountUser (for impersonation) and roles/iam.serviceAccountTokenCreator (for token generation), and candidates mistakenly think token creation alone enables full impersonation.

How to eliminate wrong answers

Option B is wrong because roles/iam.serviceAccountTokenCreator allows generating access tokens for the target SA but does not grant the ability to impersonate it for running operations; impersonation requires roles/iam.serviceAccountUser. Option C is wrong because creating a new SA in project A with storage permissions would not allow impersonating the existing SA in project B, which is the requirement; it would be a separate identity. Option D is wrong because granting roles/storage.objectViewer directly to the instance's SA in project A would only allow that SA to access storage, not impersonate the SA in project B, and the instance's SA may not have the necessary cross-project access.

Practice this question →
5
MCQeasy

A company wants to use Google Cloud resources but does not have a Google Workspace or Cloud Identity account. They want to manage identities for their users without paying for additional licenses. What is the most cost-effective identity solution?

A.Use the Compute Engine default service account for all users.
B.Use Cloud Identity Premium edition.
C.Use Cloud Identity Free edition.
D.Use Google Workspace.
AnswerC

Cloud Identity Free provides basic user identity management for accessing Google Cloud resources at no cost.

Why this answer

Cloud Identity Free edition provides identity management for users who only need to access Google Cloud resources (Compute Engine, Cloud Storage, etc.) without Gmail, Google Drive, or other Google Workspace services. It is free. Cloud Identity Premium includes additional features like device management and security policies but costs money.

Google Workspace is a paid suite of productivity apps. The Compute Engine default service account is not for user identities.

Practice this question →
6
MCQmedium

Your organization has an IAM policy at the folder level that grants a user the Compute Admin role. A deny policy at the project level denies the same user the compute.instances.create permission. What is the effective access for this user on the project?

A.The user can create instances because the allow policy at the folder level takes precedence over the deny policy at the project level.
B.The user can create instances because the project-level deny policy only applies to resources within the project, not to permissions inherited from the folder.
C.The user can create instances because deny policies only block explicit allows, not inherited ones.
D.The user cannot create instances because deny policies override allow policies.
AnswerD

Deny policies take precedence over allow policies, so the deny at the project level blocks the inherited allow.

Why this answer

Deny policies always override allow policies. The deny at the project level explicitly denies compute.instances.create, so the user cannot create instances despite the folder-level allow.

Practice this question →
7
MCQhard

Your organization uses Cloud Identity with SAML 2.0 federation from an external identity provider (IdP). You need to ensure that only users from a specific group in the IdP can access a critical application behind an HTTPS load balancer. Which combination of steps is required?

A.Create a firewall rule that allows traffic only from the IdP's SAML endpoint IP
B.Set up a VPN between the IdP and Google Cloud and restrict access to the load balancer via VPC firewall
C.Configure Cloud Armor to allow traffic only from the IdP's IP range
D.Enable IAP on the load balancer and grant the roles/iap.httpsResourceAccessor role to the Google group representing the IdP group
AnswerD

This is the correct approach: IAP enforces authentication, and the IAM role controls authorization based on group membership.

Why this answer

To restrict access to a specific group, you must first configure IAP on the backend service, then create an IAP access policy (or IAM binding) that grants the roles/iap.httpsResourceAccessor role to the Google group that corresponds to the IdP group. The IdP group must be synced to Google Cloud via directory sync or SCIM.

Practice this question →
8
Multi-Selectmedium

A cloud architect is designing a multi-project environment in Google Cloud. They want to ensure that a specific folder-level IAM policy cannot be overridden by project-level policies. Which TWO statements about IAM policy inheritance and deny policies are correct? (Choose two.)

Select 2 answers
A.Deny policies can only be applied at the organization level.
B.Allow policies at the folder level are inherited by all projects in that folder and cannot be overridden by project-level allow policies.
C.If a deny policy denies a permission, an allow policy granting the same permission at a lower level will not be effective.
D.Deny policies at a higher level (e.g., organization) can override allow policies at a lower level (e.g., project).
E.Allow policies are evaluated before deny policies.
AnswersC, D

Deny policies take precedence over allow policies, so the deny blocks the permission regardless of lower-level allow.

Why this answer

Correct statements: 1) Organization policies (deny policies) can block permissions even if an allow policy grants them. 2) Deny policies can be applied at any level and override allow policies. The other statements are incorrect: allow policies are hierarchical with additive inheritance, but they cannot be made 'hard' to prevent override; deny policies are the mechanism for that. Project-level allow policies can override folder-level allow policies (inheritance is additive).

Deny policies can be applied at the folder level.

Practice this question →
9
MCQhard

An organization has a deny policy at the folder level that denies the permission resourcemanager.projects.create. A user has an allow policy at the project level granting roles/owner. What is the effective permission for the user to create projects in that project?

A.The user cannot create projects because the deny policy at the folder level explicitly denies the permission.
B.The user cannot create projects because the deny policy is at a higher level in the hierarchy.
C.The user can create projects because Owner role includes all permissions.
D.The user can create projects if the project-level allow is more specific.
AnswerA, B

Deny policies take precedence over allow policies.

Why this answer

Deny policies take precedence over allow policies. Even though the user has Owner role at the project level, the folder-level deny policy blocks project creation. Deny policies are evaluated before allow policies and, if matched, the permission is denied.

Practice this question →
10
Multi-Selectmedium

A company wants to allow their on-premises Active Directory users to access Google Cloud resources using their existing credentials. They need to synchronize user accounts and groups to Google Cloud Directory and enable federated authentication. Which TWO services should they use?

Select 2 answers
A.Workload Identity Federation
B.Identity-Aware Proxy
C.OAuth 2.0 consent screen
D.Cloud Directory Sync (CDS)
E.SAML 2.0 SSO with Cloud Identity
AnswersD, E

CDS syncs AD objects to Google Cloud Directory.

Why this answer

Cloud Directory Sync (CDS) synchronizes users and groups from Active Directory to Google Cloud Directory. SAML 2.0 federation with Google Workspace or Cloud Identity enables SSO using existing AD credentials.

Practice this question →
11
MCQeasy

A developer wants to grant a Compute Engine instance access to read objects from a Cloud Storage bucket. The instance runs under a service account. What is the best practice for granting this access?

A.Create an IAM policy on the bucket that grants access to the instance's external IP address.
B.Assign the Storage Object Viewer role to the service account attached to the instance.
C.Use a signed URL with a long expiration time for the instance.
D.Generate a JSON key for the service account, download it to the instance, and use it in application code.
AnswerB

This is the correct approach. The service account is authorized, and the instance can access the bucket using its metadata server credentials.

Why this answer

The best practice is to assign the appropriate IAM role (e.g., Storage Object Viewer) to the service account that the instance is running as. Then, the instance can use the service account's credentials automatically via the metadata server. This avoids the need to manage service account keys.

Generating keys is discouraged. Allowing the instance to use the default compute engine service account is common but less secure; a custom service account with minimal permissions is preferred.

Practice this question →
12
MCQmedium

A security engineer wants to ensure that all Compute Engine VMs in an organization use Shielded VM features. The organization uses Cloud Identity as the identity provider. What is the most efficient way to enforce this requirement?

A.Configure a Cloud Security Command Center (SCC) policy to scan and alert on non-compliant VMs.
B.Use an IAM deny policy to prevent users from creating VMs without Shielded VM.
C.Create a custom organization policy using the Organization Policy Service.
D.Apply the built-in constraint 'constraints/compute.requireShieldedVm' via the Organization Policy Service.
AnswerD

This built-in constraint directly enforces Shielded VM at the organization level.

Why this answer

Organization policies can enforce constraints across all projects. The built-in constraint 'constraints/compute.requireShieldedVm' requires all new VMs to have Shielded VM features enabled. This is more efficient than manual audits, scripts, or custom constraints.

Practice this question →
13
MCQmedium

An administrator needs to restrict which external identities can be used to access Google Cloud resources. The organization uses SAML federation with an external identity provider. Which organization policy constraint should be used?

A.constraints/iam.allowedPolicyMemberDomains
B.constraints/iam.disableServiceAccountKeyCreation
C.constraints/compute.requireShieldedVm
D.constraints/iam.disableCrossProjectServiceAccountUsage
AnswerA

This constraint limits the domains that can be used in IAM policies.

Why this answer

The constrain constraints/iam.allowedPolicyMemberDomains restricts which domains can be granted IAM roles. By setting this to the domain of the external IdP, the administrator ensures only federated identities from that domain can be used.

Practice this question →
14
Multi-Selecteasy

A developer wants to allow a CI/CD pipeline running on GitHub Actions to deploy resources to a GCP project without using service account keys. Which two components are needed? (Choose two.)

Select 2 answers
A.A Workload Identity Pool and Provider configured for GitHub.
B.A Google service account with the iam.workloadIdentityUser role.
C.A Cloud Build trigger to run the workflow.
D.A Cloud KMS key to encrypt the workflow.
E.A service account JSON key stored as a GitHub secret.
AnswersA, B

This is the identity federation setup.

Why this answer

Workload Identity Federation allows GitHub Actions to exchange GitHub OIDC tokens for GCP service account impersonation. You need to set up a workload identity pool and provider for GitHub. The GitHub Actions workflow must be configured to use the OIDC token and request impersonation of a service account.

Practice this question →
15
MCQmedium

A company has an organization policy that disables service account key creation (constraints/iam.disableServiceAccountKeyCreation). However, a legacy application requires a service account key to authenticate. What should the engineer do to satisfy this requirement while following best practices?

A.Create a service account key and use it despite the policy, then document the exception
B.Use workload identity federation to authenticate the legacy application without keys
C.Create a custom role that includes iam.serviceAccountKeys.create and assign it to the service account
D.Remove the organization policy constraint to allow key creation
AnswerB

Workload identity federation allows keyless authentication from external workloads, meeting the requirement without violating the policy.

Why this answer

The best practice is to avoid service account keys entirely. Use workload identity federation if the application runs outside GCP, or use Workload Identity for GKE if it runs in GKE. If the application must use keys, you can request an exception by creating a custom organization policy with a condition or by using the policy simulator to test, but the preferred approach is to eliminate key usage.

Practice this question →
16
MCQhard

A security engineer notices that a service account has been assigned the roles/iam.serviceAccountUser role at the project level. What actions can a user with this role perform?

A.Create new service accounts in the project.
B.Impersonate the service account to access resources.
C.Delete the service account.
D.View the service account's keys.
AnswerB

Correct: this role grants the iam.serviceAccounts.actAs permission.

Why this answer

The roles/iam.serviceAccountUser role allows a user to impersonate a service account (via gcloud or API) and use its permissions to access resources. It does not allow the user to create, delete, or modify the service account itself.

Practice this question →
17
Multi-Selecthard

A security architect is designing an IAM hierarchy for a large organization. The requirements are: 1) Development projects should inherit a policy that allows Compute Engine access. 2) Production projects should not have Compute Engine access. 3) Audit team must be able to read all resources across all projects. Which three IAM policy placements are correct? (Choose three.)

Select 3 answers
A.Grant the development team roles/compute.admin at the folder level for the development folder.
B.Grant the audit team roles/viewer at the organization level.
C.Grant the production team roles/compute.admin at the folder level for the production folder, then create a deny policy at the org level to block Compute Engine.
D.Place a deny policy at the production folder level to block Compute Engine access.
E.Grant the audit team roles/viewer at each project level.
AnswersA, B, D

Inherited by all projects in the development folder.

Why this answer

Audit team gets viewer at org (A). Development folder grants compute admin (B). Production folder gets a deny policy for Compute Engine (D).

This meets all requirements.

Practice this question →
18
MCQmedium

A company wants to allow an external auditor to view all IAM policies in a project but not modify them. The auditor's Google account is from a different domain. Which IAM role should be assigned?

A.roles/iam.roleViewer
B.roles/viewer
C.roles/iam.securityReviewer
D.roles/securityAdmin
AnswerC

Correct: allows viewing IAM policies and security settings.

Why this answer

The roles/iam.securityReviewer role grants permission to view IAM policies and other security settings without write access. roles/viewer does not include iam.roles.list or iam.policies.get. roles/iam.roleViewer only lists roles, not policies. roles/securityAdmin includes write permissions.

Practice this question →
19
MCQmedium

A company uses Google Workspace and wants to allow users to authenticate to a third-party SaaS application using their Google credentials. The SaaS application supports SAML 2.0. What should the administrator configure?

A.Workload Identity Federation
B.SAML 2.0 SSO in Google Admin Console
C.Cloud Identity-Aware Proxy (IAP)
D.OAuth 2.0 consent screen
AnswerB

Google Workspace can act as a SAML 2.0 identity provider to grant SSO to third-party apps.

Why this answer

Google Workspace supports SAML 2.0 federation. The admin would set up a custom SAML app in the Google Admin console, configuring the IdP (Google) and SP (SaaS app) metadata.

Practice this question →
20
MCQmedium

An organization has set up IAP to protect a web application running on Compute Engine. The application needs to know the authenticated user's email address for logging. How can the application securely obtain this information?

A.Read the user's email from the instance's metadata server.
B.Extract the email from the X-Goog-Authenticated-User-Email header after verifying the JWT signed by IAP.
C.Use the Cloud Logging API to query the most recent IAP access logs.
D.Call the IAP API to retrieve the user identity.
AnswerB

IAP sets signed headers with the user's identity; the application must verify the JWT to trust the header.

Why this answer

IAP passes the authenticated user's identity to the backend application via signed HTTP headers (X-Goog-Authenticated-User-Email, X-Goog-Authenticated-User-Id). The application should verify the JWT signature of the IAP token (using Google's public keys) to trust these headers. The headers cannot be spoofed if the application verifies the JWT.

Using Cloud Logging is not for real-time identity. The metadata server does not provide IAP user identity. The IAP API is for managing IAP configuration, not for retrieving user identity per request.

Practice this question →
21
MCQmedium

An organization wants to allow an external identity provider (IdP) that supports OpenID Connect (OIDC) to access GCP resources. They want to avoid creating and managing service account keys. What should they use?

A.Use Cloud Identity Platform to federate the external IdP.
B.Create a service account key and share it with the external IdP.
C.Use a VPN tunnel to connect the external IdP to GCP and use internal IPs.
D.Configure Workload Identity Federation to allow the external IdP to impersonate a service account.
AnswerD

Workload Identity Federation enables keyless authentication for workloads running outside GCP.

Why this answer

Workload Identity Federation allows an external identity provider (IdP) that supports OpenID Connect (OIDC) to impersonate a GCP service account without requiring service account keys. This enables the external IdP to obtain short-lived, scoped tokens directly from GCP, eliminating the need to create, store, or rotate long-lived keys.

Exam trap

The trap here is that candidates confuse Cloud Identity Platform (which is for end-user federation) with Workload Identity Federation (which is for non-human workloads like external IdPs), leading them to pick Option A.

How to eliminate wrong answers

Option A is wrong because Cloud Identity Platform is primarily for customer-facing identity and access management (e.g., end-user authentication), not for federating external IdPs to allow them to access GCP resources as a service account. Option B is wrong because creating and sharing a service account key directly violates the requirement to avoid managing keys; it introduces long-lived credentials that must be securely stored and rotated. Option C is wrong because a VPN tunnel only provides network-level connectivity, not identity federation; it does not enable the external IdP to obtain GCP credentials or impersonate a service account.

Practice this question →
22
Multi-Selecthard

A company wants to implement workload identity federation for a GitHub Actions workflow, allowing it to access Google Cloud resources without using service account keys. Which three steps are required? (Choose three.)

Select 3 answers
A.Grant the service account the roles/iam.workloadIdentityUser role on the workload identity pool.
B.Generate a JSON key for the service account and store it as a GitHub secret.
C.Create a service account in GCP and grant it the necessary roles.
D.Create a workload identity pool and provider in GCP for GitHub Actions.
E.Configure GitHub Actions workflow to authenticate using the workload identity provider.
AnswersC, D, E

A service account is needed as the target identity.

Why this answer

The correct steps: create a service account (A), create a workload identity pool and provider (C), and configure the workflow to authenticate via the provider (E). Step D is incorrect because the role is granted on the service account, not the pool.

Practice this question →
23
Multi-Selectmedium

A security team wants to restrict service account key creation in their organization to prevent key-based authentication. They have set the organization policy constraint constraints/iam.disableServiceAccountKeyCreation to True. However, they need to allow a specific project to continue creating keys for legacy applications. Which two steps are required? (Choose two.)

Select 2 answers
A.Remove the constraint from the organization level and apply it to all child projects except the legacy one.
B.Use a deny policy to block key creation for all projects except the legacy one.
C.Create a custom role with iam.serviceAccountKeys.create permission and assign it to the project.
D.Set a folder-level policy to disable the constraint for the folder containing the project.
E.Add an exception in the organization policy for the specific project using conditions.
AnswersD, E

A folder policy can override the org policy if it is less restrictive.

Why this answer

Option D is correct because setting a folder-level policy to disable the constraint for the folder containing the project allows the organization policy to remain enforced at the org level while creating an exception for the specific folder and its child projects. Option E is correct because the organization policy supports conditions, enabling you to add an exception for a specific project without removing the constraint from the organization level.

Exam trap

Cisco often tests the misconception that you must remove the constraint from the organization level and reapply it to individual projects, when in fact you can use hierarchical overrides or conditions to create targeted exceptions without altering the organization-level policy.

Practice this question →
24
MCQmedium

A developer wants to run a containerized application on GKE that needs to read from a Cloud Storage bucket. The developer needs to securely provide credentials. What is the recommended approach?

A.Create a Google service account with necessary permissions, create a Kubernetes service account, and configure Workload Identity to bind them.
B.Use the default compute engine service account for the GKE nodes.
C.Store the service account key in Cloud Secret Manager and retrieve it in the pod at startup.
D.Create a service account key, store it as a Kubernetes secret, and mount it in the pod.
AnswerA

Workload Identity allows pods to use GCP service accounts without keys, following best practices.

Why this answer

The recommended approach is to use Workload Identity to bind a Kubernetes service account to a Google service account. This avoids managing keys and allows fine-grained access. The developer should create a GCP service account with the Storage Object Viewer role, then create a Kubernetes service account, and bind them using Workload Identity.

The pod should use the Kubernetes service account.

Practice this question →
25
MCQmedium

A security engineer needs to ensure that a specific Compute Engine instance can only be accessed via HTTPS from users authenticated through Cloud Identity. The instance is behind an HTTP(S) load balancer. What should the engineer configure on the load balancer to enforce this access control?

A.Set firewall rules to allow only HTTPS traffic from the load balancer's IP ranges
B.Enable HTTPS only on the load balancer and use client certificates for authentication
C.Configure Cloud Armor with a security policy to require valid JWT tokens
D.Configure IAP on the backend service of the load balancer
AnswerD

IAP can be enabled on the backend service of an HTTPS load balancer to enforce authentication and authorization for all requests.

Why this answer

Identity-Aware Proxy (IAP) provides zero-trust access control for web applications and can be enabled on a load balancer backend service. It verifies user identity and context before allowing access. Configuring IAP on the backend service of the load balancer restricts access to authenticated users only.

Practice this question →
26
MCQmedium

A DevOps engineer wants to allow a CI/CD pipeline running in GitHub Actions to deploy resources to a Google Cloud project without using long-lived service account keys. What should the engineer implement?

A.Use a Cloud Functions HTTP trigger called from GitHub Actions.
B.Create a service account and distribute its JSON key to the GitHub repository secrets.
C.Enable Cloud Build triggers that watch the GitHub repository.
D.Configure Workload Identity Federation between GitHub and the service account.
AnswerD

This allows keyless authentication using OIDC.

Why this answer

Option D is correct because Workload Identity Federation allows GitHub Actions to exchange OpenID Connect (OIDC) tokens for Google Cloud temporary credentials, eliminating the need for long-lived service account keys. This approach follows Google's security best practices by using short-lived, automatically rotated tokens and avoids the risk of key exposure in repository secrets.

Exam trap

Cisco often tests the distinction between using a CI/CD service's native triggers (like Cloud Build) versus configuring an external identity federation (like Workload Identity Federation) to allow a different CI/CD tool (GitHub Actions) to authenticate securely.

How to eliminate wrong answers

Option A is wrong because a Cloud Functions HTTP trigger would require the CI/CD pipeline to call an HTTP endpoint, which still needs authentication (e.g., an API key or OAuth token) and does not solve the long-lived credential problem; it merely shifts the authentication point. Option B is wrong because distributing a service account JSON key to GitHub repository secrets creates a long-lived, static credential that can be leaked or misused, violating the principle of avoiding long-lived keys. Option C is wrong because Cloud Build triggers that watch a GitHub repository are a separate CI/CD service, not a method for GitHub Actions to authenticate to Google Cloud; this option confuses the CI/CD platform (Cloud Build) with the authentication mechanism needed for GitHub Actions.

Practice this question →
27
MCQmedium

An application running on Compute Engine needs to authenticate to Google Cloud APIs. The security engineer wants to avoid managing keys. What is the recommended method?

A.Store the service account key in Cloud Secret Manager and retrieve it at boot.
B.Create a service account key and store it in the instance's local disk.
C.Use workload identity federation to exchange a JWT from the application.
D.Attach a service account to the VM instance and use the metadata server to obtain tokens.
AnswerD

This is the recommended approach; no keys are needed, and the service account is securely attached to the VM.

Why this answer

Use the default compute engine service account or a custom service account attached to the VM instance. The VM automatically obtains tokens via the metadata server, no keys required. This is the recommended approach for workloads on Compute Engine.

Practice this question →
28
MCQeasy

A security engineer is configuring access for a new team member who needs to manage Cloud Storage buckets, but should not be able to delete or modify existing objects. Which IAM role should be assigned?

A.Storage Legacy Bucket Writer (roles/storage.legacyBucketWriter)
B.Storage Object Viewer (roles/storage.objectViewer)
C.Storage Admin (roles/storage.admin)
D.Storage Object Admin (roles/storage.objectAdmin)
AnswerA

This role allows listing buckets and creating/overwriting objects, but not deleting objects. It does not grant permission to delete or modify existing objects.

Why this answer

The Storage Legacy Bucket Writer role (roles/storage.legacyBucketWriter) allows a user to list, create, and update buckets, but it does not grant permissions to delete or modify existing objects within those buckets. This role is specifically designed for managing bucket-level metadata while restricting object-level write and delete operations, making it the correct choice for the described requirement.

Exam trap

Cisco often tests the distinction between bucket-level and object-level roles, and the trap here is that candidates confuse 'bucket writer' with 'object writer,' assuming it allows object modification, when in fact it only affects bucket metadata and not the objects themselves.

How to eliminate wrong answers

Option B (Storage Object Viewer) is wrong because it only provides read-only access to objects (e.g., viewing and listing), with no ability to manage buckets or create/update objects, which the team member needs. Option C (Storage Admin) is wrong because it grants full control over all Cloud Storage resources, including deleting and modifying objects, which violates the restriction. Option D (Storage Object Admin) is wrong because it allows full control over objects (create, read, update, delete) but does not include bucket-level management permissions, and it permits object deletion, which is explicitly prohibited.

Practice this question →
29
MCQmedium

A company wants to allow an application running in an on-premises data center to access Google Cloud Storage buckets without storing long-lived service account keys. The on-premises application authenticates using an external identity provider (IdP) that supports OpenID Connect (OIDC). Which Google Cloud feature should they use?

A.Use Cloud VPN to connect the on-premises network and access Cloud Storage via private IP
B.Configure a VPN between on-premises and Google Cloud and use a Compute Engine instance as a proxy
C.Create a service account key and store it securely on-premises
D.Use workload identity federation to exchange OIDC tokens for Google Cloud tokens
AnswerD

Workload identity federation enables keyless access from external workloads by federating with external IdPs.

Why this answer

Workload identity federation allows the on-premises application to exchange OIDC tokens from the external IdP for short-lived Google Cloud access tokens, eliminating the need to store long-lived service account keys. This directly meets the requirement of accessing Cloud Storage buckets without managing static credentials.

Exam trap

Cisco often tests the misconception that network connectivity (VPN) alone solves authentication and authorization, but the question specifically requires identity-based access without static keys, which only workload identity federation provides.

How to eliminate wrong answers

Option A is wrong because Cloud VPN only provides network connectivity; it does not solve the authentication requirement of exchanging OIDC tokens for Google Cloud tokens. Option B is wrong because using a Compute Engine instance as a proxy still requires managing credentials or service account keys on that instance, and does not leverage the external IdP's OIDC tokens for direct federation. Option C is wrong because storing a service account key on-premises violates the explicit requirement to avoid long-lived keys and introduces security risks.

Practice this question →
30
Multi-Selectmedium

A company wants to implement a zero-trust access model for SSH access to Compute Engine instances. They need to ensure that only authorized users can connect and that all connections are logged. Which two services should they use? (Choose TWO.)

Select 2 answers
A.Identity-Aware Proxy (IAP)
B.Cloud NAT
C.Cloud Shell
D.Cloud VPN
E.Cloud Audit Logs
AnswersA, E

Provides zero-trust SSH access via TCP forwarding.

Why this answer

Identity-Aware Proxy (IAP) allows zero-trust TCP forwarding for SSH and RDP without a bastion host. Cloud Audit Logs record all IAP tunnel connections. Cloud NAT is for outbound internet, Cloud VPN is for network connectivity, and Cloud Shell is a browser-based terminal but does not provide zero-trust access control.

Practice this question →
31
MCQeasy

What is the purpose of Identity-Aware Proxy (IAP) on Google Cloud?

A.To enforce identity-based access control for web applications and SSH/RDP to VMs without requiring a VPN.
B.To manage firewall rules for VPC networks.
C.To provide a VPN connection between on-premises and Google Cloud.
D.To act as a web application firewall (WAF) that blocks SQL injection and XSS attacks.
AnswerA

IAP provides zero-trust access by verifying the user's identity and context, allowing access to web apps and VMs via SSH/RDP without a VPN.

Why this answer

Identity-Aware Proxy (IAP) is a service that provides a zero-trust access control layer for applications and resources. It verifies a user's identity and context before allowing access, enforcing application-level access control. It is not a VPN or firewall; it works at the identity level, not network level.

It does not replace Cloud Armor or VPC firewalls but complements them.

Practice this question →
32
Multi-Selecteasy

A company wants to use Google Cloud Directory Sync (GCDS) to synchronize users and groups from an on-premises Active Directory to Cloud Identity. Which two prerequisites must be met? (Choose two.)

Select 2 answers
A.A service account with the Directory Sync role.
B.An organization policy that allows directory sync.
C.A Cloud Identity or Google Workspace account with super admin privileges.
D.A Compute Engine VM to run the GCDS service.
E.Network connectivity from the GCDS server to the Google servers.
AnswersC, E

GCDS requires super admin credentials to synchronize directory data.

Why this answer

GCDS needs a super admin account (A) and network connectivity to Google (C).

Practice this question →
33
MCQeasy

What is the purpose of Identity-Aware Proxy (IAP) in Google Cloud?

A.To manage API keys for services running on Google Cloud.
B.To authenticate users and enforce access policies for applications and VMs based on identity and context.
C.To provide network-level firewall rules for HTTP traffic.
D.To encrypt data in transit between clients and Google Cloud.
AnswerB

IAP uses identity and context to control access, aligning with zero-trust principles.

Why this answer

IAP provides zero-trust access control for web applications and SSH/RDP connections. It verifies user identity and context (device, location) before granting access, without requiring VPNs.

Practice this question →
34
MCQmedium

An organization uses Cloud Directory Sync to synchronize users from on-premises Active Directory to Cloud Identity. After syncing, a user reports they cannot access a Google Cloud project even though they are a member of the correct AD group. The group has been assigned the roles/compute.admin role on the project. What is the most likely cause?

A.The role was assigned at the organization level instead of the project level
B.The user needs to log out and log back in to refresh their session
C.The user is not a direct member of the group; they are a nested group member
D.The group was not synced as a Google Group; only users were synced
AnswerD

If the group object is not synced, the IAM policy binding to the group will have no effect because the group does not exist in Cloud Identity.

Why this answer

Cloud Directory Sync synchronizes users and groups, but group membership changes may take time to propagate. Additionally, the group must be synced as a Google Group or Cloud Identity group with the proper membership synced. If the group is not recognized in Cloud Identity, the IAM binding will not apply to the users.

Practice this question →
35
MCQhard

A company has a Google Cloud organization with multiple folders representing departments. The security team wants to enforce that all Compute Engine VMs in the organization must have Shielded VM enabled. Which approach should the team use to enforce this requirement?

A.Use VPC Service Controls to restrict VM creation.
B.Apply an organization policy with the constraint constraints/compute.requireShieldedVm at the organization level.
C.Create a deny policy that denies the compute.instances.create permission unless Shielded VM is enabled.
D.Configure a custom role that includes the permission to create VMs only if Shielded VM is enabled.
AnswerB

This enforces Shielded VM across all projects.

Why this answer

Organization policies with constraints can be applied at the organization level and are inherited by all descendants. The constraint constraints/compute.requireShieldedVm enforces Shielded VM on all new VMs. Deny policies are for IAM permissions, not resource configurations.

VPC Service Controls is for data exfiltration prevention.

Practice this question →
36
MCQhard

A security team needs to allow a third-party application running on AWS to access a Cloud Storage bucket without using service account keys. The application already uses AWS IAM roles. Which Google Cloud feature should they use?

A.Secret Manager with a service account key
B.Identity-Aware Proxy (IAP)
C.Cloud VPN
D.Workload Identity Federation
AnswerD

Allows AWS workloads to impersonate a GCP SA using AWS IAM roles without keys.

Why this answer

Workload Identity Federation allows the AWS application to exchange its AWS IAM role credentials for Google Cloud temporary security tokens, enabling access to Cloud Storage without managing or storing service account keys. This is the correct approach because it directly addresses the requirement to avoid service account keys while leveraging the existing AWS IAM identity.

Exam trap

Cisco often tests the misconception that network-level solutions like Cloud VPN or IAP can solve identity and access management problems, but the key requirement here is identity federation, not network connectivity or application-layer proxy access.

How to eliminate wrong answers

Option A is wrong because Secret Manager with a service account key still requires storing and managing a long-lived service account key, which directly violates the requirement to avoid using service account keys. Option B is wrong because Identity-Aware Proxy (IAP) controls access to web applications and does not provide authentication or authorization for Cloud Storage bucket access via AWS IAM roles. Option C is wrong because Cloud VPN establishes an encrypted network tunnel between AWS and Google Cloud but does not handle identity federation or token exchange for accessing Cloud Storage.

Practice this question →
37
Multi-Selectmedium

A company uses Cloud Identity with SAML 2.0 federation from an external IdP. They want to enforce that users must be members of a specific group in the IdP to access GCP resources. Which two configurations are necessary? (Choose two.)

Select 2 answers
A.Create a corresponding group in Cloud Identity and map it to the IdP group.
B.Disable direct user accounts in Cloud Identity.
C.Use IAP to enforce group membership.
D.Create an organization policy to restrict access to only those users.
E.Configure the IdP to send group membership in the SAML assertion.
AnswersA, E

Cloud Identity groups can be used in IAM policies to grant access based on group membership.

Why this answer

To enforce group-based access, the IdP must send group info (A), and Cloud Identity groups must be created and mapped (B) so that IAM policies can reference them.

Practice this question →
38
MCQeasy

An organization wants to grant a team of data analysts the ability to run BigQuery queries and create datasets, but prevent them from deleting datasets or modifying IAM policies. Which predefined IAM role should be assigned?

A.roles/bigquery.dataOwner
B.roles/bigquery.dataViewer
C.roles/bigquery.dataEditor
D.roles/bigquery.jobUser
AnswerC

Allows creating datasets and running queries, but not deleting or managing IAM.

Why this answer

The BigQuery Data Editor role (roles/bigquery.dataEditor) allows creating datasets and running queries, but does not allow deleting datasets or modifying permissions. The Viewer role is read-only, Owner allows deletion and IAM changes, and Job User only allows running jobs without dataset creation.

Practice this question →
39
Multi-Selecteasy

A developer wants to grant a Kubernetes service account in GKE the ability to read objects from a specific Cloud Storage bucket. Which two resources need to be bound together? (Choose two.)

Select 2 answers
A.The Cloud Storage bucket
B.The IAM policy for the bucket
C.The Kubernetes service account
D.The GCP service account
E.The GKE cluster
AnswersC, D

The Kubernetes service account needs to be mapped to the GCP service account via Workload Identity.

Why this answer

Option C is correct because the Kubernetes service account is the identity used by pods running in GKE to authenticate to Google Cloud APIs. Option D is correct because a GCP service account is the IAM identity that must be granted permissions on the Cloud Storage bucket via IAM policies. The two are bound together using workload identity federation, which allows the Kubernetes service account to impersonate the GCP service account.

Exam trap

Cisco often tests the distinction between a Kubernetes service account (a cluster-internal identity) and a GCP service account (an IAM identity), and candidates mistakenly think the bucket or the cluster itself can be directly bound to the Kubernetes service account.

Practice this question →
40
MCQmedium

An organization uses Azure Active Directory as its identity provider. They want to allow employees to access Google Cloud resources using their Azure credentials without provisioning Google Cloud user accounts. Which solution should they implement?

A.Set up SAML 2.0 federation between Azure AD and Google Cloud using Cloud Identity.
B.Create Google Cloud user accounts for all employees and assign IAM roles directly.
C.Use Workforce Identity Federation to allow Azure AD users to authenticate to GCP.
D.Configure Cloud Directory Sync to synchronize Azure AD users to Google Cloud Directory.

Why this answer

Workload Identity Federation allows external identities (from AWS, Azure, or other OIDC providers) to impersonate a Google Cloud service account, eliminating the need to manage Google accounts or keys.

Practice this question →
41
MCQmedium

A security engineer is configuring access for a service account used by a batch job that runs on Compute Engine. The job needs to read from a BigQuery dataset and write results to Cloud Storage. What is the recommended way to grant these permissions?

A.Use the default compute engine service account and grant it BigQuery Admin (roles/bigquery.admin) and Storage Admin (roles/storage.admin).
B.Create a custom role with bigquery.datasets.get, bigquery.tables.get, bigquery.tables.getData, storage.objects.create, storage.objects.get, and storage.objects.list.
C.Grant the service account the BigQuery Data Owner role (roles/bigquery.dataOwner) and Storage Admin (roles/storage.admin).
D.Grant the service account the BigQuery Data Viewer (roles/bigquery.dataViewer) and Storage Object Viewer (roles/storage.objectViewer).
AnswerB

This custom role follows least privilege, granting only read on BigQuery and write on Storage.

Why this answer

Create a custom role with the required BigQuery and Storage permissions, or use predefined roles: BigQuery Data Viewer (roles/bigquery.dataViewer) and Storage Object Admin (roles/storage.objectAdmin) for write access. The best practice is to use the principle of least privilege: grant only the necessary permissions. Predefined roles are acceptable if they match the needs.

Practice this question →
42
MCQhard

A company needs to allow developers to create and manage custom IAM roles at the project level, but restrict the permissions that can be added to those roles to a predefined list. What should be used?

A.Grant the developers the IAM Role Administrator role (roles/iam.roleAdmin) and rely on training to only use allowed permissions.
B.Use a custom organization policy constraint to define the allowed permissions for custom roles.
C.Grant the developers the Project IAM Admin role (roles/resourcemanager.projectIamAdmin) and restrict roles via a deny policy.
D.Use the constraint constraints/iam.allowedPolicyMemberDomains to restrict the domains of members who can be assigned roles.
AnswerB

Custom constraints can restrict which permissions can be included in custom roles.

Why this answer

Custom roles can be defined at the organization or project level. To restrict the permissions that can be included, use an organization policy with a custom constraint that specifies allowed permissions for custom roles. Roles Administrator (roles/iam.roleAdmin) allows managing all roles.

Organization policy constraints like constraints/iam.allowedPolicyMemberDomains restrict member domains, not permissions. The correct approach is to create a custom organization policy constraint that limits the permissions that can be added to a custom role.

Practice this question →
43
MCQhard

An engineer is configuring Cloud Armor for an HTTP(S) load balancer and needs to allow traffic only from users who have been authenticated by Identity-Aware Proxy (IAP). The backend service already has IAP enabled. What additional configuration is needed to ensure that only authenticated requests reach the backend?

A.Configure Cloud Armor to allow only traffic from the IP ranges used by IAP
B.Create a Cloud Armor security policy that requires a valid JWT token signed by IAP
C.No additional configuration is needed; IAP already blocks unauthenticated requests
D.Set a firewall rule on the backend instances to allow traffic only from the load balancer's health check IPs
AnswerC

IAP intercepts requests before they reach Cloud Armor and rejects unauthenticated ones.

Why this answer

Option C is correct because when IAP is enabled on a backend service, it intercepts all requests and blocks unauthenticated traffic before it reaches the backend. Cloud Armor operates at the edge, but since IAP already enforces authentication at the application layer, no additional Cloud Armor configuration is required to restrict access to authenticated users. The load balancer forwards only requests that have passed IAP authentication to the backend.

Exam trap

The trap here is that candidates overthink the question and assume Cloud Armor must be explicitly configured to work with IAP, when in fact IAP independently blocks unauthenticated traffic at the load balancer level, making additional Cloud Armor rules unnecessary for this specific requirement.

How to eliminate wrong answers

Option A is wrong because IAP does not use fixed IP ranges for its authentication proxy; it uses a global, dynamic set of IPs that are not documented or stable, so relying on IP-based allowlisting in Cloud Armor would be unreliable and is not a supported method for IAP integration. Option B is wrong because Cloud Armor does not natively validate JWT tokens signed by IAP; JWT validation is handled by IAP itself at the application layer, and Cloud Armor security policies cannot inspect or validate JWT tokens for IAP authentication. Option D is wrong because firewall rules on backend instances that allow only load balancer health check IPs are unrelated to IAP authentication; they are used for network-level access control and do not enforce user authentication.

Practice this question →
44
MCQmedium

A developer needs to deploy an application on Compute Engine that reads from a Cloud Storage bucket. The engineer wants to avoid managing service account keys. What is the recommended approach to grant the necessary permissions?

A.Create a service account, generate a JSON key, and store it on the instance.
B.Use the default Compute Engine service account and grant it the Storage Object Viewer role.
C.Use Application Default Credentials (ADC) without a service account.
D.Create a custom service account, grant it required roles, and attach it to the Compute Engine instance.
AnswerD

This follows the principle of least privilege and avoids key management.

Why this answer

Option D is correct because attaching a custom service account directly to a Compute Engine instance is the recommended approach to avoid managing service account keys. This method uses the instance's metadata to provide credentials via the instance metadata server, eliminating the need to download, store, or rotate JSON key files. The custom service account can be granted only the required roles (e.g., Storage Object Viewer) following the principle of least privilege.

Exam trap

Cisco often tests the misconception that the default Compute Engine service account is the simplest and most secure choice, but the trap is that it usually has excessive permissions (e.g., the editor role) and is not recommended for production; the correct approach is to create a custom service account with minimal roles and attach it to the instance.

How to eliminate wrong answers

Option A is wrong because generating a JSON key and storing it on the instance introduces security risks and management overhead, directly contradicting the requirement to avoid managing service account keys. Option B is wrong because the default Compute Engine service account typically has overly broad permissions (e.g., project editor role) by default, and granting it Storage Object Viewer does not follow least privilege; moreover, using the default service account is not the recommended approach for production workloads. Option C is wrong because Application Default Credentials (ADC) still require a service account to be attached to the instance or a key file to be provided; ADC is a mechanism for finding credentials, not a substitute for a service account.

Practice this question →
45
MCQhard

A company has multiple Google Cloud projects organized under folders by department. The security team wants to enforce a policy that all Compute Engine instances must use Shielded VM features. They need to prevent non-compliant instances from being created. Which action should be taken to enforce this requirement most effectively?

A.Create an IAM deny policy at the organization level that denies the compute.instances.create permission unless the Shielded VM flag is set.
B.Create a custom role that includes the permission to create instances only with Shielded VM, and assign it to all users.
C.Use the Organization Policy Service with the constraint constraints/compute.requireShieldedVm.
D.Implement a service account that only has permission to create instances and use service account impersonation for all instance creation.
AnswerC

This built-in constraint forces Shielded VM to be required when creating instances. It can be applied at the folder level to cover all projects under a department.

Why this answer

Organization Policy constraints are the correct mechanism to enforce requirements across the resource hierarchy. The built-in constraint 'constraints/compute.requireShieldedVm' ensures that any new Compute Engine instance must have Shielded VM features enabled. This policy can be applied at the organization, folder, or project level.

IAM roles or custom roles cannot enforce instance configuration requirements. Service account impersonation is unrelated. Deny policies can deny specific permissions but not enforce Shielded VM settings.

Practice this question →
46
Multi-Selectmedium

A company needs to grant developers the ability to deploy applications to App Engine, but they should not be able to modify IAM policies. Which two roles should be assigned to the developers? (Choose two.)

Select 2 answers
A.roles/owner
B.roles/appengine.appViewer
C.roles/appengine.appAdmin
D.roles/appengine.serviceAdmin
E.roles/appengine.deployer
AnswersD, E

Service Admin allows managing services and versions, also does not include IAM modification.

Why this answer

The correct roles are App Engine Deployer and App Engine Service Admin. App Engine Admin includes IAM policy modification.

Practice this question →
47
MCQmedium

An organization uses Cloud Identity with a third-party IdP via SAML 2.0. A security engineer needs to enforce that all Google Cloud access requires multi-factor authentication (MFA) from the IdP. What is the recommended approach?

A.Create an organization policy constraint requiring the use of security keys for all users.
B.Require MFA in the third-party IdP before it issues SAML assertions.
C.Enable MFA enforcement in the Cloud Identity admin console for all users.
D.Configure a context-aware access level in Access Context Manager that requires MFA, and apply it to Google Cloud resources.
AnswerB

This is the recommended approach: enforce MFA at the IdP so that only authenticated users with MFA can access Google Cloud resources.

Why this answer

The best practice is to configure MFA at the IdP level because the IdP is the authoritative source for authentication. This ensures MFA is enforced before SAML assertion is issued, and it works for all applications relying on that IdP, including Google Cloud. Enforcing MFA on Google Cloud side via IAP or context-aware access is possible but not the recommended primary enforcement for SAML federated users; it should be done at the IdP.

Practice this question →
48
MCQmedium

A company wants to allow an application running on an on-premises server to access Cloud Storage without using long-lived service account keys. The on-premises environment uses Azure Active Directory (Azure AD) as its identity provider. Which GCP feature should they use?

A.Service Account Key rotation policy.
B.Workload Identity Federation with Azure AD as an identity provider.
C.Create a custom OAuth 2.0 client ID for the application.
D.Use a VPN between on-premises and GCP, and allow the on-premises server to use a metadata server.
AnswerB

Workload Identity Federation allows keyless authentication using tokens from Azure AD.

Why this answer

Workload Identity Federation supports Azure AD as an external identity provider. The on-premises app can obtain an Azure AD token and exchange it for a GCP service account token, eliminating the need for keys.

Practice this question →
49
Multi-Selecthard

A security administrator needs to deploy a solution that allows a group of developers to access a web application running on Compute Engine behind an internal HTTP load balancer. The solution must enforce access based on user identity and device security status, and must not expose the application to the public internet. Which THREE components are required?

Select 3 answers
A.Cloud NAT
B.Cloud Armor
C.Access Context Manager (Access Levels)
D.Identity-Aware Proxy (IAP)
E.Internal HTTP Load Balancer
AnswersC, D, E

Access levels define device security requirements for IAP.

Why this answer

Identity-Aware Proxy (IAP) provides identity and context-aware access. An internal HTTP load balancer keeps the app private. Context-aware access requires an access level (e.g., based on device policy).

IAP uses access levels to enforce security.

Practice this question →
50
Multi-Selecthard

A security administrator needs to grant a team of developers the ability to deploy applications to a GKE cluster, but only to specific namespaces. The developers should not be able to modify cluster-level resources or IAM policies. Which three steps should the administrator take? (Choose THREE.)

Select 3 answers
A.Create a Kubernetes Role in the namespace with permissions to create and manage pods and services.
B.Grant the developers the Kubernetes Engine Developer role (roles/container.developer) at the project level.
C.Create a ClusterRole and ClusterRoleBinding for the namespace.
D.Grant the developers the Kubernetes Engine Cluster Viewer role (roles/container.clusterViewer) at the project level.
E.Create a RoleBinding in the namespace that binds the developers' group to the Role.
AnswersA, B, E

Namespace-scoped role for developers.

Why this answer

Option A is correct because a Kubernetes Role defines permissions within a specific namespace, and granting permissions to create and manage pods and services aligns with the requirement to deploy applications without cluster-level access. This ensures developers can only interact with resources in the designated namespace, adhering to the principle of least privilege.

Exam trap

The trap here is that candidates often confuse the project-level IAM roles (like roles/container.developer) with Kubernetes RBAC roles, assuming one is sufficient for namespace-scoped access, but both are required: IAM for cluster access and RBAC for namespace-level permissions.

Practice this question →
51
MCQmedium

A security administrator wants to prevent users from disabling Shielded VM on existing Compute Engine instances. Which IAM permission should they deny?

A.compute.instances.setMetadata
B.compute.instances.setMachineResources
C.compute.instances.updateShieldedVmConfig
D.compute.instances.update
AnswerC

This permission specifically controls the ability to update Shielded VM settings on an existing instance.

Why this answer

The permission compute.instances.updateShieldedVmConfig controls the ability to update the Shielded VM configuration (enable/disable) on an existing instance. Denying this permission will prevent users from changing Shielded VM settings on instances. The permission compute.instances.setMetadata is for metadata changes, compute.instances.update is for general updates, and compute.instances.setMachineResources is for changing machine types.

Practice this question →
52
MCQhard

A Google Kubernetes Engine (GKE) cluster has applications that need to access Cloud Storage. The security team wants to grant fine-grained access per pod. What is the recommended approach?

A.Use Workload Identity: map each Kubernetes service account to a dedicated GCP service account with minimal permissions.
B.Use node-level service accounts and rely on network policies to restrict pod access.
C.Store service account keys as Kubernetes secrets and mount them into pods.
D.Create a single GCP service account with Storage permissions, and use it for all pods in the cluster.
AnswerA

Workload Identity allows per-pod identity mapping, enabling the principle of least privilege.

Why this answer

Workload Identity for GKE allows you to bind a Kubernetes service account to a GCP service account. Pods running with that Kubernetes SA can then authenticate as the GCP SA to access GCP resources. This provides pod-level granularity.

Practice this question →
53
MCQmedium

A company uses Cloud Identity to manage users and groups. They want to synchronize users from their on-premises Active Directory to Cloud Identity. Which tool should they use?

A.Identity and Access Management (IAM)
B.Cloud Deployment Manager
C.Google Cloud Directory Sync (GCDS)
D.Cloud Identity SDK
AnswerC

Correct: GCDS syncs AD/LDAP to Cloud Identity.

Why this answer

Google Cloud Directory Sync (GCDS) is the official tool for synchronizing users and groups from Active Directory or LDAP to Cloud Identity. Cloud Identity SDK is not a sync tool. Deployment Manager is for infrastructure.

IAM is for access control.

Practice this question →
54
Multi-Selectmedium

A company wants to enforce that only users from a specific domain (example.com) can be granted IAM roles on any resource in their organization. Which two steps are required? (Choose two.)

Select 2 answers
A.Create custom roles that only allow users from example.com.
B.Configure Cloud Identity or Google Workspace to manage the example.com domain.
C.Set the organization policy constraint 'constraints/iam.allowedPolicyMemberDomains' to include example.com.
D.Create an IAM deny policy to deny access to users from other domains.
E.Use Cloud Directory Sync to sync only example.com users.
AnswersB, C

The constraint requires the domain to be managed by Cloud Identity/Workspace.

Why this answer

Enforcing allowed member domains requires setting the organization policy constraint 'constraints/iam.allowedPolicyMemberDomains' to include example.com. Additionally, configuring Cloud Identity or Google Workspace with the domain is necessary for the constraint to work. IAM deny policies are not used.

Custom roles are not required. Cloud Directory Sync is for syncing users, not enforcement.

Practice this question →
55
MCQeasy

Your organization wants to assign a set of permissions to a group of users that allows them to create and delete Compute Engine instances, but not to modify other resources like Cloud Storage buckets. Which type of IAM role should you create?

A.Predefined role (roles/compute.instanceAdmin.v1)
B.Basic role (Editor)
C.Predefined role (roles/editor)
D.Custom role with only compute.instances.create and compute.instances.delete
AnswerD

A custom role allows you to include exactly the permissions needed, granting fine-grained access control.

Why this answer

Custom IAM roles allow you to curate a specific set of permissions tailored to your needs. Predefined roles like roles/compute.instanceAdmin include broader permissions that may not be desired. Basic roles (Owner, Editor, Viewer) are too broad and should be avoided in production.

Practice this question →
56
Multi-Selecthard

A company runs a batch job on Compute Engine that reads data from Cloud Storage and writes results to BigQuery. The Compute Engine instance uses a service account. The job fails with a permission error. Which THREE steps should the engineer take to resolve this? (Choose three.)

Select 3 answers
A.Grant the service account the roles/bigquery.dataEditor role on the BigQuery dataset
B.Grant the service account the roles/iam.serviceAccountUser role on itself
C.Enable the Cloud Storage and BigQuery APIs in the project
D.Grant the service account the roles/storage.objectViewer role on the Cloud Storage bucket
E.Ensure the service account has the cloud-platform scope when creating the instance
AnswersA, D, E

This grants write access to the dataset.

Why this answer

Option A is correct because the service account needs the roles/bigquery.dataEditor role on the BigQuery dataset to write data (insert rows) into BigQuery tables. Without this IAM permission, the job fails with a permission error when attempting to execute INSERT or load jobs against the dataset.

Exam trap

Cisco often tests the distinction between IAM roles and OAuth scopes; the trap here is that candidates think granting IAM roles alone is sufficient, but they forget that Compute Engine instances also require the correct access scopes (e.g., cloud-platform) to actually use those roles.

Practice this question →
57
MCQmedium

A security team wants to enforce that all Compute Engine instances in the organization use Shielded VM features (Secure Boot, vTPM, Integrity Monitoring). What should they configure?

A.A custom organization policy with a CEL condition
B.An IAM policy that only allows creation of Shielded VMs
C.The built-in constraint constraints/compute.requireShieldedVm
D.A deny policy that denies the permission compute.instances.create unless Shielded VM is enabled
AnswerC

This built-in constraint enforces Shielded VM on all new instances.

Why this answer

The organization policy constraint constraints/compute.requireShieldedVm enforces that all new VMs must have Shielded VM enabled. It is a built-in constraint available in the Organization Policy service.

Practice this question →
58
MCQeasy

An organization wants to use a third-party identity provider (IdP) that supports OpenID Connect (OIDC) to manage access to Google Cloud resources. They want users to authenticate with the external IdP and access GCP via the Cloud Console and gcloud CLI. Which feature should they use?

A.Cloud Identity with OIDC federation
B.Cloud Identity with SAML 2.0 federation
C.Service account key authentication
D.Workload Identity Federation
AnswerA

Cloud Identity supports OIDC federation for user authentication with external IdPs.

Why this answer

Cloud Identity supports OIDC federation, allowing users to authenticate with an external OIDC IdP and access GCP.

Practice this question →
59
Multi-Selectmedium

A company wants to implement single sign-on (SSO) for its employees to access the Google Cloud Console using their existing corporate credentials from an on-premises Active Directory. Which THREE components are required? (Choose 3)

Select 3 answers
A.Workload Identity Federation to map AD users to service accounts.
B.Cloud Directory Sync to synchronize user and group objects from Active Directory to Google Cloud Directory.
C.A VPN connection between the on-premises network and Google Cloud.
D.A SAML 2.0 identity provider (e.g., AD FS) that authenticates users against Active Directory.
E.Cloud Identity or Google Workspace to configure the SAML integration.
AnswersB, D, E

Users must exist in Google's directory for IAM assignments.

Why this answer

SAML 2.0 federation requires a SAML Identity Provider (AD FS or similar) to authenticate users, Cloud Identity or Google Workspace as the identity platform to configure the SAML trust, and Cloud Directory Sync to synchronize users from AD to Google Cloud Directory so that users exist in Google's directory for IAM binding.

Practice this question →
60
MCQeasy

A developer wants to grant a service account the ability to impersonate another service account in a different project. Which IAM permission is required for the developer to assign?

A.iam.serviceAccounts.actAs
B.iam.serviceAccounts.getAccessToken
C.iam.serviceAccounts.create
D.iam.serviceAccounts.update
AnswerA

Required to impersonate a service account.

Why this answer

The iam.serviceAccounts.actAs permission on the target service account allows a principal to impersonate that service account. This permission is included in the Service Account User role (roles/iam.serviceAccountUser). The developer needs to grant that role to the source service account (or user) on the target service account.

Practice this question →
61
MCQmedium

A DevOps engineer needs to allow a CI/CD pipeline running in Google Kubernetes Engine (GKE) to push images to a specific Artifact Registry repository. The pipeline uses a Kubernetes service account. What is the best practice to grant this access without creating a JSON key for a Google service account?

A.Use a node pool with a service account that has the required roles
B.Grant the GSA the IAM role directly on the namespace using RBAC
C.Use Workload Identity to bind the KSA to a GSA with the Artifact Registry Writer role
D.Create a JSON key for the GSA, store it as a Kubernetes secret, and mount it into the pod
AnswerC

Workload Identity enables keyless authentication by allowing the KSA to impersonate the GSA.

Why this answer

Workload Identity for GKE allows you to bind a Kubernetes service account (KSA) to a Google service account (GSA). The KSA can then impersonate the GSA when accessing Google Cloud APIs, eliminating the need for service account keys.

Practice this question →
62
MCQeasy

Which of the following is true about IAM deny policies?

A.Deny policies can only be applied at the organization level.
B.Deny policies take precedence over allow policies.
C.Deny policies are evaluated before allow policies.
D.Deny policies can grant permissions.
AnswerB

Correct: if a deny matches, access is denied regardless of allows.

Why this answer

Deny policies override allow policies. They are evaluated after allow policies, and if a deny matches, the access is denied regardless of allowed roles. They apply to the resource hierarchy as well.

Deny policies can be set at the organization, folder, project, or resource level.

Practice this question →
63
Multi-Selectmedium

A company wants to enforce that no service account keys are created for service accounts in a specific project. Additionally, they want to allow only users from their corporate domain (example.com) to be granted IAM roles. Which TWO organization policy constraints should they apply at the project level?

Select 2 answers
A.constraints/iam.workloadIdentityPoolProviders
B.constraints/iam.allowedPolicyMemberDomains
C.constraints/compute.requireShieldedVm
D.constraints/compute.restrictCloudArmorPolicies
E.constraints/iam.disableServiceAccountKeyCreation
AnswersB, E

Restricts IAM members to domains in the list.

Why this answer

The constraint 'constraints/iam.disableServiceAccountKeyCreation' prevents key creation. 'constraints/iam.allowedPolicyMemberDomains' restricts IAM members to specified domains. Both can be applied at the project level.

Practice this question →
64
MCQmedium

A security engineer needs to grant a DevOps team the ability to deploy and manage Cloud Run services, but they should not be able to modify IAM policies or delete the service. Which predefined role should be assigned?

A.Cloud Run Invoker (roles/run.invoker)
B.Cloud Run Admin (roles/run.admin)
C.Cloud Run Viewer (roles/run.viewer)
D.Cloud Run Developer (roles/run.developer)
AnswerD

This role allows creating, updating, and deploying services, but not deleting or modifying IAM.

Why this answer

Cloud Run Developer (roles/run.developer) allows creating, updating, and deleting Cloud Run services, but not modifying IAM policies. Cloud Run Admin (roles/run.admin) allows full control including IAM. Cloud Run Viewer (roles/run.viewer) is read-only.

Cloud Run Invoker (roles/run.invoker) only allows invoking services.

Practice this question →
65
MCQmedium

A company uses Active Directory (AD) on-premises and wants to synchronize user accounts to Google Cloud Identity for SSO with SAML 2.0. They require automatic user provisioning and de-provisioning. Which Google Cloud tool should they use?

A.Cloud Identity Platform
B.Google Workspace Admin SDK
C.Cloud Identity-Aware Proxy (IAP)
D.Cloud Directory Sync (CDS)
AnswerD

CDS synchronizes users and groups from AD/LDAP to Google Cloud Directory automatically.

Why this answer

Cloud Directory Sync (CDS) is the tool that synchronizes users from Active Directory or LDAP to Google Cloud Directory. It handles automatic provisioning and de-provisioning based on AD changes. SAML SSO is configured separately, but CDS is for directory sync.

Practice this question →
66
Multi-Selecthard

A security engineer needs to ensure that service account keys are not used in production workloads. They want to enforce this across the entire organization. Which TWO controls should they implement?

Select 2 answers
A.Use a custom organization policy constraint to enforce service account key rotation (max age 90 days)
B.Use VPC Service Controls to restrict the IAM API
C.Use the built-in constraint constraints/iam.disableServiceAccountKeyCreation
D.Use a deny policy to deny the permission iam.serviceAccountKeys.create
E.Use IAM roles to remove the ability to generate keys for all users
AnswersA, C

A custom constraint can enforce rotation and prevent use of old keys.

Why this answer

The built-in organization policy constraint constraints/iam.disableServiceAccountKeyCreation prevents creation of new keys. A custom organization policy can enforce key rotation and disable use of existing keys older than a certain age.

Practice this question →
67
MCQmedium

An organization wants to enforce that all new projects automatically have a specific set of IAM roles assigned to a security group. What is the best way to achieve this?

A.Create an organization policy that requires the roles to be assigned.
B.Use a Cloud Function triggered by Cloud Asset Inventory to assign the roles when a new project is created.
C.Assign the IAM roles to the security group at the organization level.
D.Use a service account with the Security Admin role to periodically scan and update new projects.
AnswerC

Organization-level IAM policies are inherited by all folders and projects, ensuring every new project gets the bindings.

Why this answer

Use organization policies? No, organization policies enforce constraints on resources, not IAM role bindings. You can use a folder-level IAM policy that applies to all projects in the folder. If all projects are under a folder, assign the roles to the folder.

Alternatively, use a custom script via Cloud Asset Inventory or Deployment Manager. The simplest is to assign IAM roles at the organization level, which are inherited by all projects. So assign the security group the necessary roles at the organization node.

Practice this question →
68
MCQeasy

An organization wants to allow users to authenticate to Google Cloud using their existing Active Directory credentials via SAML 2.0. Which Google Cloud identity service should they configure?

A.Workload Identity Federation
B.Identity-Aware Proxy
C.Cloud Identity
D.Cloud Directory Sync
AnswerC

Supports SAML 2.0 federation with an external IdP.

Why this answer

Cloud Identity or Google Workspace can be configured as a SAML 2.0 service provider (or identity provider) to federate with an external IdP like Active Directory. For SAML 2.0 SSO, Cloud Identity supports integration with external IdPs. Cloud Directory Sync syncs users but doesn't handle SSO.

IAP is for access control, not identity federation.

Practice this question →
69
MCQmedium

A security engineer needs to prevent users from creating service account keys in a Google Cloud project. The solution must be enforceable across all projects in the organization and should not block other IAM operations. Which approach should they use?

A.Use IAM Conditions to restrict service account key creation to only a specific project.
B.Create a custom role that excludes the permission iam.serviceAccountKeys.create and assign it to all users.
C.Use the Organization Policy Service with the constraint constraints/iam.disableServiceAccountKeyCreation.
D.Create an IAM deny policy at the organization level to deny the permission iam.serviceAccountKeys.create.
AnswerC

This is the correct method. The built-in constraint specifically disables service account key creation across the resource hierarchy.

Why this answer

Organization Policy constraints provide a way to enforce restrictions across the resource hierarchy. The built-in constraint 'constraints/iam.disableServiceAccountKeyCreation' specifically prevents creation of service account keys at the project, folder, or organization level. It does not affect other IAM operations.

IAM deny policies can deny specific permissions but are more complex to manage and apply at the org level for this specific use case. Custom roles are not designed for enforcement across projects. The Organization Policy Service is the correct choice for such organization-wide restrictions.

Practice this question →
70
MCQeasy

An organization needs to grant a contractor access to a specific project for 30 days, with the ability to start and stop Compute Engine instances but not delete them. Which IAM role should be used?

A.Compute Viewer (roles/compute.viewer)
B.Compute OS Login (roles/compute.osLogin)
C.Compute Admin (roles/compute.admin)
D.Compute Instance Admin (v1) (roles/compute.instanceAdmin.v1)
AnswerD

This role allows starting/stopping instances but not deleting them.

Why this answer

The Compute Instance Admin (v1) role (roles/compute.instanceAdmin.v1) allows starting, stopping, and modifying instances, but not deleting them. It is suitable for this scenario. Compute Admin (roles/compute.admin) allows full control including deletion.

Compute Viewer (roles/compute.viewer) is read-only. Compute Instance Operator (beta) might exist but not standard.

Practice this question →
71
MCQmedium

A DevOps team wants to grant a CI/CD pipeline (running on a Compute Engine VM) the ability to restart Compute Engine instances in a specific project. The VM has a service account attached. What is the best practice to grant this permission?

A.Create a custom role with compute.instances.stop and compute.instances.start permissions, and assign it to the service account at the project level.
B.Generate a service account key and use it in the CI/CD system to authenticate.
C.Grant the VM's service account the roles/iam.serviceAccountUser role so it can impersonate another service account that has Compute Admin.
D.Grant the service account the Compute Admin role (roles/compute.admin) at the project level.
AnswerA

Custom roles provide only necessary permissions, following least privilege.

Why this answer

The best practice is to create a custom role with only the required permissions (compute.instances.stop and compute.instances.start) and assign it to the service account.

Practice this question →
72
MCQeasy

A security engineer needs to configure Identity-Aware Proxy (IAP) for a web application running on Compute Engine. The goal is to ensure that only authenticated users from the corporate domain can access the application. What is the first step in the configuration?

A.Configure OAuth 2.0 consent screen and create credentials.
B.Enable IAP on the backend service of the load balancer.
C.Create a firewall rule to allow traffic only from IAP IP ranges.
D.Grant the IAP-secured Web App User role to the corporate domain users.
AnswerB

Enabling IAP on the backend service is the initial step to protect the application.

Why this answer

The first step is to enable IAP on the backend service or resource. Then configure OAuth consent screen, create an IAP access policy, and assign IAP-secured Web App User role to users. The correct order is to enable IAP first.

Practice this question →
73
MCQmedium

A user in a Google Cloud organization wants to create a custom IAM role at the project level. Which permission is required to create custom roles?

A.resourcemanager.projects.setIamPolicy
B.iam.roles.create
C.iam.serviceAccounts.create
D.iam.roles.update
AnswerB

This permission allows creation of custom roles.

Why this answer

The permission iam.roles.create is needed to create custom roles. This permission is included in roles like roles/iam.roleAdmin or roles/owner.

Practice this question →
74
MCQeasy

In the Google Cloud IAM resource hierarchy, which level supports the most granular policy attachment?

A.Folder
B.Organization
C.Project
D.Resource
AnswerD

Resources like Cloud Storage buckets are the most granular level for IAM policy attachment.

Why this answer

Policies can be attached at the organization, folder, project, and resource levels. The most granular is at the resource level, such as a specific Cloud Storage bucket or Compute Engine instance.

Practice this question →
75
Multi-Selectmedium

A company is migrating to Google Cloud and wants to implement least privilege access for their engineers. They have the following requirements: 1) Engineers must be able to create and manage Cloud Storage buckets. 2) Engineers must NOT be able to delete any resources. 3) Engineers should not be granted basic roles. Which two predefined roles should they combine to meet these requirements? (Choose two.)

Select 1 answer
A.roles/storage.objectAdmin with deletion permissions removed via a custom role
B.roles/storage.objectViewer
C.roles/storage.admin
D.roles/storage.objectCreator
E.roles/storage.objectAdmin
AnswersD

This role allows creating objects but not deleting them.

Why this answer

The correct combination is roles/storage.objectCreator and roles/storage.objectViewer. However, note that objectCreator does not allow bucket creation. Actually, to create buckets, they need roles/storage.admin or roles/storage.legacyBucketWriter.

The question states they need to create and manage buckets, which requires bucket-level permissions. Storage admin includes deletion. Perhaps the intended correct answer is roles/storage.admin and then use a deny policy to block deletion.

But that's not a predefined role combination. Given the constraints, the best predefined roles are roles/storage.admin (but it allows deletion) and roles/storage.objectViewer. However, deletion is not allowed.

Let's reconsider: To create buckets, they need roles/storage.admin (includes deletion) or roles/storage.legacyBucketWriter (but that is legacy). The question might be flawed. Instead, I'll provide a different question.

Practice this question →
Page 1 of 2 · 135 questions totalNext →

Ready to test yourself?

Try a timed practice session using only Pcse Configuring Access questions.

Start 20-question session