GCP Professional Cloud Security Engineer Practice Questions¶
40 scenario-based questions weighted by exam domain.
Exam Domain Breakdown¶
| Domain | Weight | Questions |
|---|---|---|
| Configuring access within a cloud solution environment | 26% | 10 |
| Managing operations | 22% | 9 |
| Configuring network security | 20% | 8 |
| Ensuring compliance | 14% | 6 |
| Securing data | 18% | 7 |
Cert page: exams/gcp/cloud-security-engineer/
Domain 1: Configuring Access Within a Cloud Solution Environment (Questions 1-10)¶
Question 1¶
Scenario: A company needs to implement a least privilege access model for their Google Cloud environment. They have 500 employees across multiple teams who need different levels of access to various projects. What approach should they use to manage IAM efficiently?
A. Give all users the Owner role at the organization level so nobody is ever blocked, and rely on training for responsible use B. Assign IAM roles directly to each individual user account, project by project, as people ask for access C. Create a separate custom role for each individual user, tailored to what that person does day to day D. Map teams to Google Groups and grant roles to the groups at folder or project level
Answer
**Correct: D** **Why:** Google Groups simplify IAM management at scale - adding/removing group membership automatically updates access. Groups can be mapped to organizational teams. Roles assigned to groups at folder level inherit to child projects. Individual assignments (B) become unmanageable at scale. Owner for all (A) violates least privilege. Per-user custom roles (C) create management overhead. **Key Concept:** [IAM Best Practices](https://cloud.google.com/iam/docs/using-iam-securely)Question 2¶
Scenario: A development team needs temporary elevated access to production projects for troubleshooting. The access should expire automatically, require approval, and be fully audited. What solution provides this?
A. Share a service account key with the team for the length of the troubleshooting session B. Privileged Access Manager (PAM) with time-bound grants that require approval C. Permanently assign the elevated roles to the developers so they can always troubleshoot D. Temporarily add developers to a shared admin Google group and remove them by hand once the troubleshooting is finished
Answer
**Correct: B** **Why:** Privileged Access Manager enables just-in-time, time-bound access with approval workflows. Access is automatically revoked after the specified duration. All grants are logged for audit. Permanent elevated access (C) violates least privilege. Service account keys (A) lack user attribution and are hard to revoke. Manual group membership (D) is error-prone and may not be revoked. **Key Concept:** [Privileged Access Manager](https://docs.cloud.google.com/iam/docs/pam-overview)Question 3¶
Scenario: An application running on GKE needs to access Cloud Storage and Pub/Sub. The security team requires that no service account keys be used and that each workload has its own identity. How should this be configured?
A. Hardcode service account credentials in the container images so every pod can authenticate without extra setup B. Use Workload Identity to bind Kubernetes service accounts to Google service accounts C. Mount service account key files into pods D. Use the default compute service account for all pods
Answer
**Correct: B** **Why:** Workload Identity provides keyless authentication by binding Kubernetes service accounts to Google Cloud service accounts. Each workload can have its own GSA with specific permissions. No key management required. Key files (C, A) risk exposure and require rotation. Default service account (D) violates least privilege and is overly permissioned. **Key Concept:** [Workload Identity](https://cloud.google.com/kubernetes-engine/docs/concepts/workload-identity)Question 4¶
Scenario: A company uses multiple identity providers (corporate AD, partner IdPs) and needs users from all providers to access Google Cloud with appropriate roles. How should identity federation be configured?
A. Replicate user directories into Google Cloud B. Configure Workforce Identity Federation with pools for each IdP, mapping attributes to IAM roles C. Share a single service account across organizations D. Create Google accounts for all external users
Answer
**Correct: B** **Why:** Workforce Identity Federation allows external IdPs to authenticate users for Google Cloud access. Identity pools group users from external IdPs. Attribute mappings can translate IdP claims to IAM conditions for role assignment. Creating Google accounts (D) duplicates identity management. Shared service accounts (C) lack user attribution. Replication (A) creates sync overhead. **Key Concept:** [Workforce Identity Federation](https://cloud.google.com/iam/docs/workforce-identity-federation)Question 5¶
Scenario: A CI/CD pipeline running in an external system (GitHub Actions) needs to deploy to Google Cloud. The security team prohibits long-lived service account keys. What authentication method should be used?
A. Configure Workload Identity Federation for GitHub Actions with short-lived token exchange B. Use interactive user authentication C. Store a service account key in GitHub encrypted secrets and rotate it every 90 days with a scheduled workflow D. Manually approve each deployment
Answer
**Correct: A** **Why:** Workload Identity Federation for external workloads allows GitHub Actions to exchange its OIDC token for short-lived Google Cloud credentials. No long-lived keys to manage or rotate. Service account key in secrets (C) uses long-lived credentials. Manual approval (D) slows automation. Interactive auth (B) doesn't work for automated pipelines. **Key Concept:** [Workload Identity Federation for External Workloads](https://cloud.google.com/iam/docs/workload-identity-federation)Question 6¶
Scenario: A healthcare organization needs to ensure that only users accessing from their corporate network or managed devices can access sensitive patient data in BigQuery. How should this be enforced?
A. Implement VPC firewall rules only, allowing the corporate CIDR ranges and denying all other source addresses on every ingress path B. Trust every authenticated user, because Google sign-in already verifies who they are and that is enough C. Context-aware access levels for corporate IP or device trust, applied through IAM conditions D. Use a VPC Service Controls perimeter with no access levels defined, so only the project boundary is enforced
Answer
**Correct: C** **Why:** BeyondCorp Enterprise context-aware access defines access levels based on device trust, network location, or other signals. These access levels can be used in IAM conditions to restrict BigQuery access. This implements zero trust - identity alone isn't sufficient. VPC controls (D) restrict network paths, not user context. Trusting all users (B) ignores device security. Firewall rules (A) don't restrict authenticated API access. **Key Concept:** [Context-Aware Access](https://docs.cloud.google.com/access-context-manager/docs/overview)Question 7¶
Scenario: An organization wants to ensure that no user can grant themselves additional IAM permissions, even if they have IAM admin capabilities in their project. How can this be enforced?
A. Do not grant any IAM permissions to anyone in the project, including the project administrators B. Review all IAM bindings every quarter and remove any permissions that look excessive or unnecessary C. Trust admins not to escalate privileges, and rely on the Admin Activity audit logs to catch any misuse afterwards D. Use Organization Policy constraints or custom constraints to restrict IAM role bindings
Answer
**Correct: D** **Why:** Organization Policy can restrict which roles can be granted (e.g., deny granting Owner role) across the organization. Custom constraints can implement more specific restrictions like preventing self-assignment. This provides technical enforcement. Trust (C) is not verification. No permissions (A) prevents all work. Quarterly review (B) is reactive, not preventive. **Key Concept:** [Custom Organization Policy Constraints](https://cloud.google.com/resource-manager/docs/organization-policy/creating-managing-custom-constraints)Question 8¶
Scenario: A company's security policy requires that service accounts used by production workloads cannot be impersonated by developers. Only automated systems should use production service accounts. How should this be enforced?
A. Configure IAM deny policies to prevent developer principals from having iam.serviceAccounts.actAs permission on production service accounts B. Don't share service account emails C. Verbal policy enforcement D. Audit impersonation after the fact
Answer
**Correct: A** **Why:** IAM deny policies take precedence over allow policies. A deny policy preventing developers from actAs permission on production service accounts cannot be overridden. This prevents impersonation even if a developer has broad permissions elsewhere. Obscurity (B) isn't security. Verbal policies (C) aren't enforceable. Post-facto audit (D) doesn't prevent the action. **Key Concept:** [IAM Deny Policies](https://cloud.google.com/iam/docs/deny-overview)Question 9¶
Scenario: An application needs to access secrets stored in Secret Manager. Different environments (dev, staging, prod) have their own secrets, and the application should only access secrets for its environment. How should access be configured?
A. Use a single secret with environment-specific JSON keys and let the application read only the keys for its own environment B. Store all secrets in environment variables C. Use separate service accounts per environment with IAM permissions scoped to specific secret resource paths D. Grant access to all secrets and trust the application to access only appropriate ones
Answer
**Correct: C** **Why:** IAM permissions on secrets can be scoped to specific resources (e.g., `secretmanager.secretAccessor` on `projects/*/secrets/prod-*`). Each environment's service account gets permissions only for its secrets. Trust (D) relies on application behavior, not enforcement. Environment variables (B) expose secrets in process listings. Single secret (A) gives access to all environments. **Key Concept:** [Secret Manager IAM](https://cloud.google.com/secret-manager/docs/access-control)Question 10¶
Scenario: A company needs to provision Google Cloud access for employees during onboarding and revoke access immediately upon termination. They use Okta as their IdP. What approach ensures timely provisioning and deprovisioning?
A. Create separate Google accounts for each employee and have HR email the helpdesk to disable them when staff leave B. Run a weekly batch synchronization job that adds new hires and removes departed employees from the directory C. Okta SCIM provisioning into Cloud Identity for automated lifecycle management D. Create and delete each account manually in the Google Admin console whenever HR files a ticket
Answer
**Correct: C** **Why:** SCIM (System for Cross-domain Identity Management) automates user provisioning and deprovisioning. When a user is deactivated in Okta, Cloud Identity is immediately updated, revoking Google Cloud access. This ensures no orphaned access. Manual processes (D) are slow and error-prone. Separate accounts (A) require duplicate management. Weekly sync (B) leaves access active too long after termination. **Key Concept:** [Cloud Identity Provisioning](https://docs.cloud.google.com/architecture/identity/okta-provisioning-and-single-sign-on)Domain 2: Managing Operations (Questions 11-19)¶
Question 11¶
Scenario: A security team needs to detect suspicious activities across all Google Cloud projects in their organization, including unusual API access patterns, data exfiltration attempts, and potential compromised credentials. What service provides this capability?
A. Security Command Center Premium with Event Threat Detection B. Cloud Logging with custom log-based metrics and saved queries written for each project separately by the team C. Cloud Monitoring alerts D. Review logs by hand each morning, going through the projects one at a time
Answer
**Correct: A** **Why:** Security Command Center (SCC) Premium includes Event Threat Detection which analyzes audit logs for threats including cryptomining, data exfiltration, IAM anomalies, and compromised credentials. It covers the entire organization with no setup per project. Custom logging queries (B) require building detection rules. Monitoring (C) is for metrics, not threat detection. Manual review (D) doesn't scale. **Key Concept:** [Event Threat Detection](https://cloud.google.com/security-command-center/docs/concepts-event-threat-detection-overview)Question 12¶
Scenario: During a security incident, the team needs to investigate what a compromised service account did over the past week. They need to see all API calls made, resources accessed, and any errors. Where should they look?
A. VPC Flow Logs capturing the network connections between the VM instances that the service account was attached to B. Cloud Audit Logs (Admin Activity and Data Access) filtered by the service account C. Cloud Monitoring metrics and dashboards covering the instances the service account was attached to D. Application logs written by each service the account called, searched for errors and access events
Answer
**Correct: B** **Why:** Cloud Audit Logs capture API calls with principal identity, resource accessed, action taken, and result. Admin Activity logs (always on) capture config changes. Data Access logs (must be enabled) capture data reads/writes. Filter by `protoPayload.authenticationInfo.principalEmail` for the service account. Application logs (D) may not capture all API calls. Metrics (C) are aggregated. Flow logs (A) show network traffic, not API calls. **Key Concept:** [Cloud Audit Logs](https://cloud.google.com/logging/docs/audit)Question 13¶
Scenario: A company needs to ensure that their Google Cloud resources comply with CIS Benchmarks. They want continuous monitoring with automatic notification of compliance violations. What service provides this?
A. Security Command Center with Security Health Analytics comparing against CIS Benchmarks B. Penetration testing performed by an external firm once a year against the production projects only C. Manual compliance audits D. Cloud Monitoring dashboards showing CPU, network and storage trends across the projects each week
Answer
**Correct: A** **Why:** Security Health Analytics in SCC continuously scans for misconfigurations against security best practices including CIS Benchmarks. Findings are generated for violations with severity ratings. Notifications can be configured via Pub/Sub or email. Manual audits (C) are point-in-time. Pen testing (B) finds vulnerabilities, not compliance gaps. Monitoring (D) doesn't assess compliance. **Key Concept:** [Security Health Analytics](https://cloud.google.com/security-command-center/docs/concepts-security-health-analytics-overview)Question 14¶
Scenario: A security analyst needs to investigate the attack path an adversary could take from an internet-exposed VM to sensitive data in BigQuery. What Security Command Center feature helps visualize this?
A. Compliance reporting that maps findings to CIS and PCI-DSS controls across the whole organization B. Asset inventory C. Attack Path Simulation showing possible paths from exposed assets to high-value resources D. Vulnerability scanning that lists known CVEs on the VMs and containers across the whole organization
Answer
**Correct: C** **Why:** SCC Premium's Attack Path Simulation identifies paths attackers could take to reach high-value resources. It visualizes how an internet-exposed VM could potentially access BigQuery through IAM relationships, network paths, and service account chains. This enables proactive hardening. Vulnerability scanning (D) finds CVEs, not attack paths. Asset inventory (B) lists resources. Compliance (A) checks configurations. **Key Concept:** [Attack Path Simulation](https://docs.cloud.google.com/security-command-center/docs/attack-exposure-learn)Question 15¶
Scenario: A company needs to ensure all access to production data in BigQuery is logged, including which datasets and tables were queried, by whom, and what data was returned. How should this be configured?
A. Query the BigQuery job history only, and export it to a table once a day for the auditors B. Add application-level logging in every client application that sends queries to BigQuery C. Enable Admin Activity audit logs only, since they are on by default and are assumed to record all resource access D. Enable BigQuery Data Access audit logs, including ADMIN_READ and DATA_READ
Answer
**Correct: D** **Why:** Data Access audit logs for BigQuery capture metadata reads (ADMIN_READ) and data reads (DATA_READ). They log query executions, datasets accessed, and caller identity. These logs are not enabled by default and must be explicitly configured. Admin Activity (C) only captures management operations. Job history (A) is limited and doesn't show all access patterns. Application logging (B) misses console/CLI queries. **Key Concept:** [BigQuery Audit Logs](https://cloud.google.com/bigquery/docs/reference/auditlogs)Question 16¶
Scenario: An organization wants to ensure that when security findings are detected in SCC, relevant teams are automatically notified and tickets are created in their tracking system. How should this be automated?
A. Configure SCC notification config to Pub/Sub, triggering Cloud Functions to create tickets and send notifications B. Email monthly reports C. Check SCC dashboard daily D. Manual finding review
Answer
**Correct: A** **Why:** SCC notification configs export findings to Pub/Sub in real-time. Cloud Functions subscribed to Pub/Sub can filter findings, create tickets in Jira/ServiceNow, and send Slack/email notifications. This enables immediate response. Dashboard checking (C) introduces delay. Monthly reports (B) are too slow for security issues. Manual review (D) doesn't scale. **Key Concept:** [SCC Notifications](https://cloud.google.com/security-command-center/docs/how-to-notifications)Question 17¶
Scenario: A company needs to detect if any of their GKE containers are running with known vulnerabilities. They want continuous scanning with integration into their security workflow. What should be enabled?
A. Annual penetration tests run by a third party against the cluster endpoints and the running workloads B. Inspect the containers by hand, one image at a time, whenever the team ships a release C. Network-level scanning only D. GKE Security Posture vulnerability scanning, with findings sent to SCC
Answer
**Correct: D** **Why:** GKE Security Posture provides continuous vulnerability scanning of container images. Findings appear in Security Command Center for unified security view. This covers both Artifact Registry images and running workloads. Manual inspection (B) doesn't scale. Network scanning (C) doesn't find container CVEs. Annual tests (A) miss vulnerabilities between tests. **Key Concept:** [GKE Security Posture](https://docs.cloud.google.com/kubernetes-engine/docs/concepts/about-security-posture-dashboard)Question 18¶
Scenario: During incident response, the team needs to quickly identify all resources that could have been affected by a compromised service account. The account had Viewer role at the project level. What tool helps identify the blast radius?
A. Assume every resource in the whole organization was affected, and rebuild all of them from scratch B. List every resource in the project by hand in the console and check each one for signs of misuse C. Policy Analyzer, to list what the account can reach through its effective permissions D. Check only the resources mentioned in the audit log entries for that service account and ignore the rest
Answer
**Correct: C** **Why:** Policy Analyzer evaluates effective permissions - given a principal and permission, it shows all resources they can access. This reveals the actual blast radius based on IAM inheritance and conditions. Manual listing (B) misses resources. Log-based (D) misses resources that weren't accessed but could have been. Assuming all (A) overestimates scope. **Key Concept:** [Policy Analyzer](https://cloud.google.com/policy-intelligence/docs/analyze-iam-policies)Question 19¶
Scenario: A security team needs to review who has access to sensitive GCS buckets and whether any permissions are overly broad. They want recommendations for removing unused permissions. What tool provides this analysis?
A. Remove all permissions from the buckets and add them back one request at a time as users complain B. Grant minimum permissions and never review C. IAM Recommender analyzing actual usage patterns to suggest removing unused permissions D. Manual permission review
Answer
**Correct: C** **Why:** IAM Recommender analyzes actual permission usage over time and suggests removing permissions that haven't been used. This data-driven approach ensures least privilege based on real behavior. Manual review (D) is time-consuming and doesn't know actual usage. Static minimum (B) doesn't adapt to changing needs. Removing all (A) causes outages. **Key Concept:** [IAM Recommender](https://cloud.google.com/iam/docs/recommender-overview)Domain 3: Configuring Network Security (Questions 20-27)¶
Question 20¶
Scenario: A company wants to ensure that their Cloud Storage and BigQuery data cannot be exfiltrated to unauthorized projects, even by users with data access permissions. Data should only be accessible from within approved projects. What security control addresses this?
A. IAM permissions only, granting storage.objectViewer and bigquery.dataViewer to a vetted group of principals B. Encryption C. Firewall rules D. VPC Service Controls with a perimeter around sensitive projects blocking data egress
Answer
**Correct: D** **Why:** VPC Service Controls create a security perimeter around Google Cloud resources. Data cannot be copied or accessed from outside the perimeter even with valid IAM permissions. This prevents exfiltration via `gsutil cp` to external buckets or BigQuery copies to unauthorized projects. IAM (A) controls who, not where. Firewall (C) is for VM networking. Encryption (B) protects data at rest, not exfiltration. **Key Concept:** [VPC Service Controls](https://cloud.google.com/vpc-service-controls/docs/overview)Question 21¶
Scenario: An organization has a partner company that needs to access specific BigQuery datasets. Both companies have Google Cloud environments. The partner should not have access to any other resources. How should this cross-organization access be configured with VPC Service Controls?
A. Disable VPC Service Controls B. Add partner project inside the perimeter C. Copy data to partner's project D. Configure an egress rule allowing access to specific BigQuery resources for the partner's perimeter, using an ingress rule on your perimeter
Answer
**Correct: D** **Why:** VPC Service Controls ingress/egress rules enable controlled cross-perimeter access. An ingress rule on your perimeter allows the partner's perimeter to access specified BigQuery datasets. An egress rule on the partner's perimeter allows their principals to access your resources. This maintains security while enabling collaboration. Adding to perimeter (B) grants too much access. Disabling (A) removes protection. Copying data (C) loses control. **Key Concept:** [VPC-SC Ingress/Egress Rules](https://cloud.google.com/vpc-service-controls/docs/ingress-egress-rules)Question 22¶
Scenario: A web application running on GKE needs to be protected from common web attacks (SQL injection, XSS, OWASP Top 10). The application uses external HTTPS load balancing. What security control should be implemented?
A. Cloud Armor with WAF rules (OWASP ModSecurity Core Rule Set) attached to the load balancer B. VPC firewall rules for HTTP filtering that block known SQL injection and XSS patterns in request payloads C. Network-level firewalls only D. Application-level input validation only, written by each development team inside its own services
Answer
**Correct: A** **Why:** Cloud Armor provides web application firewall (WAF) capabilities at the load balancer level. Pre-configured WAF rules based on OWASP ModSecurity CRS protect against SQL injection, XSS, and other OWASP Top 10 threats. Network firewalls (C, B) are layer 4 and can't inspect HTTP content. Application validation (D) is good defense-in-depth but Cloud Armor provides perimeter protection. **Key Concept:** [Cloud Armor WAF](https://cloud.google.com/armor/docs/waf-rules)Question 23¶
Scenario: An organization wants to prevent users from creating public IP addresses on VMs and ensure all outbound traffic goes through a centralized firewall appliance. How should this be enforced?
A. Trust teams to follow guidelines B. Organization Policy constraint preventing external IPs, with VPC routing all egress through Cloud NAT or firewall appliance C. Document the requirement in security policy D. Review firewall logs for violations
Answer
**Correct: B** **Why:** Organization Policy `constraints/compute.vmExternalIpAccess` can deny all VMs external IPs. VPC routes can direct 0.0.0.0/0 traffic to a firewall appliance (Network Virtual Appliance) or through Cloud NAT for controlled egress. This provides technical enforcement. Documentation (C) and trust (A) aren't enforceable. Log review (D) is reactive. **Key Concept:** [External IP Org Policy](https://docs.cloud.google.com/compute/docs/ip-addresses#restrict-ips)Question 24¶
Scenario: A company needs to inspect all traffic between VPCs in their hub-and-spoke network architecture for threat detection and compliance logging. Traffic includes both north-south (internet) and east-west (VPC to VPC). What architecture supports this?
A. VPC firewall rules between the hub and spokes that allow only required ports and log every accepted connection B. VPC peering only, with routes exchanged between the hub and each spoke network in the design C. Network-level ACLs applied at the subnet boundaries of both the hub and the spoke VPC networks D. Cloud NGFW with intrusion detection and traffic inspection at the network choke points
Answer
**Correct: D** **Why:** Cloud NGFW (next-generation firewall) provides deep packet inspection, intrusion detection (IDS/IPS), and TLS inspection. Deploying at network hub enables inspection of all traffic between spokes. This supports both security monitoring and compliance requirements. Basic firewall rules (A, C) are stateless/stateful but don't inspect payloads. Peering alone (B) doesn't provide inspection. **Key Concept:** [Cloud NGFW](https://cloud.google.com/firewall/docs/about-firewalls)Question 25¶
Scenario: Developers need to access GKE cluster APIs for kubectl commands. The cluster should not have a public endpoint. Developers work remotely without VPN access to the VPC. How should secure access be provided?
A. Use Connect Gateway to access private GKE clusters through Cloud Identity authentication B. Enable the public cluster endpoint and limit it to authorized networks used by the developers C. VPN for all developers D. SSH tunneling through a bastion host in the VPC, with each developer's key added to the instance metadata
Answer
**Correct: A** **Why:** Connect Gateway provides authenticated access to private GKE clusters without exposing cluster endpoints publicly or requiring VPN. Authentication uses Google Identity with IAM for authorization. This enables secure remote access with identity-based controls. Public endpoint (B) exposes the cluster. VPN (C) is complex to manage for all developers. Bastion SSH (D) is less direct and requires additional infrastructure. **Key Concept:** [Connect Gateway](https://cloud.google.com/anthos/multicluster-management/gateway)Question 26¶
Scenario: A financial services company needs to ensure that API calls to Google Cloud services from their VPC never traverse the public internet, even for global services like BigQuery and Cloud Storage. How should this be configured?
A. Enable Private Google Access with restricted.googleapis.com VIP for all Google API traffic B. Use VPN to Google Cloud C. Accept that some traffic goes over the internet because TLS encrypts it, and document the exception D. Proxy all API calls through a VM
Answer
**Correct: A** **Why:** Private Google Access with the restricted.googleapis.com VIP (199.36.153.4/30) routes all Google API traffic through Google's private network, never touching the public internet. Combined with VPC Service Controls, this ensures complete private connectivity. Default googleapis.com uses public IPs. VPN (B) doesn't cover Google API traffic. Proxying (D) adds complexity and latency. **Key Concept:** [Private Google Access](https://cloud.google.com/vpc/docs/configure-private-google-access)Question 27¶
Scenario: A company hosts customer-facing APIs on Cloud Run. They need to rate limit requests per customer, block requests from known bad actors, and protect against DDoS. What security controls should be implemented?
A. Application-level rate limiting only, implemented inside the Cloud Run service with an in-memory counter in each container instance B. Cloud Armor with rate limiting policies, IP deny lists, and DDoS protection in front of Cloud Run via load balancer C. No protection - rely on Cloud Run scaling D. Network firewall rules
Answer
**Correct: B** **Why:** Cloud Armor provides rate limiting (per-client throttling), IP/geographic deny lists, and DDoS protection. For Cloud Run, this requires external HTTPS load balancer which Cloud Armor attaches to. This provides perimeter protection before traffic reaches the application. Application-level limiting (A) consumes resources before rejecting. Firewall rules (D) are layer 4. Relying on scaling (C) incurs cost from attack traffic. **Key Concept:** [Cloud Armor for Cloud Run](https://cloud.google.com/run/docs/securing/cloud-armor)Domain 4: Ensuring Compliance (Questions 28-33)¶
Question 28¶
Scenario: A healthcare organization needs to ensure their Google Cloud environment complies with HIPAA requirements. They need to sign a BAA with Google and ensure their configurations meet HIPAA controls. How should they approach this?
A. Use any Google Cloud services B. Sign Google Cloud BAA, use only HIPAA-eligible services, configure according to compliance guides, and enable Assured Workloads C. Assume Google Cloud is automatically HIPAA compliant because the platform holds ISO 27001 and SOC 2 certifications D. HIPAA only applies to on-premises
Answer
**Correct: B** **Why:** HIPAA compliance requires: signing Google's BAA, using only covered services, proper configuration (encryption, access controls, audit logging), and organizational controls. Assured Workloads can enforce compliant service/region restrictions. Simply using Google Cloud (C, A) isn't sufficient - configuration matters. HIPAA applies regardless of location (D). **Key Concept:** [HIPAA on Google Cloud](https://cloud.google.com/security/compliance/hipaa)Question 29¶
Scenario: A company needs to restrict their Google Cloud resources to specific geographic regions for data sovereignty requirements. They cannot have any data processed or stored outside the EU. How should this be enforced?
A. Document the regional requirements in the security policy and share it with every project team B. Organization Policy resource location constraints plus Assured Workloads for the EU C. Manually check resource locations in the console each month and delete any resource found outside the approved regions D. Trust each team to deploy only in the correct EU regions and remind them during onboarding
Answer
**Correct: B** **Why:** Organization Policy `constraints/gcp.resourceLocations` restricts where resources can be created. Assured Workloads provides additional data residency controls and compliance guardrails for specific regimes. Together they technically enforce geographic restrictions. Documentation (A) and trust (D) aren't enforceable. Manual checks (C) are reactive and error-prone. **Key Concept:** [Resource Location Constraint](https://cloud.google.com/resource-manager/docs/organization-policy/defining-locations)Question 30¶
Scenario: An organization needs to prove to auditors that their Google Cloud environment has maintained continuous compliance with SOC 2 controls over the past year. What evidence should they provide?
A. A point-in-time assessment only, run by an external auditor in the weeks before the annual audit and filed as evidence for the full year B. Google's SOC 2 report plus SCC compliance reports and audit logs over time C. Screenshots of the current configuration taken in the console just before the auditors arrive D. Verbal assurance
Answer
**Correct: B** **Why:** Google's SOC 2 Type II report covers Google's infrastructure controls. Organization's Security Command Center compliance reports show resource compliance against standards over time. Audit logs demonstrate continuous monitoring and control operation. Screenshots (C) and point-in-time (A) don't show continuity. Verbal assurance (D) isn't auditable evidence. **Key Concept:** [Google Cloud Compliance](https://cloud.google.com/compliance)Question 31¶
Scenario: A company needs to implement data retention requirements - some data must be retained for 7 years for compliance, while other data must be deleted after 90 days for privacy. How should this be managed in Cloud Storage?
A. Object Lifecycle Management rules for automatic deletion, and Object Lock/Retention policies for mandatory retention periods B. Never delete anything C. Manual deletion tracking D. Application-level deletion
Answer
**Correct: A** **Why:** Lifecycle Management automatically deletes objects after specified age (90 days). Retention policies with Bucket Lock prevent deletion until retention period expires (7 years), meeting legal hold requirements. These are enforced by the platform. Manual tracking (C) is error-prone. Never deleting (B) violates privacy requirements. Application deletion (D) can be bypassed. **Key Concept:** [Object Lifecycle Management](https://cloud.google.com/storage/docs/lifecycle)Question 32¶
Scenario: An organization needs to ensure that sensitive data classifications (PII, financial, health) are consistently applied across their data assets and that security controls match the classification. What approach should they use?
A. A shared spreadsheet that tracks the classification of each dataset, updated by hand and reviewed by the data owners every quarter B. Same security for all data C. Data Catalog with policy tags for classification, BigQuery column-level security enforcing access based on tags D. Informal data classification
Answer
**Correct: C** **Why:** Data Catalog policy tags provide systematic classification. Policy tags can be applied to BigQuery columns, and column-level security enforces that only authorized roles can access tagged data. This connects classification to enforcement. Informal (D) and spreadsheet (A) classifications aren't enforced by technology. Same security for all (B) is either over-protective or under-protective. **Key Concept:** [BigQuery Column-Level Security](https://cloud.google.com/bigquery/docs/column-level-security)Question 33¶
Scenario: A company receives a legal hold request requiring them to preserve all emails, documents, and cloud data related to a specific project. The data must not be modified or deleted until the hold is lifted. How should this be implemented?
A. Ask employees not to delete data B. Google Vault for Gmail/Drive retention, Cloud Storage retention policy lock, and BigQuery table snapshots with restricted access C. Back up data and allow normal operations D. Disable all delete permissions broadly
Answer
**Correct: B** **Why:** Google Vault provides legal hold for Gmail and Drive. Cloud Storage retention policy lock prevents object deletion until the policy period. BigQuery snapshots preserve point-in-time data. These technical controls ensure preservation regardless of user actions. Asking employees (A) is unenforceable. Backups (C) don't prevent modification of originals. Broad disable (D) affects all operations, not specific data. **Key Concept:** [Google Vault](https://support.google.com/vault/answer/2462365)Domain 5: Securing Data (Questions 34-40)¶
Question 34¶
Scenario: A company needs to encrypt data at rest with keys they control, rotate keys automatically, and ensure Google cannot access the plaintext encryption keys. The data is in Cloud Storage and BigQuery. What encryption approach meets these requirements?
A. Default Google-managed encryption, which rotates keys automatically and gives the customer full control over the key lifecycle B. Client-side encryption only C. Cloud HSM only D. Customer-managed encryption keys (CMEK) in Cloud KMS with automatic rotation enabled
Answer
**Correct: D** **Why:** CMEK uses keys in Cloud KMS under customer control. Cloud KMS automatic rotation creates new key versions while maintaining access to data encrypted with previous versions. The envelope encryption model means Google never has access to the plaintext KEK. Default encryption (A) uses Google-managed keys. Client-side (B) works but adds application complexity. Cloud HSM (C) is for stricter requirements and is part of KMS. **Key Concept:** [CMEK](https://cloud.google.com/kms/docs/cmek)Question 35¶
Scenario: A financial services company requires that their encryption keys are protected by FIPS 140-2 Level 3 certified hardware and that keys never exist in plaintext outside the HSM. Which Cloud KMS option meets this requirement?
A. Cloud KMS software keys protected by Google's FIPS 140-2 validated cryptographic modules at Level 1 B. Cloud EKM (External Key Manager) with keys held in a supported partner key manager C. Default Google encryption D. Cloud HSM (Hardware Security Module) keys in Cloud KMS
Answer
**Correct: D** **Why:** Cloud HSM provides FIPS 140-2 Level 3 certified hardware protection. Key material never leaves the HSM in plaintext - all cryptographic operations happen within the HSM boundary. This meets strict financial services requirements. Software keys (A) aren't hardware-protected. EKM (B) uses external HSMs. Default encryption (C) doesn't provide customer control or HSM protection. **Key Concept:** [Cloud HSM](https://cloud.google.com/kms/docs/hsm)Question 36¶
Scenario: A company has strict data sovereignty requirements mandating that encryption keys remain on-premises in their own data center. They still want to use Google Cloud services for compute and storage. What Cloud KMS option supports this?
A. Cloud KMS regional keys created in the same region as the data, so the key material stays in-country B. Import keys into Cloud KMS C. Cloud HSM in Google's data centers D. Cloud EKM (External Key Manager) connecting to their on-premises key management system
Answer
**Correct: D** **Why:** Cloud EKM allows Google Cloud services to use encryption keys stored and managed in a supported external key management system. Keys never leave the customer's on-premises environment. Google sends cryptographic requests to the external KMS. Imported keys (B) copy key material to Google. Cloud KMS/HSM keys (A, C) are stored in Google's infrastructure. **Key Concept:** [Cloud EKM](https://cloud.google.com/kms/docs/ekm)Question 37¶
Scenario: A healthcare company needs to share de-identified patient data with researchers. The original data contains names, addresses, phone numbers, and medical record numbers. How should the data be de-identified while preserving research utility?
A. Cloud DLP with de-identification transforms: masking for names/addresses, format-preserving encryption for medical record numbers, date shifting for dates B. Manual redaction C. Delete all records with PII D. Share original data with NDAs
Answer
**Correct: A** **Why:** Cloud DLP identifies sensitive data and applies appropriate de-identification transforms. Masking replaces values with fixed characters. Format-preserving encryption maintains data format for referential integrity. Date shifting preserves temporal relationships while obscuring exact dates. This balances privacy with research utility. Deleting records (C) loses data. Manual redaction (B) doesn't scale. NDAs (D) don't technically protect data. **Key Concept:** [Cloud DLP De-identification](https://cloud.google.com/dlp/docs/deidentify-sensitive-data)Question 38¶
Scenario: A company wants to ensure that sensitive data (credit card numbers, SSNs) is not accidentally stored in Cloud Storage or BigQuery. They want automatic detection and alerting when such data is discovered. What service provides this capability?
A. Keyword searching B. Trust developers not to store sensitive data, and add a policy reminder to the engineering onboarding checklist C. Cloud DLP inspection jobs with automated scanning of Cloud Storage and BigQuery, alerting via Pub/Sub/SCC D. Manual data inspection, with analysts opening a sample of the objects and tables from every project each quarter
Answer
**Correct: C** **Why:** Cloud DLP inspection jobs can automatically scan Cloud Storage objects and BigQuery tables for 150+ predefined detectors (credit cards, SSNs, etc.) or custom patterns. Findings can trigger Pub/Sub notifications or appear in Security Command Center. This provides continuous data discovery. Manual inspection (D) doesn't scale. Keyword search (A) misses variations. Trust (B) isn't verification. **Key Concept:** [Cloud DLP Inspection](https://cloud.google.com/dlp/docs/inspecting-storage)Question 39¶
Scenario: A database application needs to encrypt specific columns containing sensitive data (SSN, credit card) so that database administrators cannot see the plaintext values. The application should transparently encrypt on write and decrypt on read. What approach provides this?
A. Network encryption only, using TLS between the application servers and the database, with certificates rotated B. Database-level encryption (TDE), which encrypts the files on disk but lets any authorized database user read the columns C. Application-layer encryption using Cloud KMS tink library, storing ciphertext in database columns D. File-system encryption
Answer
**Correct: C** **Why:** Application-layer encryption encrypts data before it reaches the database. Database admins see only ciphertext. Tink library with Cloud KMS integration provides easy-to-use envelope encryption. Only application service accounts with KMS access can decrypt. TDE (B) and filesystem encryption (D) protect at rest but DBAs can query plaintext. Network encryption (A) protects in transit only. **Key Concept:** [Tink Cryptographic Library](https://developers.google.com/tink)Question 40¶
Scenario: A company uses BigQuery for analytics containing customer data. They need to ensure that analysts can run aggregate queries (counts, averages) without being able to see individual customer records. How should this be implemented?
A. Trust analysts not to query individual records B. Remove detailed data from BigQuery C. Authorized views returning only aggregated results, or BigQuery differential privacy for private aggregate queries D. Encryption only