Security on GCP Day 1

Which TWO of the following statements are TRUE regarding Google's ability to protect its customers from DoS attacks?

• Google Front End can detect when an attack is taking place and can drop or throttle traffic associated with that attack.

• A single Google data center has many times the bandwidth of even a large DoS attack, enabling it to simply absorb the extra load.

• Application-aware defense is not currently supported on Google Cloud, although support for this is planned in the very near future.

Which ONE of the following statements is TRUE for the use of Cloud Identity?

• Cloud Identity can work with any domain name that is able to receive email.

• Your organization must use Google Workspace services in order to use Cloud Identity.

• You cannot use both Cloud Identity and Google Workspace services to manage your users across your domain.

• A Google Workspace or Cloud Identity account can be associated with more than one Organization.

The main purpose of Google Cloud Directory Sync is to: (choose ONE option below)

• Help simplify provisioning and deprovisioning user accounts.

• Completely replace an Active Directory or LDAP service.

• Enable two-way data synchronization between Google Cloud and AD/LDAP accounts.

• Enable SSO between Cloud Identity and GCP

Which TWO of the following are considered authentication "best practices?"

• Requiring 2-Step Verification (2SV) is only recommended for super-admin accounts.

• You should have no more than three Organization admins.

• Avoid managing permissions on an individual user basis where possible.

• Organization Admins should never remove the default Organization-level permissions from users after account creation.

Which TWO of the following statements about IAM policies are TRUE?

• A policy is a collection of access statements attached to a resource.

• An organization policy can only be applied to the organization node.

• A less restrictive parent policy will not override a more restrictive child resource policy.

• A Policy binding binds a list of members to a role.

Which ONE of the following statements is TRUE when discussing the SSL capabilities of the Google Cloud load balancer?

• You must use one of the 3 pre-configured “Google-managed profiles” to specify the level of compatibility appropriate for your application.

• Google Cloud load balancers require, and will only accept, a Google-managed SSL Cert.

• The Google-managed profile, COMPATIBLE, allows clients which support out-of-date SSL features.

• If no SSL policy is set, the SSL policy is automatically set to the most constrained policy, which is RESTRICTED.

Your customer is moving their corporate applications to Google Cloud Platform. The security team wants detailed visibility of all resources in the organization. You use Resource Manager to set yourself up as the org admin. What Cloud Identity and Access Management (Cloud IAM) roles should you give to the security team?

• Org viewer, Project owner

• Org viewer, Project viewer

• Org admin, Project browser

• Project owner, Network admin

You are running an on-premise HR application that needs to download employee information stored in Google Cloud Storage. How would you distribute credentials to your on-premise servers?

• Create a workload identity pool in your Google Cloud project and get short-lived Google Cloud access token

• Create a service account key using the Google Cloud console to first establish the identity of the on premise server

• Authenticate using the Google Cloud SDK from the on premise server to deliver keys to the application.

• Assign a Google-managed service account to the HR app to have Google automatically deliver the credentials

Which two implied firewall rules are defined on a VPC network?

• A rule that allows all outbound connections

• A rule that denies all inbound connections

• A rule that blocks all inbound port 25 connections

• A rule that blocks all outbound connections

• A rule that allows all inbound port 80 connections

An application running on a Compute Engine instance needs to read data from a Cloud Storage bucket. Your team does not allow Cloud Storage buckets to be globally readable and wants to ensure the principle of least privilege.Which option meets the requirement of your team?

• Create a Cloud Storage ACL that allows read-only access from the Compute Engine instance's IP address and allows the application to read from the bucket without credentials.

• Use a service account with read-only access to the Cloud Storage bucket, and store the credentials to the service account in the config of the application on the Compute Engine instance.

• Use a service account with read-only access to the Cloud Storage bucket to retrieve the credentials from the instance metadata.

• Encrypt the data in the Cloud Storage bucket using Cloud KMS, and allow the application to decrypt the data with the KMS key.