Security on GCP Day 2

Which TWO of the following TWO statements about Google Cloud service accounts are TRUE?

• VMs without service accounts cannot run APIs.

• Service accounts are a type of identity.

• Virtual machine (VM) instances use service accounts to run API requests on your behalf.

• Custom service accounts use "scopes" to control API access.

Which TWO recommendations below ARE considered to be Compute Engine "best practices?"

• Always run critical VMs with default, scope-based service accounts.

• Utilize projects and IAM roles to control access to your VMs.

• Hardened custom images, once added to your Organization's resources, are then maintained by Google with automatic security patches and other updates.

• Cloud Interconnect or Cloud VPN can be used to securely extend your data center network into Google Cloud projects.

Which of the following statements is FALSE when discussing the Organization Policy Service?

• Descendants of a targeted resource do not inherit the parent's Organization Policy.

• Organization Policy Services allow centralized control for how your organization’s resources can be used.

• To define an Organization Policy, you will choose and then define a constraint against either a Google Cloud service or a group of Google Cloud services.

• Organization Policy Services are available at no cost to all Google Cloud Platform Customers

Which TWO of the following statements are TRUE when discussing storage and BigQuery best practices?

• In most cases, you should use Access Control Lists (ACLs) instead of IAM permissions.

• BigQuery data can be adequately secured using the default basic roles available in Google Cloud.

• Do not use any personally identifiable information as object names.

• One option to serve content securely to outside users is to use signed URLs.

Which TWO of the following statements is TRUE with regards to security in BigQuery and its datasets?

• It is always better to assign BigQuery roles to individuals as this will help to lower operational overhead.

• A BigQuery Authorized View allows administrators to restrict users to viewing only subsets of a dataset.

• Using IAM, you can grant users granular permissions to BigQuery tables, rows and columns.

• BigQuery has its own list of assignable IAM roles.

Which of the following statements about Application Security is TRUE?

• Developers are commonly given a requirements document that clearly defines security requirements for the application.

• Applications are the most common target of cyber attack.

• "Injection Flaws" are the least frequently found application security issue.

• Applications in general, including many web applications, do not need to properly protect sensitive user data.

Which TWO of the following are common application security vulnerabilities that Web Security Scanner can find?

• Insecure logins.

• Mixed HTTP and HTTPS content.

• Outdated or insecure libraries.

• Personalized data in object names.

• User data in images.

Where are signed policy documents embedded?

• In the form field

• In the storage bucket

• In the IAM console

• In the endpoint configuration

Is the following statement TRUE or FALSE?

"Kubernetes service account" and "Google service account" are different names for the same type of service account.

• True

• False

Which ONE of the following is NOT a security best practice on Kubernetes?

• Disable Workload Identity.

• Restrict access between pods.

• Upgrade your GKE infrastructure.

• Use shielded GKE nodes.