You are a member of the security team at an organization. Your team has a single GCP project with credit card payment processing systems alongside web applications and data processing systems. You want to reduce the scope of systems subject to PCl audit standards. What should you do?

Move the cardholder data environment into a separate GCP project.

Use multi-factor authentication for admin access to the web application.

Use only applications certified compliant with PA-DSS.

Use VPN for all connections between your office and cloud environments.

Your employer stores important customer data locally, but plans to migrate to Google Cloud Platform. They are planning to store the data in a Cloud Storage bucket, but before uploading the data, they want to redact the customer’s unique id which consists of 25 alphanumeric characters arranged in five hyphenated groups. Here is an example: 3xrde-11plp-i9vdf-ax990-512k2 Which of the following infoType detectors you should use to detect the customer’s unique id?

Regular Expression InfoType Detector

Regular Custom InfoType Detector

Stored Custom InfoType Detector

A company allows every employee to use Google Cloud Platform. Each department has a Google Group, with all department members as group members. If a department member creates a new project, all members of that department should automatically have read-only access to all new project resources. Members of any other department should not have access to the project. You need to configure this behavior. What should you do to meet these requirements?

Create a Project per department under the Organization. For each department's Project, assign the Project Viewer role to the Google Group related to that department.

Create a Folder per department under the Organization. For each department's Folder, assign the Project Viewer role to the Google Group related to that department.

Create a Folder per department under the Organization. For each department's Folder, assign the Project Browser role to the Google Group related to that department.

Create a Project per department under the Organization. For each department's Project, assign the Project Browser role to the Google Group related to that department.

A customer's internal security team must manage its own encryption keys for encrypting data on Cloud Storage and decides to use customer-supplied encryption keys (CSEK). How should the team complete this task?

Encrypt the object, then use the gsutil command line tool or the Google Cloud Platform Console to upload the object to Cloud Storage.

Upload the encryption key to a Cloud Storage bucket, and then upload the object to the same bucket.

Use the gsutil command line tool to upload the object to Cloud Storage, and specify the location of the encryption key.

Generate an encryption key in the Google Cloud Platform Console, and upload an object to Cloud Storage using the specified key.

Your company is planning to migrate to Google Cloud Platform, but before migration begins all employees are learning important security best practices related to data encryption. You have read that data is encrypted using envelope encryption. Which statement correctly describes the envelope encryption process in Google Cloud Platform's Cloud Key Management Service (KMS)?

Create a data encryption key (DEK) locally to encrypt data chunks then encrypt the DEK using a key encryption key (KEK) and then store the KEK in Cloud KMS.

Create a key encryption key (KEK) locally to encrypt data chunks then encrypt the KEK using the data encryption key (DEK) and then store the DEK in Cloud KMS.

Create a single data encryption key (DEK) locally to encrypt all data, then encrypt the DEK using key encryption key (KEK) store the KEK in Cloud KMS.

Create a data encryption key locally to encrypt data chunks then encrypt DEK using a key encryption key and then store the KEK in any third-party key storage service.

A customer has 300 engineers. The company wants to grant different levels of access and efficiently manage IAM permissions between users in the development and production environment projects. Which two steps should the company take to meet these requirements? (Choose two.)

Create a folder for each development and production environment.

Create a Google Group for the Engineering team, and assign permissions at the folder level.

Create a project with multiple VPC networks for each environment.

Create an Organizational Policy constraint for each folder environment.

Create projects for each environment, and grant IAM rights to each engineering user.

You want to evaluate your organization's Google Cloud instance for PCI compliance. You need to identify Google's inherent controls. Which document should you review to find the information?

PCI SSC Cloud Computing Guidelines

Google Cloud Platform: Customer Responsibility Matrix

PCI DSS Requirements and Security Assessment Procedures

Product documentation for Compute Engine

You are working in a fast-growing organization that has its business-critical applications hosted in GCP. As your users’ engagement is increasing, cloud infrastructure requirements are also increasing. You are planning to configure additional infrastructure for another project using reserved instances to get a discount. You would need to set up networks, and all other resources required to host a basic web application. Due to a lack of employees, you need an easy way to continuously re-deploy certain infrastructure. What's the best way to do this?

Make use of Cloud Deployment Manager.

Use Forseti Security to get configuration details from existing projects.

Use Asset History from Resource Manager.

Your company runs a website that will store Pll on Google Cloud Platform. To comply with data privacy regulations, this data can only be stored for a specific amount of time and must be fully deleted after this specific period. Data that has not yet reached the time period should not be deleted. You want to automate the process of complying with this regulation. What should you do?

Store the data in a single BigQuery table and set the appropriate table expiration time.

Store the data in a single Persistent Disk, and delete the disk at expiration time.

Store the data in a single Cloud Storage bucket and configure the bucket's Time to Live.

Store the data in a single BigTable table and set an expiration time on the column families.

While migrating your organization's infrastructure to GCP, a large number of users will need to access GCP Console. The Identity Management team already has a well-established way to manage your users and want to keep using your existing Active Directory or LDAP server along with the existing SSO password. What should you do?

Use Google Cloud Directory Sync to synchronize the data in Google domain with your existing Active Directory or LDAP server.

Manually synchronize the data in Google domain with your existing Active Directory or LDAP server.

Users sign in directly to the GCP Console using the credentials from your on-premises Kerberos compliant identity provider.

Users sign in using OpenlD (OIDC) compatible IdP, receive an authentication token, then use that token to log in to the GCP Console.

Your company's internal infrastructure is hosted in Google Cloud where a number of instances are running across different projects that are managed by different teams. The Vice President of the company has asked your team to manage an inventory of the infrastructure so that in any case of issues, you should be able to see what was running in your set up at a particular time. Which Google Cloud service would you choose to get the required inventory details in quick time?

Configure Forseti Security to manage inventory

Check historical inventory using Resource Manager

Export Logs from all projects or use a cross project sink.

Configure individual services to take a snapshot after a few days

Your company is using GSuite and has developed an application meant for internal usage on Google App Engine. You need to make sure that an external user cannot gain access to the application even when an employee's password has been compromised. What should you do?

Enforce 2-factor authentication in GSuite for all users.

Configure Cloud Identity-Aware Proxy for the App Engine Application.

Provision user passwords using GSuite Password Sync.

Configure Cloud VPN between your private network and GCP.

A large financial institution is moving its Big Data analytics to Google Cloud Platform. They want to have maximum control over the encryption process of data stored at rest in BigQuery. What technique should the institution use?

Use Cloud Storage as a federated Data Source.

Use a Cloud Hardware Security Module (Cloud HSM).

A large e-retailer is moving to Google Cloud Platform with its ecommerce website. The company wants to ensure payment information is encrypted between the customer's browser and GCP when the customers checkout online. What should they do?

Configure an SSL Certificate on an L7 Load Balancer and require encryption.

Configure an SSL Certificate on a Network TCP Load Balancer and require encryption.

Configure the firewall to allow inbound traffic on port 443, and block all other inbound traffic.

Configure the firewall to allow outbound traffic on port 443, and block all other outbound traffic.

You have uploaded 500 GB of important project files to a Cloud Storage bucket and added a retention policy of two years to the bucket without a retention policy lock. After one month, you realize you uploaded the same folder twice, which includes approximately 100 GB of data. You need to delete that redundant folder to avoid any unnecessary storage costs, but when you attempt to delete it you receive error messages that you have not reached the required retention period. In this case, what can you do in order to delete the folder and preserve the security of data stored in this bucket?

First, delete the retention policy and then delete the folder. Next, lock the bucket by adding a new retention policy.

Disable the policy and delete the folder, and then re-enable the same policy for the bucket.

First, unlock the policy lock and then delete the folder. Reapply the policy lock once the file is deleted.

You cannot delete the folder using the console. You can use the “gsutil rm gs://your-bucket/folder-to-delete/** command to delete the folder.

You have a client that has all of its infrastructure hosted in GCP. The Client has asked you to give a certain VM instance read access to a specific storage bucket. How would you fulfill the client's request?

Assign a new service account to the VM instance, and grant it the Storage Object Viewer role on the storage bucket

Grant the roles for allAuthenticatedUsers in the access control list for the storage bucket

Download the service account keys from the project that has the storage bucket, and use the keys in the VM instance

Add the default service account used by the VM instance to the access control list for the storage bucket

You want to limit the images that can be used as the source for boot disks. These images will be stored in a dedicated project. What should you do?

Use the Organization Policy Service to create a compute.trustedimageProjects constraint on the organization level. List the trusted project as the whitelist in an allow operation.

Use the Organization Policy Service to create a compute.trustedimageProjects constraint on the organization level. List the trusted projects as the exceptions in a deny operation.

In Resource Manager, edit the project permissions for the trusted project. Add the organization as member with the role: Compute Image User.

In Resource Manager, edit the organization permissions. Add the project ID as member with the role: Compute Image User.

Your team needs to prevent users from creating projects in the organization. Only the DevOps team should be allowed to create projects on behalf of the requester. Which two tasks should your team perform to handle this request? (Choose two.)

Remove all users from the Project Creator role at the organizational level.

Add a designated group of users to the Project Creator role at the organizational level.

Create an Organization Policy constraint, and apply it at the organizational level.

Grant the Project Editor role at the organizational level to a designated group of users.

Grant the billing account creator role to the designated DevOps team.

You're an Organization Administrator for your company's Google Cloud presence. You noticed today that you're not able to delete an outdated VM instance due to a permission denied error. After troubleshooting, you found that one of your former coworkers removed your Owner role for the project. How would you get back your access if you were the only one managing that Google account?

You will be able to give yourself the Owner role for that project.

Nothing can be done, as you need Project Owner permission.

Create a new project and delete the older one.

Contact Google Support to get your access back.

A customer deployed an application on Compute Engine that takes advantage of the elastic nature of cloud computing. How can you work with Infrastructure Operations Engineers to best ensure that Windows Compute Engine VMs are up to date with all the latest OS patches?

Build new base images when patches are available, and use a CI/CD pipeline to rebuild VMs, deploying incrementally.

Federate a Domain Controller into Compute Engine, and roll out weekly patches via Group Policy Object.

Use Deployment Manager to provision updated VMs into new serving Instance Groups (IGs).

Reboot all VMs during the weekly maintenance window and allow the StartUp Script to download the latest patches from the internet.

Your team needs to make sure that their backend database can only be accessed by the frontend application and no other instances on the network. How should your team design this network?

Create an ingress firewall rule to allow access only from the application to the database using firewall tags.

Create a different subnet for the frontend application and database to ensure network isolation.

Create two VPC networks, and connect the two networks using Cloud VPN gateways to ensure network isolation.

Create two VPC networks, and connect the two networks using VPC peering to ensure network isolation.

Your company is planning to store pictures in Cloud Storage buckets. Your manager has asked you to use a key that is created and managed on-premises in the encryption process of the objects. What type of key service would you use?

Use Cloud Storage customer-supplied encryption keys

Use Cloud KMS default encryption

Use KMS customer-supplied encryption keys

As the security lead, you want to use Cloud KMS to generate symmetric encryption keys, and you want to configure Cloud KMS to rotate the keys automatically every 180 days. Which type of keys will meet these requirements?

Customer-managed encryption keys that are stored as software keys

Customer-managed encryption keys that are stored externally

Your team wants to make sure Compute Engine instances running in your production project do not have public IP addresses. The frontend application Compute Engine instances will require public IPs. The product engineers have the Editor role to modify resources. Your team wants to enforce this requirement. How should your team meet these requirements?

Set up an organization policy to only permit public IPs for the front-end Compute Engine instances.

Enable Private Access on the VPC network in the production project.

Remove the Editor role and grant the Compute Admin IAM role to the engineers.

Set up a VPC network with two subnets: one with public IPs and one without public IPs.

Which two security characteristics are related to the use of VPC peering to connect two VPC networks? (Choose two.)

Non-transitive peered networks; where only directly peered networks can communicate

Ability to peer networks that belong to different Google Cloud organizations

Central management of routes, firewalls, and VPNs for peered networks

Firewall rules that can be created with a tag from one peered network to another peered network

Ability to share specific subnets across peered networks

GCP Mock Questions

Authored by Awo Gyamea

Computers

12th Grade

Used 1+ times

AI Actions

Add similar questions

Adjust reading levels

Convert to real-world scenario

Translate activity

More...

Content View

Student View

39 questions

Show all answers

MULTIPLE CHOICE QUESTION

30 sec • 1 pt

Your company is using GCP Compute Engine to host its applications where one such application has a number of unauthenticated REST API calls. One of the users has located the URL of one such API call, which when repeatedly executed, crashed the Compute Engine instance. The instance was down for almost 3 hours and disrupted business for the whole company. What would you do to make sure that next time this happens, you are notified immediately if CPU usage goes above 90 percent?

Choose an Alerting Policy based on Process health in Cloud Monitoring

Choose an Alerting Policy based on metric rate in Cloud Monitoring

Choose an Alerting Policy based on uptime check in Cloud Monitoring

Create a script in your VM Instance to track the CPU Usage and trigger the notification if usage goes above defined threshold.

MULTIPLE CHOICE QUESTION

30 sec • 1 pt

An organization is starting to move its infrastructure from its on-premises environment to Google Cloud Platform (GCP). The first step the organization wants to take is to migrate its current data backup and disaster recovery solutions to GCP for later analysis. The organization's production environment will remain on-premises for an indefinite time. The organization wants a scalable and cost-efficient solution. Which GCP solution should the organization use?

BigQuery using a data pipeline job with continuous updates

Cloud Storage using a scheduled task and gsutil

Compute Engine Virtual Machines using Persistent Disk

Cloud Datastore using regularly scheduled batch upload jobs

MULTIPLE CHOICE QUESTION

30 sec • 1 pt

You are creating an internal App Engine application that needs to access a user's Google Drive on the user's behalf. Your company does not want to rely on the current user's credentials. It also wants to follow Google-recommended practices. What should you do?

Create a new Service account, and give all application users the role of Service Account User.

Create a new Service account, and add all application users to a Google Group. Give this group the role of Service Account User.

Use a dedicated G Suite Admin account, and authenticate the application's operations with these G Suite credentials.

Create a new service account, and grant it G Suite domain-wide delegation. Have the application use it to impersonate the user.

MULTIPLE CHOICE QUESTION

30 sec • 1 pt

Your manager has asked you to grant one contingent worker to review all the Cloud Storage buckets for two hours in order to create a similar bucket configuration for his team. What is the most secure and efficient method to grant the contingent worker access to Cloud Storage for only two hours?

Create a pre-signed URL granting two hours of access.

Configure an access control list (ACL) to allow access from the contingent works IP address and then modify it two hours later.

Assign an IAM role to an IAM user for the contingent worker with an expiration time of two hours.

Create an IAM user for the contingent worker and then manually remove the IAM user after two hours.

MULTIPLE CHOICE QUESTION

30 sec • 1 pt

A customer wants to move their sensitive workloads to a Compute Engine-based cluster using Managed Instance Groups (MIGs). The jobs are bursty and must be completed quickly. They have a requirement to be able to control the key lifecycle. Which boot disk encryption solution should you use on the cluster to meet this customer's requirements?

Customer-supplied encryption keys (CSEK)

Customer-managed encryption keys (CMEK) using Cloud Key Management Service (KMS)

Encryption by default

Pre-encrypting files before transferring to Google Cloud Platform (GCP) for analysis

MULTIPLE CHOICE QUESTION

30 sec • 1 pt

Your company is using Cloud Dataproc for its Spark and Hadoop jobs. You want to be able to create, rotate, and destroy symmetric encryption keys used for the persistent disks used by Cloud Dataproc. Keys can be stored in the cloud. What should you do?

Use the Cloud Key Management Service to manage the data encryption key (DEK).

Use the Cloud Key Management Service to manage the key encryption key (KEK).

Use customer-supplied encryption keys to manage the data encryption key (DEK).

Use customer-supplied encryption keys to manage the key encryption key (KEK).

MULTIPLE CHOICE QUESTION

30 sec • 1 pt

Your manager has asked you to store all Cloud Logging data access logs in Google Cloud. The Analytics team will review these logs for quality improvement and plans to retain them for up to 20 years. Which of the following options should the Analytics team choose to store the logs, keeping cost optimization in mind?

BigQuery

Cloud Storage

Cloud Logging

Cloud Pub/Sub

Access all questions and much more by creating a free account

Create resources

Host any resource

Get auto-graded reports

Continue with Google

Continue with Email

Continue with Classlink

Continue with Clever

or continue with

Microsoft

Apple

Others

Already have an account?

Popular Resources on Wayground

10 questions

Factors 4th grade

Quiz

•

4th Grade

10 questions

Cinco de Mayo Trivia Questions

Interactive video

•

3rd - 5th Grade

13 questions

Cinco de mayo

Interactive video

•

6th - 8th Grade

20 questions

Math Review

Quiz

•

3rd Grade

20 questions

Main Idea and Details

Quiz

•

5th Grade

20 questions

Context Clues

Quiz

•

6th Grade

20 questions

Inferences

Quiz

•

4th Grade

19 questions

Classifying Quadrilaterals

Quiz

•

3rd Grade

Discover more resources for Computers

45 questions

AP CSP Exam Review

Quiz

•

9th - 12th Grade

50 questions

AP CSP Review

Quiz

•

9th - 12th Grade

17 questions

CSP Robot Questions Review

Quiz

•

10th - 12th Grade

50 questions

IBT Final Exam Review (Spring)

Quiz

•

9th - 12th Grade

GCP Mock Questions

You are creating an internal App Engine application that needs to access a user's Google Drive on the user's behalf. Your company does not want to rely on the current user's credentials. It also wants to follow Google-recommended practices. What should you do?

Your manager has asked you to grant one contingent worker to review all the Cloud Storage buckets for two hours in order to create a similar bucket configuration for his team. What is the most secure and efficient method to grant the contingent worker access to Cloud Storage for only two hours?

Your company is using Cloud Dataproc for its Spark and Hadoop jobs. You want to be able to create, rotate, and destroy symmetric encryption keys used for the persistent disks used by Cloud Dataproc. Keys can be stored in the cloud. What should you do?

You are a member of the security team at an organization. Your team has a single GCP project with credit card payment processing systems alongside web applications and data processing systems. You want to reduce the scope of systems subject to PCl audit standards. What should you do?

A retail customer allows users to upload comments and product reviews. The customer needs to make sure the text does not include sensitive data before the comments or reviews are published. Which Google Cloud Service should be used to achieve this?

Access all questions and much more by creating a free account

Popular Resources on Wayground

Discover more resources for Computers