Font size
WorksheetsGoogle Cloud Security Worksheet – Extracted Questions
Total questions: 65
Worksheet time: 33mins
Cymbal Bank recently discovered service account key misuse in one of the teams during a security audit. As a precaution, going forward you do not want any team in your organization to generate new external service account keys. You also want to restrict every new service account’s usage to its associated Project. What should you do?
Navigate to Organizational policies in the Google Cloud Console. Select your organization. Select iam.disableServiceAccountKeyCreation. Under Policy Enforcement, select Merge with parent. Click Save. Repeat the process for iam.disableCrossProjectServiceAccountLienRemoval.
Navigate to Organizational policies in the Google Cloud Console. Select your organization. Select iam.disableServiceAccountKeyCreation. Customize the applied to property, and set Enforcement to ‘On’. Click Save. Repeat the process for iam.disableCrossProjectServiceAccountUsage.
Navigate to the IAM & Admin section in Google Cloud Console. Under Service Accounts, select all service accounts, and then disable key generation and cross-project usage.
Run the gcloud resource-manager org-policies allow command with the boolean constraints iam.disableServiceAccountKeyCreation and iam.disableCrossProjectServiceAccountUsage with Organization ID.
Run the gcloud resource-manager org-policies enable-enforce command with the constraints iam.disableServiceAccountKeyCreation, and iam.disableCrossProjectServiceAccountUsage and the Project IDs you want the constraints to apply to.
You are an administrator for Cymbal Bank’s Mobile Development Team. You want to control how long different users can access the Google Cloud console, the Cloud SDK, and any applications that require user authorization for Google Cloud scopes without having to reauthenticate. More specifically, you want users with elevated privileges (project owners and billing administrators) to reauthenticate more frequently than regular users at the organization level. What should you do?
In the Admin console, select Google Cloud session control and set a reauthentication policy that requires reauthentication. Choose the reauthentication frequency from the drop-down list.
Open all Google Cloud projects that belong to Cymbal Bank’s Mobile Development team. Find each project’s Google Cloud session control setting, and configure a reauthentication policy that requires reauthentication. Choose the reauthentication frequency from the drop-down list.
Create a custom role for project owners and billing administrators at the organization level in the Google Cloud console. Add the reauthenticationRequired permission to this role. Assign this role to each project owner and billing administrator.
Navigate to IAM in the Google Cloud Console, assign a custom IAM policy to project owners and billing administrators that specifies a reauthentication frequency, and apply it at the organization level.
Create a custom role for project owners and billing administrators at the organization level in the Google Cloud console. Add the reauthenticationRequired permission to this role. Create a Google Group that contains all billing administrators and project owners. Apply the custom role to the group.
Which tool will Cymbal Bank use to synchronize their identities from their on-premise identity management system to Google Cloud?
Active Directory
Google Cloud Identity Synchronization Tool (GCSync)
Google Cloud Directory Sync
Cloud Identity
Service Accounts
Which feature of Google Cloud will Cymbal Bank use to control the source locations and times that authorized identities will be able to access resources?
IAM Conditions
VPN
IAM Roles
Service Accounts
Identity-aware Proxy
Cymbal Bank is releasing a new loan management application using a Compute Engine managed instance group. External users will connect to the application using a domain name or IP address protected with TLS 1.2. A load balancer already hosts this application and preserves the source IP address. You are tasked with setting up the SSL certificate for this load balancer. What should you do?
Import a self-managed SSL certificate. Attach a global static external IP address to the external proxy Network Load Balancer. Validate that an existing URL map will route the incoming service to your managed instance group backend. Load your certificate and create an SSL proxy routing to your URL map. Create a global forwarding rule that routes incoming requests to the proxy.
Create a Google-managed SSL certificate. Attach a global static external IP address to the global external Application Load Balancer. Validate that an existing URL map will route the incoming service to your managed instance group backend. Load your certificate and create an HTTPS proxy routing to your URL map. Create a global forwarding rule that routes incoming requests to the proxy.
Create a Google-managed SSL certificate. Attach a global dynamic external IP address to the internal Application Load Balancer. Validate that an existing URL map will route the incoming service to your managed instance group backend. Load your certificate and create an HTTPS proxy routing to your URL map. Create a global forwarding rule that routes incoming requests to the proxy.
Create a self-managed SSL certificate. Attach a global static external IP address to the internal Application Load Balancer. Create a forwarding rule that routes incoming requests to the proxy.
Import a self-managed SSL certificate. Attach a global static external IP address to the external proxy Network Load Balancer. Validate that an existing URL map will route the incoming service to your managed instance group backend. Load your certificate and create a TCP proxy routing to your URL map. Create a global forwarding rule that routes incoming requests to the proxy.
You have recently joined Cymbal Bank as a cloud engineer. You created a custom VPC network, selecting to use the automatic subnet creation mode and nothing else. The default network still exists in your project. You create a new Linux VM instance and select the custom VPC as the network interface. You try to SSH into your instance, but you are getting a “connection failed” error. What answer best explains why you cannot SSH into the instance?
You should have deleted the default network. When you have multiple VPCs in your project, Compute Engine can’t allow you to connect because overlapping IP ranges prevent the API from establishing a root connection.
You did not set up any firewall rules on your custom VPC network. While the default VPC comes with a predefined firewall rule that allows SSH traffic, these need to be added to any custom VPCs.
You did not assign an external IP address to your Linux VM. Since your custom VPC network does not provide any external IPs by default, you cannot SSH into the instance.
You should have used the default network when setting up your instance. While custom networks support instance creation, they should only be used for internal communication.
You should have used custom subnet creation mode. Since the default VPC still exists, automatic mode created subnets in the same regions, which led to overlapping IP addresses.
Which tool will Cymbal Bank use to enforce authentication and authorization for services deployed to Google Cloud?
VPN
Firewall rules
Google Cloud Armor
Identity-Aware proxy
Application Load Balancer
How will Cymbal Bank enable resources with only internal IP addresses to make requests to the Internet?
Dedicated Interconnect
Google private access
Shared VPC
VPN
Cloud NAT
Cymbal Bank needs to statistically predict the days customers delay the payments for loan repayments and credit card repayments. Cymbal Bank does not want to share the exact dates a customer has defaulted or made a payment with data analysts. Additionally, you need to hide the customer name and the customer type, which could be corporate or retail. How do you provide the appropriate information to the data analysts?
Generalize all dates to year and month with bucketing. Use the built-in infoType for customer name. Use a custom infoType for customer type with a custom dictionary.
Generalize all dates to year and month with date shifting. Use a predefined infoType for customer name. Use a custom infoType for customer type with a custom dictionary.
Generalize all dates to year and month with bucketing. Use the built-in infoType for customer name. Use a custom infoType for customer type with regular expression.
Generalize all dates to year and month with date shifting. Use a predefined infoType for customer name. Use a custom infoType for customer type with regular expression.
None of them
Cymbal Bank has a Cloud SQL instance that must be shared with an external agency. The agency’s developers will be assigned roles and permissions through a Google Group in Identity and Access Management (IAM). The external agency is on an annual contract and will require a connection string, username, and password to connect to the database. How would you configure the group’s access?
None of them
Use Cloud Key Management Service. Use the destination IP address and Port attributes to provide access for developers at the external agency. Remove the IAM access after one year and rotate the shared keys. Add cloudkms.cryptoKeyEncrypterDecrypter role for the group that contains the external developers.
Use Secret Manager for the connection string and username, and use Cloud Key Management Service for the password. Use tags to set the expiry period to the timestamp one year from now. Add secretmanager.secretVersionManager and secretmanager.secretAccessor roles for the group that contains external developers.
Use Secret Manager. Use the duration attribute to set the expiry period to one year. Add the secretmanager.secretAccessor role for the group that contains external developers.
Use Secret Manager. Use the resource attribute to set a key-value pair with key as duration and values as expiry period one year from now. Add secretmanager.viewer role for the group that contains external developers.
Cymbal Bank uses Google Kubernetes Engine (GKE) to deploy its Docker containers. You want to encrypt the boot disk for a cluster running a custom image so that the key rotation is controlled by the Bank. GKE clusters will also generate up to 1024 randomized characters that will be used with the keys with Docker containers. What steps would you take to apply the encryption settings with a dedicated hardware security layer?
Import the spreadsheets into Cloud Storage and create NoSQL tables. Use App Engine cron jobs to run monthly for Sales and quarterly for Marketing. Use a separate job to delete the data after 1 year.
Create a new key ring using Cloud Key Management Service. Extract this key to a certificate. Use the kubectl command to update the Kubernetes configuration. Validate using MAC digital signatures, and use a startup script to generate random bytes.
In the Google Cloud console, navigate to Google Kubernetes Engine. Select your cluster and the boot node inside the cluster. Enable customer-managed encryption. Use Cloud HSM to generate random bytes and provide an additional layer of security.
Create a new GKE cluster with customer-managed encryption and HSM enabled. Deploy the containers to this cluster. Delete the old GKE cluster. Use Cloud HSM to generate random bytes and provide an additional layer of security.
Create a new key ring using Cloud Key Management Service. Extract this key to a certificate. Use the Google Cloud Console to update the Kubernetes configuration. Validate using MAC digital signatures, and use a startup script to generate random bytes.
You are tasked with developing an AI system on Google Cloud for a telecommunications business. This AI system will conduct sentiment analysis on conversations agents have with customers, and provide conversational recommendations to improve customer satisfaction in the future. What AI/ML-specific security controls do you need to plan for when developing this system?
Ensure data minimization and de-identification for training and inference data, including masking or tokenizing personally identifiable information in transcripts.
Implement model access controls and endpoint authentication/authorization, including per-tenant service accounts and scoped OAuth tokens.
Establish dataset lineage, consent tracking, and audit logging for all training and prediction requests.
Detect and mitigate prompt injection and adversarial inputs by validating and constraining model inputs and using allowlists/denylists.
Continuously monitor model outputs for bias and toxicity, and set up rollback or quarantine policies when quality or safety thresholds are breached.
What feature will allow Cymbal Bank to delete or change the storage class of objects in Cloud Storage buckets?
Lifecycle management rules
Use signed URLs to temporarily grant access to objects, and manually delete or change storage class after access
Rotation periods
Object versioning
Retention policies
Cymbal Bank experienced a recent security issue. A rogue employee with admin permissions for Compute Engine assigned existing Compute Engine users some arbitrary permissions. You are tasked with finding all these arbitrary permissions. What should you do to find these permissions most efficiently?
Use Event Threat Detection and configure Continuous Exports to filter and write only Firewall logs to the Security Command Center. In the Security Command Center, select Event Threat Detection as the source, filter by evasion: iam, and sort to find the attack time window. Click on Persistence: IAM Anomalous Grant to display Finding Details. View the Source property of the Finding Details section.
Use Event Threat Detection and configure Continuous Exports to filter and write only Firewall logs to the Security Command Center. In the Security Command Center, select Event Threat Detection as the source, filter by category: anomalies, and sort to find the attack time window. Click on Evasion: IAM Anomalous Grant to display Finding Details. View the Source property of the Finding Details section.
Use Event Threat Detection and trigger the IAM Anomalous grants detector. Publish results to the Security Command Center. In the Security Command Center, select Event Threat Detection as the source, filter by category: iam, and sort to find the attack time window. Click on Persistence: IAM Anomalous Grant to display Finding Details. View the Source property of the Finding Details section.
Cymbal Bank has suffered a remote botnet attack on Compute Engine instances in an isolated project. The affected project now requires investigation by an external agency. An external agency requests that you provide all admin and system events to analyze in their local forensics tool. You want to use the most cost‑effective solution to enable the external analysis. What should you do?
Use Event Threat Detection. Trigger the IAM Anomalous Grant detector to detect all admins and users with admin or system permissions. Export these logs to the Security Command Center. Give the external agency access to the Security Command Center.
Use Cloud Audit Logs. Filter Admin Activity audit logs for only the affected project. Use a Pub/Sub topic to stream the logs from Cloud Audit Logs to the external agency’s forensics tool.
Use the Security Command Center. Select Cloud Logging as the source, and filter by category: Admin Activity and category: System Activity. View the Source property of the Finding Details section. Use Pub/Sub topics to export the findings to the external agency’s forensics tool.
Use Cloud Monitoring and Cloud Logging. Filter Cloud Monitoring to view only system and admin logs. Expand the system and admin logs in Cloud Logging. Use Pub/Sub to export the findings from Cloud Logging to the external agency’s forensics tool or storage.
None of them
The loan application from Cymbal Bank’s lending department collects credit reports that contain credit payment information from customers. According to bank policy, the PDF reports are stored for six months in Cloud Storage, and access logs for the reports are stored for three years. You need to configure a cost‑effective storage solution for the access logs. What should you do?
Set up a logging export bucket in Cloud Storage to collect data from the Security Command Center. Configure object lifecycle management rules to delete logs after three years.
Set up a logging export dataset in BigQuery to collect data from Cloud Logging and the Security Command Center. Create table expiry rules to delete logs after three years.
Set up a logging export dataset in BigQuery to collect data from Cloud Logging and Cloud Monitoring. Create table expiry rules to delete logs after three years.
Set up a logging export bucket in Cloud Storage to collect data from Cloud Audit Logs. Configure object lifecycle management rules to delete logs after three years.
None of them
Which feature of Google Cloud will Cymbal Bank use to prevent unauthorized container images from being deployed into production environments?
Cloud Monitoring
Binary Authorization
Cloud Build
VPN
Audit logs
How will Cymbal Bank be able to determine who performed a particular administrative action and when?
Binary Authorization
Cloud Monitoring
VPC service controls
VPC flow logs
Audit logs
You are designing a web application for Cymbal Bank so that customers who have credit card issues can contact dedicated support agents. Customers may enter their complete credit card number when chatting with or emailing support agents. You want to ensure compliance with PCI‑DSS and prevent support agents from viewing this information in the most cost‑effective way. What should you do?
Use customer‑supplied encryption keys (CSEK) and Cloud Key Management Service (KMS) to detect and encrypt sensitive information.
Detect sensitive information with Cloud Natural Language API.
Use customer‑managed encryption keys (CMEK) and Cloud Key Management Service (KMS) to detect and encrypt sensitive information.
Implement Cloud Data Loss Prevention using its REST API.
None of them
You are a cloud engineer at Cymbal Bank. You need to share the auditing and compliance standards with your CTO that cover controls over financial reporting and both public and private controls over security, availability, and confidentiality. Which compliance standard covers this?
SOX
GDPR
PCI‑DSS
TCP IP
FIPs 140‑2
Cymbal Bank has a compliance requirement to have control over key lifecycle and rotation periods. Which Google Cloud feature can they leverage to satisfy that requirement?
Audit logs
CMEK with Cloud KMS
VPN
VPC service controls
PCI‑DSS compliance
Cymbal Bank has compliance requirements to ensure certain data is stored, processed, and never transferred or used outside of Europe. Which Google Cloud feature can help them achieve this?
VPN
Sensitive Data Protection
Audit logs
VPC service controls
Organization policy constraints
What is the primary benefit to a Google Cloud customer of using resources in several zones within a region?
For getting discounts on other zones
For expanding services to customers in new areas
For better performance
For improved fault tolerance
For centralized management and administrative control over all resources in a region
Why might a Google Cloud customer use resources in several regions around the world?
To improve security
To bring their applications closer to users around the world, and for improved fault tolerance
To earn discounts
To offer localized application versions in different regions
For improved fault tolerance
Order these IAM role types from broadest to finest‑grained.
Predefined roles, basic roles, custom roles
Basic roles, predefined roles, custom roles
Custom roles, basic roles, predefined roles
Custom roles, predefined roles, basic roles
Predefined roles, custom roles, basic roles
In Google Cloud VPCs, what scope do subnets have?
Global
Zonal
Private
Regional
Multi‑regional
For which of these interconnect options is a Service Level Agreement available?
Standard Network Tier
Premium Network Tier
Dedicated Interconnect
Carrier Peering
Direct Peering
How does global Cloud Load Balancing allow you to balance HTTP‑based traffic?
Across multiple Compute Engine regions.
Across multiple physical machines in a single data center.
Across multiple Google Cloud services.
Across multiple subnets in a single Virtual Private Cloud (VPC)
Across multiple virtual machine instances in a single Compute Engine region.
Which of the following describes a Virtual Private Cloud (VPC)?
A service that routes traffic through a Google Point of Presence (PoP).
An option that allows one or more direct, private connections to Google.
A fully distributed, software-defined, managed service for traffic distribution.
A secure, individual, private cloud-computing network hosted within a public cloud.
A cloud-based content delivery network that caches data at Google’s PoPs.
What is the correct use case for Cloud Storage?
Cloud Storage is well suited to providing the root file system of a Linux virtual machine.
Cloud Storage is well suited to providing durable and highly available object storage.
Cloud Storage is well suited to providing data warehousing services.
Cloud Storage is well suited to providing RDBMS services.
None of them
Why would a customer consider the Coldline storage class?
To save money on storing infrequently accessed data.
To store high-performance, low-latency data.
To improve security.
To use the Coldline Storage API.
To save money on storing frequently accessed data.
What is a Kubernetes pod?
A group of containers
A group of VMs
A group of nodes
A group of applications
A group of clusters
Where do the resources used to build Google Kubernetes Engine clusters come from?
Cloud Functions
Compute Engine
Cloud Storage
App Engine
Bare-metal servers
Why might a Google Cloud customer choose to use Cloud Run functions?
Cloud Run functions are specifically designed for long-running tasks and batch processing.
Their application has a legacy monolithic structure that they want to separate into microservices.
Cloud Run functions is a free service for hosting computer operations.
Their application contains event-driven code that they don't want to provision compute resources for.
Cloud Run functions are the primary way to run C++ applications in Google Cloud.
Generative AI is a type of artificial intelligence that can ____.
Make predictions about future events.
Generate text, images, or other data using generative models.
Perform complex calculations and mathematical operations.
Generate responses on real-time data.
None of them
How can you avoid hallucinations when using a large language model?
Train the LLM on a smaller dataset.
Do not add any context to your prompts.
Train the model to operate with very few constraints.
Train the model on a clean, curated dataset.
None of them
Which of the following is not a good practice for constructing prompts?
Avoid ambiguity.
Include long and detailed sentences.
Keep it short and simple.
Vary your prompts.
None of them
You are designing a virtual machine in the cloud to act as a network gateway between an external public network and a private internal network. To ensure strong security and traffic separation, what technology can you implement?
Cloud VPN
VLAN tagging within a single NIC
SOX
Multiple Network Interface Cards (NICs)
Premium Tier IPs
You want to improve network performance. You are not comfortable using the public internet to route traffic. Which service tier is the best fit?
Free version
Premium tier
Standard tier
Pro version
Prime tier
How does VPC Peering exchange routing information between two peered VPCs?
It relies on the default route table to forward traffic between the VPCs.
It uses Border Gateway Protocol (BGP) to dynamically exchange routes.
It requires manual configuration of static routes in each VPC's route table.
It automatically discovers and propagates routes through the Google Cloud Router.
None of them
Which of the following approaches to multi-project networking uses a centralized network administration model?
Cloud VPN and Shared VPC
Cloud VPN
VPC Network Peering
Shared VPC
None of them
In regards to VPC Flow Logs, which of the following statements is correct?
Log updates are provided every 5 minutes.
Logs cannot be analyzed in BigQuery or visualized in Looker Studio.
There is a delay and performance penalty in routing logged IP packets.
Logs can be used for network monitoring, forensics, real-time security analysis, and expense optimization.
None of them
To set up hybrid deployments for DNS resolution, which type of DNS policy should you use?
Response policy
Traffic policy
Server policy
All of them
Routing policy
To enable Private Google Access for a VPC network:
Enable it on the VPC network, on the desired subnets, and on Cloud Router.
Enable it on the VPC network.
Enable it on all desired subnets in the VPC network.
Enable it on all desired subnets and on Cloud Router.
None of them
Which of the following practices is LEAST likely to improve network security in Google Cloud?
Assigning public IP addresses to all virtual machines in a VPC.
Regularly reviewing and updating IAM (Identity and Access Management) permissions.
Enabling VPC flow logs to monitor network traffic.
Implementing network firewall rules to control traffic.
None of them
You are designing a Google Cloud network for a large financial services company with strict security requirements. The network needs to isolate sensitive customer data from other resources and limit communication between specific network segments. Which of the following network topologies would be most suitable for this scenario?
Hub-and-spoke
Mesh
Tree
Mirrored
Gated ingress and egress
Which Google Cloud service provides defense against infrastructure and application Distributed Denial of Service (DDoS) attacks?
Google Cloud Armor
Cloud DNS
Cloud CDN
Cloud Load Balancing
VPN
Which IAM role contains permissions to create, modify, and delete networking resources, except for firewall rules and SSL certificates?
Network administrator
Network operator
Security viewer
Security administrator
Network viewer
What is the primary purpose of Packet Mirroring in network security?
To filter out unwanted traffic from a network.
To redirect traffic to a different network interface.
To encrypt network traffic for privacy.
To create a duplicate copy of network traffic for analysis.
None of them
When you use the internal IP address of the forwarding rule to specify an internal Network Load Balancer next hop, the load balancer can only be:
In the same VPC network as the next hop route or in a peered VPC network.
In the same subnet as the next hop route or a Shared VPC network.
In the same VPC network as the next hop route.
In the same subnet as the next hop route.
You can use hybrid load balancing to connect these environments:
Google Cloud, other public clouds, and on-premises
Google Cloud and on-premises
Google Cloud, AWS, and on-premises
Google Cloud and AWS
VPN
Which of the following best practices help optimize load balancing cost?
Ignoring load balancer health checks to avoid additional API calls.
Implementing a caching layer with a content delivery network (CDN).
Overprovisioning load balancer resources to handle peak traffic loads.
Selecting the most expensive load balancer type for maximum performance.
All of them
Your company is located in a city where Google Cloud does not have a Dedicated Interconnect location, but you need a private connection to your Google Cloud Virtual Private Cloud (VPC). Which Cloud Interconnect option is most suitable for this scenario?
Network Connectivity Center
Partner Interconnect
Dedicated Interconnect
None of them
Carrier Peering
In the Network Connectivity Center, what are the two main types of spokes that can be connected to a hub?
VPC spokes and Hybrid spokes
Regional spokes and Global spokes
Global spokes and Hybrid spokes
VPC spokes and Global spokes
None of them
Which ONE of the following statements is TRUE concerning Google's built-in security measures?
An organization's on-premises resources are not allowed to connect to Google Cloud in order to lower the risk of DDoS attacks.
To guard against phishing attacks, all Google employee accounts require the use of U2F compatible security keys.
Customers always have the option to configure their instances to encrypt all of their data while it is "at rest" within Google Cloud.
Only Google-managed encryption keys are allowed to be used within Google Cloud.
None of them
Which ONE of the following statement is TRUE regarding regulatory compliance on Google Cloud?
Contacting your regulatory compliance certification agency is the only way to find out whether Google currently supports that particular standard.
Google's Cloud products regularly undergo independent verification of security, privacy, and compliance controls.
Proper configuration of encryption and firewalls is the only requirement for achieving regulatory compliance.
Google has no plans at this time to expand its already-extensive portfolio of regulatory compliance certifications.
None of them
Which of the following statements is TRUE for the use of Cloud Identity?
Your organization must use Google Workspace services in order to use Cloud Identity.
You cannot use both Cloud Identity and Google Workspace services to manage your users across your domain.
A Google Workspace or Cloud Identity account can be associated with more than one Organization.
Cloud Identity can work with any domain name that is able to receive email.
All of them
Which ONE of the following is IAM Objects that can be used to organize resources in Google Cloud?
Member
Container
Bucket
Project
Role
Which ONE of the following statements is TRUE when discussing the SSL capabilities of Google Cloud Load Balancer?
The Google-managed profile, COMPATIBLE, allows clients which support out-of-date SSL features.
Google Cloud Load Balancers require, and will only accept, a Google-managed SSL Cert.
If no SSL policy is set, the SSL policy is automatically set to the most constrained policy, which is RESTRICTED.
You must use one of the 3 pre-configured “Google-managed profiles” to specify the level of compatibility appropriate for your application.
None of them
"Kubernetes service account" and "Google service account" are different names for the same type of service account.
True
False
Which ONE of the following is NOT a security best practice on Kubernetes.
Restrict access between pods.
Use shielded GKE nodes.
Allow unrestricted communication between all pods
Disable Workload Identity.
Upgrade your GKE infrastructure.
GKE has logging and monitoring functions built in.
True
False
Which ONE of the following vulnerability is scanned for when you use Web Security Scanner?
Personalized data in object names.
Insecure logins.
Mixed content.
All of them
User data in images.
Cloud Interconnect or Cloud VPN can be used to securely extend your data center network into Google Cloud projects.
True
False
Utilizing projects and IAM roles to control access to your VMs is considered a best practice
True
False
