Google Practice Questions, Discussions & Exam Topics by our Authors
A customer wants to move their sensitive workloads to a Compute Engine-based cluster using Managed Instance Groups (MIGs). The jobs are bursty and must be completed quickly. They have a requirement to be able to control the key lifecycle.
...
To address the customer's requirements for moving sensitive workloads to a Compute Engine-based cluster using Managed Instance Groups (MIGs), we need to select a boot disk encryption solution that meets the following criteria:
- Sensitive workloads imply that the customer requires high security for data stored in Google Cloud.
- Bursty jobs that must be completed quickly imply that the solution needs to be highly scalable and responsive.
- Control over the key lifecycle means the customer must be able to manage their encryption keys rather than relying on Google’s default key management.
A) Customer-supplied encryption keys (CSEK)
- Reasoning: With CSEK, the customer manages their encryption keys for data at rest in Google Cloud. This solution provides the customer full control over the encryption keys. However, using CSEK requires additional management overhead as the keys must be manually supplied and rotated. Furthermore, CSEK is not as integrated with Google’s Key Management Services and might lead to more complexity in automating key rotation and managing access.
- Rejected because: While it offers full control over the keys, CSEK can be more challenging to manage in a scalable and automated way for bursty workloads. It might not be as seamless as other options when combined with Managed Instance Groups.
B) Customer-managed encryption keys (CMEK) using Cloud Key Management Service (KMS)
- Reasoning: With CMEK, the customer retains control over the keys but uses Google’s Cloud Key Management Service (KMS) to manage the lifecycle of those keys. This solution strikes a balance between control and ease of management, offering automated key rotation, centralized key management, and seamless integration with GCP services like Compute Engine, which is ideal for bursty jobs. This allows the customer to retain full control over the keys while leveraging the scalability and simplicity of GCP's managed KMS service.
- Selected because: CMEK wi...
Author: Aarav2020 · Last updated Jul 20, 2026
Your company is using Cloud Dataproc for its Spark and Hadoop jobs. You want to be able to create, rotate, and destroy symmetric encryption keys used for the persistent disks u...
To meet the requirement of creating, rotating, and destroying symmetric encryption keys used for the persistent disks of Cloud Dataproc, the company needs a solution that provides key management capabilities while ensuring that encryption is controlled. The persistent disks are the storage for data in Cloud Dataproc clusters, and the encryption keys used to protect them need to be managed properly.
A) Use the Cloud Key Management Service to manage the data encryption key (DEK)
- Reasoning: Cloud Key Management Service (KMS) is designed to manage encryption keys. However, the data encryption key (DEK) typically encrypts the actual data, and Cloud KMS itself uses key encryption keys (KEKs) to encrypt these DEKs. KMS manages the lifecycle of KEKs and can rotate, create, and destroy these keys, but it is not ideal to manage just the DEK directly for persistent disks in this scenario. KMS generally handles the KEK for protecting the DEKs.
- Rejected because: This option does not fully fit the use case for managing encryption at a higher level, as KMS is intended to manage KEKs (key encryption keys) that are used to protect DEKs, not the DEKs themselves directly.
B) Use the Cloud Key Management Service to manage the key encryption key (KEK)
- Reasoning: This is the correct approach. Key encryption keys (KEK) are used to encrypt the actual data encryption keys (DEK), which in turn are used to encrypt the data stored on persistent disks. Cloud KMS provides a highly secure way to manage the KEKs, which would be used to manage the lifecycle of DEKs for Cloud Dataproc's persistent disks. KMS can rotate, create, and destroy KEKs, and this would meet the requirement of key management.
- Selected because: This solution meets the requirement of managing encryption for persistent disks in Cloud Dataproc. Cloud KMS allows for the creation, ro...
Author: Sofia · Last updated Jul 20, 2026
You are a member of the security team at an organization. Your team has a single GCP project with credit card payment processing systems alongside web applications and data processing systems. You wa...
To reduce the scope of systems subject to PCI audit standards, the primary focus should be on isolating the cardholder data environment (CDE) from other systems in the organization. This is essential because PCI DSS (Payment Card Industry Data Security Standard) audits specifically apply to systems that process, store, or transmit cardholder data. The goal is to limit the exposure of systems that need to be audited by separating them from non-sensitive systems.
A) Use multi-factor authentication for admin access to the web application
- Reasoning: While multi-factor authentication (MFA) is a best practice for enhancing security, it does not specifically address the issue of reducing the scope of systems subject to PCI audit standards. MFA can protect access to applications but does not isolate or reduce the scope of the cardholder data environment (CDE).
- Rejected because: While MFA is important for securing access to systems, it does not impact the scope of PCI DSS requirements or reduce the number of systems subject to the audit. This does not solve the isolation problem.
B) Use only applications certified compliant with PA-DSS
- Reasoning: PA-DSS (Payment Application Data Security Standard) certification ensures that the application follows security guidelines for payment applications. While using PA-DSS-certified applications is beneficial for meeting PCI DSS requirements, it does not directly help reduce the scope of the systems subject to PCI audits. The issue here is isolating the systems that handle cardholder data, not just ensuring that applications are compliant.
- Rejected because: Although PA-DSS certification is crucial for ensuring that payment applications meet PCI requirements, it does not isolate the cardholder data environment. It does not reduce the overall scope of PCI audits by itself.
C) Move the car...
Author: VenomousSerpent42 · Last updated Jul 20, 2026
A retail customer allows users to upload comments and product reviews. The customer needs to make sure the text does not include sensitive data before the comments or reviews...
To address the need to prevent the publication of sensitive data in user comments and product reviews, the most suitable Google Cloud service is the Cloud Data Loss Prevention API (DLP API). Here's an explanation of why it's the best fit, and why the other options are less suitable:
B) Cloud Data Loss Prevention API (DLP API)
- Key Feature: The Cloud DLP API is specifically designed to discover, classify, and redact sensitive information in text and other data. It can scan user-uploaded content for sensitive data such as credit card numbers, social security numbers, email addresses, or any other defined sensitive data.
- Use Case: In this scenario, it will scan user comments and product reviews before they are published, ensuring that sensitive information is detected and redacted, preventing accidental exposure of private data.
- Why this is selected: The DLP API is purpose-built for this kind of task—detecting and preventing sensitive data exposure in various types of content.
Why other options are rejected:
- A) Cloud Key Management Service (KMS)
- Key Feature: Cloud KMS is used to manage encryption keys and helps in encrypting or decrypting data. It's a vital service for protecting data at rest or in transit through encryption.
- Why it's rejected:...
Author: Madison · Last updated Jul 20, 2026
A company allows every employee to use Google Cloud Platform. Each department has a Google Group, with all department members as group members. If a department member creates a new project, all members of that department should automatically have read-only access to all new project resources. Members of any other...
To meet the requirements where every employee in a department should automatically have read-only access to all new project resources created by that department, the best approach is to create a Folder per department under the Organization and assign the appropriate role to the Google Group related to that department.
A) Create a Folder per department under the Organization. For each department's Folder, assign the Project Viewer role to the Google Group related to that department.
- Key Feature: A Folder in Google Cloud is a container for organizing projects and resources. By assigning roles to a Folder, the permissions cascade to all projects within that Folder, which automatically applies the required permissions to all new projects created under that department's Folder.
- Why it's selected: The Project Viewer role provides read-only access to all resources within a project, which aligns with the requirement that department members should have read-only access to all resources in any new project they create. Since folders group projects and propagate permissions to their contents, assigning the Project Viewer role at the Folder level ensures that all members of the department (in the corresponding Google Group) automatically have read-only access to any new projects within that Folder.
- Use Case: This is ideal because it automatically scales to any new projects created under the department's Folder, and department members are granted the necessary access without further manual intervention.
Why other options are rejected:
- B) Create a Folder per department under the Organization. For each department's Folder, assign the Project Browser role to the Google Group related to that department.
- Key Feature: The Project Browser role grants the ability to view project details but does not include the ability to access the project resources themselves.
- Why it's rejected: The Project Browser role does not provide the necessary access to resources like VMs, storage buckets, etc. Since the requireme...
Author: GlowingTiger · Last updated Jul 20, 2026
A customer's internal security team must manage its own encryption keys for encrypting data on Cloud Storage and decides to use customer-supplied e...
To meet the requirement of using customer-supplied encryption keys (CSEK) for encrypting data on Cloud Storage, the correct approach involves providing the encryption key directly during the upload process to ensure that the object is encrypted with the customer-managed key.
B) Use the gsutil command line tool to upload the object to Cloud Storage, and specify the location of the encryption key.
- Key Feature: The gsutil command-line tool allows you to specify a customer-supplied encryption key (CSEK) during the upload process by using the `-h` flag and specifying the key. This ensures that the object is encrypted with the provided key when it's uploaded to Cloud Storage.
- Why it's selected: This method is the most direct and recommended way to upload data to Cloud Storage with CSEK. The encryption key is supplied during the upload, and the object is encrypted accordingly. This ensures the customer retains full control over the encryption process, which is the key requirement here.
- Use Case: The gsutil tool is ideal for those who prefer a command-line interface to manage and automate their workflows for uploading data with encryption.
Why other options are rejected:
- A) Upload the encryption key to a Cloud Storage bucket, and then upload the object to the same bucket.
- Key Feature: This option suggests uploading the encryption key as an object in the same Cloud Storage bucket.
- Why it's rejected: Uploading the encryption key as an object in the same bucket is not secure, as it would allow anyone with access to the bucket to retrieve the encryption key. This defeats the purpose of encryption and doesn'...
Author: Emily · Last updated Jul 20, 2026
A customer has 300 engineers. The company wants to grant different levels of access and efficiently manage IAM permissions between users in the development and production environment projects....
To meet the requirements of granting different levels of access and efficiently managing IAM permissions for users in development and production environments, the company should focus on organizing their Google Cloud resources efficiently and utilizing IAM (Identity and Access Management) roles appropriately.
B) Create a folder for each development and production environment.
- Key Feature: Folders in Google Cloud are a logical way to group resources (such as projects) within an organization. By creating a separate folder for development and production environments, the company can easily manage and apply IAM policies at the folder level. This helps control access at a higher level and ensures that different sets of permissions can be assigned to the development and production environments.
- Why it's selected: Folders provide an organized structure for grouping related projects and allow administrators to apply IAM permissions efficiently at the folder level. By separating the environments into distinct folders, the company can apply different access control policies to development and production resources without the need to manage permissions for individual projects, which could become cumbersome.
- Use Case: This is suitable for companies looking to group resources and manage access based on environments (development, production) in a scalable and manageable way.
C) Create a Google Group for the Engineering team, and assign permissions at the folder level.
- Key Feature: Using Google Groups for the Engineering team allows the company to manage permissions at scale. Instead of assigning individual IAM permissions to 300 engineers, the company can assign permissions to the Google Group. By granting this group the appropriate access at the folder level, it simplifies management, ensuring that all engineers in the group have the correct access to the relevant environments.
- Why it's selected: Google Groups streamline IAM management by allowing bulk permission assignments. By assigning permissions at the folder level for the Google Group, the company can easily manage and maintain access control across all the engineers without dealing with individual user permissions. This is especially useful for a team of 300 engineers.
- Use Case: This is ideal when there’s a need to manage large numbers of users with similar roles, ensuring that permissions can be managed effectivel...
Author: SilverBear · Last updated Jul 20, 2026
You want to evaluate your organization's Google Cloud instance for PCI compliance. You need to identify Google's inherent controls.
...
To evaluate your organization's Google Cloud instance for PCI compliance and identify Google's inherent controls, the best document to review is the Customer Responsibility Matrix. Here's why:
A) Google Cloud Platform: Customer Responsibility Matrix
- Key Feature: The Customer Responsibility Matrix outlines which security and compliance responsibilities are handled by Google and which ones are the responsibility of the customer. This matrix is particularly useful for understanding what inherent security controls Google provides (such as physical security, network infrastructure, and platform services) and what aspects the customer needs to manage (like application-level security and data protection).
- Why it's selected: The matrix is the most direct and relevant source of information when evaluating Google Cloud's role in PCI DSS compliance. It highlights the shared responsibility model, detailing which security controls are already provided by Google, which is crucial for understanding how to align your use of Google Cloud with PCI compliance requirements.
- Use Case: This document is ideal for customers evaluating the security controls of Google Cloud, especially for compliance purposes like PCI DSS.
Why other options are rejected:
- B) PCI DSS Requirements and Security Assessment Procedures
- Key Feature: This document is the official PCI DSS standard from the Payment Card Industry Security Standards Council, detailing the requirements for compliance.
- Why it's rejected: While the PCI DSS standard is essential for understanding compliance requirements, it does not specifically cover Google's inher...
Author: Grace · Last updated Jul 20, 2026
Your company runs a website that will store PII on Google Cloud Platform. To comply with data privacy regulations, this data can only be stored for a specific amount of time and must be fully deleted after this specific period. Data that has not yet reached the time pe...
When automating the process of complying with data privacy regulations that require deletion of PII after a specific period, we need to choose the best option based on how the data is stored and managed. Let's analyze each option and determine the most appropriate one.
Option A: Store the data in a single Persistent Disk, and delete the disk at expiration time.
- Analysis: Persistent Disks are block storage used with Compute Engine instances, and they are suitable for applications requiring low-latency storage. However, it is difficult to set up automatic expiration or deletion based on time. To manage this manually, you'd need to create custom scripts or scheduled tasks to delete the entire disk after a certain time period. This is not an ideal approach because it doesn't offer any built-in functionality for automatically expiring the data based on a retention policy.
- Rejection Reason: The option is cumbersome for automatic expiration and involves unnecessary complexity for handling PII deletion.
Option B: Store the data in a single BigQuery table and set the appropriate table expiration time.
- Analysis: BigQuery is designed for large-scale analytics and provides native support for managing table expiration times. You can set an expiration time on the table when you create it or modify it afterward. Once the expiration time is reached, BigQuery will automatically delete the table, including all of its data. This is a simple and automated solution, especially for datasets that are structured and require compliance with data privacy regulations.
- Suitability: This option works well for structured data, especially when dealing with large-scale analytics or reporting data that can be stored in a table format. It meets the requirement of deleting data automatically after a specified time.
- Selected: This is a highly suitable solution for compliance because of its ease of use, automation, and nati...
Author: Ahmed · Last updated Jul 20, 2026
A DevOps team will create a new container to run on Google Kubernetes Engine. As the application will be internet-facing, they want to minimi...
When minimizing the attack surface of a container running on Google Kubernetes Engine (GKE), the main objective is to reduce the number of potential vulnerabilities by following best practices for container security. Let's analyze each option based on this goal.
Option A: Use Cloud Build to build the container images.
- Analysis: Cloud Build is a service to automate building and deploying container images, but it does not directly reduce the attack surface of the container itself. While Cloud Build can help automate the build process, it doesn't inherently address the size or composition of the container images, which is the key factor in minimizing the attack surface.
- Rejection Reason: While Cloud Build is useful for automation, it doesn't directly impact the container image's attack surface. The core issue is how the image is constructed, not the tool used to build it.
Option B: Build small containers using small base images.
- Analysis: This is a critical security best practice. Small containers built with minimal base images, like `alpine` or `distroless`, reduce the number of installed packages, which means fewer potential vulnerabilities. These images are leaner, have fewer services running, and require less maintenance. By minimizing unnecessary libraries, tools, or services, you reduce the attack surface for potential exploits.
- Suitability: This approach is directly aligned with minimizing the attack surface of the container. Smaller base images reduce the number of vulnerabilit...
Author: RadiantPhoenixX · Last updated Jul 20, 2026
While migrating your organization's infrastructure to GCP, a large number of users will need to access GCP Console. The Identity Management team already has a well-established way to manage your users and want to keep using your ...
When migrating an organization's infrastructure to Google Cloud Platform (GCP) and needing to integrate with an existing Active Directory (AD) or LDAP server for user authentication, it's important to consider both ease of integration and scalability for managing access to the GCP Console. Let’s analyze each option in this context.
Option A: Manually synchronize the data in Google domain with your existing Active Directory or LDAP server.
- Analysis: This approach involves manually synchronizing users between the existing identity provider (Active Directory or LDAP) and the GCP environment. While this might be feasible for small environments or a one-time migration, it can be labor-intensive and error-prone for large-scale environments, especially when you need to maintain synchronization over time. Manual processes are also harder to scale and automate.
- Rejection Reason: This option is inefficient and not scalable for large user bases, as it requires significant manual effort to keep the synchronization up-to-date and is prone to human error.
Option B: Use Google Cloud Directory Sync (GCDS) to synchronize the data in Google domain with your existing Active Directory or LDAP server.
- Analysis: Google Cloud Directory Sync (GCDS) is a tool specifically designed to synchronize your existing Active Directory or LDAP with GCP’s identity services. It automatically syncs user and group data between your on-premises directory and GCP, making it easy to manage access without requiring users to manually sign in to different platforms. GCDS also supports Single Sign-On (SSO), allowing users to authenticate with their existing AD or LDAP credentials. This is the most efficient and scalable option for organizations with a large number of users and a desire to keep their current identity management system intact.
- Suitability: This is the best option for organizations that already have a well-established Active Directory or LDAP server and want seamless integration with GCP. It automates the synchronization and simplifies user management without requiring major changes to existing workflows.
- Selected: This is the ideal choice for ensuring ...
Author: Vikram · Last updated Jul 20, 2026
Your company is using GSuite and has developed an application meant for internal usage on Google App Engine. You need to make sure that an external user cannot gain access to the applica...
To ensure that an external user cannot gain access to your internal application on Google App Engine (even if an employee's password is compromised), you need to implement additional layers of security beyond just password protection. Let's analyze each option and determine the best approach for this scenario.
Option A: Enforce 2-factor authentication (2FA) in GSuite for all users.
- Analysis: Enforcing 2FA in GSuite adds an additional layer of security by requiring users to provide a second factor (such as a code from a mobile device or security key) in addition to their password. This can help mitigate the risk of unauthorized access even if an employee’s password is compromised. However, 2FA mainly secures the GSuite accounts and does not necessarily address access to the application hosted on Google App Engine, which may require a different access control mechanism for the application itself.
- Suitability: While enforcing 2FA in GSuite is a strong security measure for protecting GSuite accounts, it may not be sufficient by itself to restrict access to the Google App Engine application, especially if it's intended for internal use only.
Option B: Configure Cloud Identity-Aware Proxy (IAP) for the App Engine Application.
- Analysis: Cloud Identity-Aware Proxy (IAP) provides fine-grained access control to web applications and VMs running in Google Cloud. By configuring IAP for your App Engine application, you can restrict access to the application based on the identity of the user. IAP integrates with Google’s Identity Platform, leveraging GSuite accounts (and other identities) to enforce access policies. This means only authenticated and authorized users (based on their GSuite or other configured identity) can access the application, even if a password is compromised, provided they don’t have the necessary role or permission.
- Suitability: This is the best solution for your scenario, as it provides robust access control for your App Engine application, ensuring that only authorized users can access it, even if an employee's password is compromised. IAP acts as a gatekeeper and ens...
Author: Lucas · Last updated Jul 20, 2026
A large financial institution is moving its Big Data analytics to Google Cloud Platform. They want to have maximum control over the encryption process of data st...
When a financial institution is moving its Big Data analytics to Google Cloud Platform (GCP) and wants to have maximum control over the encryption of data stored at rest in BigQuery, it is crucial to select an encryption method that provides the highest level of control, security, and compliance. Let's analyze each option based on these requirements:
Option A: Use Cloud Storage as a federated Data Source.
- Analysis: Cloud Storage can be used as a data source for BigQuery, but this does not address encryption directly. Federating Cloud Storage with BigQuery allows data to reside in Cloud Storage and be queried from BigQuery, but it does not provide direct control over the encryption of data at rest in BigQuery itself.
- Rejection Reason: This option does not give the institution direct control over the encryption of data at rest within BigQuery. It is more relevant for handling external storage rather than controlling BigQuery encryption.
Option B: Use a Cloud Hardware Security Module (Cloud HSM).
- Analysis: Cloud HSM provides hardware-based key management and secure cryptographic operations within Google Cloud. It allows organizations to manage their own cryptographic keys in a secure environment, providing greater control over encryption. While Cloud HSM can be used for key management, it does not directly handle data encryption for BigQuery storage. Cloud HSM is more appropriate for managing keys for services that require custom cryptographic operations, but BigQuery does not require such operations for typical use cases.
- Rejection Reason: Although Cloud HSM provides secure key management, it is not the most direct method for managing the encryption of data stored in BigQuery at rest. It's a good option for custom encryption processes, but not specifically tailored for BigQuery's encryption requirements.
Option C: Customer-managed encryption keys (CMEK).
- Analysis: Customer-managed encryption keys (CMEK) allows customers to use their own encryption keys to encrypt data at rest within Google Cloud services, including BigQuery. This option pro...
Author: IceDragon2023 · Last updated Jul 20, 2026
A company is deploying their application on Google Cloud Platform. Company policy requires long-term data to be stored using a solution that can automatically replicate data over at...
For this scenario, the company needs a storage solution on Google Cloud Platform (GCP) that automatically replicates data across at least two geographic locations, to comply with company policy for long-term data storage. Let's evaluate each option to understand which one fits the requirement and why the others do not.
A) Cloud Bigtable
- Description: Cloud Bigtable is a fully managed NoSQL database service designed for high-throughput, low-latency workloads, such as large-scale data analytics or Internet of Things (IoT) applications.
- Replication: Cloud Bigtable allows automatic replication within the same region and supports multi-region replication for high availability and disaster recovery.
- Fit for Requirement: Cloud Bigtable is suitable for long-term storage of large amounts of data that may require replication across multiple geographic locations. It allows replication across regions and ensures data availability in different locations.
- Rejection: Cloud Bigtable is ideal for NoSQL use cases, so if the company doesn't require NoSQL database features but needs traditional file storage, this would not be the best option.
B) Cloud BigQuery
- Description: Cloud BigQuery is a fully managed data warehouse solution for running SQL queries on large datasets. It is used for big data analytics, and it can handle structured data.
- Replication: BigQuery automatically replicates data across multiple regions for availability and durability. Data in BigQuery is highly durable due to the underlying storage system that automatically handles redundancy.
- Fit for Requirement: BigQuery is also suitable for long-term data storage and complies with the company's policy of automatically replicating data across multiple geographic locations. BigQuery is often used for analytics, but it is not a general-purpose file storage system.
- Rejection: BigQuery is primarily intended for data analytics and is not a general-purpose st...
Author: Liam · Last updated Jul 20, 2026
A large e-retailer is moving to Google Cloud Platform with its ecommerce website. The company wants to ensure payment information is encrypted between the customer's b...
To ensure payment information is encrypted between the customer's browser and Google Cloud Platform (GCP) during the online checkout process, the company needs to ensure that secure communication is established between the client (customer's browser) and the platform. Here's an evaluation of each option to determine which one meets the requirement.
A) Configure an SSL Certificate on an L7 Load Balancer and require encryption
- Description: The L7 (Layer 7) Load Balancer in GCP operates at the application layer, handling HTTP/HTTPS traffic. By configuring an SSL certificate on the L7 Load Balancer, you can enable SSL/TLS encryption for all incoming traffic.
- How it meets the requirement: This is the best solution because it ensures that traffic between the customer’s browser (client) and the GCP infrastructure is encrypted over HTTPS. The SSL certificate on the L7 Load Balancer handles the encryption/decryption of data, securing sensitive information such as payment details during checkout.
- Why it’s selected: The L7 Load Balancer is designed to handle HTTP(S) traffic and provides SSL termination (encryption and decryption), ensuring secure communication between the customer’s browser and the platform. This method is commonly used for web applications, especially e-commerce sites, to ensure secure transactions.
- Rejection: None — this is the ideal solution for web traffic requiring HTTPS encryption.
B) Configure an SSL Certificate on a Network TCP Load Balancer and require encryption
- Description: The TCP Load Balancer operates at Layer 4 (Transport Layer) and handles TCP traffic. While it supports the transport of encrypted data (through SSL/TLS), it does not natively manage SSL certificates like the L7 Load Balancer does.
- Why it’s rejected: The TCP Load Balancer does not handle SSL/TLS termination by default, meaning it would require additional confi...
Author: Zara · Last updated Jul 20, 2026
Applications often require access to `secrets` - small pieces of sensitive data at build or run time. The administrator managing these secrets on GCP wants to keep a track of `who did what, where, and when?` within their GCP projects.
W...
To track who did what, where, and when in Google Cloud Platform (GCP) projects, the administrator needs to focus on logs that provide detailed auditing and access information related to actions performed by users or systems. Here's an evaluation of each log stream option:
A) Admin Activity logs
- Description: Admin Activity logs are part of the Cloud Audit Logs and capture administrative actions taken by users, such as creating, updating, or deleting resources. These logs provide detailed information about actions related to GCP services and resources, including who performed the action, what was changed, and when it happened.
- Why it’s selected: Admin Activity logs are the primary source of information for auditing user actions within GCP projects. This log stream provides exact tracking of administrative actions such as changes to secrets management, IAM roles, and resource configurations, making it an ideal choice for tracking "who did what, where, and when."
B) System Event logs
- Description: System Event logs capture system-generated events that occur within a GCP project, such as automatic resource creation or service health-related events.
- Why it’s rejected: While System Event logs track system-level events, they do not provide detailed information on actions performed by users, such as access to secrets or the modification of configurations. These logs are more useful for understanding system operations, rather than user-driven actions.
C) Data Access logs
- Description: Data Access logs, also part of Cloud Audit Logs, capture data-level interactions, such as read or write actions on specific resources (e.g., Cloud Storage buckets, Cloud Secrets Manager, BigQuery datasets...
Author: Emma · Last updated Jul 20, 2026
You are in charge of migrating a legacy application from your company datacenters to GCP before the current maintenance contract expires. You do not know what ports the application is using and no documentation is available for you to ch...
When migrating a legacy application without knowing the specific ports it uses, the goal is to ensure that the migration process is secure and controlled while minimizing risks. Let's go through the options to determine the best approach for safely migrating the application while determining the necessary traffic requirements.
A) Migrate the application into an isolated project using a "Lift & Shift" approach. Enable all internal TCP traffic using VPC Firewall rules. Use VPC Flow logs to determine what traffic should be allowed for the application to work properly.
- Description: In this approach, you would migrate the application as-is ("Lift & Shift") into an isolated project and allow all internal TCP traffic. VPC Flow logs would then be used to analyze the traffic patterns to identify which ports are necessary.
- Why it's selected: This option provides a controlled environment where the application is isolated within a project, and VPC Flow logs give visibility into the traffic patterns so you can determine which ports should be allowed. By enabling all internal TCP traffic initially, you reduce the chances of the application breaking due to blocked traffic. After migration, you can refine the firewall rules based on the actual traffic observed in VPC Flow logs.
- Why it's better: The approach ensures that you can quickly identify the required ports by capturing the network traffic after migration. This is helpful when you do not have prior knowledge of the ports in use.
B) Migrate the application into an isolated project using a "Lift & Shift" approach in a custom network. Disable all traffic within the VPC and look at the Firewall logs to determine what traffic should be allowed for the application to work properly.
- Description: This option involves a "Lift & Shift" approach but with a custom VPC where all traffic is initially disabled. You would then look at the firewall logs to determine which traffic is required for the application to function properly.
- Why it's rejected: While firewall logs can show denied traffic, Firewall logs only capture blocked traffic rather than capturing allowed traffic. This limits your ability to understand all the necessary ports that should be open for the application to work. Blocking all traffic initially could cause the application to fail, whic...
Author: Noah Williams · Last updated Jul 20, 2026
Your company has deployed an application on Compute Engine. The application is accessible by clients on port 587. You need to balance the load between the different instances running the application. The connection should be se...
To determine the best type of Load Balancing for your application, it's important to consider the specific requirements:
- Application accessibility on port 587 (typically used for SMTP or secure email submission)
- TLS termination at the Load Balancer, which means the load balancer will decrypt the traffic before forwarding it to backend instances.
- Balancing the load between multiple instances running the application.
Let's evaluate the options:
A) Network Load Balancing
- Description: Network Load Balancing is a Layer 4 (TCP/UDP) load balancer that distributes traffic based on IP protocol data. It operates at the transport layer and does not handle any encryption or decryption of traffic (i.e., it doesn’t support TLS termination).
- Why it’s rejected: Since TLS termination is required in this scenario, Network Load Balancing is not suitable because it doesn’t support termination of encrypted traffic. It merely forwards raw packets to the backend, without any decryption.
B) HTTP(S) Load Balancing
- Description: HTTP(S) Load Balancing is a Layer 7 (Application Layer) load balancer that operates on HTTP or HTTPS traffic. It allows you to perform routing based on URL paths, headers, and other HTTP-specific parameters. It also supports TLS termination.
- Why it’s rejected: This option is designed specifically for HTTP/HTTPS traffic, and since the application uses port 587, which is not HTTP/HTTPS traffic, this is not the right fit. HTTP(S) Load Balancing will not work with SMTP or other non-HTTP traffic.
C) TCP Proxy Load Balancing
- Description: TCP Proxy Load Balancing operates at L...
Author: Amira99 · Last updated Jul 20, 2026
You want to limit the images that can be used as the source for boot disks. These images will be stored...
To limit the images that can be used as the source for boot disks, the goal is to specify which projects are allowed to provide images for boot disks, and restrict others from using images that are not in the trusted project.
Let's evaluate the options:
A) Use the Organization Policy Service to create a compute.trustedimageProjects constraint on the organization level. List the trusted project as the whitelist in an allow operation.
This option enables you to define a whitelist of trusted projects where the images can be sourced from. By creating a "compute.trustedimageProjects" constraint at the organization level and listing the trusted projects in an allow operation, you ensure that only the specified projects can be used as image sources. This option is ideal for enforcing a strict policy on trusted images across the organization.
B) Use the Organization Policy Service to create a compute.trustedimageProjects constraint on the organization level. List the trusted projects as the exceptions in a deny operation.
This option denies all projects except for the trusted ones, but it could be too broad or restrictive because it doesn't explicitly allow only the trusted projects; it denies everything else. While this ap...
Author: Noah · Last updated Jul 20, 2026
Your team needs to prevent users from creating projects in the organization. Only the DevOps team should be allowed to create projects on behalf of the requester.
Which...
To prevent users from creating projects in the organization and allow only the DevOps team to create projects on behalf of requesters, we need to focus on restricting the "Project Creator" role and ensuring that the appropriate permissions are granted to the DevOps team.
Let's evaluate the options:
A) Remove all users from the Project Creator role at the organizational level.
This option would prevent all users from creating projects, which is a necessary step to block non-DevOps users from creating new projects. Removing users from the "Project Creator" role ensures that no unauthorized users can create projects. This is the first step in limiting the ability to create projects organization-wide.
B) Create an Organization Policy constraint, and apply it at the organizational level.
This option could be used to enforce a specific policy at the organizational level, such as restricting project creation to specific roles or members. By using a constraint like "constraints/iam.disableServiceAccountCreation," you can prevent users from creating resources. However, for controlling who can create projects, the specific use of the "Project Creator" role is more directly applicable. This constraint may not be as effective ...
Author: Charlotte · Last updated Jul 20, 2026
A customer deployed an application on Compute Engine that takes advantage of the elastic nature of cloud computing.
How can you work with Infrastructure Operations Engineers to best ensu...
To ensure that Windows Compute Engine VMs are up to date with the latest OS patches, it's important to select a solution that is automated, scalable, and integrates well with the cloud environment's elasticity. Let's evaluate the options:
A) Build new base images when patches are available, and use a CI/CD pipeline to rebuild VMs, deploying incrementally.
This option focuses on creating new base images with the latest patches and automating the process of rebuilding VMs using a CI/CD pipeline. This is a great way to ensure that the VMs are up to date, as it involves creating new VM images with patches applied and gradually replacing existing VMs. This method benefits from cloud scalability and automation. However, rebuilding the entire VM every time patches are available can be resource-intensive, especially for frequently updated systems. This option is well-suited for environments where frequent changes to the OS are needed.
B) Federate a Domain Controller into Compute Engine, and roll out weekly patches via Group Policy Object.
This option uses Active Directory and Group Policy Objects (GPOs) to manage patching. While this can be effective in environments with large numbers of Windows-based systems, it requires setting up and maintaining Active Directory, which might not be as efficient or necessary in a cloud-native environment. The cloud’s elastic nature is better suited to more automated, image-based patching approaches that don’t rely on traditional domain controller management. Thus, this option might be more complex and less ideal for cloud-native workloads.
...
Author: Sofia · Last updated Jul 20, 2026
Your team needs to make sure that their backend database can only be accessed by the frontend application and no other instances o...
To ensure that the backend database can only be accessed by the frontend application and no other instances on the network, the network design must focus on restricting access and ensuring proper isolation between the frontend and database layers. Let's evaluate the options:
A) Create an ingress firewall rule to allow access only from the application to the database using firewall tags.
This option allows the backend database to be accessed only by the frontend application through a firewall rule that uses firewall tags. This is a simple and effective approach to limit access to the database. Firewall rules can be configured to allow traffic only from specific instances or tags associated with the frontend application. This is the most straightforward solution, as it directly addresses the requirement of restricting access to the backend database.
B) Create a different subnet for the frontend application and database to ensure network isolation.
While subnetting is important for organizing the network, creating a separate subnet by itself does not inherently guarantee security or prevent unwanted access between instances on different subnets. You would still need to rely on firewall rules or other access control mechanisms to enforce restrictions between the frontend and database. So, while subnetting is useful, it alone does not f...
Author: Layla · Last updated Jul 20, 2026
An organization receives an increasing number of phishing emails.
Which method should be used to pro...
In response to the increasing number of phishing emails, protecting employee credentials requires measures that prevent unauthorized access even if credentials are compromised. Let’s evaluate the options:
A) Multifactor Authentication (MFA)
MFA is the most effective method for protecting employee credentials, especially in the context of phishing attacks. Even if an attacker obtains an employee’s username and password, they would still need access to a second factor (e.g., a phone, an authentication app, or a hardware token) to successfully log in. This adds a critical layer of protection and significantly reduces the likelihood of unauthorized access due to stolen credentials. MFA is a direct, well-recognized defense against phishing.
B) A strict password policy
While enforcing a strict password policy (e.g., requiring complex passwords, regular changes, etc.) is important, it does not fully protect against phishing attacks. Phishing often involves tricking users into revealing their passwords, regardless of how strong th...
Author: Michael · Last updated Jul 20, 2026
A customer is collaborating with another company to build an application on Compute Engine. The customer is building the application tier in their GCP
Organization, and the other company is building the storage tier in a different GCP Organization. This is a 3-tier web application. Communication betwee...
To connect the application tier and storage tier across different GCP Organizations, while ensuring that the communication does not traverse the public internet, we need to select a connectivity option that allows for private and secure communication between VPCs in different organizations. Let’s evaluate each option based on this requirement.
1. VPC Peering (A):
- VPC Peering allows two VPCs to communicate privately. It is often used within a single organization or between two VPCs that belong to different organizations. However, it has limitations such as:
- It does not support transitive peering. This means if you have more than two VPCs, VPC peering will not allow communication between them unless they are directly peered.
- It does not provide any centralized control or management.
- It requires you to manage the routing and IP range conflicts manually.
- While it avoids the public internet, it is not suitable for complex or large-scale inter-organizational scenarios where multiple VPCs need to be interconnected.
Rejected: VPC peering would not be the best option here since it could become complex to manage and scale when dealing with multiple VPCs across different organizations.
2. Cloud VPN (B):
- Cloud VPN creates an encrypted tunnel between two networks (e.g., on-premise to Google Cloud or between two Google Cloud VPCs). While it ensures that communication is private and secure by encrypting the data over the public internet, it still relies on the public internet for the underlying transport.
- This option is not ideal because the requirement is that the communication should not traverse the public internet in any way.
Rejected: Cloud VPN is rejected because it still relies on the public internet for communication.
3. Cloud Interconnect (C):
- Cloud Interconnect provides a private and dedicated connection between your o...
Author: Ryan · Last updated Jul 20, 2026
Your team wants to make sure Compute Engine instances running in your production project do not have public IP addresses. The frontend application Compute
Engine instances will require public IPs. The product engineers have the Editor role to mod...
To meet the requirement of ensuring Compute Engine instances in the production project do not have public IPs (except for the frontend application), let's evaluate the different options:
1. Enable Private Access on the VPC network in the production project (A):
- Private Access enables instances in the VPC network to access Google services like Cloud Storage, Cloud Bigtable, etc., without needing public IPs. This would ensure that instances in the production environment do not require public IPs for accessing Google services.
- However, enabling private access does not directly enforce the restriction on the instances themselves to prevent public IPs. It is more about routing traffic securely within Google Cloud.
- This option addresses access to Google services but does not fully solve the problem of preventing public IPs on Compute Engine instances.
Rejected: While helpful for secure access to Google services, it does not directly enforce the restriction on instances' public IP addresses.
2. Remove the Editor role and grant the Compute Admin IAM role to the engineers (B):
- The Editor role allows users to modify resources within the project, including the ability to create instances with public IPs.
- The Compute Admin role grants permissions related to managing Compute Engine resources, but it does not inherently prevent users from assigning public IPs to instances.
- This option is focused on permissions, but it doesn't solve the need to specifically enforce a policy on public IPs. Engineers could still manually assign public IPs unless there is a specific organization policy or constraint in place.
Rejected: Changing roles may limit overall permissions but does not directly enforce the restriction of disallowing public IPs on instances.
3. Set up an organization policy to only permit public IPs for the front-end Compute Engine instances (C):
- Organization policies in GCP allow you to enforce rules that apply across projects, ensuring compliance with your...
Author: Mia · Last updated Jul 20, 2026
Which two security characteristics are related to the use of VPC peering to connect two VPC networks...
Let's evaluate each option based on the security characteristics related to the use of VPC Peering to connect two VPC networks:
1. A) Central management of routes, firewalls, and VPNs for peered networks:
- VPC Peering does not provide a central management solution for routes, firewalls, or VPNs for peered networks. Each VPC maintains its own routing table, firewall rules, and VPN configurations.
- VPC Peering allows networks to directly communicate, but it does not centralize management of these resources; they must be managed individually in each VPC.
Rejected: VPC Peering does not centralize route, firewall, or VPN management, so this is not a relevant characteristic of VPC Peering.
2. B) Non-transitive peered networks; where only directly peered networks can communicate:
- Non-transitive nature of VPC Peering is a crucial security characteristic. When two VPCs are peered, they can communicate, but they cannot reach other VPCs indirectly through the peering relationship. This means that if VPC-A is peered with VPC-B, and VPC-B is peered with VPC-C, VPC-A cannot communicate with VPC-C via the VPC-B peering.
- This non-transitive property helps maintain network isolation and adds an extra layer of security since communication is only possible between directly peered networks.
Selected: This is a valid security characteristic of VPC Peering as it ensures that only the directly connected networks can communicate.
3. C) Ability to peer networks that belong to different Google Cloud organizations:
- VPC Peering does allow you to peer networks from different Google Cloud organizations. However, this feature does not directly relate to security; it is more of a connectivity feature that allows resource sharing and communication across organizational boundaries.
- While this is an important feature of VPC Peering, it is not specifically tied to security c...
Author: Aria · Last updated Jul 20, 2026
A patch for a vulnerability has been released, and a DevOps team needs to update their running containers in Google Kubernetes En...
Let’s evaluate the different options for updating running containers in Google Kubernetes Engine (GKE) after a vulnerability patch has been released.
1. A) Use Puppet or Chef to push out the patch to the running container:
- Puppet and Chef are configuration management tools that automate the deployment of updates, but they are typically used for managing servers or infrastructure, not containers directly. These tools are better suited for managing virtual machines or physical hosts, and using them to patch running containers might not be the best approach in a containerized environment.
- Containers should be updated by rebuilding images and redeploying them, not by patching running instances. Also, pushing patches to running containers without updating the container image may not address all vulnerabilities (e.g., missing libraries or outdated software versions within the image).
Rejected: This approach is not ideal for containerized environments and would be more complex and error-prone.
2. B) Verify that auto upgrade is enabled; if so, Google will upgrade the nodes in a GKE cluster:
- Auto-upgrade in GKE only applies to the Kubernetes nodes, not the containers running on the nodes. Node auto-upgrade ensures that the underlying virtual machine instances (nodes) are automatically updated to the latest recommended version by Google.
- While node upgrades are important for maintaining the overall health of the cluster and for applying security patches to the Kubernetes infrastructure, it does not automatically update the containers themselves. The containers need to be updated individually to apply the patch for the vulnerability.
Rejected: This approach does not address updating the containers directly; it only updates the nodes running Kubernetes.
3. C) Update the application code or apply a patch, build a new image, and redeploy it:
- This is the most appropriate and correct approach. In Kubernetes, containers are typically updated by building a new container image (which includes the ...
Author: Zara · Last updated Jul 20, 2026
A company is running their webshop on Google Kubernetes Engine and wants to analyze customer transactions in BigQuery. You need to ensure that no ...
Let's evaluate each option to determine the best approach to ensure that no credit card numbers are stored in BigQuery while analyzing customer transactions.
1. A) Create a BigQuery view with regular expressions matching credit card numbers to query and delete affected rows:
- This approach relies on regular expressions to detect and delete credit card numbers from data that has already been ingested into BigQuery. While this might be useful for cleaning up data after the fact, it doesn't address the problem at the point of ingestion, meaning that the sensitive data (credit card numbers) would still be stored temporarily before being detected and deleted.
- This method is reactive, not proactive, and it may not guarantee complete removal of sensitive data, especially in large datasets.
Rejected: This approach doesn't prevent sensitive data from being stored in the first place, making it inefficient and risky for ensuring no credit card numbers are stored in BigQuery.
2. B) Use the Cloud Data Loss Prevention API to redact related infoTypes before data is ingested into BigQuery:
- The Cloud Data Loss Prevention (DLP) API can be used to scan and redact sensitive data (such as credit card numbers) before it is ingested into BigQuery. The DLP API is designed to identify and handle sensitive information in structured and unstructured data.
- By using the DLP API to redact credit card numbers before the data reaches BigQuery, you can ensure that sensitive data is not stored in BigQuery in the first place. This is a proactive approach that ensures compliance and prevents the storage of sensitive information from the outset.
Selected: The DLP API is the most effective and secure solution because it prevents sensitive data from being ingested into BigQuery in the first place.
3. C) Leverage Security Command Center to scan for the as...
Author: ThunderBear · Last updated Jul 20, 2026
A customer wants to deploy a large number of 3-tier web applications on Compute Engine.
How should the customer ensure authenticated networ...
To ensure authenticated network separation between the different tiers of the application, it's essential to isolate the tiers and control access between them based on network policies. Let’s analyze each option:
A) Run each tier in its own Project, and segregate using Project labels.
- Reasoning: While using separate projects can help in isolating resources at a high level, it doesn't directly provide network isolation between the tiers. Project labels are primarily useful for organizational purposes and for identifying resources, but they do not enforce security or network rules. To achieve network segregation, firewall rules or network policies are required, which are not inherently enforced by project-level segregation.
- Rejected Reasoning: This option is not ideal for managing network separation between tiers as it does not provide the necessary network-level controls to enforce segregation.
B) Run each tier with a different Service Account (SA), and use SA-based firewall rules.
- Reasoning: Using Service Accounts (SAs) can provide access control at the application level, but firewall rules based on service accounts are not directly supported by Google Cloud. Firewall rules in GCP are typically based on IP addresses or network tags, not service accounts. SAs control access to APIs and Google Cloud services but do not directly control networking access between different tiers of an application.
- Rejected Reasoning: This option is not practical as firewall rules based on service accounts are not a supported feature in Google Cloud, and thus wouldn't provide effective network separation.
C) Run each tier in its own subnet, and use subnet-based firewall rules.
...
Author: Emma · Last updated Jul 20, 2026
A manager wants to start retaining security event logs for 2 years while minimizing costs. You write a filter to select the appr...
To retain security event logs for 2 years while minimizing costs, we need to focus on storage solutions that are cost-effective and provide a reasonable way to store logs long-term. Let’s analyze the options:
A) BigQuery datasets
- Reasoning: BigQuery is a powerful analytics tool primarily used for large-scale data analysis. It is typically used for querying and analyzing log data in real-time, but it is not an ideal solution for long-term log retention because it can be expensive, especially if the volume of logs is high. Although it supports storing large datasets, its pricing model is based on storage and query costs, which can add up significantly for 2 years of data.
- Rejected Reasoning: BigQuery is better suited for data analysis and querying, but it is not the most cost-effective option for retaining security event logs over an extended period (e.g., 2 years) without incurring high storage costs.
B) Cloud Storage buckets
- Reasoning: Cloud Storage is a cost-effective solution for long-term storage of logs, especially when minimizing costs is a priority. You can store logs in Cloud Storage buckets with different storage classes (e.g., Nearline, Coldline, Archive), allowing you to optimize costs based on the access frequency. For logs that are not frequently accessed, Coldline or Archive storage classes would be the most cost-efficient option. These storage classes are designed for long-term retention with lower storage costs.
- Selected Option: Cloud Storage is the most cost-effective option for long-term storage of logs, especially if the logs are not accessed frequently. You can retain logs for 2 years in this solution while minimizing costs th...
Author: Rohan · Last updated Jul 20, 2026
For compliance reasons, an organization needs to ensure that in-scope PCI Kubernetes Pods reside on `in-scope` Nodes only. These Nodes can only contain the
`...
To ensure that in-scope PCI Kubernetes Pods are deployed only on the appropriate `in-scope` Nodes, the solution needs to involve a method of isolating and enforcing Pod placement based on the properties of the Nodes, while also making sure that only `in-scope` Pods can run on those Nodes.
Let’s analyze each option:
A) Add a nodeSelector field to the pod configuration to only use the Nodes labeled `inscope: true`.
- Reasoning: The `nodeSelector` field in the Pod configuration ensures that Pods are scheduled only on Nodes that have a specific label. By labeling the `in-scope` Nodes with `inscope: true`, and then using `nodeSelector` in the Pod configuration to specify the same label, this would restrict the Pods to run only on those Nodes.
- Selected Option Reasoning: This option is a simple and effective solution for ensuring that the Pods are scheduled on the right Nodes based on their label. However, it doesn't prevent other Pods from running on the same Nodes, so this is effective but might not fully isolate the Nodes if the goal is to prevent any other Pods from running on them.
B) Create a node pool with the label `inscope: true` and a Pod Security Policy that only allows the Pods to run on Nodes with that label.
- Reasoning: Creating a separate node pool for `in-scope` Nodes and labeling them `inscope: true` is a good strategy for physical isolation. However, Pod Security Policies are not meant for restricting the Pods to specific Nodes. They focus on security-related policies like controlling privileged access or enforcing security contexts. A Pod Security Policy does not directly handle scheduling constraints like labeling nodes.
- Rejected Reasoning: This approach is not suitable for achieving the desired goal because Pod Security Policies do not directly control where Pods are scheduled based on node labels. Therefore, it would not effectively ensu...
Author: CrimsonViperX · Last updated Jul 20, 2026
In an effort for your company messaging app to comply with FIPS 140-2, a decision was made to use GCP compute and network services. The messaging app architecture includes a Managed Instance Group (MIG) that controls a cluster of Compute Engine instances. The instances use Local SSDs for data caching and
UDP for instance-to-instance communications. Th...
To comply with FIPS 140-2 (Federal Information Processing Standard), you need to ensure that the messaging app's infrastructure is using cryptographic modules that meet FIPS 140-2 requirements for both storage encryption and communication security. Let’s evaluate each option:
A) Encrypt all cache storage and VM-to-VM communication using the BoringCrypto module.
- Reasoning: While BoringCrypto is a cryptographic library designed for use with Google Cloud, it is not explicitly FIPS 140-2 validated. FIPS 140-2 compliance requires cryptographic modules that have been validated by the National Institute of Standards and Technology (NIST). Although BoringCrypto is a part of Google Cloud’s internal libraries for cryptographic functions, it does not guarantee FIPS 140-2 compliance in this context.
- Rejected Reasoning: This option does not fully meet FIPS 140-2 compliance requirements as it does not ensure that the cryptographic module has been validated for FIPS 140-2 compliance.
B) Set Disk Encryption on the Instance Template used by the MIG to customer-managed key and use BoringSSL for all data transit between instances.
- Reasoning: Setting Disk Encryption to use customer-managed keys (CMKs) ensures that disk storage encryption meets compliance needs, as you have control over the keys used. However, BoringSSL (while being a secure library) is not explicitly FIPS 140-2 validated. Therefore, this combination doesn’t fully meet FIPS 140-2 compliance since BoringSSL is not a FIPS 140-2 validated cryptographic module.
- Rejected Reasoning: While this approach secures disk encryption and communication, it still does not guarantee FIPS 140-2 compliance due to the use of BoringSSL (which isn't FIPS validated).
C) Change the app instance-to-instance communications from UDP to TCP and enable BoringSSL on clients' TLS connections.
- Reasoning: TCP offers better security and reliability over UDP, but the change in protocol (from UDP to TCP) alone doesn't ad...
Author: Emma Brown · Last updated Jul 20, 2026
A customer has an analytics workload running on Compute Engine that should have limited internet access.
Your team created an egress firewall rule to deny (priority 1000) all traffic to the internet.
The Compute Engine instances...
To ensure the Compute Engine instances can reach the public repository for security updates while still maintaining restricted internet access, your team needs to modify the egress firewall rules appropriately. Let's evaluate each option:
A) Create an egress firewall rule to allow traffic to the CIDR range of the repository with a priority greater than 1000.
- Reasoning: An egress firewall rule that allows traffic to the CIDR range of the repository will ensure that the Compute Engine instances can reach the repository's public IP range. Setting the priority greater than 1000 means this rule would be evaluated after the existing deny rule (priority 1000), allowing the allowed traffic through.
- Selected Option Reasoning: This option is ideal because it ensures that only traffic to the specific repository (based on its IP range) is allowed, while all other internet traffic is still denied due to the priority configuration.
B) Create an egress firewall rule to allow traffic to the CIDR range of the repository with a priority less than 1000.
- Reasoning: A priority less than 1000 would result in this allow rule being evaluated before the deny rule. This would work to allow traffic to the repository's IP range, but it could potentially override the existing deny rule and inadvertently allow broader internet access.
- Rejected Reasoning: While this would allow traffic to the repository, it risks undermining the intent of the original deny rule, which might result in more open...
Author: Noah · Last updated Jul 20, 2026
You want data on Compute Engine disks to be encrypted at rest with keys managed by Cloud Key Management Service (KMS). Cloud Identity and Access
Management (IAM) permissions to these keys must be managed in a...
To select the appropriate option, we need to consider the key factors involved: encryption, key management, IAM permissions, and scalability. Let's break down each option and the reasoning behind selecting the right one:
A) Create a single KeyRing for all persistent disks and all Keys in this KeyRing. Manage the IAM permissions at the Key level.
- Pros: This option would group all persistent disk encryption keys in a single KeyRing, making it easier to manage encryption keys.
- Cons: Managing IAM permissions at the Key level could be cumbersome if you want uniform permissions for all keys. This approach means you would need to update permissions for each key individually, which could be less efficient if many keys are involved.
- Scenario: This option could be used if IAM permissions vary per key and need to be set individually for each disk key, but that is not the goal here.
B) Create a single KeyRing for all persistent disks and all Keys in this KeyRing. Manage the IAM permissions at the KeyRing level.
- Pros: By managing IAM permissions at the KeyRing level, you apply consistent permissions across all keys in the KeyRing. This is efficient, especially when you want uniform IAM permissions for all keys.
- Cons: Since all keys reside in one KeyRing, there may be a limit on scalability as the KeyRing grows. However, for most use cases, this approach balances both ease of permission management and scalability.
- Scenario: This is the best approach when you need consistent IAM permissions across multiple keys (as in the case for disks with the same permissions) and when...
Author: Arjun · Last updated Jul 20, 2026
A company is backing up application logs to a Cloud Storage bucket shared with both analysts and the administrator. Analysts should only have access to logs that do not contain any personally identifiable information (PII). Log files containing...
To determine the most appropriate option, let's consider the key requirements of the scenario:
1. Logs should be scanned for PII (Personally Identifiable Information): This means there needs to be a way to identify which logs contain PII and which don't.
2. Logs containing PII should be moved to a restricted bucket accessible only by the administrator: Any log files that contain PII need to be transferred to a more secure location.
3. Analysts should have access only to logs without PII: Analysts should not be able to access logs with sensitive data.
We will review each option and analyze their suitability based on the requirements.
A) Use Cloud Pub/Sub and Cloud Functions to trigger a Data Loss Prevention scan every time a file is uploaded to the shared bucket. If the scan detects PII, have the function move the file into a Cloud Storage bucket only accessible by the administrator.
- Pros: This approach uses a Cloud Function that is triggered by new file uploads to the shared bucket, and then performs a Data Loss Prevention (DLP) scan to check for PII. If PII is found, the file is moved to a separate, restricted bucket. This solution efficiently automates the scanning and file-moving process.
- Cons: The setup requires integrating Cloud Pub/Sub, Cloud Functions, and DLP, which can increase complexity. However, this complexity is manageable and ensures proper separation of logs based on PII detection.
- Scenario: This option is ideal when you need to scan files in real time and automatically handle file segregation based on their content.
B) Upload the logs to both the shared bucket and the bucket only accessible by the administrator. Create a job trigger using the Cloud Data Loss Prevention API. Configure the trigger to delete any files from the shared bucket that contain PII.
- Pros: The logs are initially uploaded to both buckets, and the DLP API is used to scan files for PII.
- Cons: The scenario specifically requires logs with PII to be moved, not deleted. Deleting files from the shared bucket could lead to the loss of valuable data or cause operational issues, as it doesn't align with the requirement to keep...
Author: Carlos Garcia · Last updated Jul 20, 2026
A customer terminates an engineer and needs to make sure the engineer's Google account is automatically...
To select the best option, let's break down each option based on the need to automatically deprovision an engineer's Google account and the associated IAM permissions:
A) Use the Cloud SDK with their directory service to remove their IAM permissions in Cloud Identity.
- Pros: The Cloud SDK can be used to manually remove IAM permissions.
- Cons: This approach would be manual and not automatic. The customer would need to run the command every time they want to remove the permissions, which is inefficient for deprovisioning. This solution also doesn't specifically handle user removal or deprovisioning in Cloud Identity, just the IAM permissions.
- Scenario: This could work for very limited or ad-hoc tasks but does not meet the requirement of automatic deprovisioning.
B) Use the Cloud SDK with their directory service to provision and deprovision users from Cloud Identity.
- Pros: The Cloud SDK can interact with Cloud Identity and be used to provision and deprovision users.
- Cons: While this could technically remove users, it still requires manual intervention to trigger the deprovisioning of the engineer’s account. For automatic deprovisioning, this isn't the best option.
- Scenario: This could be used if someone is managing the process manually, but it is not ideal for automating the deprovisioning process.
C) Configure Cloud Directory Sync with their directory service to provision and deprovision users from Cloud Identity.
- Pros: Cloud Directory Sync (CDS) can automatically synchronize user data between the organization's directory service (such as Activ...
Author: Ryan · Last updated Jul 20, 2026
An organization is evaluating the use of Google Cloud Platform (GCP) for certain IT workloads. A well-established directory service is used to manage user identities and lifecycle management. This directory service must continue for the organization to ...
Let's evaluate each option in the context of the requirement: the organization needs to continue using its well-established directory service as the "source of truth" for identity and lifecycle management while leveraging Google Cloud Platform (GCP).
A) Google Cloud Directory Sync (GCDS)
- Pros: GCDS allows for the synchronization of users, groups, and other directory objects from an external directory service (e.g., Active Directory or LDAP) to Google Cloud. This means that the organization's directory service remains the source of truth, and Google Cloud is updated automatically based on changes in that service.
- Cons: GCDS only syncs identities and does not fully replace or integrate with the directory service for identity management. It's primarily used to sync data for users, groups, and contact information into Google Cloud, not to manage the lifecycle of identities directly.
- Scenario: This solution is ideal when the organization wants to keep its existing directory service (e.g., Active Directory) as the authoritative source for identities while still using GCP services.
B) Cloud Identity
- Pros: Cloud Identity provides identity and access management for users in Google Cloud. It allows organizations to manage identities and access policies within Google Cloud and integrates well with other GCP services. However, it requires Google to manage the identity lifecycle, which might not align with the customer's need to continue using their existing directory service as the source of truth.
- Cons: Cloud Identity is more suitable when an organization wants to adopt a Google-managed identity solution. It could be used alongside GCDS but doesn’t inherently allow for syncing with an external directory service as the source of truth unless paired with other tools (like GCDS).
- Scenario: This solution would be appropriate if the organization wanted to migrate to Google-managed identities, but it doesn't meet the requirement of keeping a...
Author: Sophia Clark · Last updated Jul 20, 2026
Which international compliance standard provides guidelines for information security controls applicabl...
Let's break down each of the options and determine which international compliance standard provides guidelines specifically for information security controls applicable to the provision and use of cloud services:
A) ISO 27001
- Pros: ISO 27001 is the international standard for information security management systems (ISMS). It provides a systematic approach to managing sensitive company information, ensuring its security. It applies to a broad range of industries, not specific to cloud services.
- Cons: While it is a foundational standard for information security management, ISO 27001 does not focus specifically on cloud services. It outlines the general principles for managing information security in any organization but doesn't provide detailed guidelines specific to cloud environments.
- Scenario: This option is appropriate for a general ISMS framework, but it’s not focused on the unique requirements of cloud services.
B) ISO 27002
- Pros: ISO 27002 provides best practice recommendations for implementing information security controls. It is designed as a supplement to ISO 27001 and offers a set of guidelines for various information security domains.
- Cons: While ISO 27002 provides detailed guidelines for information security controls, it still does not specifically focus on cloud services. It applies more generally across a wide range of contexts, not just cloud environments.
- Scenario: This standard is useful for overall information security management but does not specifically address the provision and use of cloud services.
C) ISO 27017
- Pros: ISO 27017 provides guidelines for information security controls specific to the pro...
Author: Kai99 · Last updated Jul 20, 2026
You will create a new Service Account that should be able to list the Compute Engine instances in the project. You want to fo...
Let's evaluate each option based on the Google-recommended best practices for service accounts:
Option A: Create an Instance Template, and allow the Service Account Read Only access for the Compute Engine Access Scope.
- Analysis: Instance Templates are used to create new VM instances with pre-configured settings. Access Scope Read Only for Compute Engine restricts the service account's permissions to the Compute Engine API. However, this option is not appropriate for listing instances because it focuses more on managing VM instances, not on reading or listing the current ones.
- Why it's rejected: Instance Templates are not relevant to listing Compute Engine instances. Access Scopes are typically used to configure APIs at a VM-level rather than defining roles for broader access control.
Option B: Create a custom role with the permission compute.instances.list and grant the Service Account this role.
- Analysis: Creating a custom role with only the `compute.instances.list` permission ensures that the service account has minimal permissions, adhering to the principle of least privilege. This is a more granular approach to access control, ensuring that the service account can list instances without over-provisioning unnecessary permissions.
- Why it's recommended: This follows Google’s best practice of creating custom roles to precisely define permissions and restrict access to only what’s necessary for the service account's specific use case. It allows you to manage permissions with fine granularity.
Option C: Give the Service Account the role of ...
Author: Ethan · Last updated Jul 20, 2026
In a shared security responsibility model for IaaS, which two layers of the stack does the customer ...
In an Infrastructure as a Service (IaaS) model, the cloud provider and the customer share responsibility for security across various layers of the stack. Here's a breakdown of each option:
Option A: Hardware
- Analysis: The hardware layer, including physical servers, storage devices, and network components, is entirely managed by the cloud provider. Customers do not have control over or responsibility for the physical hardware in an IaaS model.
- Why it's rejected: This is a layer completely under the provider's responsibility. The customer is not involved in securing or maintaining the physical infrastructure.
Option B: Network Security
- Analysis: Network security is shared between the cloud provider and the customer. While the provider manages the physical network infrastructure and ensures its availability, the customer is responsible for configuring and securing the network at the virtualized level, including firewalls, virtual private networks (VPNs), and other access controls.
- Why it's selected: In IaaS, customers are responsible for securing network boundaries such as firewalls, VPNs, and managing virtual network configurations. This is a clear shared responsibility between the provider and the customer.
Option C: Storage Encryption
- Analysis: The cloud provider is generally responsible for ensuring that data storage is encrypted at rest, but the customer is responsible for managing encryption keys and securing data in transit. In many IaaS environments, customers can choose to implement their own encryption, adding an additional layer of responsibility.
- Why it's selected: While the provider handles encryption at the phy...
Author: Zara · Last updated Jul 20, 2026
An organization is starting to move its infrastructure from its on-premises environment to Google Cloud Platform (GCP). The first step the organization wants to take is to migrate its ongoing data backup and disaster recovery solutions to GCP. The organization's on-premises production environment is going to be the next phase for migration to GCP. ...
Let's evaluate each option and select the most appropriate GCP solution for migrating data backup and disaster recovery to GCP, based on the organization's needs.
Option A: BigQuery using a data pipeline job with continuous updates via Cloud VPN
- Analysis: BigQuery is primarily a data warehouse solution used for analytics and querying large datasets. While BigQuery is great for processing and querying data, it is not designed for handling backup and disaster recovery solutions. Continuous updates via Cloud VPN would work for data streaming or analytics, but it doesn't address data backup and disaster recovery in the traditional sense.
- Why it's rejected: BigQuery is not suitable for the specific use case of data backup and disaster recovery. The solution also assumes real-time updates, which are not typically a requirement for backup solutions.
Option B: Cloud Storage using a scheduled task and gsutil via Cloud Interconnect
- Analysis: Cloud Storage is a scalable and cost-effective solution for storing backup data. It is commonly used for backup, archiving, and disaster recovery purposes. The scheduled task and `gsutil` command-line tool can be used to automate the transfer of data from on-premises to Cloud Storage. Additionally, Cloud Interconnect offers dedicated, high-bandwidth connectivity between on-premises data centers and Google Cloud, ensuring stable and fast data transfer for backups.
- Why it's selected: This option is the most suitable for migrating backup and disaster recovery solutions to GCP. Cloud Storage is specifically designed for this purpose, and Cloud Interconnect ensures reliable and stable connectivity, making it ideal for the organization's needs.
Option C: Compute Eng...
Author: Noah · Last updated Jul 20, 2026
What are the steps to encrypt data using envelope encryption?
A.
* Generate a data encryption key (DEK) locally.
* Use a key encryption key (KEK) to wrap the DEK.
* Encrypt data with the KEK.
* Store the encrypted data and the wrapped KEK.
B.
* Generate a key encryption key (KEK) locally.
* Use the KEK to generate a data encryption key (DEK).
* Encrypt data with the DEK.
* Store the encrypted data and the wrapped DEK.
C.
* Generate a data encryption key (DEK) locally.
* Encrypt data with the DEK.
* Use a key encryption key (KEK) to w...
Let's analyze each option carefully based on how envelope encryption works:
Envelope encryption is a technique that uses two keys: a data encryption key (DEK) to encrypt the actual data and a key encryption key (KEK) to encrypt the DEK itself. The process follows this general flow:
1. Generate a DEK: This key encrypts the actual data.
2. Wrap the DEK: Use a KEK to encrypt the DEK (this is often referred to as "wrapping" the DEK).
3. Encrypt the data: Use the DEK to encrypt the data.
4. Store both the encrypted data and the wrapped DEK: The encrypted data is stored for future retrieval, and the wrapped DEK is stored to allow decryption of the data.
Let's evaluate each option:
Option A:
- Steps:
1. Generate a data encryption key (DEK) locally.
2. Use a key encryption key (KEK) to wrap the DEK.
3. Encrypt data with the KEK.
4. Store the encrypted data and the wrapped KEK.
- Analysis:
- This option incorrectly suggests that the data should be encrypted with the KEK, which is not correct. The KEK is used to encrypt the DEK, not the data. The data should be encrypted using the DEK, not the KEK.
- Why it's rejected:
- The KEK should not be used to encrypt the data directly; it should only wrap the DEK. Encrypting data with the KEK violates the typical structure of envelope encryption.
Option B:
- Steps:
1. Generate a key encryption key (KEK) locally.
2. Use the KEK to generate a data encryption key (DEK).
3. Encrypt data with the DEK.
4. Store the encrypted data and the wrapped DEK.
- Analysis:
- This option suggests generating a KEK first and using it to generate the DEK. However, the KEK is used to wrap t...
Author: Isabella1 · Last updated Jul 20, 2026
A customer wants to make it convenient for their mobile workforce to access a CRM web interface that is hosted on Google Cloud Platform (GCP). The CRM can only be accessed by someone on the corporate network. The customer wants to make it available over the internet. Your team requires an authentication layer in fron...
Let's evaluate each option based on the customer’s requirement to provide convenient access to a CRM web interface over the internet with two-factor authentication (2FA).
Option A: Cloud Identity-Aware Proxy (IAP)
- Analysis: Cloud Identity-Aware Proxy (IAP) allows secure access to applications running on Google Cloud Platform (GCP) by verifying user identity and access context, such as the location, device, or network they are accessing from. It is capable of implementing two-factor authentication (2FA) as part of its access control. IAP sits in front of the application and ensures that only authenticated users with the correct permissions can access the web application, regardless of whether they are inside or outside the corporate network.
- Why it's selected: This solution directly addresses the requirement for secure, internet-accessible web applications with 2FA. IAP provides an authentication layer, supports two-factor authentication, and is highly suitable for making applications accessible over the internet while keeping them secure.
Option B: Cloud Armor
- Analysis: Cloud Armor provides protection against DDoS attacks and other internet-based threats by filtering incoming traffic. It is primarily used for network security, not for user authentication or two-factor authentication. While it enhances the security of the application, it does not provide any built-in authentication features or support 2FA.
- Why it's rejected: Cloud Armor is not designed for the authentication of users, and does not provide the necessary 2FA functionality required in this scenario. It's more suited for protecting applications from external threats, but it doesn't address the need for user authentication and ac...
Author: Joseph · Last updated Jul 20, 2026
Your company is storing sensitive data in Cloud Storage. You want a key generated on-premises to be used i...
In this scenario, the goal is to use a key generated on-premises to manage the encryption process for sensitive data stored in Cloud Storage. Let’s evaluate the options step by step.
Option A: Use the Cloud Key Management Service (KMS) to manage a data encryption key (DEK).
- Explanation: The Cloud Key Management Service (KMS) is a fully managed service that can be used to store and manage cryptographic keys. However, the DEK itself would be stored and managed by Cloud KMS, meaning the key is not generated on-premises. Since the requirement is to use a key generated on-premises, this option does not fulfill the requirement.
- Rejection Reason: It does not meet the on-premises key generation requirement.
Option B: Use the Cloud Key Management Service to manage a key encryption key (KEK).
- Explanation: In this case, Cloud KMS would manage the KEK, which is used to encrypt and decrypt data encryption keys (DEKs). However, it does not align with the requirement to use an on-premises key for managing encryption. The KEK here would be managed by the cloud service, meaning the key would not be generated on-premises.
- Rejection Reason: The requirement for on-premises key generation is not fulfilled, as Cloud KMS would manage the KEK.
Option C: Use customer-supplied encryption keys to manage the data encryption key (DEK).
- Explanation: This option allows the customer to supply their own encryption keys (customer-supplied encryption keys or CSEK). Y...
Author: Sophia · Last updated Jul 20, 2026
Last week, a company deployed a new App Engine application that writes logs to BigQuery. No other workloads are running in the project. You need to validate that all data written to BigQ...
To validate that all data written to BigQuery was done using the App Engine Default Service Account, we need to ensure that only the App Engine Default Service Account has the necessary permissions and that any writes to BigQuery logs are associated with this service account. Let's evaluate the options:
Option A:
1. Use Cloud Logging and filter on BigQuery Insert Jobs.
2. Click on the email address in line with the App Engine Default Service Account in the authentication field.
3. Click Hide Matching Entries.
4. Make sure the resulting list is empty.
- Explanation: This option suggests using Cloud Logging to filter BigQuery Insert Jobs, which could help track which service account is performing the write operations. However, clicking "Hide Matching Entries" would hide the entries associated with the App Engine Default Service Account, and you are expected to make sure the resulting list is empty. This isn't the correct way to validate that the App Engine Default Service Account is the only account performing writes; it instead focuses on hiding certain entries.
- Rejection Reason: The logic behind hiding matching entries doesn't help validate the requirement effectively.
Option B:
1. Use Cloud Logging and filter on BigQuery Insert Jobs.
2. Click on the email address in line with the App Engine Default Service Account in the authentication field.
3. Click Show Matching Entries.
4. Make sure the resulting list is empty.
- Explanation: Similar to Option A, this method suggests showing matching entries, which could help identify any jobs performed by accounts other than the App Engine Default Service Account. However, again, the focus on ensuring that the list is empty isn't an effective validation method for the requirement.
- Rejection Reason: The idea of showing matching entries doesn't provide a clear or proper validation strategy for the sole usage of the App Engine Default Service Account.
Option C:
1. In BigQuery, select the related dataset.
2. Make sure that the Ap...
Author: David · Last updated Jul 20, 2026
Your team wants to limit users with administrative privileges at the organization level.
Which two ro...
To limit users with administrative privileges at the organization level, it's important to focus on roles that grant broad and high-level administrative capabilities within the organization. Let's analyze each option:
Option A: Organization Administrator
- Explanation: The Organization Administrator role is a very high-level administrative role at the organization level. It grants full access to manage all resources and settings within the organization, including managing IAM policies, billing, and project creation. This role should definitely be restricted if your team wants to limit users with administrative privileges at the organization level.
- Selected Reasoning: This role grants extensive administrative privileges at the organization level, so restricting it is essential to control administrative access.
Option B: Super Admin
- Explanation: The Super Admin role (specific to Google Workspace or Cloud Identity) grants full control over the entire Google Workspace or Cloud Identity organization, including the ability to manage users, services, and settings across the entire organization. This role is extremely broad in scope, and limiting it is crucial for security.
- Selected Reasoning: This role provides complete control over the organization's administrative functions, making it another key role to restrict.
Option C: GKE Cluster Admin
- Explanation: The GKE Cluster Admin role is specific to Google Kubernetes Engine (GKE). It provides administrative privileges over Kubernetes clusters but does not give broader organizational control. While important for managing GKE clusters, it is not directly rela...
Author: Sofia · Last updated Jul 20, 2026
An organization's security and risk management teams are concerned about where their responsibility lies for certain production workloads they are running in
Google Cloud and where Google's responsibility lies. They are mostly running workloads using Google Cloud's platform-as-a-Service (PaaS) offerings, includin...
When using Google Cloud’s App Engine, the responsibility for securing workloads is shared between the customer (the organization) and Google. Understanding the scope of responsibilities is key to ensuring that security measures are applied appropriately. Let’s evaluate the options based on where the organization’s responsibility lies.
Option A: Configuring and monitoring VPC Flow Logs
- Explanation: VPC Flow Logs are used to capture and log network traffic within a Virtual Private Cloud (VPC). However, when using App Engine, customers do not manage the underlying network infrastructure directly, because App Engine is a platform-as-a-service (PaaS) offering. Google abstracts away much of the networking details, so the responsibility for configuring and monitoring VPC Flow Logs generally does not fall on the customer when using App Engine.
- Rejection Reason: Since App Engine abstracts away the underlying network infrastructure, configuring and monitoring VPC Flow Logs is not typically the customer’s responsibility.
Option B: Defending against XSS and SQLi attacks
- Explanation: Cross-site scripting (XSS) and SQL injection (SQLi) are common web application vulnerabilities. While Google Cloud provides protections against certain types of attacks at the platform level, the customer is responsible for securing their application code and implementing measures to defend against application-layer vulnerabilities such as XSS and SQLi. This responsibility includes validating inputs, sanitizing data, and implementing other security measures in the application itself.
- Selected Reasoning: Defending against XSS and SQLi attacks is primarily the customer’s responsibility when using App Engine, as the organization is responsible for the security of their application code and handling ap...
Author: Samuel · Last updated Jul 20, 2026
An engineering team is launching a web application that will be public on the internet. The web application is hosted in multiple GCP regions and will be directed to the respective backend based on the URL request.
Your team wants to avoid exposing the application directly on the internet and wants to ...
In this scenario, the engineering team wants to avoid exposing their web application directly to the internet while also denying traffic from a specific list of malicious IP addresses. The solution must not only ensure security but also direct traffic to the appropriate backend in different GCP regions based on URL requests.
Let’s evaluate the available options:
Option A: Cloud Armor
- Explanation: Cloud Armor is a security service that provides protection against DDoS attacks and malicious IP addresses. It can be used with Google Cloud HTTP(S) Load Balancing to filter and deny traffic based on IP address, region, or other attributes. Cloud Armor allows you to create security policies to explicitly block or allow specific IP addresses. This would meet the requirement of denying traffic from a list of malicious IPs. It also integrates with the Google Cloud Load Balancer, which can handle regional traffic routing to the appropriate backend based on the URL.
- Selected Reasoning: Cloud Armor is specifically designed to protect applications from malicious traffic and is the best fit for blocking IPs while keeping the application secure behind Google Cloud’s infrastructure. It integrates with load balancing and can provide the necessary security without directly exposing the application to the internet.
Option B: Network Load Balancing
- Explanation: Network Load Balancing (NLB) operates at the TCP/UDP layer and is suitable for non-HTTP/HTTPS traffic. NLB can balance traffic to backend instances but does not offer advanced features like filtering traffic based on IP addresses or content inspection. It is a more basic form of load balancing and does not provide the level of security (such as IP filteri...
Author: Ava · Last updated Jul 20, 2026
A customer is running an analytics workload on Google Cloud Platform (GCP) where Compute Engine instances are accessing data stored on Cloud Storage.
Your team wants to make sure that this workload will not be able to access, or be accessed ...
To ensure that a customer's analytics workload on Google Cloud Platform (GCP) does not access, or is accessed from, the internet, we need to consider strategies to isolate the workload from external internet traffic while ensuring it can still access Cloud Storage. Here's an analysis of the options:
A) Configure Private Google Access on the Compute Engine subnet
- Explanation: Private Google Access allows instances in a Virtual Private Cloud (VPC) to access Google services, such as Cloud Storage, without using public IP addresses. It ensures the instances can still communicate with Google APIs and services over private IPs. This is crucial to avoid the use of public IPs for accessing services like Cloud Storage.
- Why selected: This ensures secure access to Cloud Storage without exposure to the public internet. The instances can access Cloud Storage over private Google access rather than public IPs, which helps meet the requirement to avoid internet access.
- Why others are rejected: Not configuring this could lead to instances needing public IPs to access Google services, violating the requirement to restrict internet access.
B) Avoid assigning public IP addresses to the Compute Engine cluster
- Explanation: By not assigning public IPs to the Compute Engine instances, the instances cannot directly be accessed from the internet. This is one of the basic strategies to ensure instances are isolated from public internet access.
- Why selected: This prevents inbound and outbound internet access, as these instances will only be reachable over the private network or VPC.
- Why others are rejected: Public IPs would make the instances accessible from the internet, directly violating the requirement.
C) Make sure that the Compute Engine cluster is running on a separate subnet
- Explanation: While subnetting can be a good prac...
Author: Ahmed97 · Last updated Jul 20, 2026
A customer wants to run a batch processing system on VMs and store the output files in a Cloud Storage bucket. The networking and security teams have decided that ...
To meet the customer's requirement of running a batch processing system on VMs while preventing those VMs from reaching the public internet, we need to implement a solution that allows access to Cloud Storage but ensures no internet traffic is possible.
A) Create a firewall rule to block internet traffic from the VM
- Explanation: While creating a firewall rule to block internet traffic could effectively prevent outbound traffic to the public internet, this does not guarantee access to Cloud Storage. The firewall rule would block all internet traffic, including essential Google Cloud services like Cloud Storage.
- Why rejected: Cloud Storage access requires specific network routes or permissions, and simply blocking outbound traffic to the internet could inadvertently block internal services or communications with Cloud Storage. Therefore, this approach isn't ideal for allowing the VMs to access Cloud Storage while blocking all internet access.
B) Provision a NAT Gateway to access the Cloud Storage API endpoint
- Explanation: A NAT Gateway allows VMs without public IPs to access the internet for outbound traffic. While this could allow Cloud Storage access, it contradicts the requirement of preventing the VMs from reaching the public internet. The VMs would still have access to the internet via the NAT gateway, which violates the constraint of no internet access.
- Why rejected: The customer’s requirement is to prevent any internet access from the VMs, and a NAT Gateway would allow that, so it’s not a suitable option.
C) Enable Private Google Access
- Explanation: Priva...
Author: RadiantPhoenixX · Last updated Jul 20, 2026
