Google Practice Questions, Discussions & Exam Topics by our Authors

As adoption of the Cloud Data Loss Prevention (Cloud DLP) API grows within your company, you need to optimize usage to reduce cost. Cloud DLP target data is stored in Cloud Storage and BigQuery. The location and region are ...

When optimizing costs for the Cloud Data Loss Prevention (Cloud DLP) API, it's important to focus on minimizing the amount of data processed, especially when dealing with Cloud Storage and BigQuery. Below is an analysis of each option and the rationale for selecting the best cost reduction strategy: A) Set appropriate rowsLimit value on BigQuery data hosted outside the US and set appropriate bytesLimitPerFile value on multiregional Cloud Storage buckets - Explanation: Setting the `rowsLimit` on BigQuery data helps control the number of rows scanned, reducing the number of processing units consumed by the Cloud DLP API. Similarly, setting the `bytesLimitPerFile` on Cloud Storage buckets helps limit the amount of data scanned per file, which can reduce costs. - Why rejected: This option does not fully address cost reduction by focusing solely on limiting the data processed without optimizing the sampling or scanning strategy (which would be more effective in reducing unnecessary scans and resource usage). Additionally, it doesn’t leverage advanced sampling techniques or limit the scope of scans effectively across multiple regions or buckets. B) Set appropriate rowsLimit value on BigQuery data hosted outside the US, and minimize transformation units on multiregional Cloud Storage buckets - Explanation: This approach sets the `rowsLimit` for BigQuery data but also focuses on minimizing transformation units on Cloud Storage buckets. Transformation units are part of the Cloud DLP pricing, so minimizing these units can help reduce costs. - Why rejected: While minimizing transformation units is useful, this option doesn’t optimize the data sampling or scanning efficiency across both BigQuery and Cloud Storage. Transformation units are part of the cost, but focusing solely on them, without considering sampling and scan limits, is less effective than combining multiple strategies. C) Use rowsLimit and bytesLimitPerFile...

Author: Ella · Last updated Jul 20, 2026

Your team uses a service account to authenticate data transfers from a given Compute Engine virtual machine instance of to a specified Cloud Storage bucket. An engineer accidentally deletes the service account, which breaks application functionality. Y...

In this scenario, the goal is to recover the application as quickly as possible without compromising security after the accidental deletion of a service account that was used for data transfers from a Compute Engine instance to a Cloud Storage bucket. A) Temporarily disable authentication on the Cloud Storage bucket - Explanation: Disabling authentication on the Cloud Storage bucket would prevent any access to the bucket, including from the Compute Engine instance. While this could "temporarily stop the break," it completely disrupts the application functionality and doesn't solve the underlying problem of restoring proper authentication. - Why rejected: This would introduce unnecessary downtime and does not address the root cause of the issue, which is the deleted service account. Disabling authentication would disrupt not only the recovery process but also other legitimate operations that might need to access the Cloud Storage bucket. B) Use the undelete command to recover the deleted service account - Explanation: Unfortunately, service accounts cannot be recovered using an "undelete" command in Google Cloud. Once a service account is deleted, it is permanently removed, and there's no built-in "undelete" functionality specifically for service accounts in GCP. - Why rejected: This is not a valid option because Google Cloud doesn't provide an undelete functionality for service accounts. Once deleted, the service account is permanently gone, and you would need to recreate the service account. C) Create a new service account with the same name as the deleted service account - Explanation: Creating a new service account with the same name might seem like a quick fix, but this approach would not automatic...

Author: Abigail · Last updated Jul 20, 2026

You are the Security Admin in your company. You want to synchronize all security groups that have an email address from y...

To synchronize security groups containing email addresses from your LDAP directory to Cloud IAM in Google Cloud, it's important to choose the most appropriate solution that aligns with your security and management needs. A) Configure Google Cloud Directory Sync to sync security groups using LDAP search rules that have `=D7=92=E2=82=ACuser email address=D7=92=E2=82=AC` as the attribute to facilitate one-way sync - Explanation: Google Cloud Directory Sync (GCDS) enables the synchronization of data between your LDAP directory and Google Cloud, including security groups and user accounts. A one-way sync would ensure that changes made in the LDAP directory (like adding or removing email addresses) are reflected in Cloud IAM, but not the other way around. - Why rejected: While this approach could work for syncing email addresses from LDAP to Cloud IAM, the "one-way sync" limits flexibility in managing changes from Cloud IAM to LDAP. You might want bidirectional synchronization to keep changes synced in both directions, especially when managing access control across multiple environments. B) Configure Google Cloud Directory Sync to sync security groups using LDAP search rules that have `=D7=92=E2=82=ACuser email address=D7=92=E2=82=AC` as the attribute to facilitate bidirectional sync - Explanation: This option configures GCDS for bidirectional sync, meaning changes in either the LDAP directory or Cloud IAM would be reflected in both places. This is ideal for a comprehensive and flexible solution where you want to manage groups and access in both directions. - Why selected: Bidirectional sync allows for flexibility in managing both Cloud IAM and LDAP directory groups and users. Changes in either system are automatically reflected in both, ensuring that access control is up to date and preventing discrepancies between systems. This is the preferred solution for most organizations that require ongoing synchronization of security groups and email addresses between LDAP and Cloud IAM. C) Use a management tool to sync the subset based on the email address attribute. Create a group in the Google domain. A group created in a Goog...

Author: Max · Last updated Jul 20, 2026

You are part of a security team investigating a compromised service account key. You need to audit which new resources were...

In this scenario, the goal is to audit which new resources were created by the compromised service account. To identify this activity, the most appropriate option is to query the Admin Activity logs. Here's why: A) Query Data Access logs: - Data Access logs primarily record interactions with data resources, such as reading, writing, and modifying data. While useful for auditing access to specific data (like Cloud Storage, databases, etc.), it does not provide information about the creation of new resources (like new instances, buckets, or services). This makes it not ideal for auditing resource creation by the compromised service account. B) Query Admin Activity logs: - Admin Activity logs capture administrative actions taken by users or service accounts, such as creating, modifying, or deleting resources. These logs include events like creating virtual machines, buckets, or changing IAM roles. Since you're trying to identify newly created resources, the Admin Activity logs would provide the most relevant information. Admin Activity logs track changes in resources or co...

Author: Vikram · Last updated Jul 20, 2026

You have an application where the frontend is deployed on a managed instance group in subnet A and the data layer is stored on a mysql Compute Engine virtual machine (VM) in subnet B on the same VPC. Subnet A and Subnet B hold several other Compute Engine VMs. You only want to ...

In this scenario, the goal is to allow the frontend application, which is deployed on a managed instance group in Subnet A, to communicate with the MySQL instance in Subnet B. The MySQL instance should only be accessible by the frontend application on port 3306, ensuring that other VMs or services are restricted from accessing it. Let's evaluate each option: A) Configure an ingress firewall rule that allows communication from the src IP range of subnet A to the tag "data-tag" that is applied to the mysql Compute Engine VM on port 3306. - Evaluation: This approach allows traffic from all the IPs in subnet A to the MySQL VM (tagged with `data-tag`), but it doesn't restrict traffic to just the frontend VMs. All VMs in subnet A could access the MySQL VM if they have access to port 3306. This does not limit the access to only the frontend VMs and may expose the MySQL instance to unwanted traffic from other VMs in subnet A. - Rejected: It doesn't enforce the restriction to just the frontend VMs. B) Configure an ingress firewall rule that allows communication from the frontend's unique service account to the unique service account of the mysql Compute Engine VM on port 3306. - Evaluation: This option involves using service accounts for access control. While it allows you to specify which service accounts are allowed to access the MySQL VM, it doesn't consider the network-level configuration, which is important when controlling traffic between instances based on their network location. The firewall rules generally work at the network level and not strictly by service account, so it would likely require a combination of service account permissions and network-based rules, which adds unnecessary complexity. - Rejected: Service accounts alone don't control network-level traffic and this setup isn't as efficient as using tags and subnet-based network rules. C) Configure a network tag "fe-ta...

Author: StarryEagle42 · Last updated Jul 20, 2026

Your company operates an application instance group that is currently deployed behind a Google Cloud load balancer in us-central-1 and is configured to use the Standard Tier network. The infrastructure team wants to expand to a second Google Cloud region, us-east-2. You need to se...

To set up a single external IP address that distributes requests to instance groups in both regions (us-central-1 and us-east-2), the most effective approach involves using global load balancing and configuring the load balancer to serve traffic from both regions. Let’s evaluate each option in detail: A) Change the load balancer backend configuration to use network endpoint groups instead of instance groups. - Evaluation: This option involves using Network Endpoint Groups (NEGs), which can be used for more flexible routing, especially for services like Kubernetes clusters or VM-based applications that require external or internal endpoints. While NEGs are beneficial in some cases, the main concern here is that you're not necessarily dealing with region expansion in the way this option would address. It's more relevant for use cases that involve endpoints with IP addresses from various sources rather than expanding regions behind a global load balancer. - Rejected: Although this could be part of the solution in some scenarios, the primary requirement here is the ability to use a single IP address across multiple regions, which NEGs don’t inherently solve in this particular context. B) Change the load balancer frontend configuration to use the Premium Tier network, and add the new instance group. - Evaluation: The Premium Tier of Google Cloud's network provides global load balancing, which is necessary for routing traffic across multiple regions using a single external IP address. However, the Standard Tier already supports a single external IP address globally (not just regionally). Therefore, switching to Premium Tier is unnecessary unless you're looking for more advanced features like better performance or multi-regional failover. Additionally, simply adding a new instance group in another region does not necessarily require the frontend configuration to switch tiers. - Partially Useful but Not Required: The Premium Tier is helpful for advanced features...

Author: MysticJaguar44 · Last updated Jul 20, 2026

You are the security admin of your company. You have 3,000 objects in your Cloud Storage bucket. You do not want to manage access to each object individually. You also do not want the uploader of an object to always have full control of the...

In this scenario, the goal is to manage access to a Cloud Storage bucket with 3,000 objects without managing access to each object individually, and without giving the uploader full control over the objects. Additionally, Cloud Audit Logs should be used to track and manage access. Let's evaluate the options: A) Set up an ACL with OWNER permission to a scope of allUsers. - Evaluation: This option would provide full control (OWNER) over all objects to allUsers, meaning that everyone can have complete control over your objects (view, modify, delete). This is a highly insecure configuration and is not recommended, as it exposes your data to the public. - Rejected: This option makes the objects publicly writable and accessible, which is against the principle of least privilege and doesn't meet your requirements for restricted access control. B) Set up an ACL with READER permission to a scope of allUsers. - Evaluation: This configuration would grant read access to allUsers (i.e., public access to the objects), which allows everyone to view the objects in the bucket but not modify them. While this might be useful for publicly accessible data, it doesn't help with managing restricted access to certain users, nor does it prevent the uploader from having excessive control over their uploaded objects. - Rejected: This also doesn't meet the requirement for restricting access to certain users or managing access via IAM and Cloud Audit Logs. C) Set up a default bucket ACL and manage access for users using IAM. - Evaluation: Using a default bucket ACL is a way to automatically apply an ACL to new objects, but it still relies on Access Control Lists (ACLs) for managing permissions. ACLs can becom...

Author: Isabella1 · Last updated Jul 20, 2026

You are the security admin of your company. Your development team creates multiple GCP projects under the "implementation" folder for several dev, staging, and production workloads. You want to prevent data exfiltration by malicious insiders or compromised code by setting ...

In this scenario, the goal is to set up a security perimeter to prevent data exfiltration by malicious insiders or compromised code without restricting communication between multiple GCP projects under the "implementation" folder. Let's analyze each option in detail. A) Use a Shared VPC to enable communication between all projects, and use firewall rules to prevent data exfiltration. - Reasoning: A Shared VPC enables different projects to communicate while allowing for centralized control over network resources. It provides a way for multiple projects to use the same networking resources (e.g., VMs, subnets), allowing for communication between them. Firewall rules can be applied to restrict traffic flow based on IP ranges, ports, and protocols, which could help prevent unauthorized data access. - Why Rejected: While the Shared VPC facilitates communication between the projects, it doesn’t provide a direct mechanism for enforcing security perimeters for the purpose of preventing data exfiltration. Firewall rules can block some types of communication, but it is not a robust solution for controlling data access or preventing insider threats. Furthermore, Shared VPCs focus on network communication, but data exfiltration control needs a more comprehensive, cloud-native perimeter security approach. B) Create access levels in Access Context Manager to prevent data exfiltration, and use a shared VPC for communication between projects. - Reasoning: Access Context Manager allows you to create access levels that define what kind of data can be accessed from specific environments based on conditions like user attributes, network, and location. This could help control who accesses what data and under what conditions. By combining this with a Shared VPC, you ensure that communication between projects is allowed while enforcing strict access rules to prevent exfiltration. - Why Selected: This option combines access controls (via Access Context Manager) with Shared VPC for project communication. It directly addresses both the need for secure access to resources and the ability to maintain communication between projects without restricting the flow of data within the network. This solution is optimal for managing communication and preventing exfiltration without overly complicating the network setup. C) Use an infrastructure-as-code software tool to set up a single service perimeter and to deploy a Cloud Function that monitors the "implementation" folder via Stackdriver and Cloud Pub/Sub. When the function notices that a new project is added to the folder, it executes Terraform to add the new project to the associated perimeter. - Reasoning: This approach ...

Author: Suresh · Last updated Jul 20, 2026

You need to provide a corporate user account in Google Cloud for each of your developers and operational staff who need direct access to GCP resources. Corporate policy requires you to maintain the user identity in a third-party identity management provider and leverage single sign-on. You learn that a significant number of users are using their corporate domain email addresses for personal Goog...

To address the requirement of converting unmanaged users with personal Google accounts into managed users in a corporate Google Cloud environment, and to align with Google’s recommended practices, let's analyze the provided options: A) Use Google Cloud Directory Sync to synchronize your local identity management system to Cloud Identity. - Reasoning: Google Cloud Directory Sync (GCDS) is a useful tool for synchronizing user data from an existing identity provider, such as an LDAP server, to Google Cloud Identity or G Suite. By synchronizing the corporate identity system with Cloud Identity, it enables centralized user management and authentication, ensuring a seamless experience with Single Sign-On (SSO). However, GCDS doesn’t directly help convert unmanaged Google accounts (such as personal Gmail accounts) to managed ones. It is more about syncing corporate identities with Google Cloud resources. - Rejected: This option is rejected because it doesn’t solve the problem of converting unmanaged Google accounts to managed accounts, which is the primary focus of the task. B) Use the Google Admin console to view which managed users are using a personal account for their recovery email. - Reasoning: The Google Admin console provides insight into various user settings, including recovery email addresses. However, this only identifies which users have personal accounts associated as recovery emails, but it does not solve the core issue of converting personal accounts into corporate-managed ones. It may offer insights into the problem but doesn't facilitate any actual change to the user account setup. - Rejected: This option is rejected because it is primarily for identifying the issue, not for directly resolving the conversion of unmanaged users to managed accounts. C) Add users to your managed Google account and force users to change the email addresses associated with their personal accounts. - Reasoning: This action would involve adding users to the corporate Google Cloud environment (i.e., Cloud Identity) and requiring them to use their corporate email addresses for login, thus replacing their personal email addresses associated with their personal Google accounts. This approach would help enforce the ...

Author: Chloe · Last updated Jul 20, 2026

You are on your company's development team. You noticed that your web application hosted in staging on GKE dynamically includes user data in web pages without first properly validating the inputted data. This could allow an attacker to execute gibberish commands and display arbit...

Let's carefully analyze each of the options in terms of their relevance to preventing and fixing the Cross-Site Scripting (XSS) vulnerability described in the question. A) Use Cloud IAP based on IP address or end-user device attributes to prevent and fix the vulnerability. - Reasoning: Cloud Identity-Aware Proxy (IAP) is typically used to control access to applications based on the identity of the user or the device's attributes. While it can help ensure that only authorized users can access the application, it doesn’t address the root cause of the vulnerability (i.e., improperly validated input that could lead to XSS attacks). This approach is about access control rather than securing input or mitigating XSS risks. - Rejected: This option is rejected because it does not directly address the XSS vulnerability, which is caused by improper input validation or sanitization in the web application. IAP is a useful tool for access control, but it does not fix the underlying issue. B) Set up an HTTPS load balancer, and then use Cloud Armor for the production environment to prevent the potential XSS attack. - Reasoning: An HTTPS load balancer and Cloud Armor can help secure traffic by mitigating certain types of attacks, such as DDoS or SQL injection, and filtering traffic based on predefined security rules. However, these tools are not specifically designed to prevent XSS attacks, which involve the web application's failure to properly validate or sanitize user input. Cloud Armor and HTTPS are primarily about securing communication channels and traffic, not preventing malicious scripts injected into web pages. - Rejected: While Cloud Armor is valuable for broader web application protection, it does not address the core issue of XSS, which stems from unsanitized user input being reflected in the application. Therefore, this option does not fix the vulnera...

Author: Noah Williams · Last updated Jul 20, 2026

You are part of a security team that wants to ensure that a Cloud Storage bucket in Project A can only be readable from Project B. You also want to ensure that data in the Cloud Storage bucket cannot be accessed from or copied to Cloud S...

Let's analyze each of the options and their relevance to securing the Cloud Storage bucket to meet the specified requirements. A) Enable VPC Service Controls, create a perimeter with Project A and B, and include Cloud Storage service. - Reasoning: VPC Service Controls is designed to mitigate data exfiltration risks by creating a security perimeter around Google Cloud services. By using this option, you can create a secure boundary between your Google Cloud projects (Project A and Project B) to ensure that sensitive data in Cloud Storage is only accessible from within the defined perimeter. This would enforce the restriction that only Project B can access the Cloud Storage bucket in Project A. Additionally, by including Cloud Storage in the perimeter, data from the bucket would not be accessible outside of the defined network boundary, preventing exfiltration. - Selected: This is the best option because VPC Service Controls will enforce network-level access control, ensuring that data in the Cloud Storage bucket can only be accessed from Project B and cannot be copied to other Cloud Storage buckets outside the specified perimeter. This is exactly what is required in the scenario. B) Enable Domain Restricted Sharing Organization Policy and Bucket Policy Only on the Cloud Storage bucket. - Reasoning: The Domain Restricted Sharing Organization Policy would restrict sharing Cloud Storage buckets to specific domains, and Bucket Policy Only would enforce the use of IAM policies on the bucket instead of relying on ACLs. However, this option does not directly solve the problem of restricting access to the Cloud Storage bucket solely to Project B and preventing copying data to other buckets outside the network. While these configurations enhance bucket security, they don’t provide a strict network perimeter like VPC Service Controls. - Rejected: This approach is helpful in limiting access based on domain and IA...

Author: Amira99 · Last updated Jul 20, 2026

You are responsible for protecting highly sensitive data in BigQuery. Your operations teams need access to this data, but given privacy regulations, you want to ensure that they cannot read the sensitive fields such as email addresses and first names. These specific ...

Let's analyze each option in terms of their relevance and effectiveness for protecting sensitive data in BigQuery, specifically email addresses and first names, and ensuring that only authorized users, like the Human Resources team, can access these fields. A) Perform data masking with the Cloud Data Loss Prevention API, and store that data in BigQuery for later use. - Reasoning: Data masking replaces sensitive data with masked (obfuscated) values, making it unreadable to unauthorized users while preserving the structure of the data. However, this option is less effective for situations where you need to control who can view sensitive data because it permanently alters the data in BigQuery. Masked data can still be used for analytical purposes, but users can’t retrieve the original sensitive data, which might not allow for certain legitimate needs in the future. - Rejected: Data masking might not be ideal if you want the sensitive fields (like email addresses and first names) to be available to authorized users (e.g., HR) in their original form, and the masked data would be unusable for those who legitimately need to access the unmasked information. B) Perform data redaction with the Cloud Data Loss Prevention API, and store that data in BigQuery for later use. - Reasoning: Data redaction involves removing or hiding sensitive data. This approach would render sensitive fields entirely unavailable, even to authorized users. While it protects data from being exposed, it eliminates the ability to retrieve or use the sensitive information, which defeats the purpose of maintaining access to sensitive data for authorized users like HR. - Rejected: This option is rejected because it would remove the sensitive data completely, making it impossible to provide access to authorized ...

Author: Sam · Last updated Jul 20, 2026

You are a Security Administrator at your organization. You need to restrict service account creation capability within production environments. You want to ac...

Let's break down each option and analyze its relevance to the goal of restricting service account creation capability within production environments: A) Use Identity and Access Management (IAM) to restrict access of all users and service accounts that have access to the production environment. - Reasoning: IAM is a core tool for controlling permissions in Google Cloud. However, IAM is typically used to assign roles and permissions, not to enforce restrictions on service account creation. While restricting access to users and service accounts can control who can access the production environment, it does not specifically address the problem of restricting service account creation. - Rejected: This option doesn’t solve the specific issue of controlling the creation of service accounts. IAM is about access control but does not directly prevent the creation of service accounts in production environments. B) Use organization policy constraints/iam.disableServiceAccountKeyCreation boolean to disable the creation of new service accounts. - Reasoning: The `iam.disableServiceAccountKeyCreation` constraint disables the creation of new service account keys, which is useful for security by preventing the creation of keys for existing service accounts. However, this does not restrict the creation of new service accounts themselves, which is the focus of the requirement. - Rejected: This option is focused on preventing key creation, not on restricting service account c...

Author: Stella · Last updated Jul 20, 2026

You are the project owner for a regulated workload that runs in a project you own and manage as an Identity and Access Management (IAM) admin. For an upcoming audit,...

For an upcoming audit in an Identity and Access Management (IAM) scenario where access reviews evidence is required, the most appropriate tool would be: B) Policy Analyzer Explanation: - Policy Analyzer allows you to evaluate IAM policies by analyzing and reviewing existing permissions. It helps in reviewing access for different roles, policies, and accounts, making it the most appropriate tool for providing audit evidence related to IAM access reviews. This tool provides an in-depth analysis of permissions that are granted, which is crucial for audits requiring detailed access reviews. Why other options are rejected: - A) Policy Troubleshooter: This tool is designed for troubleshooting access issues by simulating user access based on specific policies and resources. While useful for diagnosing access issues or ensuring a user has the appropriate permissions, it’s not intended for providing audit evidence for access reviews or...

Author: Noah · Last updated Jul 20, 2026

Your organization has implemented synchronization and SAML federation between Cloud Identity and Microsoft Active Directory. You want to reduce the risk of...

To reduce the risk of Google Cloud user accounts being compromised in an environment where Cloud Identity and Microsoft Active Directory are synchronized and using SAML federation, the most effective option would be: A) Create a Cloud Identity password policy with strong password settings, and configure 2-Step Verification with security keys in the Google Admin console. Explanation: - Strong Password Policy in Cloud Identity: This is the first line of defense, ensuring that users cannot create weak passwords, which helps prevent unauthorized access due to weak password exploits. - 2-Step Verification with Security Keys: Using security keys (e.g., hardware-based 2FA like a YubiKey) provides a much stronger authentication method than traditional methods like verification codes via text or phone call. This is because security keys are less susceptible to phishing and man-in-the-middle attacks, offering better protection against account compromise, especially when synchronized with SAML federation between Cloud Identity and Microsoft Active Directory. Why other options are rejected: - B) Create a Cloud Identity password policy with strong password settings, and configure 2-Step Verification with verification codes via text or phone call in the Google Admin console: While this option is better than no 2-Step Verification at all, using verification codes sent via text or phone call is generally considered less secure than hardware security keys. SMS-based 2FA can be vulnerable to SIM swapping and other attacks, which is why it's not the optimal choice for highly secure environments. ...

Author: Sofia · Last updated Jul 20, 2026

You have been tasked with implementing external web application protection against common web application attacks for a public application on Google Cloud. You want to validate...

To validate policy changes before they are enforced for protecting a public web application on Google Cloud against common web application attacks, the most appropriate service would be: A) Google Cloud Armor's preconfigured rules in preview mode Explanation: - Google Cloud Armor is a service specifically designed to provide security against common web application attacks, such as SQL injection, cross-site scripting (XSS), and DDoS attacks. Google Cloud Armor allows you to implement a web application firewall (WAF) to block malicious traffic. By using the preconfigured rules in preview mode, you can test these rules on your application without actually enforcing them, allowing you to monitor traffic and ensure the rules won’t impact legitimate requests before fully enforcing them. This gives you the ability to validate the policy changes in a safe and controlled way. Why other options are rejected: - B) Prepopulated VPC firewall rules in monitor mode: VPC firewall rules typically control access between resources within the VPC, such as instances or services, based on IP addresses or network protocols. However, these rules do not directly protect web applications from attacks such as SQL injection, cross-site scripting (XSS), or DDoS. While monitor mode helps you view traffic matches, it is not designed specifically for web application security, which is why it is not suitable for testing web application-specific security policies. - C) The inherent protections of Google Front End (GFE): Google Front End (GFE) provides basic protections such as load balancing, SSL termination, and some basic security measures, but it is not a fully-fledged security solution for web applications. I...

Author: StarlightBear · Last updated Jul 20, 2026

You are asked to recommend a solution to store and retrieve sensitive configuration data from an application that runs o...

The most suitable solution for storing and retrieving sensitive configuration data from an application running on Compute Engine is: D) Secret Manager Explanation: - Secret Manager is specifically designed to store, manage, and securely access sensitive data like API keys, passwords, certificates, and configuration data. It integrates well with Google Cloud services, providing secure, fine-grained access control, and offers features like versioning and auditing. Secret Manager ensures that sensitive data is protected, stored in an encrypted format, and only accessible by authorized services and users. It is the best choice for handling sensitive application configuration data, as it provides a centralized and secure approach with seamless retrieval through API calls. Why other options are rejected: - A) Cloud Key Management Service (KMS): Cloud KMS is a service used to manage encryption keys for data encryption at rest or in transit. While it is a strong security service for encryption, it is not meant for storing or managing sensitive application configuration data directly. Secret Manager is more suited for storing secrets like API keys, passwords, and other sensitive data, while KMS is focused on key management and encryption. - ...

Author: Carlos Garcia · Last updated Jul 20, 2026

You need to implement an encryption at-rest strategy that reduces key management complexity for non-sensitive data and protects sensitive data while providing the flexibility of controlling the key residency and ro...

The best option for implementing an encryption-at-rest strategy that meets FIPS 140-2 L1 compliance and provides flexibility for key residency and rotation schedules is: C) Encrypt non-sensitive data with Google default encryption, and encrypt sensitive data with Cloud External Key Manager. Explanation: - Google Default Encryption: For non-sensitive data, Google Cloud automatically encrypts data at rest by default, without the need for user intervention. This encryption is managed by Google, reducing the key management complexity for less critical data. Since the question specifies reducing key management complexity for non-sensitive data, Google default encryption is a practical choice. - Cloud External Key Manager (EKM): For sensitive data, Cloud External Key Manager offers the flexibility to control key residency and key rotation schedule, which is essential for ensuring compliance with organizational policies. EKM allows you to bring your own keys (BYOK) and manage those keys outside of Google Cloud, giving you full control over key management while meeting FIPS 140-2 L1 compliance requirements. This combination of Google default encryption for non-sensitive data and Cloud EKM for sensitive data provides an ideal balance between simplicity and flexibility, ensuring that sensitive data is properly protected while reducing complexity for non-sensitive data. Why other options are rejected: - A) Encrypt non-sensitive data and sensitive data with Cloud External Key Manager: While Cloud External Key Manager (EKM) is a strong solution for managing keys for sensitive ...

Author: Emily · Last updated Jul 20, 2026

Your company wants to determine what products they can build to help customers improve their credit scores depending on their age range. To achieve this, you need to join user information in the company's banking app with customers' credit score data received from a third party. While using this raw data will allow you to complete this task, it exposes sensitive data, which could be propagated into new systems. This risk needs to be addressed using de-ident...

To address the requirement of de-identifying and tokenizing sensitive customer data while maintaining referential integrity across the database, we need to focus on a cryptographic token format that preserves the integrity of the data and allows for reversible mapping (i.e., linking the original data with its de-identified form when needed). Let’s analyze each option based on the task's needs: A) Deterministic Encryption: - Explanation: Deterministic encryption uses the same key to encrypt the same input, meaning the same input data always results in the same encrypted output. This allows referential integrity because the encrypted value will be consistent for the same input across the system. It also supports decryption, making it possible to reverse the encryption. - Use Case: This option is ideal when you need to match encrypted data back to its original form (e.g., for analysis or comparison) but want to keep the data secure. - Rejection Reason: While deterministic encryption is useful for maintaining referential integrity, it can still be vulnerable to certain attacks since it encrypts identical data into identical ciphertext. This makes it less suitable in environments with high security requirements. B) Secure, Key-Based Hashes: - Explanation: Hashing is a one-way transformation of data into a fixed-length string (hash). Secure, key-based hashes (e.g., HMAC) provide some level of protection by using a secret key. However, hashes are generally not reversible, which means you can’t retrieve the original data from the hash. - Use Case: Hashes are useful when you want to verify data integrity or perform lookups without revealing the actual data (e.g., storing passwords securely). - Rejection Reason: Since hashing is non-reversible, it does not support the required functionality of de-identifying data while still maintaining the ability to refer back to the original values for analysis. The lack of reversibility makes this option unsuitable for the need to map de-identified data back to its original form when necessary. C) Format-Preserving Encryption (FPE): - Explanation: Format-preserving encryption ensures that the encrypted output maintains t...

Author: Daniel · Last updated Jul 20, 2026

An office manager at your small startup company is responsible for matching payments to invoices and creating billing alerts. For compliance reasons, the office manager is only permitted to have the Identity and Access Management (IAM) p...

To ensure the office manager has the necessary permissions for matching payments to invoices and creating billing alerts, they should be assigned IAM roles that give them access to the billing data while limiting unnecessary permissions that would violate the principle of least privilege. Let's evaluate the options: A) Organization Administrator: - Explanation: The Organization Administrator role provides full access to manage all resources across the organization, including creating and managing IAM roles, managing billing accounts, and modifying all aspects of the system. - Rejection Reason: This role is far too broad for the office manager’s needs. They only need permissions related to billing, not organization-wide management. Assigning this role would violate the principle of least privilege and grant unnecessary permissions. B) Project Creator: - Explanation: This role allows the user to create projects within the organization. - Rejection Reason: The office manager’s responsibilities do not include creating or managing projects. They are focused on billing tasks, so this role is unnecessary and does not align with the duties described. C) Billing Account Viewer: - Explanation: This role provides read-only access to billing information, such as viewing invoices, payments, and billing data. It ensures the office manager can view and monitor payment information but does not grant permissions to modify or create billing alerts. - Use Case: This is a relevant role for an office manager who needs to view and monitor billing data without having permission to modify or create resources outside their scope. This aligns well with the task of matching payments to invoices. - Selected Reasoning: This role is a good fit because the office manager primarily ne...

Author: MoonlitPantherX · Last updated Jul 20, 2026

You are designing a new governance model for your organization's secrets that are stored in Secret Manager. Currently, secrets for Production and Non- Production applications are stored and accessed using service accounts. Your proposed solution must: * Provide granular access to secrets * Give you control over the rotation schedules ...

When designing a governance model for storing and accessing secrets in Secret Manager, the key objectives are to maintain granular access control, environment separation, control over encryption key rotation, and ease of management. Let’s evaluate each option based on these requirements: A) 1. Use separate Google Cloud projects to store Production and Non-Production secrets. 2. Enforce access control to secrets using project-level identity and Access Management (IAM) bindings. 3. Use customer-managed encryption keys to encrypt secrets. - Explanation: - Separate Projects: Using different Google Cloud projects for Production and Non-Production secrets ensures environment separation, making it easier to manage access and avoid accidental cross-environment exposure. - Project-Level IAM: While project-level IAM provides control over the resources in the project, it is too broad for controlling access to individual secrets. Granular access at the project level would make it difficult to manage specific secret access in more fine-tuned ways. - Customer-Managed Encryption Keys (CMEK): This provides control over the rotation schedules of the keys used to encrypt secrets, which gives the organization flexibility and security for managing encryption key rotation. This approach aligns well with the need for control over key management. - Rejection Reason: Although CMEK and environment separation are solid, using project-level IAM doesn't provide enough granularity for managing secret access at the individual level. It could lead to less flexibility when different teams need access to specific secrets. B) 1. Use a single Google Cloud project to store both Production and Non-Production secrets. 2. Enforce access control to secrets using secret-level Identity and Access Management (IAM) bindings. 3. Use Google-managed encryption keys to encrypt secrets. - Explanation: - Single Project: Storing both Production and Non-Production secrets in the same project could lead to difficulties in enforcing clear environment separation, which is a key requirement for security and access management. - Secret-Level IAM: This provides granular access to specific secrets, ensuring that only the right entities have access to each secret, which is ideal for managing secret access at a more granular level. - Google-Managed Encryption Keys: This simplifies key management since Google automatically handles key rotation. However, it does not provide the level of control over encryption key rotation schedules that might be required for compliance or security. - Rejection Reason: While secret-level IAM allows for fine-grained access control, using a single project for both Production and Non-Production secrets violates the requirement for environment separation. Additi...

Author: ThunderBear · Last updated Jul 20, 2026

You are a security engineer at a finance company. Your organization plans to store data on Google Cloud, but your leadership team is worried about the security of their highly sensitive data. Specifically, your company is concerned about internal ...

Given your concern about internal Google employees accessing your company's sensitive data on Google Cloud, the solution needs to focus on restricting internal access while ensuring transparency and control over potential interactions with your data. Let's analyze the available options: A) Use customer-managed encryption keys (CMEK): - Explanation: Customer-managed encryption keys give your organization control over the encryption keys that protect your data. This ensures that only your team can control the decryption of the data, even though the data itself may be stored on Google Cloud. - Rejection Reason: While CMEK ensures that Google does not automatically control your encryption keys, it does not directly address the concern about internal Google employees' access to data or provide detailed visibility and approval mechanisms for such access. It offers control over data encryption but does not specifically mitigate internal access risks from Google employees. B) Use Google's Identity and Access Management (IAM) service to manage access controls on Google Cloud: - Explanation: IAM enables you to define fine-grained permissions on Google Cloud resources, ensuring that only authorized users (both internal and external) have access to specific resources. This is useful for controlling access at the user level, but it doesn't directly address internal Google employee access, as Google administrators could still have potential access to the data. - Rejection Reason: While IAM is crucial for controlling user access within your organization, it does not specifically mitigate concerns related to Google’s internal employees (such as administrators or support staff) accessing your sensitive data. C) Enable Admin activity logs to monitor access to resources: - Explanation: Admin activity logs provide visibility into actions taken...

Author: Vivaan · Last updated Jul 20, 2026

You want to use the gcloud command-line tool to authenticate using a third-party single sign-on (SSO) SAML identity provider. Which options are necessary to ensure that authenti...

To authenticate using a third-party Single Sign-On (SSO) SAML identity provider (IdP) with the `gcloud` command-line tool, the solution must integrate with Google Cloud's support for SAML-based authentication. Let's analyze the options in detail: A) SSO SAML as a third-party IdP: - Explanation: This option directly refers to the use of a SAML-based authentication method where a third-party IdP (such as Okta, ADFS, etc.) is used for Single Sign-On. SAML is a standard protocol used for authenticating users across different systems and would be necessary to ensure that authentication can occur through the third-party provider. - Use Case: This option is essential because it indicates that the authentication will be done using a third-party SAML IdP, which is exactly what you need for integrating external IdP with `gcloud` via SSO. - Selected Reasoning: This is the correct choice because it directly addresses the need to authenticate using a third-party SSO IdP that supports the SAML protocol. B) Identity Platform: - Explanation: Google Cloud's Identity Platform is a service that helps manage authentication, including support for multiple identity providers (such as SAML, OAuth, and others). However, this service is more for managing authentication for your own applications rather than directly facilitating the integration of third-party SAML IdPs for `gcloud` authentication. - Rejection Reason: While Identity Platform does support SAML-based authentication, it is typically used for managing user authentication within your Google Cloud environment. For `gcloud` authentication, you are more focused on configuring Google Cloud to recognize the third-party SAML IdP. This makes Identity Platform not directly applicable for this specific use case. C) OpenID Connect: - Explanation: OpenID Connect (OIDC) is a protocol built on OAuth 2.0 for federated identity, providing a way to authenticate users. However, it is different from SAML, which is the protocol mentioned in the question. - Rejection Reason: OpenID Connect is not compatible with SAML au...

Author: Mia · Last updated Jul 20, 2026

You work for a large organization where each business unit has thousands of users. You need to delegate management of access control permissions to each business unit. You have the following requirements: * Each business unit manages access controls for their own projects. * Each business unit manages access control permissions at scale. * Business units cannot access other business units' projects. * Users lose their access ...

Key Factors to Consider: - Delegation of access control: Each business unit should manage access for its own projects without affecting others. - Scalability: The solution should handle managing permissions at a large scale. - Isolation: Business units should not access each other's projects. - User Lifecycle: When a user moves or leaves the company, they should lose access to the projects tied to their previous business unit. - Integration with on-premises directory service: Permissions should be synchronized with the existing on-premises directory service. --- Analysis of Options: A) Use VPC Service Controls to create perimeters around each business unit's project. - Why Not Selected: VPC Service Controls are used to protect resources from unauthorized access by creating security perimeters around Google Cloud services. However, this approach is more focused on preventing data exfiltration rather than delegating access control and managing permissions based on business units. It doesn't solve the problem of delegating access management or ensuring that users lose access when they move or leave the company. - Scenario: This can be useful for protecting data but does not address user access delegation or directory synchronization. B) Organize projects in folders, and assign permissions to Google groups at the folder level. - Why Selected: Using folders to organize projects by business units is an effective strategy for managing permissions. You can assign permissions at the folder level to ensure that business units can manage access to all projects within their respective folders. This allows delegation of access control, ensuring each business unit can control its own projects. Folder-level permissions also isolate business units, ensuring they cannot access each other's projects. - Scenario: Ideal when there is a need to delegate permissions to business units and ensure each unit can only access its own projects. C) Group business units based on Organization Units (OUs) and manage permissions based on OUs. - Why Not Selected: Organi...

Author: Lucas · Last updated Jul 20, 2026

Your organization recently deployed a new application on Google Kubernetes Engine. You need to deploy a solution to protect the application. The solution has the following requirements: * Scans must run at least once per week * Must be able to detect cross-sit...

Key Factors to Consider: - Scan Frequency: Scans need to occur at least once per week. - Cross-Site Scripting (XSS) Detection: The solution must detect XSS vulnerabilities. - Authentication with Google Accounts: The solution must support authentication using Google accounts. --- Analysis of Options: A) Google Cloud Armor - Why Not Selected: Google Cloud Armor is primarily used to protect applications from DDoS attacks and other malicious traffic at the network edge. It provides web application firewall (WAF) functionality and can prevent certain types of attacks, but it is not designed to scan for application vulnerabilities like cross-site scripting (XSS). It doesn’t meet the requirement for scanning the application for vulnerabilities. - Scenario: This is appropriate for protecting applications against network-based threats, but it is not suitable for vulnerability scanning like XSS detection. B) Web Security Scanner - Why Selected: Web Security Scanner is a Google Cloud service specifically designed to scan web applications for vulnerabilities, including cross-site scripting (XSS). It meets the requirement of running scans periodically (such as weekly), and it integrates with Google Cloud to allow authentication using Google accounts. This tool provides automated vulnerability scanning and detection, making it an ideal fit for the requirement to detect XSS vulnerabilities in your deployed application. - Scenario: This is the i...

Author: Sofia2021 · Last updated Jul 20, 2026

An organization is moving applications to Google Cloud while maintaining a few mission-critical applications on-premises. The organization must transfer the data at a bandwidth of at least 50...

Key Factors to Consider: - Bandwidth Requirement: The solution must support a bandwidth of at least 50 Gbps for data transfer. - Secure Connectivity: The solution must ensure secure connectivity between the on-premises network and Google Cloud. - Suitability for Hybrid Environments: The organization is maintaining mission-critical applications on-premises while moving others to the cloud, indicating the need for hybrid connectivity. --- Analysis of Options: A) Dedicated Interconnect - Why Selected: Dedicated Interconnect provides a high-throughput, low-latency, and secure connection between on-premises data centers and Google Cloud. It supports very high bandwidths (up to 100 Gbps per link). This solution meets the bandwidth requirement of at least 50 Gbps and offers a private, direct connection, ensuring secure and reliable connectivity. It is ideal for organizations requiring high performance for data transfer and secure hybrid connectivity. - Scenario: This solution is most appropriate for organizations that need high bandwidth (like 50 Gbps or more) and secure, dedicated connectivity between their on-premises environment and Google Cloud. B) Cloud Router - Why Not Selected: Cloud Router is used in conjunction with Cloud Interconnect or VPN to dynamically exchange routes between Google Cloud and on-premises networks via Border Gateway Protocol (BGP). It doesn't provide a direct physical link or high bandwidth on its own. It’s a routing service and doesn't handle the transfer bandwidth directly. While Cloud Router is part of a solution, it would still r...

Author: Emma Brown · Last updated Jul 20, 2026

Your organization has had a few recent DDoS attacks. You need to authenticate responses to domain name look...

Key Factors to Consider: - DDoS Protection: The organization has experienced recent DDoS attacks, so it's important to focus on a solution that provides security and protects against malicious traffic. - Authentication for DNS Lookups: The requirement is to authenticate responses to domain name lookups, which implies DNS-level protection and verification. - Context: The solution should authenticate DNS responses to prevent manipulation or unauthorized responses to domain lookups. --- Analysis of Options: A) Cloud DNS with DNSSEC - Why Selected: Cloud DNS with DNSSEC (Domain Name System Security Extensions) provides authentication for DNS responses, ensuring that the responses to domain name lookups are valid and haven't been tampered with. DNSSEC protects against DNS spoofing and ensures that the integrity of DNS responses is maintained. This is exactly the type of solution needed to authenticate DNS lookups and prevent attacks targeting DNS systems, especially after recent DDoS attacks. - Scenario: Cloud DNS with DNSSEC is ideal for securing DNS traffic, especially in the case of domain name lookups, and would directly address the concern of authenticating DNS responses to prevent tampering or spoofing. B) Cloud NAT - Why Not Selected: Cloud NAT (Network Address Translation) provides a way to manage outgoing internet traffic fro...

Author: Maya2022 · Last updated Jul 20, 2026

Your Security team believes that a former employee of your company gained unauthorized access to Google Cloud resources some time in the past 2 months by using a service account key. You need to ...

Key Factors to Consider: - Unauthorized Access: You need to confirm if unauthorized access occurred, specifically using a service account key. - Determine User Activity: The goal is to find specific actions taken by the unauthorized user to understand the scope of the access. - Timeframe: You need to look for activity that occurred in the past 2 months. --- Analysis of Options: A) Use Security Health Analytics to determine user activity. - Why Not Selected: Security Health Analytics focuses on identifying misconfigurations, vulnerabilities, and risks in your Google Cloud environment, such as insecure access controls or unpatched services. While it can be useful for improving overall security posture, it does not provide detailed logging or historical activity for specific user or service account actions. This tool is more proactive in nature, identifying risks before they lead to attacks, but it doesn't offer detailed historical activity logs. - Scenario: This tool is best used for identifying ongoing security misconfigurations rather than tracking specific user activities or unauthorized access. B) Use the Cloud Monitoring console to filter audit logs by user. - Why Not Selected: The Cloud Monitoring console focuses on monitoring the health, performance, and availability of your Google Cloud resources. While it integrates with logs to provide real-time insights, it is not specifically designed for querying detailed audit logs of user activity, especially for retrospective investigations into unauthorized access. Audit logs are better accessed via Logs Explorer, which is specifically designed for searching and analyzing logs based on user...

Author: BlazingPhoenix22 · Last updated Jul 20, 2026

Your company requires the security and network engineering teams to identify all network anomalies within and across VPCs, internal traffic from VMs to VMs, traffic between end locations on the internet and VMs, ...

To identify all network anomalies within and across VPCs, including internal traffic from VMs to VMs, traffic between end locations on the internet and VMs, and traffic between VMs and Google Cloud services in production, the appropriate method should provide detailed visibility into the traffic flow, anomaly detection, and actionable insights. Option Analysis: A) Define an organization policy constraint: - Explanation: An organization policy constraint typically helps to enforce security and compliance requirements across the organization by defining rules for resources within the Google Cloud environment. While it ensures policies like access control, permissions, or resource creation, it does not directly provide traffic monitoring or anomaly detection. - Why rejected: Defining an organization policy does not address the requirement for monitoring and identifying network traffic anomalies. - Use case: Can be used for compliance and governance but not for traffic anomaly detection. B) Configure packet mirroring policies: - Explanation: Packet mirroring allows you to capture and analyze network traffic at the packet level, which can provide deep insights into network anomalies, especially for VM-to-VM and VPC-to-VPC traffic. This method is excellent for detailed monitoring and troubleshooting, as it mirrors the traffic to a destination where it can be analyzed. - Why selected: Packet mirroring provides the best visibility into the actual traffic flow and can help identify anomalies within and across VPCs, between VMs, and in interactions with Google Cloud services. It’s suited for in-depth traffic analysis. - Use case: Used for detailed traffic analysis and...

Author: FrostFalcon88 · Last updated Jul 20, 2026

Your company has been creating users manually in Cloud Identity to provide access to Google Cloud resources. Due to continued growth of the environment, you want to authorize the Google Cloud Directory Sync (GCDS) instance and integrate it with your on-premises LDAP server to onboard hundreds of users. You are required to: * Replicate user and group lifecycle changes from the on-premises LDAP server in Cloud Identity. * Disable any manually created u...

To integrate your on-premises LDAP server with Cloud Identity using Google Cloud Directory Sync (GCDS) while ensuring that user and group lifecycle changes are replicated from LDAP and manually created users are disabled, let's analyze each option in detail: Option Analysis: A) 1. Configure the option to suspend domain users not found in LDAP. 2. Set up a recurring GCDS task. - Explanation: Configuring the option to "suspend domain users not found in LDAP" means that if a user no longer exists in the LDAP directory, they will be suspended in Cloud Identity instead of being deleted. This action would effectively disable any manually created users that do not match an LDAP user. - Why selected: Suspending users (instead of deleting them) allows for a safety net where users can be reactivated if re-added to the LDAP directory. A recurring GCDS task will ensure that user and group changes are replicated periodically, which is ideal for keeping Cloud Identity up-to-date. - Use case: Ideal when the goal is to disable manually created users that aren't found in the LDAP system without removing them completely. B) 1. Configure the option to delete domain users not found in LDAP. 2. Run GCDS after user and group lifecycle changes. - Explanation: Configuring the option to "delete domain users not found in LDAP" will remove users from Cloud Identity if they are no longer present in LDAP. While this can clean up manually created users, it risks data loss or disruption if users were manually created for a reason (e.g., for temporary purposes or for users who should be re-added later). - Why rejected: Deleting users could be too drastic, especially if there is a possibility that users might be re-added to LDAP or if any users are manually created for specific needs that should not lead to deletion. - Use case: This option could be used in cases where you want to ensure that only LDAP-sourced users remain, and there's no need to preserve manually created users. ...

Author: Siddharth · Last updated Jul 20, 2026

You are troubleshooting access denied errors between Compute Engine instances connected to a Shared VPC and BigQuery datasets. The datasets reside in a projec...

In this scenario, you are encountering access denied errors between Compute Engine instances connected to a Shared VPC and BigQuery datasets protected by a VPC Service Controls perimeter. The issue is likely related to the fact that the Compute Engine instances are trying to access resources (BigQuery datasets) that are within a restricted perimeter. Option Analysis: A) Add the host project containing the Shared VPC to the service perimeter. - Explanation: The host project is where the Shared VPC resides, and adding it to the service perimeter would allow resources within the host project to interact with services in the perimeter. However, adding the host project to the perimeter might not resolve the issue if the Compute Engine instances themselves (which reside in a different service project) are not included in the perimeter. - Why rejected: This solution only addresses the host project, not the service project where the Compute Engine instances reside. Since the Compute Engine instances are in a different project, adding the host project alone doesn't resolve access issues for resources in the service project. B) Add the service project where the Compute Engine instances reside to the service perimeter. - Explanation: Adding the service project where the Compute Engine instances reside to the VPC Service Controls perimeter would give the instances access to resources inside the perimeter (like the BigQuery datasets). - Why selected: This is the correct approach because the Compute Engine instances are in the service project, and adding that project to the perimeter ensures that the resources inside the perimeter (such as BigQuery datasets) can be accessed by the Compute Engine instances. This aligns with the goal of resolving the access denied errors by ensuring both the compute instances and the protected resources are in the same perimeter. - Use case: This is the most straightforward solution when you need to grant access to resources inside a VPC Service Controls perimeter from Compute Engine instan...

Author: John · Last updated Jul 20, 2026

You recently joined the networking team supporting your company's Google Cloud implementation. You are tasked with familiarizing yourself with the firewall rules configuration and providing recommendations based on your networking and Google Cloud experience. What product should you re...

In this scenario, you're tasked with identifying overlapping firewall rules, especially rules with attributes that might be overridden or affected by higher or equal priority firewall rules. Let’s analyze each option based on this need: Option Analysis: A) Security Command Center: - Explanation: Security Command Center is a comprehensive security management and data risk platform for Google Cloud. It focuses on security posture, risk analysis, vulnerability scanning, and threat detection across Google Cloud resources. While it provides visibility into overall security risks, it doesn't specifically focus on identifying or managing firewall rule conflicts or overlaps in its core functionality. - Why rejected: Security Command Center is a more general security tool and doesn't offer specific features for detecting overlapping firewall rules or priority conflicts in firewall configurations. - Use case: Best suited for broader security monitoring, vulnerability management, and threat detection, not for granular firewall rule analysis. B) Firewall Rules Logging: - Explanation: Firewall Rules Logging allows you to log firewall rule actions, which can help you monitor which rules are being hit by network traffic. While it’s useful for debugging and understanding firewall behavior, it doesn’t directly provide insights into whether rules are overlapping or being overridden by others. - Why rejected: Firewall Rules Logging provides data about traffic that matches specific rules, but it doesn't offer a detailed analysis of rule overlaps or conflicts based on priority. - Use case: Helpful for auditing and tracking firewall rule hits, but not for detecting rule overlap or conflicts in priority. C) VPC Flow Logs: - Explanation: V...

Author: Daniel · Last updated Jul 20, 2026

The security operations team needs access to the security-related logs for all projects in their organization. They have the following requirements: * Follow the least privilege model by having only view access to logs. * Have access to Admin Activity logs. * Have access to Data Access logs. * Hav...

To meet the requirements of the security operations team for accessing security-related logs while adhering to the principle of least privilege, let’s analyze each IAM role option carefully: Option Analysis: A) roles/logging.privateLogViewer: - Explanation: The `roles/logging.privateLogViewer` role provides read-only access to private logs, including Data Access logs and Access Transparency logs, which are often more sensitive. This role is designed for users who need to view logs, including logs related to Data Access and Admin Activity, but with a narrower scope that doesn't give them broader administrative privileges. - Why selected: This role fits the security operations team's needs perfectly. It grants view access to the required logs, including Admin Activity, Data Access, and Access Transparency logs. It ensures compliance with the least privilege principle by limiting access to read-only permissions and only to the specific logs they need to monitor. - Use case: Best for security operations teams that need to view all types of logs but should not have permissions to modify or configure logging settings. B) roles/logging.admin: - Explanation: The `roles/logging.admin` role provides full administrative access to Cloud Logging resources, including the ability to create, modify, and delete logs and logging configurations. This role goes far beyond the view-only access required by the security operations team. - Why rejected: This role provides excessive permissions, granting administrative access, which violates the least privilege model. The team only needs view access to the logs, not the ability to configure or manage logging settings. - Use case: Suitable for users who need full administrative control over Cloud Logging resources, but not appropriate for secu...

Author: Emily · Last updated Jul 20, 2026

You are exporting application logs to Cloud Storage. You encounter an error message that the log sinks don't support uniform bucket-...

When encountering the error message about log sinks not supporting uniform bucket-level access policies, the issue is typically caused by a mismatch between the bucket's access control model and the log sink's expected configurations. Let’s break down the options: Option A: Change the access control model for the bucket - Explanation: Cloud Storage buckets can use two different access control models: - Uniform bucket-level access (UBLA), where access is controlled at the bucket level using Identity and Access Management (IAM) policies. - Fine-grained access control, where access is managed through ACLs (Access Control Lists) for individual objects. Log sinks require the uniform bucket-level access model to manage permissions via IAM roles, and if the bucket is using fine-grained access control, it won't work for log sinks. When to select: You should choose this option if the bucket is currently using fine-grained access control, and you need to enable uniform bucket-level access to make it compatible with log sinks. Option B: Update your sink with the correct bucket destination - Explanation: While updating the sink destination might be useful for other types of issues, it does not directly address the problem of the access model mismatch between the log sink and the bucket. When to reject: This option won’t resolve th...

Author: Akash · Last updated Jul 20, 2026

You plan to deploy your cloud infrastructure using a CI/CD cluster hosted on Compute Engine. You want to minimize the risk of its cred...

To deploy your cloud infrastructure with minimal risk of credential theft in a CI/CD cluster hosted on Compute Engine, the main focus should be on reducing the exposure of credentials, especially service account keys. Let’s evaluate the options: Option A: Create a dedicated Cloud Identity user account for the cluster. Use a strong self-hosted vault solution to store the user's temporary credentials. - Explanation: This option suggests using a Cloud Identity user account and storing credentials in a self-hosted vault. While a vault can be useful for securely storing secrets, managing credentials via a user account for a CI/CD cluster isn’t the best approach. Cloud Identity is primarily designed for managing users, not for service-based automation like CI/CD pipelines. Additionally, the complexity of managing user credentials through a self-hosted solution adds operational overhead. When to reject: This approach is not optimal because it mixes user and service-based credentials management and introduces unnecessary complexity and overhead. Option B: Create a dedicated Cloud Identity user account for the cluster. Enable the constraints/iam.disableServiceAccountCreation organization policy at the project level. - Explanation: This option restricts the creation of service accounts by enforcing an organization policy. However, it doesn't address the problem effectively. Using a Cloud Identity user account isn't ideal for service-based authentication in CI/CD pipelines. Moreover, restricting service account creation doesn’t directly solve the problem of managing the credentials securely. When to reject: This approach does not address the ma...

Author: RadiantJaguar56 · Last updated Jul 20, 2026

You need to set up two network segments: one with an untrusted subnet and the other with a trusted subnet. You want to configure a virtual appliance such as a next-generation firewall (NGFW) to inspect all traffic...

When designing the network to inspect traffic between a trusted subnet and an untrusted subnet using a virtual appliance like a next-generation firewall (NGFW), the goal is to ensure that all traffic between the two network segments is routed through the NGFW for inspection. The design must ensure proper traffic routing and network segmentation. Let’s evaluate each option: Option A: Set up one VPC with two subnets: one trusted and the other untrusted. Configure a custom route for all traffic (0.0.0.0/0) pointed to the virtual appliance. - Explanation: This option suggests a single VPC with two subnets, one for trusted and the other for untrusted traffic. By configuring a route that points all traffic (0.0.0.0/0) to the virtual appliance, it ensures that all traffic, including between the two subnets, is routed through the appliance. When to reject: Routing all traffic to the virtual appliance might not be ideal since it includes unnecessary traffic from other internet destinations. The focus should be on routing traffic between the trusted and untrusted subnets, not general internet traffic. Option B: Set up one VPC with two subnets: one trusted and the other untrusted. Configure a custom route for all RFC1918 subnets pointed to the virtual appliance. - Explanation: RFC1918 addresses private IP ranges, so routing traffic between trusted and untrusted subnets that both use private IP addresses (RFC1918) through the NGFW is a valid approach. This setup ensures that only the internal traffic between the trusted and untrusted subnets is inspected. When to select: This is an efficient solution because it directly routes internal traffic (within RFC1918 subnets) between the trusted and untrusted subnets through the NGFW, without unnecessarily routing external interne...

Author: Leo · Last updated Jul 20, 2026

You are a member of your company's security team. You have been asked to reduce your Linux bastion host external attack surface by removing all public IP addresses. Site Reliability Engineers (SREs) require access to the bastion host from ...

To reduce the external attack surface of your Linux bastion host while still allowing off-site access for Site Reliability Engineers (SREs), you need a secure method that ensures only authorized users can access the host, without exposing it directly to the public internet. Let’s evaluate the options: Option A: Implement Cloud VPN for the region where the bastion host lives. - Explanation: Cloud VPN allows private connectivity between your on-premises network and Google Cloud's VPC. This could be used to ensure that the SREs connect securely to the internal network through a private VPN tunnel. However, while this method secures the connection to the VPC, it doesn’t address the specific need for off-site SRE access, which might require internet access. When to reject: Cloud VPN is more suitable for connecting corporate networks or on-premises locations to Google Cloud, but for off-site SREs connecting from public locations, this would not be the most practical solution. The SREs would need to set up VPN software on their devices, which might be cumbersome. Option B: Implement OS Login with 2-step verification for the bastion host. - Explanation: OS Login simplifies SSH access to instances and integrates with Google Cloud IAM, allowing you to control access to the bastion host using IAM roles. Two-step verification (2SV) adds an extra layer of security by requiring a second authentication factor when accessing the bastion host. This solution ensures strong authentication, but it doesn’t specifically address the external access to the host. When to reject: While OS Login and 2-step verification increase securit...

Author: VioletCheetah55 · Last updated Jul 20, 2026

You need to enable VPC Service Controls and allow changes to perimeters in existing environments without preventing access to res...

When you need to enable VPC Service Controls and allow changes to perimeters without preventing access to resources, the best mode to use is one that allows testing and adjustments without enforcing strict controls. Let's evaluate each option: Option A: Cloud Run - Explanation: Cloud Run is a fully managed compute platform for deploying and managing applications. It is not directly related to VPC Service Controls or perimeter management. It provides container-based deployment but does not impact the enforcement or testing of VPC Service Controls per se. When to reject: Cloud Run is not related to VPC Service Controls in this context and doesn't provide a solution for controlling access to resources or perimeters. Option B: Native - Explanation: Native mode is the mode where VPC Service Controls are fully enabled and actively enforced. It allows you to enforce perimeters that restrict data access to only certain services and users, preventing any unauthorized access. However, this enforcement can block changes or access to resources if the perimeter is configured incorrectly. When to reject: While Native mode provides strong protection, it does not allow changes to perimeters freely. It actively enforces controls and can block access if perimeters or policies are not properly configured, which isn't what you'...

Author: Mia · Last updated Jul 20, 2026

You manage your organization's Security Operations Center (SOC). You currently monitor and detect network traffic anomalies in your Google Cloud VPCs based on packet header information. However, you want the capability to explor...

To address the need for exploring network flows and their payloads for your Security Operations Center (SOC), let's evaluate the options in detail: A) Marketplace IDS An IDS (Intrusion Detection System) from the Marketplace is a third-party security solution. While it might offer some packet inspection and alerting capabilities, it typically doesn’t provide comprehensive payload-level visibility. It's more focused on identifying threats rather than detailed traffic analysis. Additionally, it could introduce complexities in terms of integration, scalability, and management when compared to native Google Cloud solutions. - Scenario: Useful for specialized intrusion detection systems but not for in-depth exploration of network flows and payloads. - Rejection: Not ideal for detailed network traffic exploration or payload inspection in Google Cloud. B) VPC Flow Logs VPC Flow Logs provide metadata about network traffic such as source/destination IP addresses, ports, and protocols. However, VPC Flow Logs don't capture full packet-level information (like payloads), meaning they can't provide the deep inspection required for your investigation. - Scenario: Good for network monitoring and anomaly detection but lacks the depth needed for payload analysis. - Rejection: Does not offer payload-level visibility. C) VPC Service Controls Logs VPC Service Controls Logs focus on monitoring and controlling access to services in your Google Cloud environment. These logs focus on access control violations and sensitive data handling across services, but they are not specifically designed for network flow analysis or packet inspection. - Scenario: Useful for managing data security boundaries and ensuring compliance. - Rejection: Does not provide network traffic flow analysis or payload inspection. D) P...

Author: IceDragon2023 · Last updated Jul 20, 2026

Your organization acquired a new workload. The Web and Application (App) servers will be running on Compute Engine in a newly created custom VPC. You are responsible for configuring a secure network communication solution that meets the following requirements: * Only allows communication between the Web and App tiers. * Enforces consistent ne...

In this scenario, your goal is to configure a secure communication solution that enforces strict network security while also addressing autoscaling, preventing changes by instance admins, and ensuring only the Web and App servers can communicate with each other. Let's break down the options: A) Configure all running Web and App servers with respective network tags. Create an allow VPC firewall rule that specifies the target/source with respective network tags. - Explanation: Network tags can be used to identify instances and allow the creation of firewall rules based on those tags. In this case, you could configure Web and App servers with specific network tags and then create firewall rules that allow only traffic between these tagged instances. - Pros: This approach works for communication restrictions between Web and App tiers and scales well with autoscaling. The rules are applied at the instance level, which ensures the security is enforced even as instances are added or removed. Also, instance admins cannot alter firewall rules directly since these are controlled at the project level. - Scenario: Ideal for enforcing network security based on instance roles and ensuring scalability in an autoscaling setup. - Selected Option: Effective for implementing network segmentation based on instance roles (Web and App) using tags. B) Configure all running Web and App servers with respective service accounts. Create an allow VPC firewall rule that specifies the target/source with respective service accounts. - Explanation: Service accounts are used for identity and access management in Google Cloud. While they control what resources a VM can access at the API level, they do not directly control network traffic. Firewall rules are usually defined based on network attributes such as IPs, network tags, or ranges, not service accounts. - Rejection: This approach would not be effective for controlling network traffic between Web and App servers because firewall rules are not typically applied to service accounts for network security. C) Re-deploy the Web and App servers with instance templates configured with respective network tags. Create an allow VPC firewall rule that specifies the t...

Author: Mia · Last updated Jul 20, 2026

You need to connect your organization's on-premises network with an existing Google Cloud environment that includes one Shared VPC with two subnets named Production and Non-Production. You are required to: * Use a private transport link. * Configure access to Google Cloud APIs through private API endpoints orig...

To meet the requirements of connecting your organization's on-premises network to Google Cloud while ensuring a secure private transport link and access to Google Cloud APIs via private endpoints, let’s evaluate the options. A) Set up a Cloud VPN link between the on-premises environment and Google Cloud. Configure private access using the restricted.googleapis.com domains in on-premises DNS configurations. - Explanation: Cloud VPN is a solution that establishes a secure IPsec tunnel between your on-premises network and Google Cloud. However, Cloud VPN is typically used for small to medium-sized environments and does not provide the high bandwidth, low latency, or reliability required for larger enterprise needs. Additionally, the restricted.googleapis.com domains in DNS configurations refer to restricted API access, but Cloud VPN may not be the best option for this scenario, especially considering the focus on private API access with VPC Service Controls. - Rejection: While Cloud VPN can provide a secure connection, it may not provide the performance and scalability needed for your setup, nor does it align well with the private API access and VPC Service Controls requirements for high-scale environments. B) Set up a Partner Interconnect link between the on-premises environment and Google Cloud. Configure private access using the private.googleapis.com domains in on-premises DNS configurations. - Explanation: Partner Interconnect is designed to provide a private, high-throughput connection between your on-premises environment and Google Cloud through a service provider. This is ideal for scenarios requiring reliable and scalable connectivity. The option also mentions configuring DNS for private.googleapis.com, which aligns with accessing Google Cloud APIs privately. This option works well for private API consumption and allows better integration with VPC Service Controls. - Pros: Provides a dedicated, high-availability connection with good throughput and low latency, ideal for enterprise setups. Also allows private API access via DNS configuration and is compliant with VPC Service Controls. - Scenario: Best suited when the organization needs a reliable, scalable private connection to Google Cloud and private API access. - Selected Option: This option is well-suited for your requirements. C) Set up a Direct Peering link between th...

Author: Daniel · Last updated Jul 20, 2026

You are working with protected health information (PHI) for an electronic health record system. The privacy officer is concerned that sensitive data is stored in the analytics system. You are tasked with anonymizing the sensitive data in a way that is not reversible. Al...

Given the scenario where you need to anonymize sensitive data (PHI) in a way that is irreversible and does not preserve the character set or length, let’s evaluate the options: A) Cloud Data Loss Prevention with deterministic encryption using AES-SIV - Explanation: Deterministic encryption with AES-SIV (Authenticated Encryption with Associated Data using a Simple Initialization Vector) means that the same plaintext input always produces the same ciphertext. This is useful for cases where you need to look up data in a consistent way (e.g., encrypted database searches). However, deterministic encryption does not fully anonymize the data because the original data can still be recovered if the encryption key is known. It also typically preserves the length of the data, which contradicts the requirement to anonymize the data in a way that does not preserve the length or character set. - Rejection: This option does not fulfill the requirement to anonymize data irreversibly and distort the length or character set. B) Cloud Data Loss Prevention with format-preserving encryption - Explanation: Format-preserving encryption (FPE) allows the encrypted data to maintain the original format (including length and character set). For instance, a Social Security Number (SSN) might still look like an SSN after encryption. While this may be useful for certain use cases where you want to maintain a specific format (e.g., in databases with strict schema constraints), this does not meet your requirement for non-reversible anonymization or distorting the length/character set. - Rejection: This option fails to anonymize the data in a way that changes its character set or length, which is a requirement in your scenario. C) Cloud Data Loss Prevention with cryptographic hashing - Explanation: Cryptographic hashing (e.g., SHA-256) is a one-way function that transforms data into a fixed-size string of characters. The hashed data is irreversible, meaning you cannot...

Author: CrystalWolfX · Last updated Jul 20, 2026

You are setting up a CI/CD pipeline to deploy containerized applications to your production clusters on Google Kubernetes Engine (GKE). You need to prevent containers with known vulnerabilities from being deployed. You have the following requirements for your solution: Must be clo...

To address the requirement of preventing containers with known vulnerabilities from being deployed to your production clusters on Google Kubernetes Engine (GKE), let's evaluate the options in detail based on the key criteria: cloud-native, cost-efficient, and minimizing operational overhead. A) Create a Cloud Build pipeline that will monitor changes to your container templates in a Cloud Source Repositories repository. Add a step to analyze Container Analysis results before allowing the build to continue. - Explanation: This option involves using Cloud Build, which is a fully-managed, cloud-native CI/CD solution, to analyze container images for vulnerabilities using Container Analysis. The Container Analysis API provides vulnerability scanning results for images stored in Google Cloud, and Cloud Build can block the pipeline from continuing if any vulnerabilities are detected. This integrates seamlessly with Google Cloud services, minimizing operational overhead and maintaining cost efficiency. - Pros: It is fully cloud-native, integrates well with Google Cloud services, and automates vulnerability scanning within the CI/CD pipeline. It minimizes overhead because Cloud Build is a managed service and requires minimal setup. - Selected Option: This is a cloud-native, cost-effective, and low-maintenance solution. B) Use a Cloud Function triggered by log events in Google Cloud's operations suite to automatically scan your container images in Container Registry. - Explanation: Cloud Functions can be triggered by events in Google Cloud's operations suite (e.g., logs or notifications) to scan container images for vulnerabilities. While this is a cloud-native approach, it would require more complex setup and monitoring. Cloud Functions are generally used for specific tasks, and setting up event-driven scanning could lead to increased operational overhead and complexity, especially in maintaining and debugging the function. - Rejection: This option could be more complex to set up and manage, which increases operational overhead. It also doesn’t offer the same tight integration with a CI/CD pipeline as the other options. C) Use a cron job on a Compute Engine instance to scan your existing repositories for known vulnerabilities and raise an alert if a non-compliant container image is found. - Explanation: This option involves manually managing a cron job on a Compute Engine instance to scan the repositories. While it could work, this approach introduces significant operational overhead since you would need to manage the cron job, the Compute Engine instance, and ensure everything is maintained and monitored. This also isn't a cloud-native solution, an...

Author: ThunderBear · Last updated Jul 20, 2026

Which type of load balancer should you use to maintain client IP by default while using the standard...

To maintain the client IP by default while using the standard network tier, you need to use a load balancer that preserves the client IP address in the request header when the request reaches the backend server. Let’s analyze each of the options: A) SSL Proxy - Key Factor: SSL Proxy load balancer is used for handling SSL termination for secure connections (HTTPS) at the edge, then forwards the request to backend services. - Reasoning: This load balancer preserves the client IP address by default. It is ideal for handling encrypted traffic while still forwarding the client’s original IP address to the backend servers. - Scenario: You should use this when you want to offload SSL termination at the edge and ensure that backend servers can log the original client IP address while managing HTTPS traffic. B) TCP Proxy - Key Factor: A TCP Proxy load balancer operates at the transport layer (TCP) and forwards client connections to backend services. It does not preserve the client IP address by default because it rewrites the connection request. - Reasoning: Client IP is not preserved by default with this load balancer, making it unsuitable for scenarios where the client IP needs to be maintained at the backend. - Scenario: Use it when dealing with encrypted (SSL/TLS) or non-SSL TCP traffic that doesn’t require the preservation of the client’s IP addres...

Author: Maya · Last updated Jul 20, 2026

You want to prevent users from accidentally deleting a Shared VPC host project. Which organization-l...

To prevent users from accidentally deleting a Shared VPC host project, the most appropriate organization-level policy constraint would be the one that specifically addresses the issue of Shared VPC host project deletion. Let's break down each option: A) compute.restrictSharedVpcHostProjects - Key Factor: This policy constraint specifically restricts the deletion or modification of Shared VPC host projects. It ensures that the host project (which serves as the backbone for Shared VPCs) is protected and cannot be accidentally removed or modified by users. - Reasoning: This is the most directly applicable policy for preventing accidental deletion of Shared VPC host projects. It ensures that only authorized users can delete or modify the Shared VPC host project, thus safeguarding it. - Scenario: Use this policy if you want to ensure that only authorized administrators can make changes to Shared VPC host projects and prevent accidental deletions. B) compute.restrictXpnProjectLienRemoval - Key Factor: This policy applies to "liens" on projects that are part of an "XPN" (Shared VPC) network. It restricts the removal of liens on XPN projects. - Reasoning: While this policy helps prevent removal of liens (a form of restriction) on Shared VPC projects, it doesn’t directly protect the host project from deletion. This constraint is more about lien management rather than directly preventing project deletion. - Scenario: This would be useful if you're specifically concerned about lien removals and the management o...

Author: Amira · Last updated Jul 20, 2026

Users are reporting an outage on your public-facing application that is hosted on Compute Engine. You suspect that a recent change to your firewall rules is responsible. You need ...

To determine whether recent changes to your firewall rules are causing issues with your public-facing application hosted on Compute Engine, you need to test the firewall rules systematically. Let’s evaluate the options based on key factors such as effectiveness, safety, and efficiency. A) Enable Firewall Rules Logging on the latest rules that were changed. Use Logs Explorer to analyze whether the rules are working correctly. - Key Factor: Firewall Rules Logging helps capture the traffic that is being allowed or denied based on the applied firewall rules. By analyzing these logs in the Logs Explorer, you can quickly identify whether traffic is being blocked as a result of the firewall rules. - Reasoning: This is an effective and non-intrusive way to troubleshoot. You can log the specific rules that were recently changed and review whether legitimate traffic is being blocked. Logs provide clear insights without requiring changes to the environment. - Scenario: Use this option when you want to analyze the behavior of the firewall rules without modifying the production setup and without causing any further disruptions. This method is particularly effective when you need to trace specific issues related to traffic filtering. B) Connect to a bastion host in your VPC. Use a network traffic analyzer to determine at which point your requests are being blocked. - Key Factor: Using a network traffic analyzer can be useful for inspecting network traffic. However, this option is more time-consuming and may not directly identify the firewall rule causing the problem. It also requires you to have a bastion host in place and manually analyze traffic. - Reasoning: While it provides visibility into network traffic, it is more complex than simply using firewall logs and might not directly identify the firewall rule causing issues. It’s more of a workaround and can be overcomplicated for a problem that might be easily resolved using logging. - Scenario: This method is useful when you're troubleshooting deeper network issues, such as routing or network configuration problems, but it is less effective for quickly identifying misconfigured firewall rules. C) In a pre-production environment, disab...

Author: Zara1234 · Last updated Jul 20, 2026

You are a security administrator at your company. Per Google-recommended best practices, you implemented the domain restricted sharing organization policy to allow only required domains to access your projects. An engineering team is now reporting that users at an external partner outside your organization domain cannot be grant...

When implementing Google-recommended best practices, it's important to maintain security while allowing necessary exceptions. The domain restricted sharing organization policy is designed to restrict project access to specific domains to ensure that only authorized internal users and partners can access your organization's resources. The question here is how to grant access to an external partner domain while adhering to the best practices and ensuring minimal disruption to security. A) Turn off the domain restriction sharing organization policy. Set the policy value to "Allow All." - Key Factor: This option would remove the domain restriction entirely and allow any external domains unrestricted access to the project. - Reasoning: This is not recommended because it bypasses the entire purpose of the domain restriction sharing policy, effectively allowing anyone on the internet to access your resources. This opens the door to security risks and exposes your organization to potential unauthorized access. - Scenario: This option would only be used in extremely specific cases where access needs to be globally open, but this defeats the purpose of the security policy and is contrary to best practices. B) Turn off the domain restricted sharing organization policy. Provide the external partners with the required permissions using Google's Identity and Access Management (IAM) service. - Key Factor: This option involves disabling the domain restriction and manually granting IAM roles to external partners. However, it doesn't address the core issue, which is that you want to allow specific external domains while keeping other restrictions in place. - Reasoning: While IAM can control who has access to specific resources, turning off the domain restriction policy entirely still removes the desired control over domain-specific access. This is not in line with best practices, which emphasize keeping domain restrictions active while allowing for targeted exceptions. - Scenario: This might work in isolated cases but is not the best solution when trying to maintain a secure environment while allowing limited external access. C) Turn off the domain restricted sharing organization policy. Add each partner's Google Workspace customer ID to a Google group, add the Google group as an exception under the organiz...

Author: Olivia Johnson · Last updated Jul 20, 2026

You plan to use a Google Cloud Armor policy to prevent common attacks such as cross-site scripting (XSS) and SQL injection (SQLi) from reaching your web application's backend. What are...

Google Cloud Armor provides protection against common web application attacks like Cross-Site Scripting (XSS) and SQL Injection (SQLi). To use Google Cloud Armor effectively, you must meet certain prerequisites regarding the setup of your load balancer and services. Let's go over the options and analyze which are valid requirements for using Google Cloud Armor security policies. A) The load balancer must be an external SSL proxy load balancer. - Key Factor: This is not a requirement for using Google Cloud Armor. Google Cloud Armor is designed to work with external HTTP(S) load balancers, not specifically SSL proxy load balancers. SSL Proxy load balancers are typically used for SSL/TLS traffic but do not support Layer 7 (L7) traffic inspection, which is necessary for web application firewall features like Google Cloud Armor. - Reasoning: This option is rejected because Google Cloud Armor relies on HTTP(S) load balancers for its L7-based traffic filtering, not SSL proxy load balancers. B) Google Cloud Armor Policy rules can only match on Layer 7 (L7) attributes. - Key Factor: This is a correct requirement because Google Cloud Armor is specifically designed to operate at Layer 7 of the OSI model. It allows policies to filter traffic based on HTTP/S attributes, such as headers, URI paths, and cookies, which is essential for protecting against attacks like XSS and SQLi. - Reasoning: Google Cloud Armor operates at the application layer, where HTTP/S traffic can be inspected and filtered. This option is selected because it directly corresponds to the type of traffic filtering Google Cloud Armor performs. C) The load balancer must use the Premium Network Service Tier. - Key Factor: The Premium Network Service Tier is recommended for high performance and global routing, but it is not a strict requirement for using Google Cloud Armor. Google Cloud Armor...

Author: Henry · Last updated Jul 20, 2026

You perform a security assessment on a customer architecture and discover that multiple VMs have public IP addresses. After providing a recommendation to remove the public IP addresses, you are told those VMs need to communicate to external sites as part of the custome...

In this case, the goal is to reduce the need for public IP addresses while still allowing the VMs to communicate with external sites. Let's evaluate each option in terms of suitability: A) Google Cloud Armor - Explanation: Google Cloud Armor is a security service that provides protection against DDoS attacks and other threats by filtering traffic to applications deployed on Google Cloud. However, this service primarily focuses on securing public-facing applications, not addressing the need for external communication from VMs. - Why rejected: While it can secure public IPs, it doesn't reduce the need for VMs to have public IPs to communicate externally. - Scenario: Used to protect external-facing services from threats, not to solve internal communication requirements. B) Cloud NAT (Network Address Translation) - Explanation: Cloud NAT allows VMs without public IP addresses to access external resources such as the internet. It provides outbound internet connectivity for private VMs using internal IP addresses, thereby avoiding the need for each VM to have its own public IP. - Why selected: This option is specifically designed to solve the problem of allowing VMs to access the internet without requiring them to have public IPs. It preserves the private IPs of VMs, reducing exposure to external threats. - Scenario: Best suited for situations where VMs need internet access (outbound traffic) but should not have public IP addresses for security or cost reasons. C) Clo...

Author: Mia · Last updated Jul 20, 2026

You are tasked with exporting and auditing security logs for login activity events for Google Cloud console and API calls that modify configurations to Google Cloud resources. Your export must meet the following requirements: * Export related logs for all projects in the...

To export and audit security logs for login activity events and API calls that modify configurations across all projects in a Google Cloud organization, you need to ensure that logs are collected, exported in near real-time, and made available to a Security Information and Event Management (SIEM) system. Let's evaluate the options: A) Create a Log Sink at the organization level with a Pub/Sub destination. - Explanation: A log sink allows you to export logs to a specified destination, such as Google Cloud Pub/Sub, which is suitable for near real-time export. Creating a log sink at the organization level ensures that logs from all projects within the organization are captured and exported. Pub/Sub is an ideal mechanism for real-time log streaming to external SIEM systems. - Why selected: This option directly meets the requirement to export logs in near real-time to an external SIEM system and ensures logs are captured at the organization level, covering all projects. B) Create a Log Sink at the organization level with the includeChildren parameter, and set the destination to a Pub/Sub topic. - Explanation: This option is similar to A, but it explicitly ensures that logs from all child resources (i.e., all projects) under the organization are included in the export. By setting the `includeChildren` parameter, you ensure that the log sink applies to every project in the organization. - Why selected: This option ensures that logs are captured from all projects within the organization and exported to the SIEM system in near real-time, which is a specific requirement for this task. C) Enable Data Access audit logs at the organization level to apply to all projects. - Explanation: Data Access audit logs capture details about API calls that modify configurations for resources, which is one of the required log types. Enabling Data Access audit logs is necessary to collect the detailed logs for API calls. - Why rejected: While this option ensures that the appropriate audit logs are captured, i...

Author: Rohan · Last updated Jul 20, 2026

What Our Friends Say

What Our Friends Say

Google Practice Questions, Discussions & Exam Topics by our Authors

As adoption of the Cloud Data Loss Prevention (Cloud DLP) API grows within your company, you need to optimize usage to reduce cost. Cloud DLP target data is stored in Cloud Storage and BigQuery. The location and region are ...

Your team uses a service account to authenticate data transfers from a given Compute Engine virtual machine instance of to a specified Cloud Storage bucket. An engineer accidentally deletes the service account, which breaks application functionality. Y...

You are the Security Admin in your company. You want to synchronize all security groups that have an email address from y...

You are part of a security team investigating a compromised service account key. You need to audit which new resources were...

You have an application where the frontend is deployed on a managed instance group in subnet A and the data layer is stored on a mysql Compute Engine virtual machine (VM) in subnet B on the same VPC. Subnet A and Subnet B hold several other Compute Engine VMs. You only want to ...

Your company operates an application instance group that is currently deployed behind a Google Cloud load balancer in us-central-1 and is configured to use the Standard Tier network. The infrastructure team wants to expand to a second Google Cloud region, us-east-2. You need to se...

You are the security admin of your company. You have 3,000 objects in your Cloud Storage bucket. You do not want to manage access to each object individually. You also do not want the uploader of an object to always have full control of the...

You are the security admin of your company. Your development team creates multiple GCP projects under the "implementation" folder for several dev, staging, and production workloads. You want to prevent data exfiltration by malicious insiders or compromised code by setting ...

You are on your company's development team. You noticed that your web application hosted in staging on GKE dynamically includes user data in web pages without first properly validating the inputted data. This could allow an attacker to execute gibberish commands and display arbit...

You are part of a security team that wants to ensure that a Cloud Storage bucket in Project A can only be readable from Project B. You also want to ensure that data in the Cloud Storage bucket cannot be accessed from or copied to Cloud S...

You are responsible for protecting highly sensitive data in BigQuery. Your operations teams need access to this data, but given privacy regulations, you want to ensure that they cannot read the sensitive fields such as email addresses and first names. These specific ...

You are a Security Administrator at your organization. You need to restrict service account creation capability within production environments. You want to ac...

You are the project owner for a regulated workload that runs in a project you own and manage as an Identity and Access Management (IAM) admin. For an upcoming audit,...

Your organization has implemented synchronization and SAML federation between Cloud Identity and Microsoft Active Directory. You want to reduce the risk of...

You have been tasked with implementing external web application protection against common web application attacks for a public application on Google Cloud. You want to validate...

You are asked to recommend a solution to store and retrieve sensitive configuration data from an application that runs o...

You need to implement an encryption at-rest strategy that reduces key management complexity for non-sensitive data and protects sensitive data while providing the flexibility of controlling the key residency and ro...

An office manager at your small startup company is responsible for matching payments to invoices and creating billing alerts. For compliance reasons, the office manager is only permitted to have the Identity and Access Management (IAM) p...

You are a security engineer at a finance company. Your organization plans to store data on Google Cloud, but your leadership team is worried about the security of their highly sensitive data. Specifically, your company is concerned about internal ...

You want to use the gcloud command-line tool to authenticate using a third-party single sign-on (SSO) SAML identity provider. Which options are necessary to ensure that authenti...

Your organization recently deployed a new application on Google Kubernetes Engine. You need to deploy a solution to protect the application. The solution has the following requirements: * Scans must run at least once per week * Must be able to detect cross-sit...

An organization is moving applications to Google Cloud while maintaining a few mission-critical applications on-premises. The organization must transfer the data at a bandwidth of at least 50...

Your organization has had a few recent DDoS attacks. You need to authenticate responses to domain name look...

Your Security team believes that a former employee of your company gained unauthorized access to Google Cloud resources some time in the past 2 months by using a service account key. You need to ...

Your company requires the security and network engineering teams to identify all network anomalies within and across VPCs, internal traffic from VMs to VMs, traffic between end locations on the internet and VMs, ...

You are troubleshooting access denied errors between Compute Engine instances connected to a Shared VPC and BigQuery datasets. The datasets reside in a projec...

You recently joined the networking team supporting your company's Google Cloud implementation. You are tasked with familiarizing yourself with the firewall rules configuration and providing recommendations based on your networking and Google Cloud experience. What product should you re...

You are exporting application logs to Cloud Storage. You encounter an error message that the log sinks don't support uniform bucket-...

You plan to deploy your cloud infrastructure using a CI/CD cluster hosted on Compute Engine. You want to minimize the risk of its cred...

You need to set up two network segments: one with an untrusted subnet and the other with a trusted subnet. You want to configure a virtual appliance such as a next-generation firewall (NGFW) to inspect all traffic...

You are a member of your company's security team. You have been asked to reduce your Linux bastion host external attack surface by removing all public IP addresses. Site Reliability Engineers (SREs) require access to the bastion host from ...

You need to enable VPC Service Controls and allow changes to perimeters in existing environments without preventing access to res...

You manage your organization's Security Operations Center (SOC). You currently monitor and detect network traffic anomalies in your Google Cloud VPCs based on packet header information. However, you want the capability to explor...

You are working with protected health information (PHI) for an electronic health record system. The privacy officer is concerned that sensitive data is stored in the analytics system. You are tasked with anonymizing the sensitive data in a way that is not reversible. Al...

You are setting up a CI/CD pipeline to deploy containerized applications to your production clusters on Google Kubernetes Engine (GKE). You need to prevent containers with known vulnerabilities from being deployed. You have the following requirements for your solution: Must be clo...

Which type of load balancer should you use to maintain client IP by default while using the standard...

You want to prevent users from accidentally deleting a Shared VPC host project. Which organization-l...

Users are reporting an outage on your public-facing application that is hosted on Compute Engine. You suspect that a recent change to your firewall rules is responsible. You need ...

You plan to use a Google Cloud Armor policy to prevent common attacks such as cross-site scripting (XSS) and SQL injection (SQLi) from reaching your web application's backend. What are...

You perform a security assessment on a customer architecture and discover that multiple VMs have public IP addresses. After providing a recommendation to remove the public IP addresses, you are told those VMs need to communicate to external sites as part of the custome...

You are tasked with exporting and auditing security logs for login activity events for Google Cloud console and API calls that modify configurations to Google Cloud resources. Your export must meet the following requirements: * Export related logs for all projects in the...