Google Practice Questions, Discussions & Exam Topics by our Authors
You manage a fleet of virtual machines (VMs) in your organization. You have encountered issues with lack of patching in many VMs. You need to automate regular patching in your VMs and view the ...
To automate patching and view patch management data across multiple virtual machines (VMs) in your organization, let's evaluate each option based on the requirements of regular patching and viewing patch management data:
Option A: View patch management data in VM Manager by using OS patch management.
- Pros:
- VM Manager provides a centralized solution for managing and viewing patching status across your VMs.
- It supports automatic OS patch management, meaning you can automate regular patching on VMs, helping to ensure they stay up to date.
- You can view detailed patch management data, including which VMs have applied or failed to apply patches, helping you stay on top of compliance.
- Cons:
- This option does not involve patch deployment, only monitoring and reporting.
Conclusion: This option is useful for viewing patch management data and automating patching on VMs, making it a strong choice for meeting the requirements.
---
Option B: View patch management data in Artifact Registry.
- Pros:
- Artifact Registry is used for managing and storing container images, dependencies, and other artifacts.
- Cons:
- This is not related to VM patching at all. Artifact Registry is more relevant to container management and does not provide any patch management functionality for VMs.
Conclusion: This option is irrelevant to the task of automating patching for VMs, so it is not suitable.
---
Option C: View patch management data in a Security Command Center dashboard.
- Pros:
- Security Command Center provides security and compliance monitoring across your Google Cloud infrastructure.
- Cons:
- While Security Command Center can detect vulnerabilities, it does not directly manage or automate patchin...
Author: Leah · Last updated Aug 24, 2026
Your organization uses BigQuery to process highly sensitive, structured datasets. Following the 'need to know' principle, you need to create the Identity and Access Management (IAM) design to meet the needs of these users:
* Business user: must access curated reports.
* Data engineer: must administra...
In this scenario, we are focusing on creating an IAM design for different users with varying needs for accessing and managing sensitive structured datasets in BigQuery. Let’s review the options based on the principle of "need to know" and evaluate each:
Option A: Configure data access log for BigQuery services, and grant Project Viewer role to the security operator.
- Pros:
- Configuring data access logs is essential for auditing and monitoring user activity on the platform, which is a key responsibility for the security operator.
- Granting the Project Viewer role to the security operator gives read-only access to the project, which is appropriate for reviewing activity but not making changes to the data.
- Cons:
- This option doesn’t address the needs of the business user or the data engineer specifically, as it only focuses on the security operator.
Conclusion: This option is partially useful for the security operator, but it does not cover the requirements for the business user or data engineer, and lacks granularity needed for fine-grained access control.
---
Option B: Set row-based access control based on the "region" column, and filter the record from the United States for data engineers.
- Pros:
- Row-level access control (RLAC) can be useful for applying granular access control to sensitive data. Filtering based on the "region" column would allow the data engineer to only access the records relevant to their tasks (e.g., excluding data from the United States).
- Cons:
- This option focuses on data engineers but doesn’t directly address the needs of the business user or the security operator.
- It doesn’t align with the principle of least privilege as the data engineer would still potentially have access to all data rows, just filtered by the region column.
Conclusion: This option is useful for limiting access to specific data for data engineers but does not fully meet the broader access control needs for the other roles.
---
Option C: Create curated tables in a separate dataset and assign the role `roles/bigquery.dataViewer`.
- Pros:
- Creating curated tables in a separate dataset ensures that sensitive data is isolated, and access can be granted more precisely.
- The business user would be assigned the `roles/bigqu...
Author: Emma · Last updated Aug 24, 2026
You are setting up a new Cloud Storage bucket in your environment that is encrypted with a customer managed encryption key (CMEK). The CMEK is stored in Cloud Key Management Service (KMS), in project 'prj-a', and the Cloud Storage bucket will use project 'prj-b'. The key is backed by a Cloud Hardware Security Module (HSM) and resides in the region europe-west3. Your storage bucket wil...
To troubleshoot the access issue between the Cloud Storage bucket and the CMEK, we need to analyze each of the options based on the information provided. Let’s go through each potential cause:
Option A: A firewall rule prevents the key from being accessible.
- Pros:
- Firewall rules can prevent access between services, but it's unlikely in this case. Google Cloud's KMS and Cloud Storage services are fully managed and typically do not rely on user-configured firewall rules for internal communication.
- Cons:
- This is not typically a problem for Cloud KMS and Cloud Storage interactions, as they are internal Google Cloud services with automatic network routing. There are no indications in the scenario suggesting that firewall issues are involved.
Conclusion: This is unlikely to be the root cause of the issue, as Google Cloud typically handles network communication internally, and firewall rules would not block this interaction.
---
Option B: Cloud HSM does not support Cloud Storage.
- Pros:
- Using a Cloud Hardware Security Module (HSM) to back a customer-managed encryption key (CMEK) should not be an issue in itself. Cloud HSM supports all typical use cases of CMEK with Google Cloud Storage, including encryption for Cloud Storage buckets.
- Cons:
- There is no restriction or incompatibility between Cloud HSM and Cloud Storage. HSM-backed keys can be used to encrypt and decrypt Cloud Storage data, and this is supported in the Google Cloud ecosystem.
Conclusion: This option is not the cause of the issue. HSMs do support Cloud Storage, so this is not relevant.
---
Option C: The CMEK is in a different project than the Cloud Storage bucket.
- Pros:
- While it’s important to ensure proper IAM permissions when accessing re...
Author: Rahul · Last updated Aug 24, 2026
You are deploying regulated workloads on Google Cloud. The regulation has data residency and data access requirements. It also requires that support is provided from the sa...
In order to deploy regulated workloads on Google Cloud while adhering to data residency and access requirements, the key considerations are ensuring that data stays within the required geographical region and that support is provided locally in accordance with the regulation.
Let’s evaluate the options:
A) Enable Access Transparency Logging:
Access Transparency provides logs of administrative access to customer data, helping to monitor and audit the actions of Google staff. While this is important for security and auditing, it does not address data residency or the requirement for support to be located in the same region as the data. Hence, this option alone is not sufficient.
B) Deploy Assured Workloads:
Assured Workloads is a Google Cloud service specifically designed for customers with regulatory and compliance needs. It ensures that workloads are deployed in specific regions and adhere to regulations such as data residency and access requirements. Assured Workloads can also help ensure that support is provided from the right geographical location. This option is highly effective in managing workloads that require strict compliance with geographical and regulatory constraints.
C) Deploy resources only to regions permitted by data residency requirements:
This option is important for meeting the data residency ...
Author: Benjamin · Last updated Aug 24, 2026
Your organization wants full control of the keys used to encrypt data at rest in their Google Cloud environments. Keys must be generated and stored outside of Google and int...
To meet the organization's requirement of having full control over the keys used to encrypt data at rest in Google Cloud, with keys generated and stored outside of Google, while integrating with services like BigQuery, let’s evaluate the options:
A) Use customer-supplied encryption keys (CSEK) with keys generated on trusted external systems. Provide the raw CSEK as part of the API call.
- Pros: CSEK allows the organization to supply their own encryption keys. It ensures that the keys are fully controlled by the organization and are stored outside of Google Cloud.
- Cons: While CSEK provides control over the keys, it requires providing the raw key during every API call, which might complicate integration and management. It also does not offer the same integration capabilities with Google Cloud services as other options like Cloud KMS or Cloud EKM.
- Key Factor: If the organization requires more seamless integration with Google services, this option would not be ideal because it involves manually managing and providing keys during API calls.
B) Create a KMS key that is stored on a Google-managed FIPS 140-2 level 3 Hardware Security Module (HSM). Manage the Identity and Access Management (IAM) permissions settings, and set up the key rotation period.
- Pros: This option uses Google Cloud's KMS with keys stored in an HSM, offering high security and compliance (e.g., FIPS 140-2 Level 3). It automates key management and integrates well with various Google Cloud services.
- Cons: The keys are managed and stored by Google, which does not meet the requirement of storing keys outside of Google Cloud. Therefore, this option does not fulfill the organization's need for full control over the encryption keys.
- Key Factor: The organization seeks to store keys outside of Google Cloud, which this option does not provide.
C) Use Cloud External Key Management (EKM) that integrates with an external Hardware Security Module (HSM) system from supported vendors.
- Pros: Cloud EKM allows organ...
Author: Sara · Last updated Aug 24, 2026
Your company is concerned about unauthorized parties gaining access to the Google Cloud environment by using a fake login page. You must implement a solution to protect agai...
To protect against man-in-the-middle (MITM) attacks, particularly where an attacker may trick users into accessing a fake login page, it is essential to use a security measure that ensures the authenticity of the login process and prevents unauthorized parties from gaining access through compromised login credentials.
Let’s analyze each option:
A) Security Key
- Pros: A security key is a physical device (such as a USB or Bluetooth key) that provides strong multi-factor authentication (MFA). When a user logs in, the key must be physically present and used in combination with a password. This is a highly effective method against phishing and MITM attacks because the security key uses public-key cryptography and is resistant to attempts at fraudulent login (even if a user lands on a fake login page, the attacker cannot authenticate without the physical key).
- Cons: Requires users to have a physical device on hand, which can be slightly inconvenient, but this is a small price to pay for enhanced security.
- Key Factor: This option is ideal for protecting against MITM attacks, as the security key provides cryptographic proof of the user's identity that cannot be intercepted or replicated by a fake login page.
B) Google Prompt
- Pros: Google Prompt sends a push notification to the user's registered device asking to confirm a login attempt. It’s a quick and easy MFA method.
- Cons: While convenient, Google Prompt is vulnerable to certain phishing attacks where an attacker might trick a user into accepting a prompt that they did not initiate. This method is not as secure as using a physical device like a security key because an attacker could potentially compromise the user's device or trick the user into accepting the prompt.
- Key Factor: While Google Prompt provides a form of MFA, it is no...
Author: Amira · Last updated Aug 24, 2026
You control network traffic for a folder in your Google Cloud environment. Your folder includes multiple projects and Virtual Private Cloud (VPC) networks. You want to enforce on the folder level that egress connections are limited only to IP range 10.58.5.0/24 and onl...
To enforce egress traffic restrictions on a folder in Google Cloud, ensuring that egress connections are limited only to the IP range 10.58.5.0/24 and are allowed only from the `dev-vpc` network, while minimizing implementation and maintenance effort, we need to evaluate the options.
A) Deploy a network appliance in “new-vpc” to filter access requests and only allow egress connections from “dev-vpc” to 10.58.5.0/24.
- Pros: Deploying a network appliance can provide filtering capabilities and allow granular control over egress traffic.
- Cons: This option involves creating and managing an additional VPC and network appliance, which increases the complexity and maintenance effort. It also does not minimize effort and introduces extra overhead to manage the appliance.
- Key Factor: While this solution can technically enforce the requirement, it is not ideal because it adds unnecessary complexity and maintenance tasks. The goal is to minimize the effort.
B) Enable Cloud NAT for “dev-vpc” and restrict the target range in Cloud NAT to 10.58.5.0/24.
- Pros: Cloud NAT can be used to control egress traffic from a VPC network to the internet. It can provide secure egress for VMs without external IPs, and restricting the target IP range would ensure that traffic only reaches 10.58.5.0/24.
- Cons: Cloud NAT is generally used to enable outbound internet access from a private VPC network without needing external IP addresses. However, Cloud NAT is designed for internet egress and doesn’t allow fine-grained control over egress from specific VPC networks to other internal networks (like limiting it to just `dev-vpc`). This is not the best solution for enforcing the egress restriction within a specific internal IP range (10.58.5.0/24) from a particular VPC network.
- Key Factor: While Cloud NAT provides egress control, it does not fit the need for restricting egress traffic between VPC networks at the folder level, which is the primary goal here.
C) Attach external IP addresses to the VMs in scope. Define and apply a hierarchical firewall policy on folder level to deny all egress connections and to allow egress to IP range 10.58.5.0/24 from network dev-vpc.
- Pros: This option uses a hierarchical firewall p...
Author: Isabella · Last updated Aug 24, 2026
Your customer has an on-premises Public Key Infrastructure (PKI) with a certificate authority (CA). You need to issue certificates for many HTTP load balancer frontends. The on-premises PKI should be minimally af...
To determine the most suitable solution for issuing certificates for HTTP load balancer frontends in a manner that minimizes the impact on the existing on-premises Public Key Infrastructure (PKI) and scales effectively, let's evaluate the options:
A) Use Certificate Manager to issue Google-managed public certificates and configure it at HTTP load balancers in your infrastructure as code (IaC).
- Pros: Google-managed certificates are easy to integrate with Google Cloud services, and Certificate Manager handles the issuance and renewal of the certificates automatically. This solution is scalable and can easily be integrated with Infrastructure as Code (IaC) tools like Terraform.
- Cons: This solution does not involve your on-premises PKI and uses Google-managed certificates instead. If your customer needs to maintain control over certificate issuance using their on-premises PKI (which is a key requirement in the problem), this option will not fulfill that need.
- Key Factor: Although it's easy to set up, this option does not use the on-premises PKI, which goes against the need to minimize changes to the existing infrastructure.
B) Use a subordinate CA in the Google Certificate Authority Service from the on-premises PKI system to issue certificates for the load balancers.
- Pros: By using Google Certificate Authority Service with a subordinate CA model, you can integrate your on-premises PKI with Google Cloud. This allows your on-premises CA to issue certificates, keeping your infrastructure and PKI largely unaffected while leveraging Google Cloud's certificate management capabilities.
- Cons: Setting up a subordinate CA in the Google Certificate Authority Service requires careful configuration of the relationship between your on-premises PKI and Google’s CA system. While it can be done, it introduces complexity and may involve additional setup.
- Key Factor: This option keeps the on-premises PKI as the issuing authority, but requires setup of a subordinate CA in Google’s managed PKI service, which may be more complex than necessary for a straightforward deployment.
C) Use Certificate Manager to import certificates issued from on-premises PKI and for the frontends. Leverage the gcloud tool for importing.
- Pros: This option al...
Author: MysticJaguar44 · Last updated Aug 24, 2026
You are developing a new application that uses exclusively Compute Engine VMs. Once a day, this application will execute five different batch jobs. Each of the batch jobs requires a dedicated set of permissions on Google Cloud resources outside of your application. You need to...
To design a secure access concept for your batch jobs, it's crucial to follow the principle of least privilege. This ensures that each batch job only has access to the resources it truly needs to function, and nothing more. Here's a breakdown of each option with a focus on key factors like security, management complexity, and adherence to least privilege:
Option A: Service Account per Batch Job with Keys Stored in Secret Manager
1. Pros:
- Least Privilege: Each batch job gets a dedicated service account (`b-sa-[1-5]`), which only has the permissions it needs. This ensures each batch job has the minimum permissions required for execution.
- Separation of Concerns: By having individual service accounts for each job, you ensure that a compromise of one batch job doesn’t affect others.
2. Cons:
- Management Overhead: You need to manage multiple service accounts and their keys. This can become cumbersome, especially when generating, rotating, and securing keys.
- Key Management Risk: Storing service account keys in Secret Manager introduces an additional layer of complexity. If the keys are mishandled or not securely managed, it can lead to unauthorized access.
- Security Risk with Keys: Service account keys are long-lived and can be exposed or leaked, compromising the access they grant.
3. When to Use: This option could work if you need to specifically use service account keys and manage them in a highly secure and controlled manner. However, the key management overhead and risks make it less ideal in general cloud-native environments.
Option B: General Service Account to Execute All Jobs
1. Pros:
- Simplicity: Using a single general service account (`g-sa`) to handle all batch jobs simplifies management and reduces the overhead of managing multiple service accounts.
- Easy Setup: This approach is simple to configure as you only need to grant permissions to one service account and execute the jobs.
2. Cons:
- Security Risk: This violates the principle of least privilege. Granting a single service account (`g-sa`) broad permissions for all jobs can lead to excessive access. A compromise of this account would expose access to all resources that any batch job requires.
- Lack of Granularity: There's no distinction between the permissions needed for different batch jobs, which could potentially result in over-permissioned access.
3. When to Use: This option might be applicable in scenarios where the jobs require very similar or identical permissions and a simpler management structure is prioritized. However, it doesn’t provide the fine-grained access control recommended for security.
Option C: Workload Identity Pool with Providers for Each Batch Job
1. Pros:
- Security and Least Privilege: Workload identity pools provide a more secure and scalable solution, allowing you to use identity federation to assign permissions dynamic...
Author: FrostFalcon88 · Last updated Aug 24, 2026
Your Google Cloud environment has one organization node, one folder named 'Apps', and several projects within that folder. The organizational node enforces the constraints/iam.allowedPolicyMemberDomains organization policy, which allows members from the terramearth.com organization. The 'Apps' folder enforces the constraints/iam.allowedPolicyMemberDomains organization policy, which allows members from the flowlogistic.com organization. It also...
Let's analyze the scenario step by step to determine the result of the action:
Scenario Breakdown:
- Organization: One organizational node with a policy (`constraints/iam.allowedPolicyMemberDomains`) that allows members from the `terramearth.com` domain.
- Folder "Apps": This folder enforces the same policy (`constraints/iam.allowedPolicyMemberDomains`), but it allows members from the `flowlogistic.com` domain. The folder has the `inheritFromParent: false` property, which means this folder does not inherit policies from the parent (the organization node), and its own policy is applied independently.
Action:
You attempt to grant access to a project within the "Apps" folder to the user `testuser@terramearth.com`.
Key Policies:
1. Organization Policy: The organization enforces the `constraints/iam.allowedPolicyMemberDomains` policy that allows members from `terramearth.com`.
2. Folder Policy: The "Apps" folder enforces its own `constraints/iam.allowedPolicyMemberDomains` policy, which allows only members from `flowlogistic.com`, and the folder has `inheritFromParent: false`, so it does not inherit the policy from the organization.
Result:
- The "Apps" folder specifically restricts access to members from the `flowlogistic.com` domain.
- Since `inheritFromParent: false` is set on the folder, the organiz...
Author: Lina Zhang · Last updated Aug 24, 2026
An administrative application is running on a virtual machine (VM) in a managed group at port 5601 inside a Virtual Private Cloud (VPC) instance without access to the internet currently. You want to expose the web interface at port 5...
Let's analyze each option in the context of the requirements:
Requirements:
- You need to expose the web interface at port 5601.
- You want to enforce authentication and authorization using Google credentials.
- The application is in a VPC with no internet access.
Option A: Configure the bastion host with OS Login enabled and allow connection to port 5601 at VPC firewall. Log in to the bastion host from the Google Cloud console by using SSH-in-browser and then to the web application.
- Pros: Using a bastion host would allow access to the VM, and OS Login can simplify SSH access management.
- Cons: This does not expose the web interface directly to users. The access would be SSH-based and you would still have to manually navigate through the VM via SSH to access the web application. Additionally, this does not address authentication and authorization using Google credentials for web interface access.
- Conclusion: This option does not meet the requirements because it does not allow direct access to the web interface and doesn't provide a way to enforce Google credentials for access.
Option B: Modify the VPC routing with the default route pointing to the default internet gateway. Modify the VPC Firewall rule to allow access from the internet 0.0.0.0/0 to port 5601 on the application instance.
- Pros: This would expose the web application to the internet directly.
- Cons: This option lacks security because it opens port 5601 to the entire internet (`0.0.0.0/0`). It does not provide an authentication or authorization layer for Google credentials, leaving the application vulnerable to unauthorized access.
- Conclusion: While this exposes the web interface, it fails to meet the security requirements and does not provide Google credentials authentication, making it unsuitable for the use case.
Option C: Configure Secure Shell Access (SSH) bastion host in a public network, a...
Author: ThunderBear · Last updated Aug 24, 2026
Your company's users access data in a BigQuery table. You want to ensure they can only access the data...
Analysis of Options:
You need to ensure that users can only access data in a BigQuery table during working hours. This requires controlling access based on specific times of the day and potentially using an automated mechanism. Let's break down each option:
Option A: Assign a BigQuery Data Viewer role along with an IAM condition that limits the access to specified working hours.
- Pros:
- IAM conditions allow for time-based access control directly through Google Cloud IAM policies.
- This is a clean and automated solution that doesn’t require any custom scripting or external tools.
- The IAM condition will enforce the rule at the IAM level, ensuring users only have access to the BigQuery table during working hours.
- Least complexity: Since the condition is part of the IAM role assignment, there is no need for external processes to manage access.
- Cons:
- There are no significant cons to this solution, as it leverages Google Cloud's built-in IAM features effectively.
- Conclusion: This option directly solves the problem with minimal complexity, leveraging Google Cloud's native IAM capabilities. It’s highly efficient for time-based access control.
Option B: Run a gsutil script that assigns a BigQuery Data Viewer role, and removes it only during the specified working hours.
- Pros:
- This approach automates role assignment and removal via a script.
- It can technically be done using a script that runs at scheduled times.
- Cons:
- Manual management is required for the script to assign and remove the role. This introduces complexity in scripting and managing the script itself.
- The script needs to be continuously monitored and maintained, which can lead to errors or failure if not properly managed.
- Not as secure or efficient as leveraging IAM conditions, as the script might have issues like race conditions or incorrect access removals.
- Conclusion: While this method can work, it introduces unnecessary complexity compared to an IAM condition-based approach. It’s less secure and harder to manage in the long term.
Option C: Assign a BigQuery Data Viewer role to...
Author: Liam · Last updated Aug 24, 2026
You have placed several Compute Engine instances in a private subnet. You want to allow these instances to access Google Cloud services, like Clou...
Let's analyze each option in the context of the requirement: allowing Compute Engine instances in a private subnet to access Google Cloud services (like Cloud Storage) without traversing the internet.
Option A: Enable Private Google Access for the private subnet.
- Pros:
- Private Google Access allows instances in private subnets to access Google services (e.g., Cloud Storage, BigQuery, etc.) without needing public IP addresses or traversing the internet.
- Simple and secure: This option ensures that traffic to Google Cloud services stays within Google's private network.
- Best fit for the use case, as it allows access to Google services from instances without the need for internet access.
- Cons:
- Limited to Google services: This only covers access to Google Cloud services, not other internet destinations.
- Conclusion: This is the most suitable and efficient solution. By enabling Private Google Access, instances in the private subnet can access Google Cloud services directly without going through the internet.
Option B: Configure Private Service Connect for the private subnet's Virtual Private Cloud (VPC) and allocate an IP range for the Compute Engine instances.
- Pros:
- Private Service Connect provides a way to connect to Google services and third-party services privately, by mapping service endpoints to VPC resources.
- Cons:
- This is more complex and typically used for specific services like Private Service Connect for connecting to third-party services or creating private connections to Google-managed services.
- Overkill for accessing typical Google Cloud services like Cloud Storage, as Private Google Access (Option A) is a simpler solution for this use case.
- Conclusion: Private Service Connect is useful for more advanced use cases involving private connections to specific services, but Private Google Access (Option A) is a simpler and more appropriate solution for accessing Google Cloud services ...
Author: Sofia · Last updated Aug 24, 2026
Your organization relies heavily on Cloud Run for its containerized applications. You utilize Cloud Build for image creation, Artifact Registry for image storage, and Cloud Run for deployment. You must ensure that containers with vulnerabilities rated above a ...
Let's analyze each option based on the context and requirements of your organization, which is heavily reliant on Cloud Run for containerized applications, Cloud Build for image creation, Artifact Registry for storage, and Cloud Run for deployment.
A) Implement vulnerability scanning as part of the Cloud Build process. If any medium or higher vulnerabilities are detected, manually rebuild the image with updated components.
- Reasoning: Scanning for vulnerabilities during the Cloud Build process ensures that images are checked as they are built. However, this option still requires manual intervention to rebuild the image if vulnerabilities are found. This adds manual effort and doesn't automate the deployment prevention process.
- Rejection: The manual rebuild process introduces a delay and operational overhead. This isn't the most efficient or automated way to prevent vulnerable images from being deployed in production.
- Scenario: Could be useful if you want some control over remediation but isn’t scalable or optimal for enforcing policies in a production environment.
B) Perform manual vulnerability checks post-build, but before Cloud Run deployment. Implement a manual security-engineer-driven remediation process.
- Reasoning: This approach would involve scanning images after they are built, before they are deployed to Cloud Run. However, like Option A, it still requires manual effort and human intervention for remediation.
- Rejection: Manual vulnerability checks at this stage are prone to errors and delays, especially in a fast-paced development environment. This makes the approach unsuitable for continuous or automated deployment pipelines.
- Scenario: This could be viable for small-scale or non-production environments, but it's not ideal for production workloads where security automation is critical.
C) Configure Binary Authorization on Cloud Run to enforce image signatures. Create policies to allow deployment only for images passing a defined vulnerability threshold.
- Reasoni...
Author: Stella · Last updated Aug 24, 2026
You run a web application on top of Cloud Run that is exposed to the internet with an Application Load Balancer. You want to ensure that only privileged users from your organization can access the application. ...
Let's break down each option based on the requirement to ensure that only privileged users from your organization can access the web application, while supporting browser access with single sign-on (SSO).
A) Change Cloud Run configuration to require authentication. Assign the role of Cloud Run Invoker to the group of privileged users.
- Reasoning: Configuring Cloud Run to require authentication restricts access to authenticated users. By assigning the Cloud Run Invoker role to a privileged group, you ensure that only users with the appropriate role can invoke the Cloud Run service.
- Rejection: While this option restricts access to authenticated users, it does not provide SSO support, which is a key requirement in this scenario. Moreover, it doesn’t allow the control of access at the level of the Application Load Balancer.
- Scenario: This could be used if the goal is simple role-based access control, but it lacks browser-based SSO integration and central management.
B) Create a group of privileged users in Cloud Identity. Assign the role of Cloud Run User to the group directly on the Cloud Run service.
- Reasoning: Creating a group in Cloud Identity and assigning the Cloud Run User role ensures that only users in that group can interact with the Cloud Run service. However, the Cloud Run User role gives users access to the service, but this doesn't include SSO support or the enforcement of access at the Application Load Balancer level.
- Rejection: This approach does not integrate with the Application Load Balancer and does not support browser-based SSO. It’s also more focused on user permissions for accessing the Cloud Run service itself, which doesn't align with the goal of limiting access via an internet-facing load balancer.
- Scenario: This might be suitable for controlling access to the Cloud Run service itself, but it lacks full integration for internet-facing access with browser-based SSO.
C) Change the Ingress Control configuration of Cloud Run to internal and create firewall rules to allow only access from known ...
Author: IceDragon2023 · Last updated Aug 24, 2026
During a routine security review, your team discovered a suspicious login attempt to impersonate a highly privileged but regularly used service account by an unknown IP address. You need to effectively i...
Let's evaluate each option based on the need to investigate a suspicious login attempt targeting a highly privileged service account and respond effectively to a potential security incident.
A) Enable Cloud Audit Logs for the resources that the service account interacts with. Review the logs for further evidence of unauthorized activity.
- Reasoning: Enabling Cloud Audit Logs is a good practice for ensuring logs are available for review. However, if the logs for the resources the service account interacts with are not already enabled, this step may not be useful in investigating a suspicious login attempt that has already occurred. This action might also be more suitable for preventing future incidents rather than investigating a past event.
- Rejection: The key issue here is that you would be enabling logs after the fact, which won't help you investigate the suspicious login attempt that has already occurred. Logs should already be in place for effective incident investigation.
- Scenario: This would be useful for long-term monitoring and prevention, but it doesn’t address the immediate investigation needs for the suspicious login attempt.
B) Review Cloud Audit Logs for activity related to the service account. Focus on the time period of the suspicious login attempt.
- Reasoning: Cloud Audit Logs record actions taken by service accounts, including login attempts and any potentially malicious activity. Reviewing these logs for the time period of the suspicious login attempt will help pinpoint the specific events surrounding the unauthorized login, such as whether the service account was actually compromised, what actions it took, and where the login attempt originated.
- Selected Option: This is the most direct approach to investigating the suspicious login attempt. It focuses on reviewing existing logs related to the service account, which are crucial for understanding the nature of the incident and gathering evidence for a response.
- Scenario: This is the most appropriate choice for an immediate investigation into the suspicious activity tied to a service account. It directly addresses the security incident.
C) Run a vulnerability scan to identify potentially exploitable weaknesses in systems that u...
Author: Maya2022 · Last updated Aug 24, 2026
Your organization has an operational image classification model running on a managed AI service on Google Cloud. You are in a configuration review with stakeholders and must describe the ...
Let's evaluate the options based on the security responsibilities for an image classification model running on a managed AI service on Google Cloud. The goal is to provide a comprehensive understanding of security responsibilities while aligning with Google Cloud's shared responsibility model.
A) Explain that using platform-as-a-service (PaaS) transfers security concerns to Google. Describe the need for strict API usage limits to protect against unexpected usage and billing spikes.
- Reasoning: While Google Cloud manages infrastructure security (e.g., physical security, network security), it is not entirely responsible for all security aspects, particularly around the model's use, access control, or the data it processes. The API usage limits focus on protecting against unexpected usage and billing spikes, but it doesn't cover the broader security responsibilities of the organization, such as IAM, data handling, and monitoring for malicious activities.
- Rejection: This option oversimplifies the responsibilities, and focusing solely on API usage limits is inadequate for a comprehensive security review. It misses important elements like access control, secure data handling, and incident monitoring.
- Scenario: This approach could be useful for preventing accidental misuse or cost overruns but does not address core security responsibilities.
B) Explain the security aspects of the code that transforms user-uploaded images using Google's service. Define Cloud IAM for fine-grained access control within the development team.
- Reasoning: This option focuses on security around the code that processes user-uploaded images, which is an important part of application security. However, it misses a broader scope of security concerns, such as IAM roles, secure data transfer, and monitoring logs for potential threats. While controlling access to the development team via IAM is crucial, this does not fully cover the shared responsibility model or broader operational security needs, like incident detection and response.
- Rejection: Although IAM for access control is important, this option doesn't address the entirety of the security responsibilities, such as data security in transit and at rest, or the need for monitoring the environment for malicious activity.
- Scenario: This option is relevant when focusing on code security and access management within the development team, but it lacks coverage of broader security concerns.
C) Explain Google's shared responsibility model. Focus the configuration review on Identity and Access Management (IAM) permissions, secure data upload/download procedures, and monitoring logs for any potential malicious activity.
- Reasoning: This option correctly emphasizes the shared responsibility mode...
Author: VenomousSerpent42 · Last updated Aug 24, 2026
You are managing data in your organization's Cloud Storage buckets and are required to retain objects. To reduce storage costs, you must automatically downgrade the storage cl...
Let's evaluate each option based on the requirement to automatically downgrade the storage class of objects older than 365 days to Coldline storage in Google Cloud Storage.
A) Use Cloud Asset Inventory to generate a report of the configuration of all storage buckets. Examine the Lifecycle management policy settings and ensure that they are set correctly.
- Reasoning: Cloud Asset Inventory provides information about the configuration of cloud resources, but it doesn’t provide direct functionality for automatically changing storage classes based on object age. This approach might help you verify the existing lifecycle policies but does not fulfill the goal of automating storage class changes.
- Rejection: This option is focused more on reporting and auditing rather than on automation. It doesn't directly address the action of changing storage classes based on the object’s age.
- Scenario: This could be useful for auditing or ensuring lifecycle policies are correctly set, but not for automating the storage class downgrade.
B) Set up a CloudRun Job with Cloud Scheduler to execute a script that searches for and removes files older than 365 days from your Cloud Storage.
- Reasoning: This option involves creating a CloudRun Job that, when triggered by Cloud Scheduler, would run a script to search for and remove files older than 365 days. However, this solution doesn't align with the goal of downgrading objects to Coldline storage. The objective is to retain the objects and reduce costs, not to delete them.
- Rejection: Removing files is not the right solution since the requirement is to retain objects while downgrading them to Coldline storage to save costs.
- Scenario: This would be useful for deletion purposes but does not solve the issue of downgrading the storage class.
C) Enable the Autoclass feature to manage all aspects of bucket storage classes.
- Reasoning...
Author: Emma · Last updated Aug 24, 2026
Your organization has a centralized identity provider that is used to manage human and machine access. You want to leverage this existing identity management system to enable on-premises appl...
To leverage your existing centralized identity provider to enable on-premises applications to access Google Cloud without hardcoded credentials, you need a solution that integrates with your on-premises identity management system and allows secure, scalable access management. Let’s analyze each option:
Option A: Enable Secure Web Proxy
This option involves deploying a Secure Web Proxy with a proxy subnet in each region and configuring policies and rules to allow access to Google Cloud services. However, this approach is focused on controlling web traffic from clients and doesn't directly address the integration between on-premises identity providers and Google Cloud access management. It's more relevant for managing web access and would require significant configuration of network resources, which is unnecessary for simply leveraging identity management.
- Reason for rejection: Secure Web Proxy is more suited for controlling and securing HTTP(S) traffic rather than providing identity federation for applications. It doesn't align well with the need to integrate your identity provider with Google Cloud for access management.
Option B: Enable Workforce Identity Federation
Workforce Identity Federation allows you to integrate external identity providers (including on-premises identity providers) with Google Cloud. You would create a workforce identity pool, specify your on-premises identity provider, and map tokens from that provider to Google Cloud STS tokens. This would enable users to authenticate without the need for hardcoded credentials and align with your goal of using an existing identity management system.
- Reason for rejection: While this option is great for user authentication and access control for human users, it is not ideal for machine-to-machine communication or for application-level access where...
Author: John · Last updated Aug 24, 2026
Your organization is migrating a sensitive data processing workflow from on-premises infrastructure to Google Cloud. This workflow involves the collection, storage, and analysis of customer information that includes personally identifiable information (PII). You need to ...
In this scenario, the primary concern is securing sensitive data, particularly personally identifiable information (PII), during the migration of a data processing workflow from on-premises to Google Cloud. You need a solution that addresses both data protection and mitigating the risk of data exfiltration. Let's evaluate each option:
Option A: Encrypt all sensitive data in transit and at rest. Establish secure communication channels by using TLS and HTTPS protocols.
This is a fundamental security measure that should always be implemented, especially when dealing with sensitive data like PII. Encrypting data in transit and at rest ensures that any data transfer or storage is protected from unauthorized access. However, while encryption protects data from being read, it does not specifically mitigate the risk of data exfiltration or prevent unauthorized access to data by users or systems that are authorized but potentially malicious.
- Reason for rejection: While this is a critical security best practice, it does not comprehensively address the risk of data exfiltration (e.g., unauthorized access, misconfigured permissions, or improper access controls). Additional steps are needed to specifically mitigate exfiltration risks.
Option B: Implement a Cloud DLP solution to scan and identify sensitive information, and apply redaction or masking techniques to the PII. Integrate VPC SC with your network security controls to block potential data exfiltration attempts.
This option is highly relevant because it integrates two key security features:
1. Cloud DLP (Data Loss Prevention): Scanning and identifying sensitive information, such as PII, and applying redaction or masking can help prevent exposure of sensitive data.
2. VPC Service Controls (VPC SC): VPC SC helps prevent data exfiltration by defining security perimeters around Google Cloud resources, limiting data access, and blocking unauthorized data movement.
Combining these meas...
Author: Aarav · Last updated Aug 24, 2026
Your organization is building a chatbot that is powered by generative AI to deliver automated conversations with internal employees. You must ensure that no data with personally identif...
When building a chatbot powered by generative AI for internal conversations, the key goal is to ensure that no Personally Identifiable Information (PII) is communicated through the system. Let’s evaluate each option and how it relates to this requirement:
Option A: Encrypt data at rest for both input and output by using Cloud KMS, and apply least privilege access to the encryption keys.
Encrypting data at rest is an essential security practice to ensure data confidentiality and integrity. Cloud Key Management Service (Cloud KMS) is a great way to manage encryption keys and apply least privilege access. However, encryption alone does not prevent PII from being communicated through the chatbot. The encryption only protects the data when stored, but it does not stop the chatbot from generating or communicating PII during active conversations.
- Reason for rejection: While encryption is important for data security, it doesn’t address the core problem of preventing PII from being processed or communicated in the first place. Encryption protects data at rest, but not during the conversational process.
Option B: Discover and transform PII data in both input and output by using the Cloud Data Loss Prevention (Cloud DLP) API.
Cloud DLP is a powerful tool specifically designed to detect, classify, and redact sensitive information, including PII. This option would allow you to scan both the input data (what the chatbot receives) and the output data (what the chatbot generates) for any PII. If PII is detected, it can be transformed, redacted, or excluded from the conversation. This solution directly addresses the issue by ensuring that PII is not part of the conversation flow.
- Reason for selection: This option is the most relevant for the use case....
Author: Samuel · Last updated Aug 24, 2026
Your organization has applications that run in multiple clouds. The applications require access to a Google Cloud resource running in your project. You must use short-lived ac...
In a scenario where applications across multiple clouds need access to a Google Cloud resource, and security is a priority through the use of short-lived access credentials, the solution must support secure, scalable, and temporary access management. Let’s evaluate the provided options:
Option A: Create a managed workload identity. Bind an attested identity to the Compute Engine workload.
This option refers to binding a managed workload identity to a Compute Engine instance. Managed identities can be useful for accessing Google Cloud resources securely, but this approach typically applies to workloads within Google Cloud, specifically Compute Engine instances. While it provides secure access to resources in Google Cloud, it does not address the need for cross-cloud access, where the applications are hosted in external clouds and need to securely interact with Google Cloud resources.
- Reason for rejection: This solution is ideal for Google Cloud-based workloads but does not effectively address the cross-cloud access requirement and short-lived credential needs.
Option B: Create a service account key. Download the key to each application that requires access to the Google Cloud resource.
Service account keys are often used to grant access to Google Cloud resources, but they pose security risks. Hard-coding or distributing long-lived service account keys across different cloud environments can lead to credential leakage, especially if the keys are not rotated regularly. Additionally, service account keys do not inherently offer short-lived credentials; they are typically static, which violates the principle of least privilege in cloud security.
- Reason for rejection: This option introduces significant security risks due to the static nature of service account keys. It is not suitable for environments requiring short-lived credentials and secure access management across multiple clouds...
Author: Elizabeth · Last updated Aug 24, 2026
Your organization's financial modeling application is already deployed on Google Cloud. The application processes large amounts of sensitive customer financial data. Application code is old and poorly understood by your current software engineers. Recent threat modeling exercises have highlighted the potential risk of sophisticated side-channel attacks against the application while the application is running. You need to further harden the Google Cloud solution...
In this scenario, the focus is on mitigating the risk of sophisticated side-channel attacks against an application processing sensitive customer financial data in Google Cloud. The goal is to enhance the confidentiality of the data during processing, without introducing significant application problems or requiring significant code changes. Let’s evaluate each option:
Option A: Enforce stricter access controls for Compute Engine instances by using service accounts, least privilege IAM policies, and limit network access.
This option is about securing the environment around the application. Enforcing stricter access controls using service accounts and least privilege IAM policies ensures that only authorized entities can interact with the application. Additionally, limiting network access can prevent unauthorized external actors from targeting the application. However, while access control is important for securing the application environment, this does not specifically mitigate side-channel attacks, which are more about the potential vulnerabilities within the application’s execution and memory rather than access control to resources.
- Reason for rejection: While access control is important for general security, it does not directly address the threat posed by side-channel attacks, which exploit weaknesses in how the application processes data. This approach does not provide protection against the underlying risks of side-channel vulnerabilities.
Option B: Implement a runtime library designed to introduce noise and timing variations into the application's execution which will disrupt side-channel attacks.
This option proposes using a runtime library to introduce noise and timing variations to disrupt side-channel attacks. While this could be a theoretical solution to reducing the likelihood of certain types of side-channel attacks, it may be difficult to implement in practice, especially given that the application code is old and poorly understood. Additionally, introducing such noise might affect the performance and reliability of the application. It may also not provide sufficient protection for sophisticated attacks, as many side-channel attacks involve deep vulnerabilities in how memory and data are processed.
- Reason for rejection: This option might not be reliable enough and could introduce performa...
Author: StarlightBear · Last updated Aug 24, 2026
Your organization has two VPC Service Controls service perimeters, Perimeter-A and Perimeter-B, in Google Cloud. You want to allow data to be copied from a Cloud Storage bucket in Perimeter-A to another Cloud Storage bucket in Perimeter-B. You must minimize exf...
To address the situation where you need to allow data to be copied from a Cloud Storage bucket in Perimeter-A to another Cloud Storage bucket in Perimeter-B while minimizing exfiltration risk and following the principle of least privilege, let's analyze each option:
Option A: Configure a perimeter bridge between Perimeter-A and Perimeter-B, and specify the Cloud Storage buckets as the resources involved.
- Explanation: A perimeter bridge in VPC Service Controls allows resources in different service perimeters to communicate with each other, while still enforcing the protections of VPC Service Controls. If you set up a perimeter bridge between Perimeter-A and Perimeter-B and specify the Cloud Storage buckets as the resources involved, it allows data transfer between those buckets.
- Why Rejected: Although this allows communication between the two service perimeters, it introduces a broader communication channel that could lead to unwanted access between other resources in the two perimeters. The solution here is not as restrictive as necessary to minimize exfiltration risk. This option could potentially open the door for more access than necessary for just copying data between two Cloud Storage buckets.
Option B: Configure a perimeter bridge between the projects hosting the Cloud Storage buckets in Perimeter-A and Perimeter-B.
- Explanation: This approach is similar to Option A but at a project level, creating a perimeter bridge between the two projects involved. It would allow communication between resources (including Cloud Storage buckets) within the two projects.
- Why Rejected: This option also introduces more extensive communication across service perimeters than what is strictly necessary. The principle of least privilege dictates that you should minimize connections, and configuring a perimeter bridge at the project level would likely open unnecessary access between all resources in the two projects, which could increase the risk of unintended data access.
Option C: Configure an egress rule for the Cloud Storage bucket in Perimeter-A and a corresponding ingress rule in Perimeter-B.
- Explanation: Egress rules control what data can leave a service perimeter, and ingress rules control what data can e...
Author: Liam123 · Last updated Aug 24, 2026
You are running code in Google Kubernetes Engine (GKE) containers in Google Cloud that require access to objects stored in a Cloud Storage bucket. You need to securely grant the Pods...
To securely grant GKE Pods access to a Cloud Storage bucket, we need to select an approach that provides proper security, minimizes management overhead, and ensures ease of use. Let's analyze each option:
Option A: Create a service account. Grant bucket access to the Pods by using Workload Identity Federation for GKE.
- Explanation: Workload Identity Federation enables GKE Pods to use the identity of a Google Cloud service account without the need to manage long-lived service account keys. This allows Pods to access resources like Cloud Storage directly using the identity assigned by Workload Identity, ensuring that only the necessary permissions are granted, and access can be audited effectively.
- Why Selected: This option is the most secure and efficient because it integrates with Google Cloud's native IAM (Identity and Access Management) and provides a secure, scalable method for Pod authentication. By using Workload Identity Federation, no keys are involved, minimizing the risk of key exposure and reducing management overhead. It also follows the principle of least privilege by only granting the service account the permissions it requires.
Option B: Create a service account with keys. Store the keys in Secret Manager with a 30-day rotation schedule. Reference the keys in the Pods.
- Explanation: This option involves creating a service account, generating keys, and storing them securely in Secret Manager with a rotation schedule. The Pods would reference these keys to authenticate and access the Cloud Storage bucket.
- Why Rejected: While Secret Manager adds security by storing the keys in a managed service, this approach still requires key management, including regular rotation. Managing service account keys is error-prone and increases overhead, as keys must be rotated, stored, and referenced properly. Additionally, there's still a risk if the keys are compromised.
Option C: Create a service account with keys. Store the keys as a Kubernetes secret. Reference the keys in the Pods.
- Explanation: Similar to Option B, this optio...
Author: Ava · Last updated Aug 24, 2026
Your organization is adopting Google Cloud and wants to ensure sensitive resources are only accessible from devices within the internal on-premises corporate network. You must configure Access Context Manager to enforce this requirement. These considerations apply:
* The internal network uses IP ranges 10.100.0.0/16 and 192.168.0.0/16.
* Some employees work remotely but connect securely through a company-managed virtual private network (VPN). The VPN dynamic...
To ensure sensitive resources are only accessible from devices within the internal on-premises corporate network and the VPN, Access Context Manager should be used to enforce network-based access control. Let’s analyze the provided options in detail:
Option A: Create an access level named "Authorized Devices." Utilize the Device Policy attribute to require corporate-managed devices. Apply the access level to the Google Cloud project and instruct all employees to enroll their devices in the organization's management system.
- Explanation: This option focuses on enforcing device management policies, such as ensuring that only corporate-managed devices (e.g., laptops and mobile devices) can access the sensitive Google Cloud project.
- Why Rejected: While device management is important for securing access, this option does not address the specific need to restrict access based on the network location (e.g., IP ranges). It doesn't ensure that access is limited to internal network IP ranges or VPN IP ranges. Hence, it doesn’t meet the full requirements of the task, which also considers network access.
Option B: Create an access level titled "Internal Network Only." Add a condition with these attributes:
- IP Subnetworks: 10.100.0.0/16, 192.168.0.0/16
- Device Policy: Require OS as Windows or macOS.
Apply this access level to the sensitive Google Cloud project.
- Explanation: This option restricts access based on the internal corporate network's IP ranges and requires devices running Windows or macOS. However, it doesn't take into account the VPN IP range (172.16.0.0/20), which is an essential part of the requirement.
- Why Rejected: This option doesn’t include the VPN’s IP range (172.16.0.0/20), which is necessary to allow remote employees to access the sensitive resources securely. Also, restricting the OS to only Windows or macOS might be too restrictive if employees are using other platforms for legitimate work.
Option C: Create an access level titled "Corporate Access." Add a condition with the IP Subnetworks attribute, including the ranges: 10.100.0.0/16, 192.168.0.0/16, 172.16.0.0/20. Assign this access level to a service perimeter encompassing the sensitive project.
- Explanation: This option correctly includes all the necessary IP ranges: internal corporate networks (10.100.0.0/16, 192.168.0.0/16) ...
Author: Ahmed · Last updated Aug 24, 2026
Your team maintains 1PB of sensitive data within BigOuery that contains personally identifiable information (PII). You need to provide access to this dataset to another team within your organization for analysis purposes. You ...
When sharing sensitive data that contains personally identifiable information (PII) while ensuring that access is controlled and the PII is protected, it’s essential to consider both security and privacy best practices. Let’s analyze each option and determine the most suitable approach.
Option A: Utilize BigQuery's row-level access policies to mask PII columns based on the other team's user identities.
- Explanation: Row-level access controls in BigQuery can be used to grant specific users or groups access to different rows in a dataset based on their identity. However, it could also be used to mask certain columns containing PII for users from the other team.
- Why Selected: This option allows you to control access to sensitive data on a granular level. By applying row-level access policies, you can ensure that the other team only sees the data they need for analysis, with sensitive columns (such as PII) masked or hidden from them. This method protects PII while enabling the necessary access for analysis.
Option B: Export the BigQuery dataset to Cloud Storage. Create a VPC Service Control perimeter and allow only their team's project access to the bucket.
- Explanation: Exporting the BigQuery dataset to Cloud Storage and using VPC Service Control perimeters restricts access to the dataset by enforcing policies that control network boundaries. It ensures only specific projects (the other team's project) can access the exported dataset in Cloud Storage.
- Why Rejected: While VPC Service Controls are a great way to limit access to a resource, exporting sensitive data out of BigQuery to Cloud Storage introduces potential risks. Cloud Storage doesn't have the same level of fine-grained data protection (e.g., row-level access control) as BigQuery. This approach could expose PII in the exported dataset, which may be a violation of data protection requirements. Additionally, it requires more management and monitoring of the export process, which is not ideal when you want to maintain privacy within BigQuery itself.
Option C: Implement data pseudonymization techniques to replace the PII fields with non-identifiable values. Grant the other team access to the pseudonymized dataset.
- Explanation: Pseudonymization involves...
Author: Sophia · Last updated Aug 24, 2026
Your organization uses Google Cloud to process large amounts of location data for analysis and visualization. The location data is potentially sensitive. You must design a solution that allows storing and processing the location data securely, minimizing data exposure risks, a...
When processing potentially sensitive location data while ensuring compliance with regulatory guidelines and your organization's data residency policies, it's crucial to choose a solution that securely handles and restricts data access based on location. Let’s break down each option to understand their strengths and weaknesses.
Option A: Enable location restrictions on Compute Engine instances and virtual disk resources where the data is handled. Apply labels to tag geographic metadata for all stored data.
- Explanation: This option involves using location restrictions for Compute Engine instances and virtual disks. It also applies geographic metadata labels to the data.
- Why Rejected: While location restrictions on resources help in controlling where data is processed, this solution doesn’t address the actual storage or encryption of data, which are critical for sensitive location data. Tags on geographic metadata are useful for organizing data but don’t directly secure or enforce policies on where data can be stored or accessed. It doesn’t fully address regulatory or data residency compliance concerns.
Option B: Use the Cloud Data Loss Prevention (Cloud DLP) API to scan for sensitive location data before any storage or processing. Create Cloud Storage buckets with global availability for optimal performance, relying on Cloud DLP results to filter and control data access.
- Explanation: The Cloud DLP API scans data to identify sensitive information before it is stored or processed, and Cloud Storage buckets are configured for global availability. Cloud DLP results are used to control access to data.
- Why Rejected: While Cloud DLP is useful for identifying and classifying sensitive data, relying on global Cloud Storage buckets may not meet the regulatory and internal data residency policies that require data to remain within specific regions. Storing data globally may violate geographic data residency rules, and the global nature of the storage could increase data exposure risks, especially in sensitive location data contexts.
Option C: Create regional Cloud Storage buckets with Object Lifecycle Management policies that limit data lifetime. Enable fine-grained access controls by using IAM conditions. Encrypt data with customer-managed encryption keys (CMEK) generated within specific Cloud KMS key locations.
- Explanation: This option uses regional Cloud Storage buckets, which ensures that the data remains within a specific geographic location, aligning with data residency policies. Object Lifecycle Management ensures that data is stored for the required du...
Author: Maya · Last updated Aug 24, 2026
Your organization utilizes Cloud Run services within multiple projects underneath the non-production folder which requires primarily internal communication. Some services need external access to approved fully qualified domain names (FQDN) while other external traffic must be blocked. Internal applications must not be ex...
To achieve the desired granular control over traffic flow and ensure that only certain external FQDNs are accessible while internal applications remain private, let's evaluate each option based on the requirement for fine-grained control, internal/external access, and specific service configurations:
Option A: Implement a global-level allowlist rule for the necessary FQDNs within a hierarchical firewall policy. Apply this policy across all VPCs in the organization and configure Cloud NAT without any additional filtering.
- Rejected: This option applies a global-level rule to all VPCs, which would be too broad. It does not provide enough granular control to specify which VPCs should have access to specific external FQDNs, and it doesn't differentiate between internal and external traffic. Additionally, the lack of additional filtering means that non-approved traffic could still flow freely, violating the internal security requirements.
Option B: Create a folder-level deny-all rule for outbound traffic within a hierarchical firewall policy. Define FQDN allowlist rules in separate policies and associate them with the necessary VPCs. Configure Cloud NAT for these VPCs.
- Selected Option: This option provides the best balance of security and flexibility. By defining a folder-level deny-all rule, it ensures that all outbound traffic is blocked by default, preventing internal services from being exposed. The FQDN allowlist rules are then defined separately and associated with the required VPCs, giving granular control over which services can access external FQDNs. This ensures that only services within the designated VPCs can reach specific external domains while all other traffic is blocked. Additionally, configuring Cloud NAT allows for outbound communication to the approved FQDNs, while main...
Author: Manish · Last updated Aug 24, 2026
Your organization hosts a sensitive web application in Google Cloud. To protect the web application, you've set up a virtual private cloud (VPC) with dedicated subnets for the application's frontend and backend components. You must implement security controls t...
To protect a sensitive web application hosted on Google Cloud, the organization needs to ensure that incoming traffic is strictly controlled, web-based attacks are mitigated, and internal traffic is monitored for anomalies. Let's evaluate each option:
Option A: Configure Cloud Firewall to permit allow-listed traffic only, deploy Google Cloud Armor with predefined rules for blocking common web attacks, and deploy Cloud Intrusion Detection System (IDS) to detect internal traffic anomalies.
- Selected Option: This is the most comprehensive approach.
- Cloud Firewall: Configuring a firewall to permit only allow-listed traffic ensures strict access control, limiting the sources that can interact with the application.
- Google Cloud Armor: Deploying Cloud Armor with predefined rules helps protect the web application from common web-based attacks such as SQL injection, cross-site scripting (XSS), and DDoS attacks.
- Cloud IDS: The Intrusion Detection System (IDS) monitors for unusual internal traffic behavior, which helps identify potential threats within the VPC, offering an additional layer of security to detect and respond to suspicious activity.
- Why Selected: This option combines network-level security (Cloud Firewall) with web application protection (Cloud Armor) and internal traffic monitoring (Cloud IDS), making it the most comprehensive solution for securing a sensitive web application.
Option B: Configure Google Cloud Armor to allow incoming connections, configure DNS Security Extensions (DNSSEC) on Cloud DNS to secure against common web attacks, and deploy Cloud Intrusion Detection System (Cloud IDS) to detect internal traffic anomalies.
- Rejected:
- Google Cloud Armor: While Google Cloud Armor helps protect the web application from attacks, it is better used with predefined rules to block common web attacks, rather than just allowing incoming connections. Allowing incoming traffic without strict filtering might expose the application to unnecessary risks.
- DNSSEC: DNSSEC protects against DNS spoofing but does not directly address the protection of the web application from web-based attacks like SQL injection, XSS, or DDoS. It is not the primary control mechanism for securing the application traffic itself.
- Cloud IDS: While monitoring internal traffic with Cloud IDS is important, t...
Author: Ava · Last updated Aug 24, 2026
Your organization relies heavily on virtual machines (VMs) in Compute Engine. Due to team growth and resource demands, VM sprawl is becoming problematic. Maintaining consistent security hardening and timely package updates poses an increasing challenge. You need to centralize VM image ...
To address the issue of VM sprawl and ensure consistent security hardening and timely updates across your virtual machines, let's evaluate the options:
Option A: Use VM Manager to automatically distribute and apply patches to VMs across your projects. Integrate VM Manager with hardened, organization-standard VM images stored in a central repository.
- Selected Option: This is the most direct and efficient approach for automating the management of VM images and enforcing security baselines across the virtual machine lifecycle.
- VM Manager: VM Manager is designed to streamline VM management, making it easier to automate patching and maintenance tasks. It can help address VM sprawl by providing centralized control for managing the configuration and lifecycle of VMs.
- Integration with Hardened VM Images: By integrating with standardized, hardened VM images stored in a central repository, you ensure that all VMs are created from secure and compliant images, improving consistency and security across your environment.
- Why Selected: This option provides a unified solution for patch management and security hardening across multiple projects. It automates updates, integrates security best practices, and centralizes image management, directly addressing the challenge of maintaining consistent security and reducing VM sprawl.
Option B: Configure the Sole-Tecy feature in Compute Engine for all projects. Set up custom organization policies in Policy Controller to restrict the operating systems and image sources that teams are allowed to use.
- Rejected:
- Sole-Tecy Feature: The option likely refers to a hypothetical or incorrect term (perhaps intended to reference something else, like "sole tenancy"), which may not be relevant to the goal of VM image management.
- Policy Controller: While restricting the operating systems and image sources is useful for governance and compliance, this approach alone doesn't provide automation for managing patching or security updates across VM images, which is the core challenge here.
- Why Rejected: This option focuses on restricting usage but doesn’t address the full lifecycle management of VMs or automate patching. It’s better suited for policy enforcement but not for automation of image updates and security hardeni...
Author: Isabella · Last updated Aug 24, 2026
Customers complain about error messages when they access your organization's website. You suspect that the web application firewall rules configured in Cloud Armor are too strict. You want to collect request...
To address the issue of customers encountering error messages and to investigate which Cloud Armor rules are blocking traffic, it's important to enable detailed logging and examine the request logs. Let's evaluate each option to determine the best approach:
Option A: Modify the Application Load Balancer backend and increase the log sample rate to a higher number.
- Rejected:
- Log Sample Rate: Modifying the log sample rate impacts the volume of logs collected, but it doesn't directly help in investigating why Cloud Armor rules are blocking specific traffic. The issue at hand is related to understanding which rules are being triggered by specific requests, not just increasing the volume of logs.
- Why Rejected: This option does not provide sufficient visibility into the Cloud Armor rules that are triggering the blocks. It’s more about logging volume rather than resolving the specific issue with the firewall rules.
Option B: Enable logging in the Application Load Balancer backend and set the log level to VERBOSE in the Cloud Armor policy.
- Rejected:
- Verbose Logging: Setting the log level to VERBOSE in Cloud Armor will indeed provide detailed logs, including information about why specific requests are being blocked by security policies. However, enabling verbose logging directly in Cloud Armor is not a straightforward setting. Logging settings typically need to be configured via the Cloud Armor policy's logging features and might not specifically handle verbose-level requests as expected.
- Why Rejected: While this option suggests a good strategy for logging, the actual implementation within Cloud Armor doesn’t directly involve changing the log level to VERBOSE. Additionally, this option might not fully address capturing the request logs and relating them to specific rules.
Option C: Change the configuration of suspicious web application firewa...
Author: Rohan · Last updated Aug 24, 2026
Your organization must follow the Payment Card Industry Data Security Standard (PCI DSS). To prepare for an audit, you must detect deviations on an infrastructure-as...
To prepare for a Payment Card Industry Data Security Standard (PCI DSS) audit and detect deviations on an infrastructure-as-a-service (IaaS) level in your Google Cloud landing zone, you need a solution that can provide visibility and detect compliance gaps in relation to PCI DSS requirements. Let's evaluate each option:
Option A: Create a data profile covering all payment relevant data types. Configure Data Discovery and a risk analysis job in Google Cloud Sensitive Data Protection to analyze findings.
- Rejected:
- Data Discovery & Risk Analysis: This approach focuses on identifying sensitive data types related to payments. While it is crucial for compliance with PCI DSS, this option is more relevant to data-level protection and discovery rather than infrastructure-level compliance monitoring. PCI DSS compliance at the IaaS level requires a focus on the security and configurations of the infrastructure itself (e.g., access control, logging, network segmentation).
- Why Rejected: This solution is more suitable for discovering sensitive data, not for monitoring infrastructure configurations or detecting deviations in IaaS compliance.
Option B: Use the Google Cloud Compliance Reports Manager to download the latest version of the PCI DSS report. Analyze the report to detect deviations.
- Rejected:
- Compliance Reports Manager: While the Compliance Reports Manager provides reports about Google Cloud's own compliance with standards like PCI DSS, it does not provide tools for detecting or monitoring compliance at the infrastructure level within your specific organization’s cloud environment. This is more of a high-level report, not a tool for ongoing auditing or real-time compliance monitoring.
- Why Rejected: This option doesn't give you the ability to monitor infrastructure or automatically detect deviations. It's more useful for understanding Google's own compliance with PCI DSS, not for auditing your infrastructure or detecting issues at the IaaS level.
Option C: Create an Assured Workloads folder in your Google Cloud organization. Migrate existing projects into the folder and monitor ...
Author: Aditya · Last updated Aug 24, 2026
Your organization is migrating a complex application to Google Cloud. The application has multiple internal components that interact with each other across several Google Cloud projects. Security is a major concern, and you must design an authorization scheme fo...
When designing an authorization scheme for administrators in a Google Cloud migration, it is important to adhere to the principles of least privilege and separation of duties. Let's evaluate the options based on these principles and security best practices.
Option A: Identify the users who will migrate the application, revoke the default user roles and assign the users with purposely created custom roles.
- Reasoning: This option is aligned with the principle of least privilege. By identifying the users who will be responsible for migrating the application and assigning them custom roles, you can control the exact permissions each user or group has. This ensures users only have access to what they need, and no more, thus minimizing the risk of unauthorized access or accidental misconfigurations.
- Strengths: Custom roles allow for fine-grained access control, providing a clear separation of duties. Custom roles can be tailored specifically for migration tasks, ensuring users don’t have excessive permissions. This setup can be repeatedly refined and updated.
- Scenario: This approach works well in any scenario where specific migration tasks require different levels of access. It's ideal for large-scale or complex application migrations where security concerns are paramount, and the team members have distinct responsibilities.
Option B: Use multiple external identity providers (IdP) configured to use different SAML profiles and federate the IdPs for each application component.
- Reasoning: Federating multiple external identity providers may add a layer of security by integrating different authentication methods, but it introduces complexity. SAML profiles could be overkill for simply controlling permissions during an internal migration within a Google Cloud project. The focus here should be more on properly managing roles within Google Cloud.
- Weakness: This option might be useful in an enterprise environment where external identity systems are heavily involved, but it's not the most direct or efficient method for managing authorization within Google Cloud for a migration project. It could lead to unnecessary overhead and complexity in managing roles and users across different identity providers.
- Scenario: This is more sui...
Author: Rohan · Last updated Aug 24, 2026
Your organization operates in a highly regulated industry and needs to implement strict controls around temporary access to sensitive Google Cloud resources. You have been using Access Approval to manage this access, but your compliance team has mandated the use of a custom signing key. Additionally, they require that the key be stored in a hardware security module (H...
When managing temporary access to sensitive resources in a highly regulated industry, the compliance requirements are paramount. Let's evaluate the options based on the need to use a custom signing key stored in an external hardware security module (HSM) and meet the required compliance standards.
Option A: Create a new asymmetric signing key in Cloud Key Management System (Cloud KMS) using a supported algorithm and grant the Access Approval service account the IAM signerVerifier role on the key.
- Reasoning: Cloud KMS is a powerful tool for managing encryption keys within Google Cloud. However, this option doesn’t meet the requirement of storing the signing key in an external HSM, as Cloud KMS itself manages keys within Google Cloud infrastructure, not an external HSM.
- Weakness: While Cloud KMS provides robust key management, it fails to meet the compliance team's requirement to store the signing key outside Google Cloud in an external HSM.
- Scenario: This option is suitable for environments where using Google Cloud for key management is acceptable, but in this case, it doesn't fulfill the external HSM requirement.
Option B: Export your existing Access Approval signing key as a PEM file. Upload the file to your external HSM and reconfigure Access Approval to use the key from the HSM.
- Reasoning: Exporting the signing key to a PEM file and manually uploading it to an external HSM could work, but this approach isn't typically supported by Google Cloud services directly. Access Approval is integrated with Google Cloud's key management infrastructure, so it's unlikely to allow for such manual handling of the key in an external HSM.
- Weakness: This process could be error-prone, difficult to automate, and may not be fully supported by the system for integration. Additionally, reconfiguring Access Approval to use the key directly from an external HSM could pose compatibility or operational challenges.
- Scenario: This approach might work in some highly customized environments, but it doesn’t align well with standard Google Cloud practices or best practices for managing key integration.
...
Author: Lucas Carter · Last updated Aug 24, 2026
Your organization has sensitive data stored in BigQuery and Cloud Storage. You need to design a solution that provides granular and flexi...
When designing a solution to provide granular and flexible control over authorization to read sensitive data in BigQuery and Cloud Storage, the focus should be on controlling access based on user identity and role, rather than just securing the data through encryption or deidentification. Let’s evaluate the options accordingly.
Option A: Deidentify sensitive fields within the dataset by using data leakage protection within the Sensitive Data Protection services.
- Reasoning: Deidentifying sensitive data is an important step for protecting privacy, but it doesn’t address granular or flexible access control for authorization. This option focuses more on data obfuscation to prevent exposure rather than managing access based on user identity or roles.
- Weakness: Deidentification reduces the usability of data for authorized users because sensitive information is altered, and it doesn’t provide a method to control who can read the data or how granular that access can be.
- Scenario: This option is suitable when the goal is to protect data from unauthorized access by obfuscating sensitive information. It is not designed for fine-grained access control in environments where the data still needs to be accessible to authorized users.
Option B: Use Cloud External Key Manager (Cloud EKM) to encrypt the data in BigQuery and Cloud Storage.
- Reasoning: Cloud EKM allows you to manage encryption keys externally, offering more control over how your data is encrypted. While encryption is important for data security, it doesn’t inherently provide granular access control mechanisms. The management of keys does not by itself allow you to enforce detailed permissions about who can read the data.
- Weakness: Cloud EKM secures the data by ensuring that only authorized users or services can access the encryption keys, but it doesn’t offer detailed control over access to the data itself. It doesn’t solve the problem of managing who can read the data at a granular level.
- Scenario: This option is ideal for organizations that need control over the encryption keys, but it’s not the best solution for managing fine-grained access permi...
Author: Isabella1 · Last updated Aug 24, 2026
Your organization is using Security Command Center Premium as a central tool to detect and alert on security threats. You also want to alert on suspicious outbound traffic tha...
When designing a solution to detect and alert on suspicious outbound traffic that targets domains of known suspicious web services, we need to evaluate the available options based on how well they integrate with Google Cloud’s Security Command Center (SCC) Premium, focus on security threat detection, and monitor egress traffic efficiently.
Option A: Create a DNS Server Policy in Cloud DNS and turn on logs. Attach this policy to all Virtual Private Cloud networks with internet connectivity.
- Reasoning: Cloud DNS is used to manage DNS services within Google Cloud. While enabling DNS logging can help monitor domain resolution activities, it doesn't directly detect suspicious outbound traffic targeting specific domains. DNS logs can provide some insights, but it doesn't provide comprehensive detection for outbound traffic or correlate the data with other security threats.
- Weakness: This option is useful for tracking DNS queries, but it doesn’t actively alert on suspicious outbound traffic based on known threat intelligence or suspicious web domains. It’s not focused on detecting egress traffic or providing alerts related to security threats.
- Scenario: This could be useful for monitoring DNS-related activity but falls short for detecting suspicious outbound traffic as part of a broader security monitoring solution like Security Command Center.
Option B: Forward all logs to Chronicle Security Information and Event Management. Create an alert for suspicious egress traffic to the internet.
- Reasoning: Chronicle Security Information and Event Management (SIEM) can aggregate and analyze logs from various sources, enabling you to create alerts based on suspicious activity, such as egress traffic to known suspicious domains. By integrating this with Security Command Center, you can set up custom alerts for outbound traffic that matches patterns linked to threat intelligence, making this a strong solution.
- Strengths: This option leverages Chronicle’s advanced capabilities to detect and alert on egress traffic, integrate with Security Command Center, and use threat intelligence feeds to identify malicious domains. It’s a flexible and comprehensive solution for monitoring and responding to suspicious outbound traffic.
- Scenario: This is ideal for organizations that want centralized visibility into ...
Author: IceDragon2023 · Last updated Aug 24, 2026
You work for a healthcare provider that is expanding into the cloud to store and process sensitive patient data. You must ensure the chosen Google Cloud configuration meets these strict regulatory requirements:
* Data must reside within specific geographic regions.
* Certain administrative actions on patient ...
When considering the regulatory requirements for storing and processing sensitive patient data, the configuration needs to ensure data residency, proper approval workflows for administrative actions, and auditable access control. Let’s break down each option based on these requirements.
Option A: Select a standard Google Cloud region. Restrict access to patient data based on user location and job function by using Access Context Manager. Enable both Cloud Audit Logging and Access Transparency.
- Reasoning: This option provides some useful features, such as Access Context Manager for restricting access based on location and job function, as well as Cloud Audit Logging and Access Transparency for auditing and monitoring. However, it lacks specific provisions for handling sensitive operations that require explicit approval from compliance officers. It also doesn’t directly address the need for strict geographic region controls for storing the data.
- Weakness: While Access Context Manager and audit logs are helpful, this option does not fully address all regulatory needs, especially for ensuring that compliance officers explicitly approve sensitive operations before they occur.
- Scenario: This might work for controlling access based on user location and job function but is not as comprehensive for meeting the regulatory requirements related to geographic data residency and approval workflows for sensitive data operations.
Option B: Deploy an Assured Workloads environment in an approved region. Configure Access Approval for sensitive operations on patient data. Enable both Cloud Audit Logs and Access Transparency.
- Reasoning: This option directly addresses all of the regulatory requirements. Assured Workloads is designed for regulated industries and ensures that data resides within specific geographic regions. It also includes Access Approval, which mandates explicit approval for sensitive administrative actions. Additionally, Cloud Audit Logs and Access Transparency provide comprehensive logging and transparency for access to the data.
- Strengths: Assured Workloads ensures compliance with geographic residency requirements, while Access Approval provides a workflow for obtaining approval from compliance officers. Both Cloud Audit Logs and Access Transparency ensure that access to sensitive data is auditable and transparent. This option is fully aligned ...
Author: Olivia Johnson · Last updated Aug 24, 2026
You work for a multinational organization that has systems deployed across multiple cloud providers, including Google Cloud. Your organization maintains an extensive on-premises security information and event management (SIEM) system. New security compliance regulations require that relevant Google Cloud logs be integrated seamlessly with the existing SIEM to provide a unified view of security events. You need to implement a solution that exports Google Cloud logs to your on-premises SIEM by using...
To select the best solution for exporting Google Cloud logs to your on-premises SIEM in a fault-tolerant, secure, and auto-scaling manner, it's essential to evaluate each option based on key factors like fault tolerance, security, scalability, and ease of implementation.
Option A: Create a Pub/Sub topic for log aggregation. Write a custom Python script on a Cloud Function that leverages the Cloud Logging API to periodically pull logs from Google Cloud and forward them to the SIEM. Schedule the Cloud Function to run twice per day.
- Fault Tolerance: Limited. The solution relies on a custom Python script and scheduled execution, which may not scale efficiently or handle failures well. There’s also no clear mechanism to retry failed deliveries.
- Scalability: Poor. Scheduling the function to run twice a day might not provide near-real-time log delivery. It would not scale efficiently to handle large volumes of logs or changing traffic patterns.
- Security: Using the Cloud Logging API could be secure, but it requires handling authentication and authorization manually in the custom script.
- Drawbacks: The periodic nature of the function makes this approach unsuitable for a real-time, near-instantaneous logging solution. It lacks robust fault tolerance and scalability mechanisms.
Option B: Collect all logs into an organization-level aggregated log sink and send the logs to a Pub/Sub topic. Implement a primary Dataflow pipeline that consumes logs from this Pub/Sub topic and delivers the logs to the SIEM. Implement a secondary Dataflow pipeline that replays failed messages.
- Fault Tolerance: Excellent. Dataflow is designed for scalable, fault-tolerant data processing. The secondary pipeline can reprocess failed messages, ensuring that no logs are missed.
- Scalability: High. Both Pub/Sub and Dataflow are highly scalable, making this solution ideal for environments with large log volumes and varying traffic.
- Security: Pub/Sub provides secure delivery mechanisms, and Dataflow integrates with Google Cloud’s IAM and other security controls, ensuring that the data is delivered securely.
- Drawbacks: More complex setup compared to other options, requiring knowledge of Dataflow and Pub/Sub. However, it is still a robust and scalable solution, well-suited for real-time delivery and fault tolerance.
Option C: Deploy a Cloud Logging sink with a filter...
Author: Liam · Last updated Aug 24, 2026
You work for a global company. Due to compliance requirements, certain Compute Engine instances that reside within specific projects must be located exclusively in cloud regions within the European Union (EU). You need to ensure that existing non-compliant workloads are ...
To ensure that Compute Engine instances are only launched in regions within the European Union (EU) and to handle non-compliant workloads, we need a solution that is both scalable and automated. Let’s break down each option based on key factors such as compliance enforcement, automation, scalability, and security.
Option A: Use a third-party configuration management tool to monitor the location of Compute Engine instances. Automatically delete or migrate non-compliant instances, including existing deployments.
- Compliance Enforcement: Not ideal. A third-party tool adds complexity and requires manual integration into your Google Cloud environment, potentially complicating compliance management.
- Automation: Automation could be implemented but is dependent on the third-party tool's capabilities. It may not provide full integration with Google Cloud services, leading to potential delays or failures in remediating non-compliant instances.
- Scalability: The solution might scale, but third-party tools often require manual updates or configuration changes to stay aligned with Google Cloud’s evolving features, which could introduce additional management overhead.
- Security: Relying on an external tool introduces additional security risks, as the tool must have access to sensitive cloud infrastructure, requiring extra attention to access control.
- Drawbacks: While it can be used for instance monitoring, it does not integrate directly into Google Cloud’s native features for enforcing region constraints, which reduces its efficiency for this task.
Option B: Deploy a Security Command Center source to detect Compute Engine instances created outside the EU. Use a custom remediation function to automatically relocate the instances, run the function once a day.
- Compliance Enforcement: Security Command Center is good at detecting misconfigurations, but it is not designed to prevent the creation of non-compliant resources in real-time. Detecting instances outside the EU would work, but it would require a custom remediation function to address them.
- Automation: Running the remediation function once a day introduces a significant delay in addressing non-compliant instances. This approach is not ideal for real-time or near-instantaneous compliance enforcement.
- Scalability: While the Security Command Center can detect violations, relying on a daily function to fix non-compliant instances limits the scalability and speed of remediation.
- Security: Although this solution can be configured with proper security controls, the delays and reliance on custom functions reduce its ability to maintain strict compliance at scale.
- Drawbacks: This option only detects violations after they occur and does not prevent non-compliant instances from being created ...
Author: Daniel · Last updated Aug 24, 2026
You are working with developers to secure custom training jobs running on Vertex AI. For compliance reasons, all supported data types must be encrypted by key materials that reside in the Europe region and are controlled by your organiza...
To ensure compliance while training models in Vertex AI, we need to focus on data encryption and managing key materials in the correct region. The goal is to maintain encryption while preventing any disruption to the training process, particularly ensuring the encryption keys are managed in the Europe region as required by your organization's compliance needs.
Option A: Encrypt the code, training data, and metadata with Google default encryption. Use customer-managed encryption keys (CMEK) for the trained models exported to Cloud Storage buckets.
- Compliance: Google default encryption is a secure option but does not allow full control over the key management process, and it may not meet the compliance requirement to control encryption keys specifically in the Europe region.
- Impact on Training Operations: Using default encryption would not impact training operations, but it doesn't meet the key requirement for the entire workflow.
- Scalability: This approach scales but does not meet the specific compliance requirement for controlling the encryption keys for all data types during training.
- Security: Default encryption doesn’t provide the fine-grained control over key management that is needed for compliance, especially when the keys must be controlled by the organization and specifically stored in the Europe region.
- Drawbacks: Doesn't fully meet the requirement to manage keys for all data types (code, training data, and metadata) during the training process, only focusing on the trained model export.
Option B: Encrypt the code, training data, metadata, and exported trained models with customer-managed encryption keys (CMEK).
- Compliance: This option ensures that all aspects of the training process—code, training data, metadata, and models—are encrypted with keys that you manage (CMEK), which is essential for controlling the encryption keys in the Europe region for compliance.
- Impact on Training Operations: Using CMEK would require configuring the necessary infrastructure for key management, but it does not impact the actual training operation in Vertex AI. Google Cloud supports using CMEK in Vertex AI, so this will work seamlessly during training.
- Scalability: This approach scales well and allows full control over the encryption process for all elements of the workflow.
- Security: By managing the encryption keys, you ensure that they are stored in the Europe region and controlled by your organization, meeting the compliance and security requirements.
- Drawbacks: There are some administrative overheads in setting up and maintaining CMEK, but these are acceptable when compliance and security are prioritized.
Option C: Encrypt the code, training data,...
Author: Isabella · Last updated Aug 24, 2026
Your EU-based organization stores both Personally Identifiable Information (PII) and non-PII data in Cloud Storage buckets across multiple Google Cloud regions. EU data privacy laws require that the PII data must not be stored outside of the EU. To help meet this compliance ...
To meet the EU data privacy laws while detecting healthcare data in Cloud Storage buckets outside the EU, it's essential to focus on compliance, automation, and data classification capabilities.
Option A: Create a Sensitive Data Protection job. Specify the infoType of data to be detected and run the job across all Google Cloud Storage buckets.
- Compliance Enforcement: This approach focuses on detecting sensitive data (such as healthcare-related PII) by scanning the contents of Cloud Storage buckets. It's designed to help ensure compliance by identifying and protecting sensitive data.
- Automation: A Sensitive Data Protection job can be configured to run automatically and scan across all Cloud Storage buckets to identify PII data, including healthcare-related information.
- Scalability: This option is scalable, as it can scan multiple buckets across different regions, making it effective in detecting sensitive data in storage.
- Security: It allows for the detection and protection of healthcare data, ensuring it is handled correctly according to EU laws.
- Drawbacks: While this approach can detect sensitive data within the buckets, it does not directly address the regional location requirement (i.e., ensuring PII is stored only within the EU). It can be used in conjunction with other methods to address this need.
Option B: Create a log sink with a filter on resourceLocation.currentLocations. Trigger an alert if a log message appears with a non-EU country.
- Compliance Enforcement: This approach focuses on monitoring the location of resources (buckets) based on logs. It can help you detect when a bucket is located outside the EU, but it does not focus on detecting the specific content type (healthcare data) stored in the bucket.
- Automation: This can be automated to alert you when a non-EU location is detected, but it won’t help in detecting whether healthcare data is stored in the bucket, which is a key part of compliance.
- Scalability: The logging and filtering can scale across regions, but you would need to ensure all logs are accurately collected and filtered.
- Security: This approach is not focused on content security; it primarily deals with geographic location compliance.
- Drawbacks: While this option helps enforce the location compliance for storing PII data, it does not detect or identify the presence of healthcare-related data in non-EU regions.
Option C: Activate Security Command Center Premium. Use compliance monitoring to detect resources that do not follow the applicable healthcare regulation.
- Compliance Enforcement: S...
Author: FrostFalcon88 · Last updated Aug 24, 2026
Your organization is migrating business critical applications to Google Cloud across multiple projects. You only have the required IAM permission at the Google Cloud organization level. You want to grant project access to support engineers fro...
When granting access to support engineers from two partner organizations using their existing identity provider (IdP) credentials, it’s important to ensure seamless integration with Google Cloud while maintaining strong access control and security. Let's evaluate each option in terms of ease of use, scalability, and security.
Option A: Create two single sign-on (SSO) profiles for the internal and partner IdPs by using SSO for Cloud Identity.
- Compliance and Integration: SSO integration allows users from partner organizations to authenticate with their own IdPs (like Active Directory, Okta, etc.), while leveraging Google Cloud Identity for access control. This allows partners to maintain their existing IdP credentials.
- Automation and Scalability: SSO can scale efficiently for a large number of users, and once set up, it automates the authentication process.
- Security: This is a secure method because it keeps authentication with the partner organization’s IdP while granting access to resources in Google Cloud. It’s built with cloud security best practices in mind.
- Drawbacks: Setting up SSO can be more complex, requiring configuration on both the partner IdP and Cloud Identity side. However, it is the most flexible and scalable solution for managing access across multiple projects with external organizations.
- Best Use Case: Ideal for scenarios where external partners need access using their own IdP credentials without creating separate Google Cloud users for each individual.
Option B: Create users manually by using the Google Cloud console. Assign the users to groups.
- Compliance and Integration: This option would require manually creating and managing each user from the partner organizations in Google Cloud. It does not integrate with existing partner IdPs, so the users would need to maintain separate credentials within Google Cloud.
- Automation and Scalability: This approach is not scalable, especially as the number of users increases. Managing users manually would also be time-consuming and prone to errors.
- Security: This approach might introduce security risks since partner engineers would have separate Google Cloud credentials, and it does not leverage the security of their own IdP.
- Drawbacks: This option is inefficient and impractical for handling a large number of users from multiple organizations. It's not the best choice for integrating external IdP credentials....
Author: Manish · Last updated Aug 24, 2026
You are creating a secure network architecture. You must fully isolate development and production environments, and prevent any network traffic between the two environments. The network team requires that there is only on...
In this scenario, the goal is to isolate the development and production environments while ensuring there is only one central entry point for traffic from the on-premises environment into the cloud. Let's analyze each option to determine the best solution:
A) Create one Virtual Private Cloud (VPC) network per environment. Add the on-premises entry point to the production VPC. Peer the VPCs with each other and create firewall rules to prevent traffic.
- Analysis: This option involves creating separate VPCs for production and development, and peering them to ensure they can communicate. However, even though firewall rules can be created to prevent traffic between the VPCs, peering can still technically allow some unwanted interaction or misconfiguration leading to potential vulnerabilities.
- Why Rejected: The peering connection inherently creates a shared network route, making complete isolation harder to maintain. This setup also allows for a shared entry point into the production VPC, which does not fully meet the requirement of a single central entry point.
B) Create one shared Virtual Private Cloud (VPC) network and use it as the entry point to the cloud network. Create separate subnets per environment. Create firewall rules to prevent traffic.
- Analysis: This approach uses a shared VPC for both environments, with separate subnets for each. Firewall rules can be created to isolate the environments. While this setup provides a single entry point into the network, it violates the requirement for complete isolation of development and production environments. Since both environments exist in the same VPC, there is a risk of cross-environment communication that could compromise security.
- Why Rejected: Using a shared VPC may not fully isolate the environments at the network layer, which is crucial for a secure architecture. Firewall rules alone cannot always guarantee total isolation if network configurations are misapplied.
C) Create one Virtu...
Author: Jack · Last updated Aug 24, 2026
You work for a large organization that is using Cloud Identity as the identity provider (IdP) on Google Cloud. Your InfoSec team has mandated the enforcement of a strong password with a length between 12 and 16 characters for all users. After configuring this requirement, users are still able to access the Google C...
To address the issue of users still being able to access the Google Cloud console with passwords shorter than 12 characters despite configuring the requirement for a password length between 12 and 16 characters, let's evaluate each option carefully.
A) Review each user's password configuration and reset existing passwords.
- Analysis: This option suggests manually reviewing each user's password and resetting it. While this would ensure that users comply with the new password policy, it is not a scalable solution for a large organization. This approach doesn't directly address the root cause of why the policy isn't enforced for new logins or existing accounts, nor does it leverage Google Cloud's built-in enforcement mechanisms.
- Why Rejected: This is a reactive and inefficient approach for an organization with many users. It does not provide a way to enforce the policy going forward for all users automatically.
B) Review the organization password management setting and select Enforce password policy at the next sign-in.
- Analysis: This option allows enforcing the password policy to be applied the next time users sign in. This would ensure that users who are still using passwords that don't meet the policy will be prompted to update their password upon their next login. However, it doesn't immediately enforce the policy for existing passwords, and users could bypass it by simply not signing in again until they meet the password policy.
- Why Rejected: While this option will enforce the policy eventually, it requires user action (sign-in) to take effect. It is less proactive than the other options, which directly apply a policy enforcement mechanism.
C) Review each user's password configuration and select E...
Author: Daniel · Last updated Aug 24, 2026
Your organization is preparing to build business services in Google Cloud for the first time. You must determine where to apply appropriate controls or policies. You must also identify ...
To determine where to apply appropriate controls or policies and understand what aspects of your cloud deployment are managed by Google, it’s crucial to understand the shared responsibility model. Let’s analyze each option in detail.
A) Model your deployment on the Google Enterprise foundations blueprint. Follow the blueprint exactly and rely on the blueprint to maintain the posture necessary for your business.
- Analysis: The Google Enterprise foundations blueprint provides a good starting point for setting up cloud infrastructure but is more of a reference for structuring and securing your Google Cloud deployment. It offers guidance on how to structure your organization, set up projects, and manage security, but it does not directly address the shared responsibility model in detail.
- Why Rejected: This approach does not specifically highlight where Google’s responsibilities end and where yours begin. While useful for structuring a deployment, it is not as focused on clearly delineating the shared responsibilities.
B) Use the Risk Manager tool in the Risk Protection Program to generate a report on your cloud security posture. Obtain cyber insurance coverage.
- Analysis: While the Risk Manager tool in the Risk Protection Program can be useful for assessing security posture, it does not provide a clear mapping of responsibilities between you and Google. It also doesn't directly address the shared responsibility model or the specifics of Google Cloud services' management. Obtaining cyber insurance might be part of an overall risk strategy, but it’s not directly relevant to determining what Google manages in your deployment.
- Why Rejected: This option is more about post-deployment security management and insurance, not about defining roles and responsibilities between your organization and Google, which is crucial in the early stages of preparing your deployment.
C) Subscribe to the Google Cloud release notes to keep up on product updates and when new services are available. Evaluate new services for appropriate use...
Author: Stella · Last updated Aug 24, 2026
Your organization operates a hybrid cloud environment and has recently deployed a private Artifact Registry repository in Google Cloud. On-premises developers cannot resolve the Artifact Registry hostname and therefore cannot push or pull artifacts. You've verified the following:
* Connectivity to Google Cloud is established by Cloud VPN or Cloud Interconnect.
* No custom DNS configurations exist on-premises.
* There is no route to the intern...
In this case, you need to identify the root cause preventing on-premises developers from pushing or pulling artifacts from the private Artifact Registry in Google Cloud, while considering the environment setup described.
Key Observations:
- Connectivity to Google Cloud is established via Cloud VPN or Cloud Interconnect.
- No custom DNS configurations exist on-premises.
- No route to the internet from the on-premises network.
Let’s now analyze each option:
A) On-premises DNS servers lack the necessary records to resolve private Google API domains. Create DNS records for restricted.googleapis.com or private.googleapis.com pointing to Google's published IP ranges.
- Analysis: This option suggests that the DNS issue is caused by missing records on the on-premises DNS servers. However, this would typically apply to a setup where the on-premises network has direct internet access to resolve public domain names like `restricted.googleapis.com` or `private.googleapis.com`. Since there is no route to the internet from the on-premises network in this case, DNS resolution through public DNS servers (like Google's) or private Google APIs wouldn’t work if they rely on external access.
- Why Rejected: The issue is not about missing DNS records, but more likely about missing configurations to enable access to Google services via private connections. Custom DNS records would not solve the issue of internal traffic routing in a hybrid cloud setup with no internet access.
B) Developers must be granted the artifactregistry.writer IAM role. Grant the relevant developer group this role.
- Analysis: IAM roles are important for controlling access permissions to services, but the problem described is related to connectivity and DNS resolution rather than permissions. The developers may already have appropriate IAM roles, and the issue at hand is the inability to resolve the Artifact Registry hostname, not a lack of permission to push or pull artifacts.
- Why Rejected: While IAM roles are necessary for access control, they don’t address the core issue of network connectivity and DNS resolution, which is preventing the developers from interacting with the Artifact...
Author: Chloe · Last updated Aug 24, 2026
Your organization has an application hosted in Cloud Run. You must control access to the application by using Cloud Identity-Aware Proxy (IAP) with these requirements:
* Only users from the AppDev group may have ...
To meet the access control requirements for your Cloud Run application using Cloud Identity-Aware Proxy (IAP), we need to ensure that only users from the AppDev group can access the application and that access is restricted to users connecting from internal network IP addresses.
Let's analyze each option:
A) Deploy a VPN gateway and instruct the AppDev group to connect to the company network before accessing the application.
- Analysis: A VPN gateway could allow users to connect from the internal network, but this solution doesn’t directly integrate with Cloud Identity-Aware Proxy (IAP) for access control. Additionally, this approach would require manual action from users (connecting to the VPN), and it does not use IAP's built-in capabilities for enforcing access policies based on groups and IP ranges.
- Why Rejected: While VPN access could control network access, it doesn't leverage the benefits of Cloud IAP for access control based on groups or internal IP ranges, and it introduces an extra layer of complexity and potential user inconvenience.
B) Create an access level that includes conditions for internal IP address ranges and AppDev groups. Apply this access level to the application's IAP policy.
- Analysis: This option makes use of IAP's access level feature, where you can define access conditions such as allowing only users from the AppDev group and restricting access based on internal IP address ranges. This solution leverages IAP's native functionality for both user group-based access and network-level access control, providing a seamless and scalable way to manage access.
- Why Selected: This option is ideal because it directly addresses both requirements—restricting access based on user group and internal IP address range—using IAP's built-in policies. It offers a secure and efficient solution without requiring additional tools or configurations.
...
Author: Isabella · Last updated Aug 24, 2026
You just implemented a Secure Web Proxy instance on Google Cloud for your organization. You were able to reach the internet when you tested this configuration on your test instance. However, developers cannot access the allowed URLs on the Secure Web Proxy instan...
The issue you're facing is related to the developers' inability to access the allowed URLs on the Secure Web Proxy instance from their Linux instances on Google Cloud. Let's analyze each option in detail:
A) Configure a Cloud NAT gateway to enable internet access from the developer instance subnet.
- Reasoning: A Cloud NAT (Network Address Translation) gateway allows instances without external IP addresses to access the internet, by mapping internal IP addresses to a public IP address. While Cloud NAT is useful when you have instances that don't have external IPs but still need to access the internet, it doesn’t address the core issue here, which is the Secure Web Proxy configuration.
- Rejection: The developers are not having an issue with general internet access (since they could reach the proxy instance in your test), but rather they cannot access the specific allowed URLs through the Secure Web Proxy instance. This suggests the issue is related to the proxy configuration rather than general internet access.
B) Ensure that the developers have restarted their instance and HTTP service is enabled.
- Reasoning: While restarting the instance and ensuring the HTTP service is enabled might help in some troubleshooting scenarios, it is unlikely to resolve the core problem. The issue appears to be related to the proxy settings, not the status of the HTTP service on the developer instances.
- Rejection: This action doesn't directly address the issue of proxy configuration or network access through the Secure Web Proxy, so it’s not the most likely solution.
C) Ensure that the developer...
Author: IronLion88 · Last updated Aug 24, 2026
You have just created a new log bucket to replace the _Default log bucket. You want to route all log entries that are currently routed to the _Default log bucket to...
In this scenario, you want to efficiently route all log entries that are currently routed to the `_Default` log bucket to a new log bucket. Here's a breakdown of each option:
A) Create exclusion filters for the _Default sink to prevent it from receiving new logs. Create a user-defined sink, and select the new log bucket as the sink destination.
- Reasoning: Exclusion filters can be used to filter out logs from the default bucket, but this is not the most efficient method to redirect all logs. This approach would involve first stopping logs from going to the default log bucket and then creating a new sink to send logs to the new bucket.
- Rejection: This option introduces unnecessary complexity by requiring both the creation of exclusion filters and a separate user-defined sink. This is not the most direct or efficient approach.
B) Disable the _Default sink. Create a user-defined sink and select the new log bucket as the sink destination.
- Reasoning: Disabling the `_Default` sink would prevent logs from being routed to it. Creating a user-defined sink would then route logs to the new log bucket. While this may achieve the goal, it’s not ideal because it disrupts the default logging flow and introduces additional steps that could affect logging behavior temporarily.
- Rejection: Disabling the `_Default` sink can potentially interrupt logging behavior, and using a user-defined sink might be an unnecessary step for this simple task.
C) Create a user-defined sink with inclusion filters copied from the _Default sink. Select the new log bucket as ...
