Free practice · No sign-up required
15 questions with answer explanations. Choose an answer below to begin.
Which practice helps ensure that only authorized services can access sensitive data in Google Cloud?
Control and manage access to data and resources
0/15 answered · Bookmark questions to review later. Focus the practice area to use keys 1–9 and Enter.
Learn by doing
Use official documentation and hands-on labs to work through topics you missed.
Terraform modules and infrastructure blueprints for advanced exploration of Google Cloud design. This is supporting engineering material, not an exam course.
Try it: Read one small VPC or service-account module. Draw the resources and permission boundaries it creates, and explain a least-privilege change without deploying an entire landing zone.
Reading the code is free. Deployment requires suitable permissions and can create billable infrastructure.
Official certification paths with exam-specific guides and preparation links for cloud roles.
Try it: Open the guide for your chosen role. For each weak domain, write one service-selection decision you cannot yet explain and find its product documentation.
Public certification information is free; training, labs, and exam registration may be paid.
Prefer to read at your own pace? Work through each question below, then open its answer to check your reasoning. You can link directly to a question or print this reference.
Which practice helps ensure that only authorized services can access sensitive data in Google Cloud?
Using fine-grained IAM roles and conditions
Storing all secrets in source code repositories
Allowing broad network access for simplicity
Disabling audit logging to reduce noise
Correct answer
Using fine-grained IAM roles and conditions
Fine-grained IAM roles and conditions limit access based on context, reducing the risk of unauthorized data access. Avoiding broad permissions and storing secrets securely are also important.
What is the primary purpose of Security Command Center in Google Cloud?
To provide a unified view of security and data risks
To manage billing and cost optimization
To automate deployment of virtual machines
To monitor network latency globally
Correct answer
To provide a unified view of security and data risks
Security Command Center aggregates security findings and provides visibility into risks across Google Cloud assets. It helps organizations prioritize remediation efforts.
Which mechanism should you use to enforce mandatory encryption for data at rest in Cloud Storage?
Bucket-level IAM policies
Customer-supplied encryption keys
Organization policy constraints
VPC Service Controls
Correct answer
Organization policy constraints
Organization policy constraints can enforce required encryption settings across projects, ensuring compliance with security standards. Customer-supplied keys add control but are not enforcement mechanisms.
What is a recommended approach to manage service account keys securely?
Avoid creating keys when possible and use workload identity
Store keys in publicly accessible Cloud Storage buckets
Share keys across multiple services for convenience
Use keys with long lifetimes to reduce rotation frequency
Correct answer
Avoid creating keys when possible and use workload identity
Workload identity allows services to authenticate without managing keys, reducing exposure risks. Keys should be rotated regularly and stored securely.
Which Google Cloud feature helps you detect potentially compromised instances?
Security Command Center findings
Cloud Scheduler jobs
Cloud DNS records
Cloud Build triggers
Correct answer
Security Command Center findings
Security Command Center analyzes logs and configuration to identify indicators of compromise and vulnerabilities. It provides actionable findings for incident response.
What is the benefit of using VPC Service Controls?
To define security perimeter for Google Cloud services
To increase network bandwidth between regions
To automatically patch operating systems
To reduce identity verification steps
Correct answer
To define security perimeter for Google Cloud services
VPC Service Controls help mitigate data exfiltration risks by defining a security perimeter around sensitive resources. They work with access contexts and Cloud IAM.
Which practice aligns with the principle of least privilege?
Assigning roles based on job responsibilities
Granting owner access to all team members
Using shared accounts for routine tasks
Removing all access reviews
Correct answer
Assigning roles based on job responsibilities
Least privilege ensures users and services have only the permissions needed to perform their tasks. Regular access reviews help maintain this principle.
What should you do to prepare for a security incident in Google Cloud?
Create and test an incident response plan
Disable all logging to prevent data leaks
Rely solely on automated alerts
Avoid documenting response procedures
Correct answer
Create and test an incident response plan
A documented and tested incident response plan helps teams react quickly and consistently. Logging and evidence preservation are critical during investigations.
Which tool can help you assess the security posture of your Google Cloud environment?
Security Command Center
Cloud CDN
Cloud Scheduler
Cloud Run
Correct answer
Security Command Center
Security Command Center provides security and data risk insights, including vulnerability findings and misconfigurations. It supports continuous assessment and compliance needs.
Why is it important to regularly rotate encryption keys?
To limit the impact of a compromised key
To simplify key management processes
To avoid using IAM policies
To reduce the number of audit logs
Correct answer
To limit the impact of a compromised key
Key rotation reduces the risk associated with a potentially exposed key and aligns with cryptographic best practices. It should be part of a broader key management strategy.
Which access control model is commonly used in Google Cloud IAM?
Role-Based Access Control (RBAC)
Mandatory Access Control (MAC)
Physical access lists
Time-based access only
Correct answer
Mandatory Access Control (MAC)
Google Cloud IAM uses Role-Based Access Control, where predefined and custom roles define permissions for users and service accounts. This model simplifies permission management.
What is a recommended practice for securing API keys used in applications?
Restrict key usage with API restrictions and IP allowlists
Embed keys directly in client-side code
Use the same key for all applications
Print keys in application logs for debugging
Correct answer
Restrict key usage with API restrictions and IP allowlists
API keys should be restricted by usage constraints and source to minimize misuse. Avoid exposing keys in code or logs, and rotate them if exposure is suspected.
Which feature can help you enforce compliance policies across Google Cloud projects?
Organization policies
Cloud Storage lifecycle rules
Cloud Monitoring dashboards
Cloud Logging sinks
Correct answer
Organization policies
Organization policies allow you to set constraints and enforce compliance rules across projects, such as required encryption or restricted locations. They provide centralized governance.
What is a best practice for logging and monitoring security events?
Enable audit logs and integrate with a SIEM
Disable logs to improve performance
Store logs only on local disks
Ignore unusual activity if it is infrequent
Correct answer
Enable audit logs and integrate with a SIEM
Audit logs provide visibility into administrative and data access events. Integrating them with a SIEM enables proactive monitoring and correlation of security events.
Which method is most effective for preventing unauthorized external access to Google Cloud resources?
Using firewall rules to restrict ingress traffic
Relying solely on IAM roles for authentication
Disabling audit logs to reduce noise
Using default service account permissions
Correct answer
Using firewall rules to restrict ingress traffic
Firewall rules act as a network-level barrier to block unauthorized external access, complementing IAM which focuses on identity-based access.
Recall the answer before opening each card.
Use fine-grained IAM roles and conditions to limit access based on context. (Control and manage access to data and resources)
To provide a unified view of security and data risks across Google Cloud assets. (Understand security capabilities and tools)
Organization Policy constraints, such as requiring Customer-Managed Encryption Keys. (Implement data protection controls)
Avoid creating keys when possible; use workload identity to authenticate without managing keys. (Securely manage credentials and keys)
Security Command Center findings, which analyze logs and configurations for indicators of compromise. (Monitor and detect security threats)
They define a security perimeter around Google Cloud services to mitigate data exfiltration risks. (Protect perimeter and data boundaries)
Assigning roles based on job responsibilities, ensuring users have only needed permissions. (Apply identity and access management best practices)
Create and test an incident response plan to ensure consistent and quick reaction. (Prepare for and respond to security incidents)
Security Command Center provides vulnerability findings and misconfiguration insights. (Evaluate security posture using available tools)
To limit the impact of a compromised key and align with cryptographic best practices. (Manage cryptographic keys securely)
Role-Based Access Control (RBAC) with predefined and custom roles. (Understand IAM access control models)
Restrict key usage with API restrictions and IP allowlists, and avoid exposing keys in code. (Securely manage API keys and secrets)
Use Organization policies to set constraints like required encryption or restricted locations. (Implement governance and compliance controls)
Enable audit logs and integrate with a SIEM for proactive monitoring and correlation. (Monitor and audit security-related events)
Firewall rules restrict ingress traffic at the network level, blocking unauthorized external access. (Understand network security controls in Google Cloud)
IAM conditions restrict access based on attributes (e.g., time, IP). Organization policies enforce rules on resources (e.g., encryption). Both are used together. (Control and manage access to data and resources)
It eliminates the need for long-lived keys, reducing exposure risks and operational overhead. (Securely manage credentials and keys)
It analyzes logs, configuration, and threat intelligence to generate findings on vulnerabilities and suspicious activity. (Monitor and detect security threats)
They create a perimeter that prevents unauthorized data transfer between inside and outside contexts. (Protect perimeter and data boundaries)
They can enforce that only CMEK keys are used, and restrict which key locations are allowed. (Manage cryptographic keys securely)
Read the prompt, commit to an answer, then flip the card. Move through the deck at your own pace and repeat any topic that does not come back quickly.
Card 1 of 20
1 reviewed this session
Connect the concepts
Open a branch to connect a topic with its practice questions and explanations. Use the map to choose your next review topic.
This is an analysis of the practice bank, not a claim about the vendor's live exam blueprint. Use it to identify the knowledge, judgment, and recall patterns exercised here, then verify your coverage against the current official exam guide.
This section covers controlling access to resources using fine-grained roles, conditions, and the principle of least privilege. The practice bank emphasizes assigning roles based on job responsibilities and using IAM conditions to limit access contextually. Google Cloud IAM uses Role-Based Access Control (RBAC) with predefined and custom roles. Understanding how to avoid broad permissions and regularly review access is critical. The questions also highlight the importance of separating duties and ensuring only authorized services access sensitive data.
This section addresses enforcing encryption for data at rest and managing encryption keys. The practice bank shows that Organization Policy constraints can mandate encryption settings across projects. Key rotation limits the impact of compromised keys. Understanding when to use Customer-Managed Encryption Keys (CMEK) versus Customer-Supplied Encryption Keys (CSEK) is also relevant, though not directly tested. The focus is on using organizational policies to enforce compliance and adopting key rotation as a security best practice.
This section covers tools and practices for detecting threats and responding to incidents. Security Command Center is highlighted as the primary tool for unified security visibility, vulnerability findings, and misconfiguration alerts. The practice bank advises enabling audit logs and integrating with a SIEM for proactive monitoring. Preparing for incidents involves creating and testing a response plan, while detection relies on analyzing Security Command Center findings to identify compromised instances.
This section combines credential management, network security, and compliance enforcement. Best practices include avoiding service account key creation by using workload identity, restricting API keys with usage constraints, and using firewall rules to block unauthorized external access. VPC Service Controls define a security perimeter to mitigate data exfiltration. Organization policies enable centralized governance across projects, enforcing constraints like required encryption or restricted locations. These controls complement IAM.
Study workflow
Review how to assign fine-grained IAM roles and conditions. Practice creating custom roles with minimal permissions. Understand the difference between basic, predefined, and custom roles. Use IAM Conditions to restrict access based on attributes like time, resource type, or IP address. Regularly audit IAM policies using the Policy Analyzer.
Learn to set Organization Policy constraints for encryption at rest, such as requiring CMEK for Cloud Storage. Understand key rotation schedules and how to use Cloud KMS. Compare CMEK and CSEK use cases. Practice configuring encryption on buckets and disks, and verify enforcement with Policy Analyzer.
Enable Security Command Center at the organization level. Explore its dashboards for vulnerability and threat findings. Configure audit logs for all services and export to a SIEM (e.g., Splunk or Chronicle). Create custom alerts for high-severity findings. Practice simulating incident response by triggering a test finding.
Adopt workload identity federation for on-prem or multi-cloud workloads to avoid service account keys. For APIs, restrict keys by source IP and API services. Rotate keys periodically. Use Secret Manager for storing sensitive values. Never hardcode keys in code or logs. Scan repositories for leaked keys.
Design VPC Service Controls perimeters around projects containing sensitive data. Use access levels based on IP ranges or device attributes. Implement firewall rules to allow only necessary ingress. Apply organization policies for location restrictions and encryption. Test policies using the Policy Simulator before enforcement.
FAQ
Clear boundaries on what the bank covers, how to use it, and where official vendor information still matters.
Set the constraint `constraints/storage.requireCustomerManagedEncryptionKey` to true at the organization or folder level. This mandates that all new buckets use a CMEK. You can also use `constraints/gcp.restrictNonCmekServices` to prevent creating resources without CMEK.
Workload identity allows external workloads to authenticate to Google Cloud without managing long-lived keys. It reduces the risk of key exposure and theft. Service account keys, if created, must be rotated and stored securely, adding operational overhead and potential security holes.
VPC Service Controls define a security perimeter around Google Cloud services (like BigQuery or Cloud Storage) to prevent data exfiltration, even from authorized IAM principals. Firewall rules control network traffic at the instance level, blocking or allowing based on IP, protocol, and port. Both are complementary.
Security Command Center aggregates security findings from various sources, including vulnerability scans and misconfigurations. It provides a centralized dashboard to prioritize threats. During incident response, it offers evidence like finding details and affected assets, aiding in investigation and remediation.
Restrict API keys by setting application restrictions (e.g., allowed IPs, HTTP referrers) and API restrictions (which APIs the key can call). Avoid embedding keys in code; use Secret Manager or environment variables. Rotate keys regularly and revoke those that are exposed.
Browse another free bank or use the study strategy guide to turn your misses into spaced review.
