Google Professional Cloud Security Engineer Practice Questions with Explanations

Correct answer: B

The best practice for storing secrets outside of source code is to encrypt them with a Customer-Managed Encryption Key (CMEK) and store them in Cloud Storage. This approach keeps secrets out of the SCM system while providing encryption at rest and access control. Cloud Source Repositories doesn't solve the secret storage problem. The Data Loss Prevention API scans for secrets but doesn't manage their storage. Deploying SCM to a Compute Engine VM replicates the on-premises problem and doesn't address secure secret management.

Why the other options are wrong:

• A. Cloud Source Repositories is a version control system and doesn't provide secure secret storage; storing secrets in Cloud SQL alongside code doesn't solve the SCM problem.
• C. The Data Loss Prevention API detects secrets but doesn't provide a secure storage solution.
• D. Running SCM on Compute Engine with local SSDs doesn't provide encryption or centralized secret management and replicates the original problem.

Correct answer: A

Cloud Directory Sync synchronizes Active Directory groups to Google Cloud Identity, allowing teams to manage GCP IAM permissions based on AD group membership. This provides centralized management of both identity and access control. SAML 2.0 SSO handles authentication but not group-based permission management in the way required. The Cloud Identity and Access Management API and Admin SDK require programmatic integration and don't provide the automatic synchronization that Cloud Directory Sync offers for group-based management.

Why the other options are wrong:

• B. SAML 2.0 SSO enables single sign-on but doesn't centrally manage group-based IAM permissions from Active Directory.
• C. The IAM API requires manual integration and doesn't automatically sync AD groups for permission management.
• D. The Admin SDK also requires manual integration and doesn't provide automatic synchronization of AD groups.

Correct answer: A

Cloud Armor is Google Cloud's WAF and DDoS protection service that allows you to define security policies based on source IP ranges (CIDR blocks) and provides native SYN flood protection. It can restrict access to only traffic from known good CIDRs while providing the SYN flood DDoS protection the customer requires. VPC Firewall Rules operate at the network layer but don't provide DDoS protection; they would require complex rules and don't include SYN flood mitigation. Cloud Identity and Access Management controls who can access GCP resources, not application traffic. Cloud CDN is for content delivery, not access control or DDoS protection.

Why the other options are wrong:

• B. VPC Firewall Rules control network traffic but don't provide DDoS protection or native SYN flood protection.
• C. Cloud IAM manages user access to GCP resources, not incoming application traffic filtering.
• D. Cloud CDN is for content delivery optimization, not for DDoS protection or CIDR- based access control.

Correct answer: A

Cloud Identity-Aware Proxy adds a JWT (JSON Web Token) assertion to HTTP requests that the backend application can validate to ensure traffic originates from IAP. The ERP system should validate the JWT assertion in the X-Goog-IAP-JWT-Assertion header to confirm the request passed through IAP authentication. Identity headers and x-forwarded- for headers are not the standard IAP validation mechanism. While IAP can provide user identifier information, JWT validation is the primary security mechanism for ensuring traffic originated from IAP.

Why the other options are wrong:

• B. Identity headers are not the standard IAP validation method; JWT assertion validation is required.
• C. X-forwarded-for headers indicate proxy forwarding but don't provide authentication or proof that traffic passed through IAP.
• D. While user identifiers may be available, JWT assertion validation is the required security mechanism to verify IAP authorization.

Correct answer: A

When a malicious script execution causes crashes, you need to detect abnormal process behavior. A Process Health condition in Stackdriver Alerting directly monitors process execution counts and can trigger notifications when the number of script executions exceeds a threshold. This provides real-time alerts on the specific suspicious behavior. Option B uses CPU as a proxy metric which is too indirect and generic. Options C and D focus on logging and analysis rather than real-time alerting for immediate notification.

Why the other options are wrong:

• B. CPU usage at 80% is a generic threshold unrelated to the specific script execution attack pattern.
• C. Creating a user-defined metric and dashboard provides visibility but not automated alerting for immediate notification.
• D. BigQuery scheduled queries provide periodic analysis but lack real-time alerting for immediate response to the attack.

Correct answer: A

To obtain unified logs from all development projects under the NONPROD folder with minimal configuration, you should create a single log sink at the folder level with includeChildren enabled. This automatically captures logs from all projects within that folder without needing individual sink configurations per project. Cloud Pub/Sub is appropriate for real-time streaming to a SIEM system. A folder-level sink with includeChildren=True is the most efficient approach for unified log collection across multiple related projects.

Why the other options are wrong:

• B. Using billingAccounts/ABC-BILLING parent includes all projects under that billing account (including test and pre-production), which is broader than just the NONPROD folder's development projects.
• C. Exporting from each development project individually requires multiple sink configurations and lacks the unified approach offered by folder-level exports.
• D. Publicly shared Cloud Storage buckets violate security principles and requiring per- project configuration is operationally inefficient.

Correct answer: C

DNS Security Extensions (DNSSEC) cryptographically sign DNS records to prevent DNS hijacking and man-in-the-middle attacks where attackers redirect domain/IP traffic to malicious sites. DNSSEC ensures that DNS responses are authentic and have not been tampered with. VPC Flow Logs only monitor network traffic, Cloud Armor protects against DDoS and application attacks, and Cloud Identity-Aware Proxy controls access authentication-none address DNS hijacking.

Why the other options are wrong:

• A. VPC Flow Logs monitor network traffic flow but do not prevent DNS hijacking or domain redirection attacks.
• B. Cloud Armor protects against DDoS and web application attacks but does not address DNS hijacking or domain/IP redirection.
• D. Cloud Identity-Aware Proxy controls user authentication and access to applications but does not prevent DNS hijacking.

Correct answer: C

Google Cloud Web Security Scanner is the service specifically designed to identify OWASP Top 10 vulnerabilities and other web application security issues. It automatically scans App Engine applications and other web applications for vulnerabilities including XSS, CSRF, authentication flaws, and other common web application weaknesses. Cloud Armor handles DDoS protection, Audit Logs track access and changes but don't test for vulnerabilities, and Anomaly Detection identifies unusual patterns rather than security flaws.

Why the other options are wrong:

• A. Cloud Armor is designed for DDoS protection and bot management, not vulnerability scanning.
• B. Audit Logs track who accessed what resources but do not perform security vulnerability assessments.
• D. Anomaly Detection identifies unusual behavior patterns but does not scan for known OWASP vulnerabilities.

Correct answer: D

When a domain is already being used by G Suite, the best practice is to conduct a thorough discovery process with the existing Super Administrator to understand all current Google service usage before attempting any changes. This minimizes disruption to existing services and ensures coordination across the organization. The Systems Engineer should work with the existing G Suite administrators to plan the transition or determine if Cloud Identity can be integrated with the existing G Suite setup, rather than attempting domain contestation or creating entirely separate domains.

Why the other options are wrong:

• A. Domain Contestation is a complex and disruptive process that should only be considered after exhausting coordination options.
• B. Registering a new domain avoids the coordination challenge but creates separate identity silos and additional operational overhead.
• C. Adding the data science manager as a Super Administrator in the existing domain does not address the broader need to manage the entire organization's Cloud Identity.

Correct answer: A

Organization Administrator is the role required to manage permissions and audit all resources across the entire organizational hierarchy. This role grants full control over the organization, folders, projects, and all resources within them, as well as the ability to manage policies and permissions. It is the appropriate role for taking over management of an organization that was previously set up independently. Security Reviewer is read-only, Organization Role Administrator manages custom roles, and Organization Policy Administrator manages organization policies-none provide the full management control needed.

Why the other options are wrong:

• B. Security Reviewer provides read-only access for auditing purposes but does not allow managing permissions.
• C. Organization Role Administrator manages custom role definitions but does not manage resource permissions or organizational access.
• D. Organization Policy Administrator manages organization policies and constraints but does not manage resource-level permissions and full organizational control.

Correct answer: C

Using a service account with read-only access to the Cloud Storage bucket and retrieving credentials from the instance metadata is the principle of least privilege approach. The Compute Engine instance can retrieve temporary credentials from its metadata server without storing credentials in configuration files, and the service account has minimal permissions. This avoids hardcoding secrets, allows credential rotation, and the service account is scoped to only read access. Option A uses IP-based ACLs which are unreliable for cloud resources. Option B stores credentials in application config which is a security risk. Option D adds unnecessary encryption complexity.

Why the other options are wrong:

• A. IP-based ACLs are unreliable in cloud environments where IPs can change, and allowing global readability violates the stated requirement.
• B. Storing service account credentials in application configuration files is a security anti- pattern that risks credential exposure.
• D. Cloud KMS encryption protects data at rest but does not address the authentication and credential management requirement of least privilege access.

Correct answer: B

Mandating infrastructure as code with static analysis in CI/CD pipelines enables developers to deploy applications safely without blocking on manual review processes. Policy enforcement happens automatically during the build pipeline, catching network, firewall, and security misconfigurations before they reach production. This shifts compliance left and accelerates deployment while maintaining security standards. Forseti is post-deployment detection, custom routers add operational complexity, and allowing unbounded dev environments defeats the purpose of governance.

Why the other options are wrong:

• A. Forseti detects issues in production after deployment rather than preventing them proactively in the pipeline.
• C. Customer-managed routers for all traffic inspection adds significant operational overhead without automating policy compliance.
• D. Allowing free rein in GCP dev environments defeats security governance and creates a false divide between dev and production security practices.

Correct answer: C

CryptoHashConfig uses cryptographic hashing to transform sensitive data into deterministic tokens. This approach allows tracking compensation changes and identifying outliers by comparing hashed values across time periods without exposing actual compensation amounts. The deterministic nature of hashing ensures the same compensation value always produces the same hash, enabling reversibility to identify which employees are outliers. Generalization and redaction destroy data utility for trend analysis. CryptoReplaceFfxFpeConfig performs format-preserving encryption but doesn't provide the same reversible identification capability as hashing.

Why the other options are wrong:

• A. Generalization reduces precision too much for identifying specific outliers in compensation data.
• B. Redaction permanently removes data, making it impossible to identify which specific employees are outliers.
• D. CryptoReplaceFfxFpeConfig encrypts but doesn't provide the deterministic reversibility needed to consistently identify the same outlier across multiple comparisons.

Correct answer: A

Google Cloud Identity's password guidelines recommend a minimum of 8 characters as the standard requirement for corporate passwords. This aligns with Google-recommended practices for Cloud Identity account security while being practical for enterprise deployment. The 8-character minimum provides adequate security without being overly restrictive.

Why the other options are wrong:

• B. 10 characters exceeds Google Cloud Identity's standard password minimum length recommendation.
• C. 12 characters exceeds Google Cloud Identity's standard password minimum length recommendation.
• D. 6 characters is below Google Cloud Identity's recommended minimum length for corporate password security.

Correct answer: A

Google-recommended envelope encryption practices require generating the Data Encryption Key (DEK) locally to encrypt application data, then wrapping that DEK with a Key Encryption Key (KEK) created in Cloud KMS. Both the encrypted data and the encrypted DEK are stored together, allowing the application to request decryption of the DEK from Cloud KMS when needed. This separation of concerns protects the actual encryption keys while maintaining cryptographic security.

Why the other options are wrong:

• B. Storing the unencrypted KEK defeats the purpose of envelope encryption by leaving the key encryption key exposed.
• C. Generating the DEK in Cloud KMS contradicts the application-layer encryption pattern, and having a locally-managed KEK eliminates the security benefits of Cloud KMS.
• D. Generating the DEK in Cloud KMS is not the recommended pattern for application- layer encryption, and storing an unencrypted KEK locally is insecure.

Correct answer: C

Organizational Log Sinks provide centralized log routing at the organization level. By exporting logs to a Cloud Pub/Sub Topic, organizations can reliably deliver logs to on- premises SIEM systems through Dataflow, which acts as a reliable bridge. This approach handles log buffering, retry logic, and delivery guarantees that are essential for enterprise SIEM integration without requiring individual project configuration.

Why the other options are wrong:

• A. Direct syslog delivery lacks the reliability, buffering, and scalability guarantees needed for production SIEM integration.
• B. Exporting all logs to BigQuery and having the SIEM query in real time creates latency and puts query load on the SIEM system.
• D. Real-time RESTful API queries from the SIEM create excessive load on GCP APIs and lack the buffering and reliability guarantees of a message-based approach.

Correct answer: C

Cloud Identity-Aware Proxy (IAP) provides application-level access control that authenticates users and enforces authorization based on Google identities. By enabling IAP and restricting access to a Google Group containing customer and employee accounts, the company can control access to in-progress sites from any location without requiring network-level restrictions or VPN connections. This solution integrates seamlessly with Cloud Identity and App Engine.

Why the other options are wrong:

• A. .htaccess files are web server configuration files that don't work with App Engine's application runtime and provide no actual authentication mechanism.
• B. App Engine firewall rules operate at the network level and cannot authenticate individual users or validate user accounts; they only filter by IP address.
• D. Cloud VPN restricts access to specific networks but doesn't provide user-level authentication and isn't necessary for controlling access from "any location" as required.

Correct answer: C

The Cloud DLP API's image inspection and redaction actions are specifically designed to detect and redact PII within images before storage. This approach maintains data utility for customer service trend analysis while removing sensitive information from the pictures of documents that customers share. The DLP API automatically identifies PII patterns in images and redacts them, solving the compliance concern without destroying the data's analytical value.

Why the other options are wrong:

• A. Cloud KMS encryption protects data but doesn't remove PII from the images, leaving the sensitive information accessible to anyone with decryption keys.
• B. Deleting chat records entirely eliminates the data needed for customer service trend analysis, defeating the business purpose.
• D. Generalization and bucketing work with structured text data, not images, and are not designed for redacting PII from document pictures.

Correct answer: C

Google-recommended practices for rotating user-managed Service Account keys require creating a new key and updating the application to use it before deleting the old key. This ensures zero-downtime rotation and allows time to verify the new key works correctly. The old key should be deleted only after confirming the new key is functioning properly in the application, not retained as a backup.

Why the other options are wrong:

• A. The gcloud command shown is not a valid Cloud IAM command for key rotation.
• B. The gcloud command shown does not exist and is not the correct way to rotate Service Account keys.
• D. Storing the old key as a backup increases the attack surface and violates the principle of minimizing active credentials in production systems.

Correct answer: A

Shared VPC Network with a host project and service projects is the correct architecture for centralizing control of networking resources while allowing multiple teams to use shared infrastructure. The host project contains the VPC network, subnets, firewall rules, and VPN gateway, while service projects attach to this shared network. This allows the network security team to control all networking resources from the host project while engineering teams manage their own compute resources in service projects.

Why the other options are wrong:

• B. Granting Compute Admin role to the networking team doesn't centralize network control across projects or provide the required VPN connectivity architecture.
• C. VPC peering doesn't provide centralized control and creates complex hub-and-spoke routing; it's not the recommended approach for this scenario.
• D. Cloud VPN Gateways in a hub-and-spoke model don't provide the centralized control of firewall rules and subnets that Shared VPC offers.

Correct answer: C

For SaaS products like G Suite, network security is Google's responsibility, not the customer's. The shared responsibility model for SaaS means Google handles infrastructure security including network controls. The organization cannot implement network-level firewall rules or VPC controls for G Suite because it operates outside their infrastructure. Instead, they should rely on G Suite's built-in security controls and compliance certifications to meet regulatory requirements.

Why the other options are wrong:

• A. Firewall rules apply to GCP infrastructure, not to G Suite SaaS services accessed over the internet.
• B. Cloud Armor protects GCP resources from DDoS and application-layer attacks; it cannot control G Suite network security.
• D. VPC networks control traffic within GCP infrastructure and cannot be applied to manage G Suite security, which is a Google-hosted service.

Correct answer: A

Creating an organization node with folders for each business unit provides the hierarchical structure needed for visibility, organization, and separate IAM permissions. This approach allows the company to view all projects across the organization while maintaining business unit separation through folders. IAM permissions can be set at the folder level to ensure each business unit has independent access controls and isolation.

Why the other options are wrong:

• B. Using gmail.com accounts and standalone projects lacks the organizational structure and centralized visibility required, and is not a best practice for enterprise deployments.
• C. Labels identify resources but don't provide organizational hierarchy or separate IAM permission boundaries like folders do.
• D. VPC networks control network traffic; they don't organize projects or provide the hierarchical visibility and separate IAM control needed for this scenario.

Correct answer: A

TCP Proxy Load Balancing is a global load balancing service that can route traffic based on geographic location to the nearest backend in different regions. It supports TCP traffic on port 995 (IMAPS) and provides automatic routing to the nearest healthy mail server across regions, which is exactly what's needed for location-based routing of mail servers.

Why the other options are wrong:

• B. Network Load Balancer is regional, not global, so it cannot route traffic across multiple regions based on client location.
• C. HTTP(S) load balancer is designed for HTTP/HTTPS traffic, not mail protocols like IMAPS on port 995.
• D. Cloud CDN is optimized for caching and serving content; it's not designed for routing mail server traffic based on location in the way required here.

Correct answer: B

The Compute Network User Role must be granted at the subnet level to allow Engineering Group A to attach instances to only the specific 10.1.1.0/24 subnet. This provides the least privilege necessary-the group can use only that subnet and cannot access other subnets in the Shared VPC. Granting this role at the host project level would allow access to all subnets, which exceeds the stated requirement.

Why the other options are wrong:

• A. Granting the role at the host project level would allow access to all subnets and resources, not just the specific 10.1.1.0/24 subnet.
• C. Compute Shared VPC Admin role is for administering the Shared VPC itself, which is too permissive for engineering groups that only need to attach instances.
• D. Shared VPC Admin roles granted at the service project level don't provide the necessary permissions to attach to specific subnets in the host project.

Correct answer: B

Forseti Security is designed to automate inventory snapshots and provide historical records of cloud resources and their configurations over time. It captures the state of infrastructure at different points and can track changes, making it the best solution for maintaining a complete historical record of what was running across thousands of instances in multiple projects.

Why the other options are wrong:

• A. Resource Manager provides organizational hierarchy and project management but doesn't maintain historical snapshots of resource state.
• C. Stackdriver (now Cloud Monitoring) creates dashboards for current metrics and logs but isn't designed for long-term historical inventory tracking.
• D. Security Command Center shows current asset inventory and security findings but doesn't provide the historical point-in-time snapshots needed for this requirement.

Correct answer: B

Cloud Storage with scheduled gsutil tasks is the most scalable and cost-efficient solution for migrating backup and disaster recovery data from on-premises to GCP. Cloud Storage is designed for data archival, is highly scalable, offers multiple storage classes for cost optimization, and can be easily automated with scheduled jobs. This approach supports the organization's need for a temporary backup destination while keeping production on- premises.

Why the other options are wrong:

• A. BigQuery is optimized for analytical queries, not for backup storage or disaster recovery solutions.
• C. Compute Engine with Persistent Disk is expensive and unnecessary for a backup/DR solution that doesn't require compute capacity.
• D. Cloud Datastore is a NoSQL database; it's not designed for large-scale backup and disaster recovery data storage.

Correct answer: D

Creating a service account with G Suite domain-wide delegation allows the application to impersonate users and access their Google Drive on their behalf without relying on user credentials. This follows Google-recommended security practices by using service accounts with appropriate delegation scopes, avoiding credential sharing, and maintaining proper separation of concerns. The application authenticates as the service account and then impersonates individual users for their specific data access.

Why the other options are wrong:

• A. Giving individual users the Service Account User role directly doesn't follow the principle of least privilege and isn't the recommended approach.
• B. Using a Google Group to manage Service Account User roles is better than option A but still doesn't implement the recommended domain-wide delegation pattern for user impersonation.
• C. Using a G Suite Admin account with application credentials violates security best practices by sharing administrative credentials and doesn't properly separate user access.

Correct answer: B

Customer-managed encryption keys (CMEK) using Cloud KMS is the correct solution because it allows customers to control the complete lifecycle of encryption keys while still benefiting from Google Cloud's managed infrastructure. This meets the requirement for key lifecycle control in a Managed Instance Group environment. CSEK requires managing keys outside of Google's systems and is less suitable for managed infrastructure, encryption by default provides no key control, and pre-encryption is inefficient for cloud- based workloads.

Why the other options are wrong:

• A. CSEK requires managing keys externally and is cumbersome for managed instance groups requiring scaling.
• C. Encryption by default does not provide customer control over the key lifecycle.
• D. Pre-encrypting files before transfer is operationally inefficient and doesn't leverage cloud-native encryption.

Correct answer: B

The Cloud Key Management Service should be used to manage the key encryption key (KEK), which is the master key that encrypts the data encryption keys. This provides the ability to create, rotate, and destroy symmetric encryption keys stored in the cloud, which is exactly what the requirement specifies. Cloud KMS manages KEKs that protect DEKs, providing proper key hierarchy and lifecycle management.

Why the other options are wrong:

• A. Managing the DEK directly with Cloud KMS is less secure than the proper key hierarchy of using KMS for the KEK.
• C. Customer-supplied encryption keys require manual key management outside of cloud systems.
• D. CSEK for KEK management is not recommended as it bypasses Cloud KMS benefits and requires external key storage.

Correct answer: C

Moving the cardholder data environment into a separate GCP project reduces the scope of systems subject to PCI audit standards by isolating sensitive payment processing systems from other workloads. This architectural separation ensures that only the dedicated project requires PCI compliance certification, leaving web applications and data processing systems outside the audit scope. The other options do not reduce the compliance scope because they don't separate the cardholder data from the broader environment.

Why the other options are wrong:

• A. Multi-factor authentication improves security but does not reduce the scope of systems subject to PCI audit.
• B. Using PA-DSS certified applications improves compliance but does not reduce the scope of audit requirements.
• D. VPN connections improve security but do not reduce the scope of systems subject to PCI audit standards.

Correct answer: B

The Cloud Data Loss Prevention API is specifically designed to detect and redact sensitive data patterns such as credit card numbers, social security numbers, and other personally identifiable information. It scans text content to identify sensitive data before publication, making it the ideal service for validating user-generated content like comments and reviews. The other options serve different purposes and are not designed for content scanning.

Why the other options are wrong:

• A. Cloud Key Management Service manages encryption keys rather than detecting sensitive data.
• C. BigQuery is a data warehouse for analysis and does not provide real-time sensitive data detection.
• D. Web Security Scanner identifies web application vulnerabilities rather than sensitive data within user content.

Correct answer: A

Creating a Folder per department and assigning the Project Viewer role to each department's Google Group ensures that when any department member creates a new project within their folder, the folder-level IAM binding automatically grants read-only access to all department members. The Folder resource hierarchy in GCP automatically cascades permissions to child projects, and Project Viewer provides read-only access. This approach scales automatically as new projects are created within each folder.

Why the other options are wrong:

• B. Project Browser role does not provide resource-level read access; Project Viewer is needed for resource visibility.
• C. Creating one Project per department does not allow automatic permissions on new projects created by department members.
• D. Creating per-department Projects combined with Project Browser role fails to provide proper resource access control.

Correct answer: D

When using customer-supplied encryption keys (CSEK), the encryption must be performed on the client side before uploading to Cloud Storage. The team should encrypt the object locally, then use either the gsutil command-line tool or Google Cloud Console to upload the encrypted object to Cloud Storage, specifying the encryption key. Google Cloud Storage does not accept unencrypted objects when CSEK is required; encryption happens client-side before transmission.

Why the other options are wrong:

• A. Uploading encryption keys to Cloud Storage defeats the purpose of CSEK and creates a security risk.
• B. While gsutil can be used for upload, the encryption must occur before upload, not just during upload specification.
• C. Encryption keys cannot be generated in the Google Cloud Console for CSEK; they must be generated and managed externally by the customer.

Correct answer: A

The Google Cloud Platform: Customer Responsibility Matrix document explicitly outlines which PCI compliance controls are Google's inherent responsibilities and which remain the customer's responsibility. This document is the authoritative source for understanding Google's inherent controls versus customer obligations in a PCI compliance evaluation. The other documents do not specifically address the division of control responsibility between Google and customers.

Why the other options are wrong:

• B. PCI DSS Requirements document describes compliance standards but does not specifically identify Google's inherent controls.
• C. PCI SSC Cloud Computing Guidelines are general cloud guidance but not specific to Google Cloud's control implementation.
• D. Product documentation for Compute Engine describes features but does not specifically address PCI compliance controls and responsibilities.

Correct answer: B

BigQuery table expiration is specifically designed for PII data retention compliance. It automatically deletes entire tables after a specified time period, ensuring data is fully removed at expiration while preserving data before that threshold. This is the purpose-built GCP solution for time-based data deletion requirements.

Why the other options are wrong:

• A. Persistent Disks require manual deletion and don't provide automatic expiration capabilities.
• C. Cloud Storage buckets have TTL policies for individual objects, not data retention with selective deletion of unexpired data.
• D. Bigtable column family expiration deletes cells based on age, which would delete data before the compliance period ends.

Correct answer: B

Building small containers using small base images directly minimizes attack surface by reducing the number of packages, libraries, and potential vulnerabilities present in the container. Fewer components mean fewer attack vectors for exploitation.

Why the other options are wrong:

• A. Cloud Build is a build service and doesn't inherently reduce the attack surface of the resulting container.
• C. Deleting old versions from Container Registry is a maintenance task that doesn't affect the security of currently running containers.
• D. Continuous Delivery tools are deployment mechanisms and don't minimize the container's attack surface itself.

Correct answer: B

Google Cloud Directory Sync is the official GCP tool designed to synchronize users from on-premises Active Directory or LDAP servers to Google Cloud Identity. It maintains the existing identity infrastructure while enabling SSO integration with GCP Console.

Why the other options are wrong:

• A. Manual synchronization is error-prone and not scalable for large user populations.
• C. GCP Console does not support direct Kerberos authentication; it requires Google Cloud Identity federation.
• D. While OpenID Connect integration is possible, it's more complex than using Directory Sync which is purpose-built for Active Directory/LDAP scenarios.

Correct answer: B

Cloud Identity-Aware Proxy (IAP) provides context-aware access control to App Engine applications, verifying both user identity and device context. It prevents external access regardless of credential compromise by enforcing that requests must come through the IAP gateway with valid authentication.

Why the other options are wrong:

• A. Two-factor authentication protects against compromised passwords but doesn't prevent external access once authenticated.
• C. Password Sync is a credential management tool that doesn't prevent unauthorized external access.
• D. VPN restricts network access but doesn't provide application-level identity verification or prevent compromised credentials from being used over the VPN.

Correct answer: D

Customer-supplied encryption keys (CSEK) allow organizations to provide their own encryption keys to BigQuery, maintaining maximum control over the encryption process. The customer generates, manages, and supplies keys for each operation, giving complete control over the encryption lifecycle.

Why the other options are wrong:

• A. Cloud Storage federated data sources don't provide encryption control.
• B. Cloud HSM is for key management and storage but CSEK is the direct method for maximum control over BigQuery encryption.
• C. Customer-managed encryption keys (CMEK) delegate key management to Google Cloud, reducing direct control compared to CSEK.

Correct answer: B

BigQuery automatically replicates data across multiple geographic regions as a built-in feature, meeting the requirement for data redundancy across at least two geographic locations without additional configuration.

Why the other options are wrong:

• A. Cloud Bigtable replication must be explicitly configured and doesn't automatically replicate across geographic regions.
• C. Compute Engine SSD Disks are local to a single zone and do not automatically replicate across geographic regions.
• D. Compute Engine Persistent Disks are zonal or regional but do not automatically replicate across multiple geographic regions.

Correct answer: A

An L7 (Application) Load Balancer with SSL certificate configuration terminates HTTPS connections from clients and encrypts traffic between the browser and GCP. The L7 load balancer understands application-layer protocols and can properly handle SSL/TLS termination for web traffic.

Why the other options are wrong:

• B. A Network TCP Load Balancer operates at Layer 4 and is not optimal for HTTPS termination; it doesn't understand SSL/TLS at the application level.
• C. Firewall rules allowing port 443 only enable traffic flow but don't configure the encryption itself.
• D. Outbound firewall rules don't encrypt inbound customer traffic; they control traffic leaving the network.

Correct answer: A

Option A provides the safest approach for migrating an application with unknown port requirements. By using a Lift & Shift approach in an isolated project and enabling all internal TCP traffic initially, the application can function while VPC Flow Logs capture actual traffic patterns. This allows you to subsequently restrict firewall rules to only the necessary ports and protocols, minimizing security risk. The isolated project prevents any impact on the production environment.

Why the other options are wrong:

• B. Firewall logs do not show blocked traffic details the way VPC Flow Logs do; starting with all traffic disabled would prevent the application from running at all during the discovery phase.
• C. Refactoring into microservices on GKE is a major architectural change inappropriate for a time-constrained legacy migration and introduces unnecessary complexity.
• D. Cloud Functions cannot host legacy applications and is entirely unsuitable for this use case.

Correct answer: D

SSL Proxy Load Balancing is the correct choice for this scenario. Port 587 is used for SMTP (email), which is a non-HTTP protocol. SSL Proxy Load Balancing handles TLS termination for non-HTTP protocols like SMTP, while HTTP(S) Load Balancing only works with HTTP/HTTPS. SSL Proxy provides the required encryption termination at the load balancer level.

Why the other options are wrong:

• A. Network Load Balancing operates at Layer 4 but does not provide TLS termination; it would pass encrypted traffic through without decryption.
• B. HTTP(S) Load Balancing is designed only for HTTP and HTTPS protocols, not for SMTP on port 587.
• C. TCP Proxy Load Balancing handles Layer 4 traffic but does not provide TLS termination capabilities.

Correct answer: A

The Organization Policy Service constraint compute.trustedimageProjects is designed specifically to control which images can be used as boot disk sources. Using an allow operation with the trusted project listed as a whitelist restricts boot disk image sources to only those images stored in the designated project. This is the proper GCP mechanism for this control at the organization level.

Why the other options are wrong:

• B. A deny operation with exceptions is the inverse approach; allow operations with whitelists are the correct pattern for restricting to trusted sources.
• C. Resource Manager project permissions and the Compute Image User role do not control which images can be used as boot disk sources organization-wide.
• D. Adding a project ID as a member with organizational permissions does not implement the constraint needed to restrict image sources.

Correct answer: A

Building new base images when patches are available and using a CI/CD pipeline to rebuild and incrementally deploy VMs is the best practice for elastic cloud infrastructure. This approach leverages immutable infrastructure principles, ensures consistent patching across all instances, allows testing before production deployment, and aligns with cloud- native operations. It avoids manual patching and ensures instances are always created from known-good images.

Why the other options are wrong:

• B. Federating Active Directory into Compute Engine adds unnecessary complexity and ties cloud infrastructure to on-premises management patterns inappropriate for elastic cloud.
• C. Deployment Manager creates new instances but does not address patching existing instances or automate the patching process.
• D. Relying on startup scripts to download patches is unreliable, introduces inconsistency, and does not follow cloud best practices for immutable infrastructure.

Correct answer: A

Creating an ingress firewall rule using firewall tags to allow access only from the frontend application to the database is the correct approach. Firewall tags enable granular, identity- based network access control within a single VPC. This method isolates database traffic to only authorized application instances without requiring multiple subnets or networks, and is more efficient and manageable than network-level segmentation.

Why the other options are wrong:

• B. Subnets provide network routing boundaries but not access control; instances in different subnets can still communicate without firewall rules to restrict it.
• C. Using separate VPC networks connected by Cloud VPN adds unnecessary complexity and latency for what can be accomplished with firewall rules.
• D. VPC peering is used for connecting entire networks, not for restricting access between specific application tiers within a single organization.

Correct answer: A

Multifactor Authentication (MFA) is the most effective defense against phishing attacks. Even if attackers obtain credentials through phishing, they cannot access accounts without the second authentication factor. MFA prevents unauthorized access regardless of password compromise, making it the primary technical control for protecting against credential theft from phishing.

Why the other options are wrong:

• B. Strict password policies alone do not prevent users from willingly providing credentials to phishers or protect against password reuse across services.
• C. Captcha prevents automated attacks but does not stop users from voluntarily entering credentials on phishing pages.
• D. Encrypted emails do not protect credentials that users may voluntarily share with attackers through phishing interactions.

Correct answer: C

Cloud Interconnect is the appropriate choice for connecting two separate GCP organizations while keeping traffic off the public internet. Cloud Interconnect provides dedicated network connections between organizations with guaranteed bandwidth and low latency. VPC peering only works within a single organization or between organizations' VPCs in a limited way, while Cloud VPN encrypts traffic but still traverses the public internet.

Why the other options are wrong:

• A. VPC peering cannot directly connect VPCs across separate GCP organizations; it is limited to VPCs within the same organization or between organizations in specific configurations.
• B. Cloud VPN, while encrypted, still traverses the public internet and does not meet the requirement that communication must not traverse public internet by any means.
• D. Shared VPC is an organizational resource sharing mechanism within a single GCP organization, not a cross-organization connectivity solution.

Correct answer: C

Organization policies are the correct mechanism to enforce constraints on resource creation across a project. By setting up an organization policy that restricts public IP assignment while creating exceptions for specific instances (the front-end ones), the team can enforce the requirement that most instances lack public IPs while allowing frontend instances to have them. This prevents engineers from circumventing the policy even with Editor role permissions.

Why the other options are wrong:

• A. Private Access enables private connectivity to Google services but does not prevent public IP assignment to instances.
• B. Removing Editor role and granting Compute Admin would still allow those engineers to create public IPs; IAM roles do not enforce this type of resource constraint.
• D. VPC subnet configuration alone cannot enforce a policy-subnets can be configured for public or private IPs, but instances can still be assigned public IPs in either case through explicit configuration.

Correct answer: C

Patching vulnerabilities in containers requires rebuilding the container image with the patched code or base image, then redeploying it. Containers are immutable artifacts; you cannot patch running containers in place. The correct approach is to update the application or patch the base image, rebuild it, and redeploy the new image to the cluster.

Why the other options are wrong:

• A. Puppet and Chef are configuration management tools designed for VMs, not for updating containerized applications in Kubernetes.
• B. GKE auto-upgrade upgrades the Kubernetes cluster nodes themselves, not the container images running on them.
• D. Containers do not automatically upgrade when a base image is updated in Container Registry; you must explicitly rebuild and redeploy the application image.