Configuring access and security

An enterprise security team requires that Compute Engine virtual machines in the 'Data-Processing' folder be prevented from enabling IP forwarding (acting as routers or network gateways), except for one specialized project named 'gw-prod-100' located inside that folder. A cloud engineer must implement this guardrail using the Google Cloud resource hierarchy while granting the explicit exception. Which configuration should the engineer apply?

A security mandate for a Google Cloud project named `analytics-prod` prohibits developers from generating or downloading long-lived JSON service account keys. A cloud engineer using the identity `[email protected]` needs temporary authorization to mint short-lived OAuth 2.0 access tokens for an existing service account named `[email protected]`. Which command should an administrator run to grant the engineer the necessary permission directly on the service account using the principle of least privilege?

An enterprise Google Cloud environment enforces the boolean Organization Policy constraint `constraints/compute.disableGlobalSerialPortAccess` (Enforced: True) at the root Organization node. A DevOps engineer who holds the primitive `roles/owner` IAM role on a child project within a subfolder attempts to enable interactive serial console access on a Compute Engine instance in that project using the Google Cloud CLI. Which statement correctly describes the outcome of this operational request and the underlying policy enforcement mechanism?

An organization is establishing strict compliance guardrails for service account administration in Google Cloud. A dedicated security team created a custom service account named `[email protected]` in project `proj-backend`. Developers in the project need to attach this service account to newly deployed Cloud Run services. However, security policy strictly forbids developers from modifying service account permissions, creating key files, or managing other service accounts in the project. Which IAM role configuration meets these security requirements while applying the principle of least privilege?

An enterprise security policy requires that an external automated CI/CD pipeline operating outside of Google Cloud deploy infrastructure into a project named `prod-app-services`. To eliminate security risks associated with long-lived credentials, a cloud administrator creates a dedicated deployment service account named `[email protected]` and configures Workload Identity Federation. Which IAM role configuration should the administrator apply to grant the external workload permission to act as the service account while following Google Cloud security best practices?

A cloud engineer is configuring customer-managed encryption keys (CMEK) in Google Cloud KMS for a sensitive Cloud Storage bucket residing in the us-central1 region. The organization requires strict separation of duties: security administrators must manage keys and IAM policies without being able to encrypt or decrypt data, whereas the Cloud Storage service account requires permissions solely to perform cryptographic encryption and decryption operations. Additionally, an operator asks to permanently delete an outdated Cloud KMS Key Ring to clean up resources. Which configuration correctly satisfies these requirements while adhering to Google Cloud KMS operational capabilities?

A cloud security engineer is tasking a DevOps team with deploying an automated monitoring agent on a new Google Compute Engine VM instance. The deployment must strictly adhere to Google Cloud security best practices of least privilege and secure service account management. Arrange the following administrative gcloud CLI and IAM setup steps in the correct operational sequence required to create, configure, delegate access for, and attach the custom service account.

A cloud administrator manages resource constraints across an enterprise Google Cloud hierarchy. An Organization Policy using the Boolean constraint constraints/compute.vmCanIpForward is set to Enforced at the Analytics folder level to prevent virtual machines from enabling IP forwarding. A specific workload inside this folder, located in the Network-Appliance project, requires a virtual machine to act as a router with IP forwarding enabled. How should the administrator configure the environment to allow IP forwarding specifically for the Network-Appliance project while maintaining the constraint for all other projects in the folder?

A software team deployed an application to Compute Engine that processes images uploaded to a Cloud Storage bucket named `media-processing-prod`. The security team recently enabled Uniform Bucket-Level Access on the bucket to meet organizational compliance requirements. Following this change, the application throws an error whenever it attempts to grant fine-grained permissions using object Access Control Lists (ACLs). According to Google Cloud security best practices, which action should the cloud administrator take to resolve the application errors and properly manage access?

An enterprise software team manages multiple environment folders under their Google Cloud organization. In the Staging folder, service account JSON key creation is currently permitted to support legacy integration tests. However, for a newly created high-security project named finance-vault-prod residing inside the Staging folder, security compliance mandates that service account key creation must be blocked completely. Which action should a Cloud Engineer take to enforce this security restriction on finance-vault-prod without modifying the policy settings for other projects in the Staging folder?

A cloud security engineer receives an alert that a specific key version of a CryptoKey in Cloud KMS may have been exposed. The security policy dictates that no new data should be encrypted using this compromised key version, but existing backup files encrypted with prior key versions must remain decryptable by authorized service accounts. Additionally, to clean up the project resources, the engineer attempts to remove the parent KeyRing that holds the CryptoKey. Which action correctly fulfills the security requirement while reflecting Cloud KMS resource capabilities?

A cloud administrator needs to configure access for an external automated pipeline running on a self-hosted server so that it can read log files stored in a Cloud Storage bucket named `analytics-logs`. To comply with company security policies, the administrator must set up a dedicated user-managed service account using short-lived credentials via service account impersonation rather than using long-lived exported JSON keys.

Which of the following steps must the administrator take to implement this configuration securely? (Select TWO.)

A security audit highlights that a Compute Engine virtual machine running an automated nightly report generator is using the default Compute Engine service account with the primitive Editor role. To comply with security mandates and the principle of least privilege, you need to reconfigure the workload to use a dedicated user-managed service account that only has access to read Cloud Storage objects and write BigQuery datasets in the project. Which sequence of steps should you take?

A cloud architect is configuring governance controls for a company's Google Cloud environment containing an Organization node, a 'Staging' folder, and multiple child projects. The security team needs to establish clear boundaries for resource configurations and access controls across the resource hierarchy. Which of the following statements correctly describe the behavior of Google Cloud Organization Policies and resource hierarchy constraints? (Select TWO.)

A cloud administrator is performing a resource cleanup in a Google Cloud project and identifies a Cloud KMS Key Ring containing unused CryptoKeys. The administrator attempts to permanently remove the Key Ring to clean up project resources, but discovers that the Google Cloud Console does not offer a delete action for Key Rings. Why does Google Cloud prevent the deletion of Cloud KMS Key Rings, and what is the recommended procedure to restrict further use of the cryptographic keys?

An organization enforces a strict security directive prohibiting the creation and export of static service account JSON keys. A automated pipeline executing under a source service account `[email protected]` in Project-A must deploy compute resources into Project-B by impersonating a target service account `[email protected]`. Which two IAM configuration actions must be performed to enable this secure impersonation workflow following Google Cloud security best practices? (Select TWO.)

A data analyst must execute a scheduled Python script from an on-premises workstation to pull analytics data from BigQuery using a dedicated service account named `[email protected]`. Organization security policies explicitly prohibit generating or downloading long-lived service account JSON key files to local machines. The analyst has already authenticated their personal user identity using `gcloud auth login`. Which configuration best satisfies this security requirement while adhering to the principle of least privilege?

An enterprise organization manages a Google Cloud resource hierarchy containing an Organization root node, a folder named `Production`, and a child project named `Payment-Service` inside `Production`. The security team wants to enforce strict network perimeter controls and ensure proper administrative access delegation across the environment. Which of the following statements correctly describe the behavior and management of Organization Policies in this resource hierarchy? (Select TWO answers.)

Your team needs to grant a newly hired developer access to manage Compute Engine virtual machine instances (create, start, stop, and delete) within a specific Google Cloud project. The developer must not be granted permissions to modify project firewall rules, VPC networks, or IAM policies. Following the principle of least privilege, which IAM role should you grant to the developer at the project level?

A security administrator needs to grant a data analyst permission to run SQL queries on a specific BigQuery dataset within a Google Cloud project, while adhering strictly to the principle of least privilege. Which of the following IAM role assignments should the administrator configure? (Select TWO.)