Examkin

All practice questions

1598 questions

All types1,598Multiple choice815Multiple select537Numeric8Matching64Ordering174
Question 661Question →

An enterprise organization requires all Data Access audit logs from multiple Google Cloud projects to be aggregated into a central Cloud Storage bucket for compliance auditing. The security architecture must prevent authorized internal analysts from exfiltrating logs to external locations outside the organization, ensure encryption key lifecycle management is handled via Google Cloud services rather than raw customer keys, and grant log processing applications minimal impersonation permissions without granting administrative control over identity resources. Which architecture should you implement?

Show answer & explanation

Answer: Configure an aggregated log sink targeting a central Cloud Storage bucket, protect the storage bucket within a VPC Service Controls perimeter, encrypt the bucket using Customer-Managed Encryption Keys (CMEK) via Cloud KMS, and assign the Service Account User role to processing workloads.

Answer

The correct solution requires implementing an aggregated log sink to a central Cloud Storage bucket protected by VPC Service Controls, encrypting the storage bucket with Customer-Managed Encryption Keys (CMEK) in Cloud KMS, and assigning the Service Account User role to log processing workloads.
The correct implementation combines VPC Service Controls to prevent authorized users from moving audit logs outside the defined perimeter, CMEK for managing key lifecycles natively in Cloud KMS without managing raw keys, and the Service Account User role to satisfy least privilege for log processing workloads.

Step-by-Step Solution

1
Evaluate data exfiltration controls for centralized audit storage
Identify that IAM controls determine who can access data, but VPC Service Controls is required to prevent authorized users from exfiltrating data outside the network perimeter.
VPC Service Controls creates a security boundary around GCP services to prevent unauthorized data transfers to external resources.
2
Determine key management requirements for audit log storage
Select Customer-Managed Encryption Keys (CMEK) utilizing Cloud KMS instead of Customer-Supplied Encryption Keys (CSEK).
CMEK fulfills cloud governance and key rotation mandates while leveraging Cloud KMS, avoiding the burden of storing and supplying raw keys for automated log sinks.
3
Apply least-privilege identity configuration for workload service accounts
Grant the Service Account User role (roles/iam.serviceAccountUser) to workloads that need to run under the service account identity.
Service Account Admin grants full control to create and delete service accounts, violating the principle of least privilege.

Key Concept

Centralized Security Logging with VPC Service Controls, CMEK, and Least-Privilege IAM
Question 662Question →

A enterprise fintech organization is implementing real-time threat detection and security event streaming using Security Command Center (SCC) Premium. The Cloud Security Architect must configure an automated workflow that exports SCC threat findings to an on-premises Security Information and Event Management (SIEM) system via Pub/Sub. The design must ensure that even if an internal user or service account credential becomes compromised, log payload data cannot be exfiltrated to external Storage buckets or Pub/Sub topics outside the organization's managed boundary. Which architectural configuration meets these security and compliance requirements?

Show answer & explanation

Answer: Configure an organization-level SCC Continuous Export to a Pub/Sub topic protected within a VPC Service Controls perimeter, granting the SCC service agent the minimal Pub/Sub Publisher role on the topic.

Answer

Configure an organization-level SCC Continuous Export to a Pub/Sub topic protected within a VPC Service Controls perimeter, granting the SCC service agent the minimal Pub/Sub Publisher role on the topic.
The combination of SCC Continuous Export, least-privilege predefined IAM roles (Pub/Sub Publisher), and VPC Service Controls fulfills both real-time streaming needs and stringent exfiltration prevention. VPC Service Controls act as a perimeter boundary that stops data movement to unauthorized destinations outside the service perimeter, even if credentials are compromised.

Step-by-Step Solution

1
Identify the proper SCC notification mechanism for real-time finding export.
SCC Continuous Export automatically routes newly generated findings directly to a designated Pub/Sub topic in real time.
Batch log sinks or manual queries do not meet real-time streaming requirements to external SIEM systems.
2
Apply least privilege access to the SCC service agent.
Grant only `roles/pubsub.publisher` on the target Pub/Sub topic.
Prevents over-privileging the service account with broad administrative or primitive roles.
3
Implement perimeter controls against data exfiltration.
Enclose the Pub/Sub topic and consuming services inside a VPC Service Controls perimeter.
VPC Service Controls block data transfer requests to resources outside the defined security perimeter regardless of IAM authorization.

Key Concept

Combining Security Command Center Continuous Export with VPC Service Controls and Least-Privilege IAM to secure real-time security finding egress.
Question 663Question →

A financial enterprise is establishing security guardrails across its Google Cloud resource hierarchy. The security team requires that all projects under the `Production` folder strictly prevent the creation of service account keys and restrict resource deployments exclusively to European regions. Which TWO Organization Policy constraints should the security team apply at the `Production` folder level to meet these requirements?

Select all that apply

Show answer & explanation

Answer: Enforce the `iam.disableServiceAccountKeyCreation` boolean constraint at the `Production` folder level.; Enforce the `gcp.resourceLocations` list constraint with allowed values specified for European regions at the `Production` folder level.

Answer

The security team must enforce the `iam.disableServiceAccountKeyCreation` constraint to block service account key creation and enforce the `gcp.resourceLocations` constraint with an allowed list of European regions.
The correct options involve applying the `iam.disableServiceAccountKeyCreation` boolean constraint and the `gcp.resourceLocations` list constraint. Organization Policies allow administrators to set organization-wide or folder-wide guardrails that inherit down the resource hierarchy. `iam.disableServiceAccountKeyCreation` explicitly prevents users from generating service account keys, while `gcp.resourceLocations` limits resource creation to specific geographical locations.

Step-by-Step Solution

1
Identify the requirement to prevent service account key creation across inherited projects.
Select the `iam.disableServiceAccountKeyCreation` boolean constraint.
Organization Policies provide programmatic constraints to disable service account key creation centrally at the folder level.
2
Identify the requirement to restrict deployment geographic locations.
Select the `gcp.resourceLocations` list constraint configured for European regions.
The `gcp.resourceLocations` list constraint defines explicit location boundaries for newly created resources across supported Google Cloud services.

Key Concept

Centralized Governance using Boolean and List Organization Policy Constraints
Question 664Question →

An enterprise energy platform is deploying a new stateless microservice to process inbound HTTP REST telemetry payloads from solar inverters. The workload experiences zero traffic at night and sharp traffic spikes during daylight hours. The architectural team requires auto-scaling to zero to minimize costs and has mandated minimizing operational management overhead. Which Google Cloud compute platform should the cloud architect select?

Show answer & explanation

Answer: Deploy the containerized service to Cloud Run.

Answer

Deploy the containerized service to Cloud Run.
Cloud Run is the optimal Google Cloud compute choice for stateless HTTP web microservices. It abstracts server management, automatically scales compute instances based on incoming request traffic (including scaling to zero when idle), and eliminates infrastructure operational overhead.

Step-by-Step Solution

1
Analyze workload requirements
The service is stateless, communicates via HTTP REST, requires auto-scaling to zero during non-daylight hours, and must minimize operational overhead.
Matching workload operational characteristics directly determines the optimal GCP compute service.
2
Evaluate candidate compute platforms against constraints
Cloud Run supports containerized HTTP workloads, scales automatically down to zero instances, eliminates node management, and bills strictly per execution resource unit.
Serverless container execution fulfills both the cost optimization and zero-operational-overhead mandates.

Key Concept

Selecting serverless container infrastructure (Cloud Run) over GKE or VM instance groups for stateless HTTP workloads to minimize operational overhead and scale to zero.
Question 665Question →

An enterprise organization operates a multi-folder Google Cloud resource hierarchy containing hundreds of projects. The Security Operations Center (SOC) requires a real-time audit logging solution to capture all Data Access audit logs across all projects and stream them securely to an external Security Information and Event Management (SIEM) system. Additionally, the Chief Information Security Officer (CISO) mandates strict data exfiltration protections so that insider threats cannot copy audit log streams to unauthorized external locations outside the organization. Which TWO architectural actions should the Cloud Architect combine to satisfy these security and operational requirements?

Select all that apply

Show answer & explanation

Answer: Configure an aggregated organization-level Cloud Logging sink that filters for Data Access audit logs and routes them to a central Cloud Pub/Sub topic hosted in a dedicated security administration project.; Enforce a VPC Service Controls perimeter around the security administration project containing the log ingestion Pub/Sub topic and processing infrastructure to prevent data exfiltration outside the trust boundary.

Answer

The correct architecture combines an aggregated organization-level log sink routing Data Access logs to a central Pub/Sub topic with a VPC Service Controls perimeter wrapping the security administration project.
The solution requires a combination of real-time multi-project log aggregation and strict perimeter protection. An aggregated organization-level log sink filtering for Data Access logs and streaming to a central Pub/Sub topic satisfies the real-time SIEM integration requirement across all projects. Concurrently, placing the logging project inside a VPC Service Controls perimeter blocks unauthorized egress and mitigates data exfiltration risks.

Step-by-Step Solution

1
Centralize log aggregation across the resource hierarchy
Creating an aggregated sink at the organization root with inclusion filters for Data Access audit logs ensures complete coverage across all child folders and projects into a centralized Pub/Sub topic.
Individual project sinks are operational anti-patterns for enterprise governance and fail to guarantee unified coverage across newly created projects.
2
Implement perimeter security against data exfiltration
Enclosing the central logging ingestion project inside a VPC Service Controls perimeter restricts API requests to authorized networks and prevents copying log entries to external GCP projects or public destinations.
IAM authorization alone does not prevent users with valid permissions from writing or copying data to external buckets outside the corporate control boundary.
3
Apply least privilege access management
Configure service account permissions using minimal predefined roles rather than primitive roles.
Primitive roles like Owner grant excessive administrative capabilities and increase the blast radius of potential key compromise.

Key Concept

Centralized Audit Log Aggregation and VPC Service Controls Perimeter Protection
Question 666Question →

An enterprise pharmaceutical firm is migrating an on-premises Oracle relational database and historical clinical trial data archives to Google Cloud. The target architecture uses Cloud SQL for PostgreSQL for operational data and Cloud Storage for unstructured archives. To ensure minimal downtime and data integrity during cutover, place the migration workflow steps in the correct chronological order from first to last.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct chronological sequence for a minimal-downtime database and archive migration is: 1) Establish Dedicated Interconnect hybrid networking, 2) Execute historical transfer via Storage Transfer Service and configure CDC replication via Database Migration Service, 3) Stop incoming write traffic on-premises and wait for replication lag to reach zero, 4) Promote the Cloud SQL target instance and update application connection strings.
The correct order follows standard Google Cloud architecture migration staging patterns: first establishing private hybrid connectivity (Dedicated Interconnect), then running bulk file transfers alongside continuous CDC replication via Database Migration Service, followed by stopping source write traffic to drain remaining replication lag to zero, and finally promoting the destination database while pointing application workloads to the new endpoint.

Step-by-Step Solution

1
Establish hybrid connectivity and network security controls.
On-premises environment securely communicates with the Google Cloud VPC via Dedicated Interconnect.
Data transfer tools require secure, high-bandwidth private network paths before executing data movement.
2
Initiate bulk archival data transfer and start continuous CDC database replication.
Historical files land in Cloud Storage while ongoing transactional changes stream continuously into Cloud SQL.
Combining bulk loading with continuous replication establishes a baseline without disrupting live production traffic.
3
Quiesce the source database and verify zero replication lag.
No new transactions occur on-premises, and all pending changes apply to the target Cloud SQL database.
Pausing writes ensures transaction consistency and prevents split-brain conditions during final cutover.
4
Promote the Cloud SQL instance and switch application configuration endpoints.
Applications resume normal operation pointing directly to Google Cloud infrastructure.
Promoting the database detaches CDC replication and establishes Cloud SQL as the primary operational system.

Key Concept

Staged Migration Workflow and Database Cutover Strategy
Question 667Question →

An enterprise cloud architecture team at a global pharmaceutical corporation is establishing a design framework for a new GCP-based clinical trial telemetry platform. The framework requires systematic translation of business goals into provisioned infrastructure. In which sequential order should the cloud architect arrange the architectural design phases, starting from initial business requirements through to final GCP infrastructure deployment?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence begins with establishing the Conceptual Architecture (business domain and compliance requirements), followed by the Logical Architecture (vendor-neutral functional tiers and data processing contracts), then the Physical Architecture (mapping logical components to specific GCP managed services, VPC topologies, and IAM), and concludes with the Implementation Specification (writing IaC manifests, VPC SC perimeters, and deployment pipelines).
The architectural translation lifecycle begins with Conceptual Architecture (defining business capabilities, compliance, and domain boundaries), progresses to Logical Architecture (defining vendor-neutral functional modules, data contracts, and trust perimeters), translates into Physical Architecture (mapping logical components to concrete GCP services like Pub/Sub and Spanner, along with VPC/IAM topologies), and finishes with Implementation Specification (authoring Terraform IaC code, VPC SC perimeters, and CI/CD deployment pipelines).

Step-by-Step Solution

1
Identify high-level business capabilities, governance policies, and compliance boundaries.
Establishes the Conceptual Architecture phase to ground the architecture in enterprise business objectives.
Architectural design must originate from business requirements, regulatory constraints, and domain boundaries without premature technical bias.
2
Define functional software tiers, messaging contracts, and logical security perimeters.
Establishes the Logical Architecture phase.
Logical design structures software capabilities and data flows into technology-agnostic patterns prior to vendor service selection.
3
Select concrete Google Cloud managed services, regional deployments, and explicit IAM controls matching the logical design.
Establishes the Physical Architecture phase.
Physical design binds logical components to real GCP resources (e.g., Cloud Spanner, Cloud Pub/Sub, CMEK) and physical network boundaries.
4
Translate the physical design blueprint into executable provisioning scripts and pipelines.
Establishes the Implementation Specification phase.
Deployment automation (IaC templates like Terraform and CI/CD pipelines) requires a finalized physical architecture specification to build the environment.

Key Concept

Sequential Translation across Conceptual, Logical, Physical, and Implementation Layers in Cloud Architecture
Question 668Question →

An enterprise architecture team is auditing a newly migrated Google Cloud environment and identified two significant areas of technical debt: application service accounts were assigned primitive Owner roles, and Terraform state files are currently stored locally on developer workstations. Which TWO actions should the architecture team take to mitigate this technical debt? (Select TWO answers.)

Select all that apply

Show answer & explanation

Answer: Replace primitive Owner roles on service accounts with fine-grained predefined or custom roles.; Migrate local Terraform state files to a remote Cloud Storage backend with object versioning enabled.

Answer

The architecture team should replace primitive Owner roles on service accounts with fine-grained predefined or custom roles, and migrate local Terraform state files to a Cloud Storage backend with object versioning enabled.
Mitigating technical debt in cloud architectures requires replacing overly permissive primitive IAM roles with fine-grained predefined or custom roles, and migrating local infrastructure state files to a secure Cloud Storage backend with versioning enabled.

Step-by-Step Solution

1
Evaluate security technical debt from broad IAM access.
Identify that primitive Owner roles grant excessive permissions across resources.
Restricting permissions to specific predefined or custom roles enforces the principle of least privilege and reduces cloud attack surfaces.
2
Evaluate operational technical debt from unmanaged Infrastructure as Code (IaC) state.
Identify that local, unversioned state files risk state corruption and team collision.
Configuring a central Cloud Storage backend with versioning provides locked, consistent, and recoverable infrastructure state management.

Key Concept

Assessing and Mitigating Technical Debt in Cloud Architectures
Question 669Question →

Match each Google Cloud security service on the left to its primary functional capability in container security and threat detection on the right.

Click a left item, then click its matching right item

Items

Container Analysis
Binary Authorization
Event Threat Detection

Matches

Show answer & explanation

Answer

Container Analysis pairs with scanning container images for vulnerabilities in Artifact Registry; Binary Authorization pairs with enforcing signature-based image deployment policies on GKE; Event Threat Detection pairs with analyzing log streams in Security Command Center to identify threats.
Container Analysis provides vulnerability scanning for container images stored in registries. Binary Authorization ensures only verified, signed images are deployed to GKE clusters. Event Threat Detection processes log streams to identify active security threats across GCP resources.

Step-by-Step Solution

1
Identify the primary role of Container Analysis.
Container Analysis scans container images stored in Artifact Registry for vulnerability CVEs.
Container Analysis provides static vulnerability scanning for stored artifacts.
2
Identify the primary role of Binary Authorization.
Binary Authorization verifies cryptographic signatures prior to container deployment on GKE.
Binary Authorization enforces deploy-time security policies based on attestations.
3
Identify the primary role of Event Threat Detection.
Event Threat Detection analyzes log streams within Security Command Center to detect threat indicators.
Event Threat Detection provides real-time analysis of audit and system logs for threat activity.

Key Concept

Vulnerability Scanning, Container Security, and Threat Detection
Question 670Question →

Match each Google Cloud perimeter security mechanism to the specific security threat or operational requirement it primarily addresses.

Click a left item, then click its matching right item

Items

VPC Service Controls
Cloud Armor
Hierarchical Firewall Policies
Private Service Connect

Matches

Show answer & explanation

Answer

VPC Service Controls matches with preventing data exfiltration around Google Cloud APIs; Cloud Armor matches with Layer 7 protection and rate-limiting at the edge; Hierarchical Firewall Policies matches with enforcing baseline rules across the organization hierarchy; and Private Service Connect matches with private cross-VPC service access without VPC Peering.
Each feature aligns directly with its primary architecture purpose: VPC Service Controls safeguards API data boundaries against exfiltration; Cloud Armor provides WAF and edge filter capabilities; Hierarchical Firewall Policies enforce network security rules across the enterprise resource hierarchy; and Private Service Connect offers secure private access to services in separate VPCs.

Step-by-Step Solution

1
Identify the primary perimeter controls for Google Cloud APIs and data protection.
Recognize that VPC Service Controls creates perimeter boundaries to mitigate data exfiltration risks.
VPC Service Controls specifically secures Google Cloud API communications, preventing unauthorized copies or access from outside defined perimeters.
2
Identify the primary edge web application security service.
Match Cloud Armor to Layer 7 protection and edge rate limiting.
Cloud Armor protects web applications attached to Google Cloud load balancers against common web attacks and DDoS.
3
Identify organization-wide network governance tools.
Match Hierarchical Firewall Policies to organization-level rule enforcement.
Hierarchical policies are inherited at the Organization and Folder levels to enforce security guardrails top-down.
4
Identify modern cross-VPC private connectivity options.
Match Private Service Connect to private service consumption without VPC Peering.
Private Service Connect uses endpoints in the consumer VPC to reach producer services privately without needing complex VPC Peering topologies.

Key Concept

GCP Network Security and Perimeter Controls
Question 671Question →

A healthcare enterprise manages a multi-tenant Google Cloud organization structured into multiple environment folders. The central FinOps team must implement centralized billing analysis across all projects, automate real-time budget threshold notifications to an external Slack channel, and enforce strict governance over quota requests and billing settings across business units. Which TWO actions should the Cloud Architect recommend to satisfy these requirements?

Select all that apply

Show answer & explanation

Answer: Enable detailed billing data export at the Cloud Billing Account level to stream all project billing data into a central administration project's BigQuery dataset.; Attach a Cloud Pub/Sub topic to Cloud Billing Budgets at the Billing Account level, and deploy a Cloud Run service using least-privilege IAM roles to process budget messages and forward them to Slack.

Answer

The Cloud Architect should enable detailed billing data export at the Cloud Billing Account level to a central BigQuery dataset, and attach a Cloud Pub/Sub topic to Cloud Billing Budgets to trigger a least-privilege Cloud Run service for automated Slack alerts.
Centralizing billing data export at the Cloud Billing Account level provides complete organizational cost visibility without delegating access to project-level teams. Connecting Cloud Billing Budgets to Cloud Pub/Sub allows secure, event-driven processing of threshold notifications via Cloud Run without exposing sensitive credentials or using elevated IAM permissions.

Step-by-Step Solution

1
Centralize billing data aggregation.
Configuring export at the Billing Account level ensures all linked project billing records stream automatically to a centralized BigQuery dataset managed by the central FinOps team.
This avoids granting project-level export permissions to business unit teams and guarantees complete organizational visibility.
2
Automate billing budget alerts securely.
Publishing budget threshold alerts to Cloud Pub/Sub enables event-driven integration with Cloud Run.
Serverless consumers running with service accounts adhere to least-privilege access rules while ensuring reliable real-time notifications.
3
Avoid anti-patterns regarding roles and quota timing.
Rejecting primitive roles and reactive pipeline quota requests prevents security vulnerabilities and deployment pipeline failures.
Quota increases require lead time for approval and should be pre-provisioned, while IAM governance demands custom or predefined roles.

Key Concept

Centralized Cloud Billing governance, BigQuery billing export, Pub/Sub budget automation, and proactive quota planning.
Question 672Question →

A financial enterprise uses a Google Cloud resource hierarchy structured with an Organization node, top-level environment folders named Production and Staging, and multiple project nodes under each folder. The security team needs to allow an external auditing team to view compute resources and monitoring metrics across all current and future production workloads without administrative rights. Concurrently, software developers working in the Staging environment must deploy Compute Engine instances configured to run under dedicated service accounts, but must not be capable of creating service accounts or modifying security policies. Which TWO architecture choices should you implement to meet these requirements while upholding least privilege and minimizing administrative overhead? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Grant the external auditing principal the predefined compute viewer (roles/compute.viewer) and monitoring viewer (roles/monitoring.viewer) roles bound at the Production folder level.; Grant the software developers the compute instance admin role (roles/compute.instanceAdmin.v1) on the Staging projects and the service account user role (roles/iam.serviceAccountUser) directly on the specific dedicated service accounts.

Answer

Grant compute viewer and monitoring viewer roles at the Production folder level for auditing, and assign compute instance admin on Staging projects with service account user rights bound directly to the target service account resources for developers.
Binding fine-grained predefined roles (compute viewer and monitoring viewer) at the folder level ensures that access policies automatically propagate to all present and future projects under that folder without granting unnecessary access to non-production environments or other GCP services. Additionally, assigning the service account user role specifically on target service account resources allows compute instances to be instantiated under that identity while preventing developers from impersonating unapproved service accounts or modifying IAM policies.

Step-by-Step Solution

1
Analyze resource hierarchy requirements for the external auditing team
Identified that permissions granted at the Production folder level inherit downwards to all child projects, automatically covering future resources without requiring primitive Viewer access at the Organization level.
Google Cloud IAM follows top-down inheritance down the resource hierarchy (Organization -> Folder -> Project -> Resource).
2
Evaluate service account access controls for developers
Determined that developers require roles/compute.instanceAdmin.v1 to provision VMs and roles/iam.serviceAccountUser to attach service accounts to those VMs.
Attaching a service account to a Compute Engine instance requires the serviceAccountUser role on that specific service account identity.
3
Apply the principle of least privilege to both access requirements
Bound specific predefined viewer roles at the folder scope and bound roles/iam.serviceAccountUser directly on the target service account resources rather than project-wide admin roles.
Resource-level IAM bindings prevent arbitrary identity misuse and guard against unauthorized privilege escalation.

Key Concept

IAM Resource Hierarchy Inheritance and Service Account Least Privilege
Question 673Question →

An organization is reviewing its CI/CD pipeline automation for deploying microservices to Cloud Run. During an internal SDLC security audit, the team discovers that the Cloud Build pipeline runs under a service account granted the Owner primitive role across the target Google Cloud project. To enforce least-privilege security controls while maintaining automated pipeline deployments, which configuration change should the Cloud Architect recommend?

Show answer & explanation

Answer: Configure Cloud Build build triggers to execute using a dedicated user-managed service account assigned only the specific predefined roles required to build artifacts and deploy to Cloud Run.

Answer

Configure Cloud Build triggers to execute using a dedicated user-managed service account assigned only the specific predefined roles required to build artifacts and deploy to Cloud Run.
Configuring Cloud Build triggers to use a custom user-managed service account with fine-grained predefined roles satisfies least-privilege access requirements while allowing automated build and deployment workflows.

Step-by-Step Solution

1
Identify the security risk in the current SDLC pipeline setup.
The pipeline service account currently holds the primitive Owner role, which grants broad, unsafe permissions across the entire GCP project.
CI/CD execution identities should strictly follow the principle of least privilege.
2
Evaluate GCP identity architecture options for Cloud Build.
Cloud Build supports attaching custom, user-managed service accounts to build triggers rather than relying on default identities with overly broad privileges.
User-managed service accounts allow scoping permissions specifically to the build and deployment targets.
3
Assign fine-grained predefined roles.
Grant only necessary roles (e.g., roles/run.developer, roles/artifactregistry.writer, roles/iam.serviceAccountUser) to the dedicated service account.
This maintains automated deployment capabilities while satisfying compliance and audit requirements.

Key Concept

Least-Privilege Pipeline Execution with User-Managed Service Accounts
Question 674Question →

An enterprise financial corporation is migrating its containerized workloads to Google Kubernetes Engine (GKE). To comply with strict regulatory frameworks (PCI-DSS and SOC 2), the Lead Cloud Architect must implement an automated end-to-end container security governance model. The architecture must enforce the following requirements:
1. All container images stored in Artifact Registry must undergo continuous scanning for OS and language package vulnerabilities.
2. Only container images built by the official CI/CD pipeline and cryptographically signed by authorized attestors can be deployed to production GKE clusters.
3. Unauthorized or unverified container deployments must be automatically blocked at the Kubernetes API server admission control layer.
4. Near real-time runtime threat detection must monitor container behavior and GKE audit logs without installing third-party agents on node virtual machines.

Which architectural strategy should the Cloud Architect implement to fulfill all security requirements while minimizing operational complexity?

Show answer & explanation

Answer: Enable Container Analysis for continuous vulnerability scanning in Artifact Registry. Enforce a Binary Authorization policy on GKE requiring cryptographic attestations signed via Cloud KMS keys. Activate Security Command Center Premium to utilize Event Threat Detection and Container Threat Detection.

Answer

The correct architecture integrates Artifact Registry vulnerability scanning via Container Analysis, enforces Binary Authorization with Cloud KMS attestations for GKE admission control, and leverages Security Command Center Premium for agentless Container Threat Detection and Event Threat Detection.
The solution combining Container Analysis, Binary Authorization, and Security Command Center (SCC) Premium provides a complete, cloud-native supply chain and runtime security model. Artifact Registry uses Container Analysis for automated vulnerability scanning. Binary Authorization enforces image signature policy checks backed by Cloud KMS at GKE deployment admission. SCC Premium delivers agentless runtime threat detection across GKE nodes and audit logs through Container Threat Detection and Event Threat Detection.

Step-by-Step Solution

1
Evaluate continuous vulnerability scanning for Artifact Registry.
Container Analysis automatically scans images stored in Artifact Registry and monitors for new CVE disclosures continuously.
Meets requirement 1 without requiring manual trigger scripts.
2
Establish supply chain security and deployment blocking controls.
Binary Authorization integrates natively with the GKE API server as an admission controller to evaluate signed attestations against policy prior to pod creation.
Meets requirements 2 and 3 by blocking unsigned or tampered images automatically.
3
Select runtime threat detection tools.
Security Command Center Premium includes built-in agentless detection (Container Threat Detection and Event Threat Detection) for analyzing node memory, container binaries, and GKE audit logs.
Meets requirement 4 without adding third-party daemonsets or VM agent overhead.

Key Concept

GCP Container Security Architecture (Binary Authorization, Container Analysis, and SCC Premium Threat Detection)
Estimated Time:3m 0s
Question 675Question →

A software company is designing an automated continuous delivery pipeline using Google Cloud Deploy to deploy stateless HTTP microservices to Cloud Run across staging and production environments. The security team mandates that the delivery pipeline service account must adhere to the principle of least privilege while allowing Cloud Deploy to act on behalf of the runtime service account during rollout execution. Which IAM role assignment configuration meets these security and pipeline automation requirements?

Show answer & explanation

Answer: Grant the Cloud Deploy execution service account the Cloud Run Developer role (roles/run.developer) and the Service Account User role (roles/iam.serviceAccountUser) on the runtime service account.

Answer

Grant the Cloud Deploy execution service account the Cloud Run Developer role (roles/run.developer) and the Service Account User role (roles/iam.serviceAccountUser) on the runtime service account.
The correct approach enforces security best practices by granting the Cloud Deploy execution worker only the specific predefined permissions required for Cloud Run management (roles/run.developer) alongside the Service Account User role (roles/iam.serviceAccountUser) on the specific runtime service account. This allows the delivery pipeline to deploy and attach the identity without exposing excessive administrative control.

Step-by-Step Solution

1
Identify the deployment target requirements and runtime model.
Stateless HTTP microservices are best targeted to Cloud Run without introducing Kubernetes cluster operational overhead.
Cloud Run handles fully managed stateless container execution.
2
Determine least-privilege deployment execution permissions for Cloud Deploy.
The execution service account requires Cloud Run Developer (roles/run.developer) to deploy service revisions.
This provides fine-grained permissions specific to managing Cloud Run deployments.
3
Determine identity impersonation requirements for the execution runner.
Grant roles/iam.serviceAccountUser to the execution service account specifically bound to the designated runtime service account.
This enables Cloud Deploy to attach and run the service under the specific runtime identity without granting broad administrative control.

Key Concept

Continuous Delivery Pipeline Identity & Least Privilege IAM Configuration
Question 676Question →

An enterprise cloud security architect is documenting the evaluation order for Google Cloud Identity and Access Management (IAM) permissions. When a principal requests access to a Google Cloud resource, IAM evaluates policies hierarchically. Place the following evaluation steps in the correct order, starting from the initial policy evaluation check to the final access decision.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct evaluation sequence begins with checking IAM Deny policies across the hierarchy, followed by evaluating IAM Allow policy inheritance top-down from Organization to Folder/Project, checking target resource-level IAM Allow policies, and concluding with a final decision that defaults to implicit deny unless an Allow policy matches.
Google Cloud evaluates authorization requests by first checking IAM Deny policies at all hierarchy levels. If no Deny policy blocks the request, IAM checks for Allow policy bindings starting at the top of the resource hierarchy (Organization node), moving down through intermediate Folder and Project nodes, and finally checking resource-level policies. If any evaluated Allow policy grants the required permission, access is granted; otherwise, an implicit deny is enforced.

Step-by-Step Solution

1
Check for explicit IAM Deny policies across the resource hierarchy
If a matching Deny policy is found at any level (Organization, Folder, or Project), evaluation stops and access is immediately denied.
Google Cloud IAM evaluates Deny rules first to ensure security guardrails override any permissive Allow rules.
2
Evaluate Allow policies starting at the Organization level
Permissions granted at the Organization node inherit down to all folders, projects, and resources.
IAM uses additive inheritance down the resource hierarchy starting from the root node.
3
Evaluate Allow policies at Folder and Project levels
Permissions granted at Folder and Project levels add to the inherited permissions evaluated from parent nodes.
Child nodes inherit parent permissions, and child policy bindings add additional permissions to the principal's effective access.
4
Evaluate Allow policies directly attached to the target resource
Resource-level policies are inspected to determine if explicit permissions exist at the resource level.
Some GCP resources support fine-grained IAM policies attached directly to individual resource instances.
5
Synthesize accumulated permissions and emit the final authorization decision
Access is granted if any Allow policy matched; otherwise, access is blocked by implicit deny.
IAM operates on a default-deny model where access requires at least one explicit Allow binding.

Key Concept

Google Cloud IAM Policy Evaluation Logic and Resource Hierarchy Inheritance
Question 677Question →

An organization requires all Data Access audit logs across all projects in their Google Cloud organization to be centralized into a BigQuery dataset housed within a dedicated security governance project for compliance analytics. In what sequential order should a Cloud Security Architect execute these implementation steps to establish this aggregated log export?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence begins with provisioning the target BigQuery dataset in the security project, followed by creating the organization aggregated log sink, retrieving the generated writer service account identity, and finally granting that service account the required IAM role on the destination dataset.
Centralized log aggregation in GCP requires preparing the target storage resource first. Next, creating the organization aggregated log sink establishes the log filter and generates a unique service account writer identity. After retrieving this service account identity, granting it write permissions (such as BigQuery Data Editor) on the target dataset enables authorized log delivery across the organization.

Step-by-Step Solution

1
Create the target BigQuery dataset inside a dedicated security project.
A destination dataset is available to store centralized logs.
Cloud Logging sinks require a pre-existing destination path upon sink creation.
2
Define an organization-level aggregated sink pointing to the dataset with a Data Access log filter.
The aggregated sink route is established, generating a unique writer service account.
Cloud Logging uses distinct service accounts per sink to maintain least-privilege log delivery.
3
Extract the writer service account principal ID from the log sink details.
The specific service account identity is available for role assignment.
The writer service account is dynamically created by GCP during sink definition.
4
Grant the BigQuery Data Editor role to the sink service account on the target dataset.
The sink receives authorization to ingest incoming audit log records.
Without explicit destination permissions, log export calls will be rejected.

Key Concept

Organization Aggregated Log Sinks and Service Account Ingestion Authorization
Estimated Time:1m 30s
Question 678Question →

A smart grid utility organization is automating the provisioning of a private Google Kubernetes Engine (GKE) cluster for critical infrastructure monitoring using Terraform. The deployment pipeline must ensure secure control plane access, maintain least-privilege identity access management, and protect infrastructure deployment state from concurrency conflicts. Which two configuration actions should you include in your provisioning architecture to satisfy these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure master authorized networks on the GKE private cluster to restrict control plane access strictly to designated management subnet IP ranges.; Grant the Service Account User role (roles/iam.serviceAccountUser) to the deployment pipeline identity so it can bind runtime service accounts to node pools.

Answer

Configure master authorized networks to secure the GKE private control plane endpoint, and assign the Service Account User role to the deployment pipeline identity.
Configuring master authorized networks restricts GKE control plane endpoint access exclusively to designated IP ranges, ensuring secure management access. Concurrently, granting the Service Account User role provides the necessary permissions for the provisioning pipeline to attach runtime identities to cluster nodes without granting broad administrative privileges.

Step-by-Step Solution

1
Evaluate private GKE cluster control plane access controls.
Configuring master authorized networks limits control plane communication to specific authorized CIDR blocks, securing the endpoint even if exposed privately.
Private GKE clusters require explicit master authorized networks to prevent unauthorized internal subnets from accessing cluster administration APIs.
2
Evaluate identity and access management requirements for deployment service accounts.
Granting roles/iam.serviceAccountUser permits the deployment pipeline to provision compute instances and GKE node pools with target service accounts attached.
Least-privilege guidelines dictate granting Service Account User rather than administrative or broad primitive roles.

Key Concept

GKE Private Cluster Provisioning & IAM Least-Privilege Execution
Estimated Time:2m 0s
Question 679Question →

A media analytics company needs to connect its on-premises data center to a Google Cloud Virtual Private Cloud (VPC). The workload requires a sustained bandwidth of 2 Gbps, an SLA-backed connection, and rapid deployment without requiring physical colocation presence at a Google peering location. Additionally, the solution must support dynamic routing so that newly created on-premises subnets are automatically advertised to Google Cloud without manual intervention. Which hybrid connectivity configuration best meets these requirements?

Show answer & explanation

Answer: Provision a Partner Interconnect connection using Cloud Router to establish BGP dynamic routing.

Answer

Provision a Partner Interconnect connection using Cloud Router to establish BGP dynamic routing.
Partner Interconnect is designed for organizations that require SLA-backed, high-bandwidth (such as 2 Gbps) connectivity to Google Cloud through a service provider without needing physical co-location at a Google colocation facility. Coupling Partner Interconnect with Cloud Router enables BGP dynamic routing, allowing newly added on-premises subnets to be automatically advertised to the GCP VPC.

Step-by-Step Solution

1
Evaluate bandwidth and SLA requirements.
The requirement is 2 Gbps with an SLA, which excludes single Classic VPN tunnels and points toward Interconnect solutions.
Interconnect solutions provide SLA-backed high-bandwidth connectivity.
2
Evaluate physical presence and deployment speed constraints.
The company does not have a physical presence at a Google colocation facility, eliminating Dedicated Interconnect.
Partner Interconnect connects via a service provider without requiring direct physical colocation.
3
Evaluate routing requirements.
Dynamic routing with Cloud Router via BGP satisfies the need for automatic subnet propagation.
BGP sessions on Cloud Router dynamically exchange routing information between on-premises routers and GCP.

Key Concept

Selecting and configuring Partner Interconnect with Cloud Router BGP dynamic routing for hybrid cloud connectivity without direct colocation.
Question 680Question →

An enterprise organization operates a central Hub VPC network connected to on-premises datacenters via Dedicated Interconnect using Cloud Routers configured with global dynamic routing. Two independent spoke VPC networks (Spoke-A and Spoke-B) maintain VPC Network Peering connections to the central Hub VPC network to reach shared services. Software components deployed in Spoke-A now require direct, low-latency private connectivity to backend instances located in Spoke-B. However, network traffic initiated from Spoke-A fails to reach Spoke-B endpoints. Which network topology modification should you implement to enable communication between Spoke-A and Spoke-B according to Google Cloud networking rules?

Show answer & explanation

Answer: Configure a direct VPC Network Peering connection between Spoke-A and Spoke-B networks.

Answer

Establish a direct VPC Network Peering connection between Spoke-A and Spoke-B.
Google Cloud VPC Network Peering is non-transitive. If VPC network A is peered with VPC network B, and VPC network B is peered with VPC network C, workloads in network A cannot reach workloads in network C through network B. To allow workloads in Spoke-A to reach backend workloads in Spoke-B over internal IP addresses, a direct VPC Network Peering connection between Spoke-A and Spoke-B must be established.

Step-by-Step Solution

1
Analyze the existing network architecture and connectivity breakdown.
Identified that Spoke-A and Spoke-B are both peered to Hub VPC, but not to each other.
Google Cloud VPC Network Peering is strictly non-transitive, meaning traffic cannot traverse Hub VPC to reach Spoke-B from Spoke-A.
2
Evaluate Google Cloud networking mechanisms for inter-VPC communication.
Direct VPC Network Peering between Spoke-A and Spoke-B establishes direct internal IP routing between both networks without passing through external gateways.
Direct peering respects the non-transitive route isolation model of Google Cloud VPCs.

Key Concept

VPC Network Peering Non-Transitivity
PreviousPage 34 / 80Next
All practice questions — Google Cloud Professional Cloud Architect | Examkin