Examkin

All practice questions

1598 questions

All types1,598Multiple choice815Multiple select537Numeric8Matching64Ordering174
Question 721Question →

An enterprise organization wants to automatically detect potential data exfiltration and unauthorized IAM policy modifications in real time across their entire GCP resource hierarchy. They require a fully managed Google Cloud threat detection service that automatically inspects Cloud Audit Logs for suspicious behavior without requiring custom log parsing code or third-party SIEM management. Which GCP solution should the organization implement?

Show answer & explanation

Answer: Enable Security Command Center Premium to leverage Event Threat Detection for automated real-time analysis of Cloud Audit Logs across the organization.

Answer

Enable Security Command Center Premium to leverage Event Threat Detection for automated real-time analysis of Cloud Audit Logs across the organization.
The correct solution uses Security Command Center Premium's built-in Event Threat Detection (ETD) engine. ETD continuously analyzes organization-level Cloud Audit Logs to identify threat patterns—such as unauthorized IAM changes, anomalous data downloads, and compromised service accounts—without requiring custom infrastructure or log parsing software.

Step-by-Step Solution

1
Identify the core architectural requirement.
The solution must detect security threats like data exfiltration and unauthorized IAM changes in real time from audit logs across the GCP resource hierarchy without custom log parsing scripts.
Managed security services minimize operational overhead and avoid custom maintenance.
2
Evaluate Google Cloud native security capabilities.
Security Command Center (SCC) Premium provides Event Threat Detection (ETD), which natively ingests and monitors Cloud Audit Logs (including Admin Activity and Data Access logs) at scale.
ETD uses built-in logic and machine learning to detect suspicious activities such as brute-force attacks, IAM policy tampering, and data exfiltration.
3
Select the option that meets all security and governance constraints.
Enabling Security Command Center Premium with Event Threat Detection fulfills all real-time threat analysis requirements.
It operates across the entire organization hierarchy seamlessly without requiring broad IAM privileges or custom scripts.

Key Concept

Security Command Center Event Threat Detection for automated Cloud Audit Log monitoring
Question 722Question →

A financial enterprise operating multiple Google Cloud projects under an organization resource needs to establish centralized audit logging and threat detection. The compliance team mandates that all Data Access audit logs across the entire organization must be continuously archived to a secure BigQuery dataset in a dedicated security project. Additionally, the security operations team requires real-time detection of anomalous user activities and unauthorized IAM modifications without introducing operational overhead for agent deployment. Which TWO configurations should the cloud architect implement to fulfill these requirements?

Select all that apply

Show answer & explanation

Answer: Create an organization-level aggregated log sink configured with an inclusion filter for Data Access logs targeting the centralized BigQuery dataset, managed via a dedicated writer service account.; Enable Security Command Center Premium to leverage Event Threat Detection for analyzing log streams in real time for suspicious IAM changes and potential threats.

Answer

The correct architecture requires creating an organization-level aggregated log sink targeting BigQuery for centralized Data Access audit log retention, and enabling Security Command Center Premium to utilize Event Threat Detection for near real-time analysis of Cloud Audit Logs.
The solution combines organization-level aggregated log sinks for automated, central BigQuery archiving of Data Access audit logs with Security Command Center Premium Event Threat Detection for agentless, real-time threat monitoring across all audit log events.

Step-by-Step Solution

1
Evaluate central logging requirements for multi-project compliance
Identified that an organization-level aggregated log sink continuously exports logs across all projects under the organization hierarchy to BigQuery.
Centralized aggregated sinks ensure non-repudiable log collection from child projects without depending on individual project administrators.
2
Evaluate threat detection requirements for IAM and anomalous behavior
Identified Security Command Center Premium with Event Threat Detection as the native Google Cloud capability for analyzing audit log streams.
Event Threat Detection inspects Cloud Audit Logs stream data automatically at scale to identify suspicious access and administrative anomalies.

Key Concept

Organization-level aggregated log sinks and Security Command Center Event Threat Detection
Question 723Question →

A principal attempts to execute an API call on a Compute Engine instance residing in a project nested within a folder hierarchy under an Organization node. IAM Deny policies and IAM Allow policies are configured across multiple levels of the resource hierarchy. In what correct chronological order does Google Cloud IAM evaluate these policies to determine whether to authorize or reject the request?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence begins with top-down evaluation of IAM Deny policies starting from the Organization level, followed by intermediate Folder levels, and then the Project level. Next, inherited and direct IAM Allow policies across the entire hierarchy are evaluated in effective union. Finally, the system renders an authorization decision granting access only if a valid Allow policy exists and no Deny policies apply.
In Google Cloud IAM, policy evaluation follows a strict order: Deny policies are evaluated first, starting at the root Organization node and moving down through Folders to the target Project. If no Deny policy matches, IAM computes the union of all inherited and direct Allow policies across Organization, Folder, Project, and Resource levels. If at least one Allow policy grants the permission, access is authorized.

Step-by-Step Solution

1
Evaluate Organization-level Deny policies
Highest priority Deny rules checked first
Google Cloud IAM Deny policies take precedence over Allow policies and are evaluated starting from the root Organization node.
2
Evaluate Folder-level Deny policies
Hierarchical Deny check traverses intermediate parent folders
Deny policies set at parent folder levels inherit downwards and block access before project policies or allow policies are considered.
3
Evaluate Project-level Deny policies
Project container Deny rules checked
Project-scoped Deny policies form the final layer of explicit denial checks before evaluating permissions.
4
Evaluate effective Union of IAM Allow policies across all levels
Aggregated inherited and direct permissions evaluated
IAM Allow policies are additive across Organization, Folder, Project, and Resource nodes. If no Deny rule matched, all granted roles are evaluated together.
5
Render authorization decision
Access authorized or implicitly denied
If an Allow rule grants the required permission, access is authorized; if no matching Allow rule is found, IAM denies access by default.

Key Concept

GCP IAM Policy Evaluation Order and Resource Hierarchy Inheritance
Question 724Question →

An enterprise security architect needs to configure an organization-wide aggregated Cloud Audit Log pipeline to stream Data Access audit logs from all current and future child projects into a centralized BigQuery dataset in a security management project. Arrange the deployment steps in the correct chronological order required to successfully establish this aggregated sink with least privilege access.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence begins by creating the destination BigQuery dataset, followed by creating the organization-level aggregated log sink with child inclusion enabled. Next, the auto-generated writer identity service account for the sink is retrieved, and finally, the service account is granted the BigQuery Data Editor role on the target dataset.
Establishing an organization-wide aggregated log sink requires creating the target dataset first, defining the organization sink with child inclusion to generate a dedicated service account identity, extracting that service account identity, and applying dataset-level IAM permissions to grant write access.

Step-by-Step Solution

1
Provision the destination storage resource in the security project.
A BigQuery dataset is created to serve as the destination URI for incoming audit log entries.
Cloud Logging sinks require an existing destination resource upon creation.
2
Execute the organization sink creation command defining the log filter and enabling child project aggregation.
The aggregated log sink is established at the organization root, and Cloud Logging creates a unique service account writerIdentity.
Creating an organization sink with the include-children parameter ensures log collection across the entire resource hierarchy.
3
Inspect the created sink properties to extract the writerIdentity service account string.
The sink's service account email address is obtained.
The service account identity is needed to grant target dataset access.
4
Apply IAM binding granting the writer identity service account BigQuery Data Editor permissions on the target dataset.
Logs begin successfully streaming from child projects into the centralized BigQuery dataset.
Least-privilege authorization must be explicitly configured on the destination resource for log writing to succeed.

Key Concept

Organization-Aggregated Cloud Audit Log Sinks and Service Account Authorization
Estimated Time:1m 30s
Question 725Question →

A financial technology company is automating the infrastructure deployment of a regional order-processing database using Terraform. The database requires standard relational ACID capabilities within a single Google Cloud region, automated high-availability failover, and data encryption at rest managed through Cloud KMS. Furthermore, the engineering team must ensure that automated CI/CD execution of Terraform code prevents state corruption and concurrent execution locks when provisioning database and storage resources. Which configuration strategy should the cloud architect recommend?

Show answer & explanation

Answer: Provision a Cloud SQL instance with High Availability (regional failover) encrypted with Customer-Managed Encryption Keys (CMEK), and store the Terraform state in a Cloud Storage backend with object versioning and state locking enabled.

Answer

Provision a Cloud SQL instance configured for High Availability using Customer-Managed Encryption Keys (CMEK) via Cloud KMS, while managing Terraform state in a Cloud Storage backend configured with object versioning and state locking.
Cloud SQL satisfies the requirement for a single-region relational database with automated HA failover, fully supporting CMEK via Cloud KMS integration. Using Google Cloud Storage as a remote Terraform backend with state locking and object versioning ensures secure, concurrent-safe deployment operations.

Step-by-Step Solution

1
Evaluate database requirements
Cloud SQL PostgreSQL/MySQL provides regional single-region relational storage with high availability failover without the multi-region overhead of Cloud Spanner.
Matching single-region relational requirements with Cloud SQL optimizes cost and meets architectural objectives.
2
Select encryption management model
Configure Customer-Managed Encryption Keys (CMEK) via Cloud KMS.
Cloud SQL supports CMEK for centralized key governance, whereas CSEK is not supported on Cloud SQL.
3
Configure IaC state management
Use Google Cloud Storage backend for Terraform with state locking and versioning enabled.
Prevents concurrent deployment pipelines from causing race conditions or corrupting database infrastructure state.

Key Concept

Provisioning Cloud SQL with CMEK and securing IaC state management via Cloud Storage backends.
Question 726Question →

A media distribution company stores proprietary video assets in a Google Cloud Storage bucket located within an isolated project. Although fine-grained IAM permissions strictly limit access to authorized developers, the security team must prevent these developers from copying data from the internal storage bucket to an external Google Cloud Storage bucket outside the organization. Which perimeter security control should be implemented to prevent this data exfiltration?

Show answer & explanation

Answer: Configure a VPC Service Controls service perimeter around the project housing the Cloud Storage bucket.

Answer

Configure a VPC Service Controls service perimeter around the project housing the Cloud Storage bucket.
Configuring a VPC Service Controls service perimeter around the project isolates Google Cloud service APIs (like Cloud Storage). It ensures that data cannot be read from within the perimeter and written to storage resources outside the defined boundary, effectively mitigating data exfiltration risks by authorized identities.

Step-by-Step Solution

1
Analyze the security requirement
The requirement asks to block authorized users from exfiltrating data from an internal Cloud Storage bucket to an external storage bucket outside the organization boundary.
Understanding the threat vector distinguishes between identity-based access control (IAM) and perimeter-based exfiltration control.
2
Evaluate Google Cloud perimeter security capabilities
VPC Service Controls creates a security perimeter around Google Cloud managed services (such as Cloud Storage) to restrict API access and prevent data transfers across the perimeter boundary.
VPC Service Controls prevents authorized users from writing data outside the perimeter even if their IAM credentials permit storage API calls.

Key Concept

VPC Service Controls Data Exfiltration Prevention
Question 727Question →

An organization is configuring a custom VPC network topology for Compute Engine instances running in a private subnet with no external IP addresses. The workloads require secure access to Google Cloud APIs (such as Cloud Storage) and need to consume a microservice hosted in an external vendor's VPC project without exposing internal IP ranges or allowing transitive network access through intermediate VPCs. Which network topology configuration satisfies these requirements?

Show answer & explanation

Answer: Enable Private Google Access on the private subnet for Google Cloud API connectivity, and deploy a Private Service Connect endpoint to consume the vendor microservice privately.

Answer

Enable Private Google Access on the private subnet for Google APIs and deploy a Private Service Connect endpoint to access the external service.
The correct answer combines Private Google Access for native GCP API connectivity with Private Service Connect endpoints for consuming external published services. This fulfills all requirements without exposing public IPs, relying on transitive peering, or deploying complex VPN gateways.

Step-by-Step Solution

1
Analyze network access requirements for Google APIs from private subnets.
Enabling Private Google Access allows Compute Engine instances lacking external IP addresses to communicate with Google APIs via internal routing.
Without public IP addresses or Cloud NAT, instances cannot reach default public Google API endpoints unless Private Google Access is enabled.
2
Determine the optimal cross-project connectivity mechanism for consuming vendor services without transitivity.
Deploying a Private Service Connect (PSC) endpoint creates a local IP inside the workload subnet that forwards traffic securely to the published service.
PSC endpoints avoid transitivity limitations of VPC Network Peering and do not require overlapping IP management or complex VPN setups.

Key Concept

Private Google Access & Private Service Connect Topology
Question 728Question →

A healthcare organization is preparing to migrate its patient analytics platform to Google Cloud to satisfy impending regulatory reporting deadlines. During stakeholder change management and operational readiness reviews, the cloud architect determines that the planned peak batch processing workload will exceed default regional vCPU quotas. Which operational action should the cloud architect take to ensure the business timeline is met without deployment failure?

Show answer & explanation

Answer: Submit and confirm regional vCPU quota increase requests in advance of the scheduled migration execution.

Answer

Submit and confirm regional vCPU quota increase requests in advance of the scheduled migration execution.
Proactively requesting quota increases in advance ensures that necessary compute capacity is allocated before workload execution begins. This satisfies business deadlines and avoids operational friction during migration.

Step-by-Step Solution

1
Analyze workload requirements against default Google Cloud project quotas.
Identify that peak batch processing demands exceed default regional vCPU limits.
Default GCP quotas are intended to protect projects from unexpected usage and must be explicitly increased for larger workloads.
2
Initiate quota increase requests prior to migration.
Ensure quota approvals are granted by Google Cloud ahead of technical deployment.
Quota increases can require review time; submitting them in advance prevents migration delays.

Key Concept

Stakeholder Requirement Analysis and Quota Management
Question 729Question →

A regional logistics enterprise needs to establish hybrid connectivity between its on-premises data center and a Google Cloud Virtual Private Cloud (VPC) to process real-time fleet telemetry. The workload requires a sustained throughput of 1.5 Gbps with dynamic BGP routing over a private network connection. The enterprise's data center does not have a physical presence at a Google Cloud colocation facility. Which hybrid connectivity solution should the cloud architect configure?

Show answer & explanation

Answer: Partner Interconnect configured with Cloud Router

Answer

Partner Interconnect configured with Cloud Router
Partner Interconnect allows organizations to connect their on-premises network to a Google Cloud VPC through a supported service provider when they do not reside in a Google Cloud colocation facility. It supports custom capacity allocations (such as 1.5 Gbps) and dynamic BGP routing via Cloud Router without traversing the public internet.

Step-by-Step Solution

1
Evaluate colocation and physical access requirements
The enterprise lacks physical presence in a Google Cloud colocation facility, ruling out direct cabling options.
Dedicated Interconnect requires establishing a physical connection at a supported Google edge colocation facility.
2
Analyze bandwidth and network transport constraints
A 1.5 Gbps private connection is required without sending traffic over the public internet.
Partner Interconnect provides flexible sub-10 Gbps capacity allocations over a service provider's private network.
3
Select the appropriate routing and interconnect components
Partner Interconnect paired with Cloud Router meets all criteria.
Cloud Router provides dynamic BGP route exchanges across the VLAN attachment connected through the service provider.

Key Concept

Selecting Partner Interconnect when on-premises facilities lack direct Google Cloud colocation presence for sub-10 Gbps private bandwidth.
Estimated Time:1m 30s
Question 730Question →

An organization is deploying an application on a Compute Engine virtual machine instance that needs read-only access to objects stored in a Cloud Storage bucket. Which configuration aligns with Google Cloud recommended best practices for service account security and least privilege?

Show answer & explanation

Answer: Create a user-managed service account with the Storage Object Viewer role assigned to it, and attach this service account to the Compute Engine instance.

Answer

Create a user-managed service account with the Storage Object Viewer role assigned to it, and attach this service account to the Compute Engine instance.
The optimal architecture attaches a user-managed service account with minimal predefined roles (Storage Object Viewer) directly to the Compute Engine instance. This enables seamless authentication via the metadata server without exporting service account keys or granting excessive permissions.

Step-by-Step Solution

1
Identify the minimum required permission for the workload.
The application only needs to read objects in Cloud Storage, which maps to the predefined role Storage Object Viewer.
Following the principle of least privilege ensures the workload has no extra permissions beyond what is strictly necessary.
2
Select the secure credential delivery mechanism for GCP workloads.
Attach a custom user-managed service account to the Compute Engine instance.
Attaching the service account allows the application to authenticate automatically using Application Default Credentials (ADC) without generating or managing long-lived JSON service account keys.

Key Concept

Service Account Lifecycle and Least Privilege Security
Estimated Time:50s
Question 731Question →

A software architecture team at a media streaming organization is conducting a post-incident review of their continuous delivery pipeline. The current SDLC pipeline uses Cloud Build to execute Terraform manifests that provision Cloud Run microservices and manage IAM permissions across staging and production environments. The audit revealed that the Cloud Build trigger runs under a service account with the primitive Editor role (`roles/editor`), the Terraform state file is stored in a Cloud Storage bucket without versioning or state locking, and team members frequently perform manual Cloud Console adjustments when builds fail, creating significant configuration drift. Which set of architectural optimizations should the team implement to secure the pipeline and standardize their SDLC release process according to Google Cloud best practices?

Show answer & explanation

Answer: Configure Cloud Build to execute using a dedicated user-managed service account with fine-grained predefined roles, enable object versioning and state locking on the Terraform Cloud Storage backend, and restrict infrastructure mutations exclusively to automated CI/CD pipeline executions.

Answer

Configure Cloud Build to execute using a dedicated user-managed service account with fine-grained predefined roles, enable object versioning and state locking on the Terraform Cloud Storage backend, and restrict infrastructure mutations exclusively to automated CI/CD pipeline executions.
The solution requiring a dedicated user-managed service account with fine-grained roles, combined with Cloud Storage object versioning and state locking for Terraform, directly remediates all identified SDLC process flaws. Enforcing automated pipeline execution eliminates manual drift and ensures traceable, repeatable deployment environments.

Step-by-Step Solution

1
Analyze security boundaries for CI/CD pipeline execution.
Identify that using primitive roles like Editor grants overly broad privileges. Replacing this with a dedicated user-managed service account adhering to least privilege isolates pipeline access.
CI/CD execution service accounts must only hold specific permissions required for artifact build and infrastructure deployment.
2
Evaluate Infrastructure as Code (IaC) state management integrity.
Determine that the Cloud Storage remote backend for Terraform must have Object Versioning enabled and support native state locking.
State locking prevents concurrent pipeline runs from corrupting state, while object versioning allows rollback and recovery if state corruption occurs.
3
Assess environment governance and configuration drift prevention.
Enforce strict GitOps principles where all infrastructure changes are declared in code and executed via automated builds, disallowing manual Console modifications.
Manual changes introduce configuration drift that invalidates IaC state tracking and leads to deployment failures in subsequent release cycles.

Key Concept

Secure SDLC and CI/CD Pipeline Optimization with Terraform State Management and IAM Security
Estimated Time:2m 0s
Question 732Question →

A software engineering team is establishing an automated deployment validation procedure for microservices running on a private Google Kubernetes Engine (GKE) cluster. During pipeline execution, automated test runners operating inside a separate management Virtual Private Cloud (VPC) attempt to execute verification scripts against the cluster master endpoint, but all connection attempts time out. Which procedure should the cloud architect implement to enable successful automated validation testing of the technical solution?

Show answer & explanation

Answer: Configure master authorized networks on the private GKE cluster to explicitly allow the CIDR range of the management VPC test runners.

Answer

Configure master authorized networks on the private GKE cluster to explicitly allow the CIDR range of the management VPC test runners.
In private GKE clusters, master authorized networks provide network-level access control to the Kubernetes control plane. To allow automated test runners from another VPC to execute validation commands against the API server, their specific IP subnet range must be included in the authorized networks list.

Step-by-Step Solution

1
Identify the cause of the network timeout during automated test validation.
The private GKE cluster control plane endpoint blocks incoming traffic from unauthorized IP ranges.
Private GKE clusters do not expose master endpoints to external or non-authorized internal networks by default.
2
Update the GKE cluster master authorized networks configuration.
The CIDR range of the test runner subnet within the management VPC is permitted to reach the master endpoint.
Master authorized networks enforce network-level access control to the cluster API server without making the endpoint publicly accessible.

Key Concept

Validating private cluster endpoints and master authorized network configurations
Estimated Time:1m 0s
Question 733Question →

A multinational enterprise operates a multi-project Google Cloud organization hosting PCI-DSS regulated payment microservices across hundreds of Virtual Private Cloud (VPC) networks. Central security governance mandates that all Compute Engine workloads must be protected by mandatory threat-blocking firewall policies defined at the organization level. The security design must satisfy three strict constraints:
1. Firewall rules must evaluate dynamically based on fine-grained resource identity tags rather than network IP ranges or service accounts.
2. Individual project administrators must be permitted to append project-specific ingress rules without the ability to override or bypass central organization security guardrails.
3. The design must prohibit transitive network exposure across project boundaries while keeping operational overhead minimal.

Which architectural design meets these requirements?

Show answer & explanation

Answer: Apply Hierarchical Firewall Policies at the Organization level using Secure Tags bound to resource instances, and utilize rule evaluation order with delegated rule priority ranges to permit project-level custom firewall rules below organizational rules.

Answer

Apply Hierarchical Firewall Policies at the Organization level using Secure Tags bound to resource instances, and utilize rule evaluation order with delegated rule priority ranges to permit project-level custom firewall rules below organizational rules.
Hierarchical Firewall Policies enable security teams to define consistent firewall rules across all projects in the organization. By attaching rules to Secure Tags (managed via Resource Manager IAM), rules dynamically follow workloads regardless of IP changes or VPC locations, while preventing local project admins from spoofing tags. Because hierarchical rules evaluate prior to VPC-level firewall rules, central security guardrails cannot be overridden by project admins.

Step-by-Step Solution

1
Evaluate perimeter control requirements for multi-project centralized governance.
Identified the need for Organization-level enforcement that cannot be bypassed by project-level admins.
Hierarchical Firewall Policies inherit down the resource hierarchy (Org -> Folder -> Project -> VPC) and enforce mandatory rules before local project VPC firewall rules are evaluated.
2
Select the appropriate workload matching mechanism.
Choose Secure Tags (Resource Manager Tags) integrated with Hierarchical Firewall Policies.
Secure Tags are bound to instances at the Resource Manager level with strict IAM access control (`roles/resourcemanager.tagUser`), preventing project administrators from modifying tags to bypass security rules, unlike standard network target tags.
3
Configure rule delegation for project administrators.
Set organizational firewall rule evaluation priority higher (lower numeric priority values) than project VPC firewall rules.
Google Cloud firewall evaluation processes hierarchical policy rules first. Matching explicit deny/allow actions at the organization level short-circuits further evaluation, ensuring project rules only apply within the allowed delegation scope.

Key Concept

Hierarchical Firewall Policies and Secure Tags for Centralized Cloud Governance
Question 734Question →

An enterprise financial institution is auditing its Google Cloud security posture to enforce strict service account lifecycle governance and credential protection. The security team discovered that developers are generating downloadable JSON service account keys for local debugging and using primitive IAM roles across multi-project environments. Furthermore, a legacy application on Compute Engine instances requires access to sensitive third-party API credentials stored in Secret Manager, with an organizational mandate to enforce automated secret rotation and prevent key exfiltration. Which TWO security controls and architecture pattern changes should you implement to satisfy these compliance mandates while adhering to Google-recommended practices? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Enforce the IAM organization policy constraint `iam.disableServiceAccountKeyCreation` at the organization level, and configure Workload Identity Federation or service account impersonation using short-lived credentials for developer access.; Configure Secret Manager with Cloud Pub/Sub topics to trigger Cloud Functions for automated secret version rotation, and grant the Cloud Run/Function service account Secret Manager Secret Accessor permissions on the target secret.

Answer

Enforce the IAM organization policy constraint `iam.disableServiceAccountKeyCreation` while providing developers short-lived credentials via service account impersonation, and automate Secret Manager secret rotation using Pub/Sub notifications paired with Cloud Functions configured with fine-grained Secret Manager roles.
Enforcing the `iam.disableServiceAccountKeyCreation` organizational policy mitigates credential leakage risks by meangingfully preventing the creation of long-lived JSON keys, pushing developers toward short-lived credentials via service account impersonation. Additionally, coupling Secret Manager with Pub/Sub topics and Cloud Functions enables automated end-to-end credential rotation using fine-grained Cloud IAM roles.

Step-by-Step Solution

1
Analyze service account key compliance requirements
Identify that downloading long-lived JSON keys creates significant security risks and violates organizational governance.
Preventing service account key creation via organizational policy `iam.disableServiceAccountKeyCreation` forces developers to adopt secure identity delegation mechanisms such as short-lived IAM credentials and Workload Identity.
2
Evaluate automated secret lifecycle management
Determine the Google Cloud recommended secret rotation mechanism.
Secret Manager natively integrates with Cloud Pub/Sub to trigger automated rotation workflows via Cloud Functions or Cloud Run, maintaining secret freshness while leveraging least-privilege IAM roles like `roles/secretmanager.secretAccessor`.
3
Eliminate antipatterns and primitive role usage
Reject primitive IAM roles and CSEK configurations.
Primitive roles grant excessive privileges, and CSEK is not supported for Secret Manager, whereas CMEK or standard Secret Manager encryption with Cloud KMS is the proper architecture.

Key Concept

Service Account Lifecycle Hardening and Secret Manager Automated Rotation Architecture
Question 735Question →

A healthcare enterprise manages several data analytics workloads across multiple projects contained within a folder named Clinical-Analytics in its Google Cloud resource hierarchy. A deployment automation pipeline uses a primary service account to create Compute Engine instances in any project under this folder. The pipeline must also attach an existing runtime service account to these newly provisioned instances. Which IAM role configuration meets these requirements while enforcing the principle of least privilege?

Show answer & explanation

Answer: Grant Compute Instance Admin (roles/compute.instanceAdmin.v1) on the Clinical-Analytics folder to the deployment service account, and grant Service Account User (roles/iam.serviceAccountUser) on the runtime service account resource to the deployment service account.

Answer

Grant Compute Instance Admin (roles/compute.instanceAdmin.v1) on the Clinical-Analytics folder to the deployment service account, and grant Service Account User (roles/iam.serviceAccountUser) on the runtime service account resource to the deployment service account.
The correct solution leverages resource hierarchy inheritance by assigning Compute Instance Admin at the folder node level, granting provisioning permissions across all child projects. Scoping the Service Account User role directly on the runtime service account resource grants the automation account exact permission to attach the identity to instances without granting service account management rights.

Step-by-Step Solution

1
Analyze resource hierarchy inheritance requirements
Assigning Compute Instance Admin (roles/compute.instanceAdmin.v1) at the Clinical-Analytics folder level ensures that all existing and future projects within the folder inherit instance management capabilities automatically.
Folder-level IAM bindings propagate down the resource hierarchy to child projects, avoiding manual project-by-project role assignments.
2
Determine the minimal permission needed to bind a runtime identity to Compute Engine instances
The deployment service account requires the Service Account User role (roles/iam.serviceAccountUser) specifically scoped to the target runtime service account.
This permission allows an identity to attach a service account to a compute resource without giving administrative privileges over the service account itself.
3
Evaluate distractors against least privilege principles
Reject options that use primitive roles (Editor), grant full service account management (Service Account Admin), or grant Organization-wide permissions.
Custom and predefined fine-grained roles scoped to the narrowest resource boundary (folder and service account resource) strictly follow Google Cloud security recommendations.

Key Concept

Resource Hierarchy IAM Inheritance & Service Account Impersonation
Estimated Time:2m 0s
Question 736Question →

A biomedical research enterprise needs to migrate genomic sequence datasets from its primary on-premises facility to a Google Cloud Virtual Private Cloud (VPC). The workload requires a sustained private bandwidth of 15 Gbps. The enterprise facility is not located in a Google Cloud colocation site, but a supported service provider is available nearby. Which TWO actions must the network architect perform to configure this hybrid connection in accordance with Google Cloud best practices?

Select all that apply

Show answer & explanation

Answer: Provision Partner Interconnect VLAN attachments through the supported service provider to establish connection to the Google Cloud VPC.; Configure Cloud Routers in the Google Cloud VPC to establish dynamic BGP sessions with the service provider routers.

Answer

The network architect must provision Partner Interconnect VLAN attachments through a supported service provider and configure Cloud Routers in the VPC network to establish dynamic BGP sessions.
Partner Interconnect is the required solution when high bandwidth (>10 Gbps) is needed and the customer facility is not located in a Google Cloud direct colocation site. Configuring Cloud Routers in the target VPC allows BGP sessions to exchange dynamic routes across the Partner Interconnect VLAN attachments.

Step-by-Step Solution

1
Assess hybrid connectivity bandwidth and location requirements.
Since 15 Gbps bandwidth is required and the company is not in a Google colocation facility, Partner Interconnect is the appropriate choice over Dedicated Interconnect or HA VPN.
Dedicated Interconnect requires colocation at a Google edge location, while Cloud VPN cannot meet 15 Gbps throughput requirements.
2
Provision VLAN attachments with the service provider.
Connects the on-premises router infrastructure to the Google Cloud VPC network via the service provider's network.
Partner Interconnect uses VLAN attachments to bridge the customer premise through the provider to GCP.
3
Configure Cloud Router for dynamic routing.
BGP sessions are configured on the Cloud Router to dynamically announce and learn routes between the VPC and on-premises environment.
Dynamic BGP routing via Cloud Router is mandatory for Cloud Interconnect connections.

Key Concept

Configuring Partner Interconnect with Cloud Router BGP dynamic routing for high-bandwidth hybrid connectivity.
Estimated Time:2m 0s
Question 737Question →

A healthcare enterprise is implementing an automated deployment pipeline using Terraform to provision cloud storage infrastructure for HIPAA-regulated patient data. The platform architecture requires that infrastructure state files are strictly protected against concurrent modifications and state corruption. Additionally, the target storage buckets must adhere to corporate security governance for key management while protecting stored objects against accidental overwrites. Which two provisioning actions should the infrastructure team implement? (Select TWO)

Select all that apply

Show answer & explanation

Answer: Configure a remote Cloud Storage backend for Terraform with object versioning enabled on the state bucket.; Enable Object Versioning on the target data storage bucket and configure Customer-Managed Encryption Keys (CMEK) using Cloud KMS.

Answer

The team should configure a remote Cloud Storage backend for Terraform with object versioning enabled, and configure the target storage bucket with Object Versioning and Customer-Managed Encryption Keys (CMEK) via Cloud KMS.
Configuring a remote Cloud Storage backend for Terraform enforces automatic state locking and state retention via versioning, ensuring robust infrastructure state management. Combining Object Versioning with Customer-Managed Encryption Keys (CMEK) on the data storage bucket guarantees data recovery against accidental overwrites while adhering to corporate security and key rotation requirements through Cloud KMS.

Step-by-Step Solution

1
Evaluate Infrastructure as Code (IaC) state protection requirements.
Identified that remote state storage in Cloud Storage with Object Versioning handles state locking automatically and preserves state history.
Local unversioned state storage risks concurrency conflicts and accidental state corruption across automated pipelines.
2
Evaluate data protection and key management compliance requirements.
Selected Object Versioning for data retention and Customer-Managed Encryption Keys (CMEK) via Cloud KMS for key governance.
Object Versioning safeguards patient records from accidental overwrite/deletion, while CMEK fulfills corporate key management requirements without the operational burden of CSEK.

Key Concept

Provisioning secure Cloud Storage buckets and managing Terraform remote state locking and key governance
Question 738Question →

A global healthcare enterprise is migrating its patient image processing application to Google Cloud. To satisfy strict data privacy regulations and governance guardrails across all projects contained within the Healthcare-Workloads folder, the cloud security team must enforce two specific governance controls:

1. Compute Engine virtual machine instances must not be allocated external/public IP addresses.
2. Google Cloud resources must be restricted to deployment exclusively within European locations (eu-west1 and eu-west3).

Which TWO Organization Policy constraints should the cloud architect apply to the Healthcare-Workloads folder? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Enforce the `constraints/compute.vmExternalIpAccess` boolean constraint with an empty allowlist.; Enforce the `constraints/gcp.resourceLocations` list constraint configured to allow `in:eu-west1-locations` and `in:eu-west3-locations`.

Answer

The architect must enforce the `compute.vmExternalIpAccess` constraint to restrict public IP allocation and the `gcp.resourceLocations` constraint to limit resource creation to specified European regions.
Applying Organization Policy constraints at the folder level ensures inherited, immutable guardrails across all contained projects. The `compute.vmExternalIpAccess` constraint blocks public IP assignments on virtual machines, and the `gcp.resourceLocations` constraint restricts resource provisioning strictly to the specified European regions.

Step-by-Step Solution

1
Identify the mechanism for restricting external IP addresses on Compute Engine VMs across a resource hierarchy.
The Organization Policy constraint `constraints/compute.vmExternalIpAccess` governs which VM instances can have external IP addresses. Applying an empty allowlist denies external IP allocation for all instances in the target folder.
Organization policies allow centralized control over infrastructure configuration options across all child projects under a folder.
2
Identify the mechanism for enforcing data sovereignty and geographic location restrictions for GCP resource creation.
The `constraints/gcp.resourceLocations` list constraint restricts the physical regions where resources can be created. Configuring it with `in:eu-west1-locations` and `in:eu-west3-locations` fulfills the European location requirement.
Resource location constraints enforce compliance guardrails across supported GCP services at the resource hierarchy level.

Key Concept

Centralized Governance using Organization Policy Constraints for VM Networking and Resource Placement
Question 739Question →

A global online gaming enterprise manages its Google Cloud infrastructure using a resource hierarchy that includes a top-level folder named `Game-Services`. Developers in the engineering group require permissions to inspect Cloud Logging entries for all workload projects nested inside this folder, as well as the ability to attach specific predefined deployment service accounts when launching Cloud Run services. Additionally, an external automated CI/CD pipeline requires permissions to act on behalf of a dedicated deployment service account without obtaining excessive administrative control over service accounts. Following Google-recommended best practices for security and resource hierarchy governance, which TWO configuration actions should the cloud security architect implement?

Select all that apply

Show answer & explanation

Answer: Grant the Logging Viewer role (roles/logging.viewer) to the developers' Google Group at the `Game-Services` folder node, and grant the Service Account User role (roles/iam.serviceAccountUser) to the group on the specific target deployment service accounts.; Grant the Workload Identity User role (roles/iam.workloadIdentityUser) to the external CI/CD principal directly on the target deployment service account.

Answer

The cloud security architect should grant the Logging Viewer role to the developers' group at the folder level alongside the Service Account User role on specific service accounts, and grant the Workload Identity User role to the CI/CD principal directly on the target deployment service account.
To satisfy least privilege while minimizing management overhead, log viewing should be granted via the predefined Logging Viewer role at the `Game-Services` folder level so it inherits down to all child projects. Permitting users to deploy services with service accounts requires granting the Service Account User role scoped directly to the target service accounts. For automated CI/CD pipelines authentication via Workload Identity, binding the Workload Identity User role directly on the target service account grants required execution rights without administrative privileges.

Step-by-Step Solution

1
Analyze resource hierarchy inheritance for log viewing
Binding `roles/logging.viewer` to the developers' group on the `Game-Services` folder node ensures inherited read access to Cloud Logging entries across all child projects without over-granting project modification access.
IAM permissions set at a parent node in the GCP resource hierarchy inherit down to all contained child projects.
2
Evaluate service account attachment permissions
Binding `roles/iam.serviceAccountUser` specifically on the target service accounts grants developers permission to attach those service accounts to compute resources without allowing them to modify the service accounts themselves.
Granting permissions on individual service account resource instances adheres strictly to the principle of least privilege.
3
Configure external CI/CD impersonation
Binding `roles/iam.workloadIdentityUser` to the CI/CD identity principal on the specific deployment service account allows secure token exchange and impersonation for automated deployments.
Workload Identity Federation combined with service account level impersonation avoids service account key creation and limits access scope.

Key Concept

Fine-grained IAM role scoping across resource hierarchy nodes and service account impersonation controls
Estimated Time:2m 30s
Question 740Question →

A company is designing a disaster recovery (DR) validation procedure for a critical database running on Google Cloud. To ensure business continuity without disrupting active users during DR drills, the team needs to test regional failover and data restoration capabilities safely. Which procedure should the Cloud Architect recommend?

Show answer & explanation

Answer: Create an isolated test environment in the DR region using point-in-time database snapshots to validate recovery steps without impacting live production data.

Answer

Create an isolated test environment in the DR region using point-in-time database snapshots to validate recovery steps without impacting live production data.
The procedure recommending an isolated test environment in the DR region using point-in-time database snapshots ensures full validation of restoration scripts and application readiness without putting live production operations or data integrity at risk.

Step-by-Step Solution

1
Identify the primary requirement for DR validation
The validation process must test recovery procedures and data restoration safely without disrupting production systems.
DR testing should isolate test workloads from live user traffic to avoid accidental downtime or data corruption.
2
Evaluate the safest validation strategy
Restoring database snapshots into a separate, isolated environment in the secondary region allows full execution of recovery validation scripts.
Using isolated environments isolates test failures and guarantees production continuity.

Key Concept

Disaster Recovery Validation Procedures in Google Cloud
PreviousPage 37 / 80Next
All practice questions — Google Cloud Professional Cloud Architect | Examkin