Examkin

Tüm alıştırma soruları

1591 soru

Tüm türler1,591Çoktan seçmeli816Çoklu seçim491Sayısal12Eşleştirme10Sıralama262
Soru 1261Soru →

A company needs to enforce a compliance rule that prohibits service account key creation for all Google Cloud projects nested inside the 'Production' folder. What is the correct way to enforce this restriction across all current and future projects in that folder?

Cevabı ve açıklamayı göster

Cevap: Apply an Organization Policy constraint disabling service account key creation at the 'Production' folder level.

Cevap

Apply an Organization Policy constraint disabling service account key creation at the 'Production' folder level.
Organization Policies allow administrators to configure constraints on specific Google Cloud resources. Applying a policy constraint at a folder level enforces the rule for that folder and automatically propagates down through resource hierarchy inheritance to all child projects.

Adım Adım Çözüm

1
Identify the administrative goal and target resources.
The goal is to restrict a specific resource capability (service account key creation) across all existing and future projects within a specific folder.
Resource configuration restrictions applied at scale require Organization Policies rather than individual IAM role grants.
2
Evaluate Google Cloud management tools for restricting resource behaviors.
Organization Policies define constraints on specific Google Cloud services and inherit down the hierarchy (Organization → Folders → Projects).
Applying the constraint at the 'Production' folder ensures all nested projects inherit the restriction automatically.

Anahtar Kavram

Organization Policies vs IAM Roles for Resource Hierarchy Constraints
Soru 1262Soru →

A DevOps team is setting up an automated deployment pipeline for a microservice in a GCP project named `project-staging`. The pipeline's dedicated service account must be able to push compiled container images to an Artifact Registry repository named `app-repo` and manage Kubernetes deployments within the project's GKE cluster. Following the principle of least privilege, which TWO role assignments should the team grant to the service account? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Grant the Artifact Registry Writer (roles/artifactregistry.writer) role to the service account on the app-repo repository.; Grant the Kubernetes Engine Developer (roles/container.developer) role to the service account on project-staging.

Cevap

The team should grant the Artifact Registry Writer role on the app-repo repository resource and the Kubernetes Engine Developer role on the project-staging project resource.
To satisfy security standards and the principle of least privilege, IAM permissions must be granted using fine-grained predefined roles scoped to the specific target resources. The Artifact Registry Writer role grants permission to push images to the app-repo repository without allowing administrative changes to the registry instance. The Kubernetes Engine Developer role allows creating and updating Kubernetes workloads in the project's GKE cluster without granting cluster creation or node modification permissions.

Adım Adım Çözüm

1
Identify the minimum required permissions for pushing container images.
The Artifact Registry Writer role (roles/artifactregistry.writer) allows pushing and pulling images on the target repository.
Granting access at the repository resource level respects resource scoping and least privilege.
2
Identify the minimum required permissions for managing Kubernetes deployments.
The Kubernetes Engine Developer role (roles/container.developer) provides full access to manage workloads, pods, and deployments inside GKE clusters.
This predefined role avoids broad administrative privileges provided by Kubernetes Engine Admin or primitive roles.
3
Select the correct combination of resource-scoped predefined roles.
Assigning Artifact Registry Writer on the specific repository and Kubernetes Engine Developer at the project scope fulfills all requirements securely.
This prevents over-privileging and avoids inheriting elevated permissions across unrelated projects in the resource hierarchy.

Anahtar Kavram

Applying the Principle of Least Privilege using Predefined IAM Roles and Specific Resource Scopes
Soru 1263Soru →

A security compliance manager at a healthcare organization must allow an external compliance auditing group ([email protected]) to generate short-lived identity tokens to inspect encrypted storage resources using a dedicated service account ([email protected]). To satisfy strict enterprise security policies that prohibit the use of static, long-lived credentials, the team decides to set up service account impersonation. Which configuration step must be performed to enable this impersonation securely?

Cevabı ve açıklamayı göster

Cevap: Grant the Service Account Token Creator role (roles/iam.serviceAccountTokenCreator) to [email protected] on the compliance-auditor service account resource.

Cevap

Grant the Service Account Token Creator role (roles/iam.serviceAccountTokenCreator) to the auditor group on the target service account resource.
Service account impersonation relies on short-lived credentials (such as OAuth2 access tokens or OIDC tokens). To grant a user or group the capability to mint tokens on behalf of a target service account, they must be granted the Service Account Token Creator role (roles/iam.serviceAccountTokenCreator) on that target service account.

Adım Adım Çözüm

1
Identify the requirement for short-lived token generation for impersonation.
Determine that keyless delegation requires assigning appropriate token creation IAM permissions.
Enterprise security policies forbid long-lived static key downloads.
2
Select the specific predefined IAM role responsible for service account token creation.
Identify roles/iam.serviceAccountTokenCreator as the required role for generating OAuth2 access tokens and ID tokens via impersonation.
roles/iam.serviceAccountUser only allows attaching service accounts to resources, whereas roles/iam.serviceAccountTokenCreator allows minting short-lived tokens.
3
Apply the IAM role to the target principal on the target service account resource.
Bind [email protected] with roles/iam.serviceAccountTokenCreator on [email protected] following the principle of least privilege.
Resource-level binding limits token creation privileges strictly to the necessary service account.

Anahtar Kavram

Service Account Impersonation requires granting the Service Account Token Creator role (roles/iam.serviceAccountTokenCreator) on the target service account to allow principals to generate short-lived credentials without JSON keys.
Soru 1264Soru →

A security operations team needs to grant a newly hired auditor access to inspect system log entries in Cloud Logging and view Cloud Storage bucket metadata (such as bucket configuration and labels) within a single development project (`proj-dev-42`). The auditor must NOT be able to view object data stored inside the buckets, nor should they receive permissions across other projects in the organization. Adhering to the principle of least privilege, which of the following IAM role assignments should you implement? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Grant the Logs Viewer role (roles/logging.viewer) bound to the principal on project proj-dev-42.; Grant the Storage Bucket Viewer role (roles/storage.bucketViewer) bound to the principal on project proj-dev-42.

Cevap

Grant the Logs Viewer role (roles/logging.viewer) on project proj-dev-42, and grant the Storage Bucket Viewer role (roles/storage.bucketViewer) on project proj-dev-42.
The solution grants narrow predefined roles at the specific project level. The Logs Viewer role allows the user to inspect logs in Cloud Logging, while the Storage Bucket Viewer role provides read-only access to Cloud Storage bucket metadata and configurations without allowing access to object contents.

Adım Adım Çözüm

1
Analyze requirement for Cloud Logging access
Assigning roles/logging.viewer scoped strictly to project proj-dev-42 provides necessary permissions to view logs without extra privileges.
Predefined role roles/logging.viewer follows least privilege for log inspection.
2
Analyze requirement for Cloud Storage bucket metadata inspection without object data access
Assigning roles/storage.bucketViewer scoped to project proj-dev-42 grants metadata read access without object content permissions.
Predefined role roles/storage.bucketViewer restricts access to bucket properties only.
3
Verify resource hierarchy scope
Both bindings must be made at the project resource level (proj-dev-42), avoiding organization-level or folder-level inheritance.
Inheritance from parent nodes would grant unintended access across all sibling projects.

Anahtar Kavram

Principle of Least Privilege using Predefined IAM Roles and Project-Level Scoping
Soru 1265Soru →

A cloud engineer is managing cryptographic keys in Google Cloud KMS for enterprise data security. Which TWO statements correctly describe key lifecycle management and access permissions for Cloud KMS? (Select TWO)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Cloud KMS key rings and key versions cannot be deleted after creation, but individual key versions can be disabled or scheduled for destruction.; Assigning the predefined Cloud KMS CryptoKey Encrypter/Decrypter role grants a service account the necessary permissions to encrypt and decrypt data.

Cevap

Cloud KMS key rings and key versions cannot be deleted once created (though key versions can be disabled or destroyed), and assigning the predefined Cloud KMS CryptoKey Encrypter/Decrypter role is the recommended approach for granting encryption and decryption capabilities.
In Cloud KMS, key rings and keys cannot be deleted to prevent inadvertent data loss and maintain immutable audit logs; however, individual key versions can be disabled or scheduled for destruction. Additionally, following the principle of least privilege requires assigning dedicated predefined roles—such as Cloud KMS CryptoKey Encrypter/Decrypter—rather than broad primitive roles.

Adım Adım Çözüm

1
Evaluate key ring and key version lifecycle rules in Cloud KMS.
Identify that Cloud KMS resources (key rings, keys) cannot be deleted to ensure data recovery auditing, though key material can be scheduled for destruction or disabled.
Google Cloud KMS design prevents accidental key ring deletion which could render encrypted data permanently unrecoverable.
2
Evaluate IAM security best practices for granting cryptographic access.
Determine that specific predefined roles (such as Cloud KMS CryptoKey Encrypter/Decrypter) should be used instead of primitive roles or relying on non-existent lower-level IAM explicit denials.
Predefined roles uphold the principle of least privilege without exposing administrative permissions across the project.

Anahtar Kavram

Cloud KMS Key Lifecycle Immutability and Least Privilege IAM Role Assignment
Soru 1266Soru →

A cloud security engineer needs to enforce uniform security policies for a Google Cloud Storage bucket storing sensitive financial reports. The bucket currently has legacy per-object Access Control Lists (ACLs) applied. The engineer plans to enable Uniform Bucket-Level Access (UBLA) on this bucket. Which of the following statements correctly describe the technical impacts and operational requirements of enabling Uniform Bucket-Level Access? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Access permissions for all objects in the bucket will be evaluated solely based on Cloud IAM policies granted at the bucket or higher resource hierarchy levels.; Any subsequent operations attempting to set or modify individual object ACLs via gsutil, gcloud, or the GCP Console will be rejected with an authorization error.

Cevap

Enabling Uniform Bucket-Level Access ensures access is governed exclusively through Cloud IAM policies across the resource hierarchy, while disabling object-level ACLs and blocking any attempts to modify object ACLs.
Uniform Bucket-Level Access (UBLA) disables fine-grained object ACLs on a Cloud Storage bucket, ensuring that all access permissions are governed strictly through Cloud IAM policies assigned across the Google Cloud resource hierarchy. Consequently, any request attempting to modify or set per-object ACLs will fail.

Adım Adım Çözüm

1
Analyze the core mechanics of Uniform Bucket-Level Access (UBLA).
UBLA disables legacy Access Control Lists (ACLs) on all objects inside the bucket and enforces Cloud IAM as the sole access control mechanism.
Understanding UBLA requires recognizing that access evaluation transitions fully to bucket-level and higher-level IAM policies.
2
Evaluate the operational restrictions when UBLA is enabled.
Attempts to write, update, or read ACLs on individual objects are blocked and return permission errors.
Cloud Storage enforces API-level constraints preventing fine-grained ACL operations when UBLA is active.
3
Verify resource hierarchy inheritance and least-privilege principles.
IAM permissions are additive down the hierarchy and cannot be negated at lower levels, and predefined roles should be used instead of primitive roles.
GCP IAM policies inherit permissions additively from organization to folder, project, and bucket.

Anahtar Kavram

Uniform Bucket-Level Access (UBLA) disables per-object ACLs and unifies Cloud Storage access control via inherited Cloud IAM permissions.
Tahmini Süre:2m 0s
Soru 1267Soru →

A security engineer must enable a developer to manage Cloud Storage buckets in a production project using service account impersonation, eliminating the need for long-lived service account keys. What is the correct sequence of steps to establish and verify this impersonated access?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct order to establish service account impersonation begins by assigning resource permissions to the target service account, granting the Service Account Token Creator role on the service account to the user, authenticating the user identity, and executing gcloud commands with the impersonation flag.
To configure service account impersonation securely, the target service account must first be granted necessary resource access permissions (Storage Admin). Next, the user principal must be granted the Service Account Token Creator role directly on the target service account. The user then authenticates their identity via gcloud auth login, and finally passes the --impersonate-service-account flag when running CLI commands.

Adım Adım Çözüm

1
Assign required resource-level IAM roles to the target service account.
The target service account acquires permission to manage Cloud Storage buckets.
Before impersonation can yield useful access, the target service account must possess the necessary resource privileges.
2
Grant roles/iam.serviceAccountTokenCreator on the service account to the developer user principal.
The developer account is authorized to mint short-lived credentials for the target service account.
Impersonation requires explicit delegation via the Service Account Token Creator role on the service account resource.
3
Run gcloud auth login with the developer user credentials.
Active user authentication token is established locally.
The CLI needs valid caller credentials to request short-lived impersonated tokens from IAM.
4
Append --impersonate-service-account to gcloud commands.
Commands execute under the permissions of the service account without requiring static key files.
Passing the impersonation flag requests Google Cloud IAM to issue short-lived credentials for the command duration.

Anahtar Kavram

Configuring Service Account Impersonation
Soru 1268Soru →

An enterprise security engineering team must standardize access control on a production Cloud Storage bucket currently configured with fine-grained Access Control Lists (ACLs). Company security policy requires enforcing access exclusively through Cloud IAM permissions while completely disabling object-level ACL evaluation, adhering to the principle of least privilege. Which TWO configuration actions must the team take to accomplish this requirement without disrupting access for authorized users?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Enable Uniform Bucket-Level Access (UBLA) on the Cloud Storage bucket to disable object ACL evaluation.; Grant predefined roles such as Storage Object Viewer (`roles/storage.objectViewer`) at the bucket level to users requiring read access.

Cevap

The security team must enable Uniform Bucket-Level Access on the Cloud Storage bucket and assign predefined IAM roles, such as Storage Object Viewer, at the bucket level to authorized users.
Enabling Uniform Bucket-Level Access (UBLA) unifies access control under Cloud IAM by disabling fine-grained ACLs on objects. Granting predefined IAM roles like Storage Object Viewer at the bucket level ensures users maintain precise, least-privilege access to objects inside the bucket.

Adım Adım Çözüm

1
Identify access requirements
Determine that permissions must be managed centrally using Cloud IAM rather than per-object ACLs.
Fine-grained ACLs add operational complexity and bypass centralized Cloud IAM governance.
2
Enforce uniform access management
Enable Uniform Bucket-Level Access on the bucket.
Enabling UBLA ensures Cloud Storage ignores existing object ACLs and relies solely on bucket-level and project-level IAM policies.
3
Apply least-privilege IAM roles
Assign predefined roles (such as `roles/storage.objectViewer`) directly to principals at the bucket level.
Predefined roles provide scoped, least-privilege access needed for specific workloads without granting broad project-wide rights.

Anahtar Kavram

Uniform Bucket-Level Access (UBLA) and IAM Access Control
Soru 1269Soru →

A Cloud Engineer needs to replace a degraded secondary persistent disk attached to a production Compute Engine Virtual Machine (app-server-1) with a restored volume from a recent snapshot named app-data-snapshot-v2. The recovery process must follow Google Cloud recommended practices using gcloud CLI commands to minimize data corruption risk. What is the correct sequence of steps to replace and restore the persistent data disk?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct operational sequence begins by safely unmounting and detaching the degraded disk from the VM instance, creating a replacement persistent disk from the source snapshot via gcloud compute disks create, attaching the newly created disk to the VM instance via gcloud compute instances attach-disk, and finally mounting the restored volume inside the guest operating system.
To safely restore a data disk onto a Compute Engine VM instance, the operational lifecycle requires disconnecting the old volume first to preserve data integrity, instantiating a new persistent disk resource from the Cloud Storage snapshot, attaching the created disk to the instance via gcloud, and mounting the restored file system within the guest OS.

Adım Adım Çözüm

1
Unmount file system and detach old disk
Disk is cleanly disconnected from app-server-1 without active file locks or pending write operations.
Detaching an active disk while mounted can cause file system errors or prevent successful creation/attachment of replacement block devices.
2
Execute gcloud compute disks create with --source-snapshot
A new zonal persistent disk containing data from app-data-snapshot-v2 is provisioned.
Compute Engine persistent disks must be instantiated as independent block resources from snapshots before attachment.
3
Execute gcloud compute instances attach-disk
The new disk becomes available as a block device on app-server-1.
Attaching links the created persistent disk resource to the specific VM compute instance.
4
Mount the volume in the guest OS
Restored file system data is accessible to application workloads.
The guest OS kernel requires mounting the attached block device to expose the file hierarchy.

Anahtar Kavram

Restoring Persistent Disks from Snapshots using gcloud CLI
Soru 1270Soru →

A system administrator needs to deploy a standard Compute Engine virtual machine instance named `analytics-db` in zone `us-central1-a` using the Google Cloud CLI. Due to third-party database software licensing rules tied to physical CPU sockets, the VM must be configured to terminate (stop) rather than live-migrate whenever Google performs host maintenance. Additionally, the instance must automatically restart if it crashes or if the host hardware fails unexpectedly. Which command should the administrator run to fulfill these requirements?

Cevabı ve açıklamayı göster

Cevap: gcloud compute instances create analytics-db --zone=us-central1-a --on-host-maintenance=TERMINATE --automatic-restart

Cevap

Execute `gcloud compute instances create analytics-db --zone=us-central1-a --on-host-maintenance=TERMINATE --automatic-restart` to configure the instance to stop on maintenance events while allowing automatic restarts during unexpected host crashes.
The command containing `--on-host-maintenance=TERMINATE` and `--automatic-restart` accurately sets the scheduling policy to stop the instance during scheduled maintenance while enabling Compute Engine to restart the VM automatically if the host system crashes.

Adım Adım Çözüm

1
Identify host maintenance requirement
The requirement specifies terminating the instance instead of live migrating, which maps to `--on-host-maintenance=TERMINATE`.
By default, standard GCP VMs live-migrate (`MIGRATE`). Software licensing constraints often require shutting down (`TERMINATE`) during maintenance.
2
Identify recovery behavior requirement
The VM must restart if hardware fails, which requires `--automatic-restart`.
The `--automatic-restart` flag tells Compute Engine to restart the VM if it crashes or the physical host experiences an unrecoverable failure.
3
Select correct gcloud flag syntax
Combine `--on-host-maintenance=TERMINATE` and `--automatic-restart` in the `gcloud compute instances create` command.
These are the exact gcloud CLI flags for managing Compute Engine instance scheduling behavior.

Anahtar Kavram

Compute Engine Instance Scheduling Options and Maintenance Policies
Tahmini Süre:1m 15s
Soru 1271Soru →

An operations engineer needs to export a production database from a Cloud SQL for MySQL instance to a Google Cloud Storage bucket using the gcloud CLI. The process must follow Google Cloud security best practices by granting the minimum required service account permissions. What is the correct sequence of steps to perform this export operation successfully?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct operational sequence begins by retrieving the service account email of the Cloud SQL instance, granting that service account the Storage Object Admin role on the Cloud Storage destination bucket, running the gcloud sql export command, and finally verifying the completed operation status and bucket contents.
Exporting data from Cloud SQL to Cloud Storage requires proper delegation of authority. First, you must identify the Cloud SQL service account associated with the instance. Second, that service account must be granted write access (roles/storage.objectAdmin) on the destination Cloud Storage bucket. Third, you execute the gcloud sql export sql command. Fourth, you inspect the operation completion status to confirm successful export.

Adım Adım Çözüm

1
Retrieve Cloud SQL Instance Identity
Obtained service account email (serviceAccountEmail field).
Cloud SQL uses its own service account to write data to Cloud Storage.
2
Configure IAM Access Control
Service account is authorized to create objects in the destination bucket.
Without explicit Object Admin/Creator access on the bucket, export operations fail with permission denied errors.
3
Initiate Export Command
Cloud SQL starts streaming the SQL dump to the Cloud Storage URI.
The export command relies on pre-configured permissions to run asynchronously.
4
Monitor and Validate Operation
Confirmed successful operation status and verified SQL file creation.
Operational auditing validates that database backups completed cleanly.

Anahtar Kavram

Cloud SQL Database Export Procedures and IAM Service Account Authorization
Soru 1272Soru →

A security administrator needs to grant an internal auditor permissions to view standard Admin Activity audit logs as well as Data Access audit logs containing sensitive data in Cloud Logging, using predefined roles that follow the principle of least privilege. Which TWO IAM roles should be assigned to the auditor? (Select two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Logs Viewer (roles/logging.viewer); Private Logs Viewer (roles/logging.privateLogViewer)

Cevap

The correct roles to assign are Logs Viewer (roles/logging.viewer) and Private Logs Viewer (roles/logging.privateLogViewer).
Viewing standard Admin Activity audit logs requires the Logs Viewer role (roles/logging.viewer). Viewing sensitive Data Access audit logs requires the Private Logs Viewer role (roles/logging.privateLogViewer). Combining these two predefined roles provides full required visibility while respecting the principle of least privilege.

Adım Adım Çözüm

1
Determine the predefined role required to view standard and Admin Activity logs.
Identify Logs Viewer (roles/logging.viewer) as the minimal predefined role for standard audit log access.
Admin Activity audit logs are accessible with standard log reading permissions.
2
Determine the predefined role required to view restricted Data Access audit logs.
Identify Private Logs Viewer (roles/logging.privateLogViewer) as the necessary role.
Data Access audit logs contain sensitive resource access information and require explicit private log viewing permissions.

Anahtar Kavram

Cloud Audit Logs IAM Permissions (Logs Viewer vs Private Logs Viewer)
Soru 1273Soru →

Your organization recently enforced Uniform Bucket-Level Access (UBLA) on a Google Cloud Storage bucket named `partner-data-exchange` to align with security compliance requirements. Shortly after this enforcement, an automated data ingestion pipeline fails when attempting to upload new files. Investigation shows that the ingestion script explicitly passes per-object Access Control List (ACL) parameters (`publicRead`) during object creation calls. Which action should you take to restore pipeline functionality while maintaining compliance with the security policy?

Cevabı ve açıklamayı göster

Cevap: Update the ingestion script to remove the per-object ACL parameters and grant the pipeline service account the Storage Object Creator IAM role on the bucket.

Cevap

Update the ingestion script to remove the per-object ACL parameters and grant the pipeline service account the Storage Object Creator IAM role on the bucket.
When Uniform Bucket-Level Access is enabled on a bucket, Cloud Storage disables ACL permissions and enforces access through Cloud IAM exclusively. Any requests specifying per-object ACLs fail with an access error. To resolve this without compromising compliance, the client code must stop requesting per-object ACLs and rely on bucket-level IAM roles such as Storage Object Creator.

Adım Adım Çözüm

1
Identify the cause of failure under Uniform Bucket-Level Access
Recognize that UBLA disables per-object ACL evaluation and causes requests containing ACL specifications to fail.
UBLA unifies access control exclusively under Cloud IAM at the bucket level.
2
Modify the application logic
Remove explicit ACL parameters from the file upload payload.
Eliminating legacy ACL directives prevents API validation errors.
3
Configure proper IAM permissions
Grant `roles/storage.objectCreator` to the ingestion pipeline's service account on the bucket.
This grants the minimum required permissions to write objects while maintaining centralized control.

Anahtar Kavram

Uniform Bucket-Level Access disables object ACLs, requiring access permissions to be defined entirely using IAM roles.
Tahmini Süre:1m 30s
Soru 1274Soru →

An organization requires that encryption keys stored in Google Cloud KMS are regularly rotated every 90 days to comply with security policies. The security team wants to ensure that newly written data uses the newest key version while previously encrypted data remains decryptable without manual re-encryption. Which configuration approach should you use in Cloud KMS?

Cevabı ve açıklamayı göster

Cevap: Configure an automated key rotation schedule with a 90-day rotation period on the target CryptoKey.

Cevap

Configure an automated key rotation schedule with a 90-day rotation period on the target CryptoKey.
Configuring an automated key rotation schedule directly on the CryptoKey allows Google Cloud KMS to generate a new primary key version automatically every 90 days. New encryption operations use the active primary version, while older key versions remain available so existing data can still be decrypted.

Adım Adım Çözüm

1
Identify the core requirement for Cloud KMS key management.
The requirement is to rotate key versions automatically every 90 days while preserving decryption capabilities for existing data.
Security compliance requires periodic key rotation, but older key versions must remain available to read existing encrypted datasets.
2
Evaluate Google Cloud KMS native key rotation capabilities.
Setting an automated rotation schedule on the CryptoKey generates new primary key versions on a schedule while keeping past versions active for decryption.
Cloud KMS supports setting a rotation period and next rotation time directly on the CryptoKey resource.

Anahtar Kavram

Cloud KMS CryptoKey Automated Key Rotation
Soru 1275Soru →

A network administrator is updating an existing VPC firewall rule named `allow-app-traffic` in Google Cloud. The rule currently has an evaluation priority of 2000. The administrator needs to modify `allow-app-traffic` to allow incoming TCP traffic on port 8080 from the CIDR block `10.150.0.0/16` specifically for virtual machine instances tagged with `app-backend`. Additionally, this rule must take precedence over a conflicting denial rule configured with a priority of 1500.

Which TWO operational actions must the administrator perform to satisfy these requirements?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Execute `gcloud compute firewall-rules update allow-app-traffic --allow=tcp:8080 --source-ranges=10.150.0.0/16 --target-tags=app-backend` to apply the updated matching criteria.; Update the rule's priority flag to a value lower than 1500 (such as `--priority=1000`) so that it is evaluated before the conflicting denial rule.

Cevap

To successfully reconfigure the firewall policy, the administrator must use `gcloud compute firewall-rules update allow-app-traffic` with `--allow=tcp:8080`, `--source-ranges=10.150.0.0/16`, and `--target-tags=app-backend`, while lowering the rule priority value to a number below 1500 (such as 1000).
The correct requirements involve updating the firewall rule attributes using the `gcloud compute firewall-rules update` command with the appropriate target tags, allowed port parameters, and CIDR ranges. In addition, because Google Cloud evaluates firewall rules from lowest numerical priority to highest numerical priority, setting the rule's priority to a value less than 1500 (such as 1000) ensures it is matched and enforced prior to the conflicting rule at priority 1500.

Adım Adım Çözüm

1
Identify the proper command context and flags for modifying existing VPC firewall rules.
Confirm that `gcloud compute firewall-rules update` must be used to adjust the allowed ports, source IP ranges, and target instance tags.
Firewall rules exist at the VPC network level, not at the subnet resource level.
2
Evaluate the firewall rule priority logic relative to the conflicting rule.
Determine that the priority must be set to a integer strictly less than 1500 (e.g., 1000).
GCP evaluates firewall rules in ascending order of their priority numbers (0 to 65535). Lower numbers represent higher precedence.

Anahtar Kavram

VPC Firewall Rule Management and Priority Evaluation
Tahmini Süre:2m 0s
Soru 1276Soru →

A cloud operations team needs to grant a network engineer permission to manage VPC subnets and firewall rules in a Google Cloud project named net-prod-2026. The engineer must not be able to create, delete, or modify Compute Engine virtual machine instances or access project storage resources. Following Google Cloud best practices and the principle of least privilege, which IAM role configuration should be granted to the network engineer?

Cevabı ve açıklamayı göster

Cevap: Grant the Compute Network Admin role (roles/compute.networkAdmin) at the project level.

Cevap

Grant the Compute Network Admin role (roles/compute.networkAdmin) at the project level.
Granting the Compute Network Admin role (roles/compute.networkAdmin) scoped to the specific project provides full control over VPC networking resources, subnets, and firewall rules without granting access to manage VM instances or other non-networking services, exactly fulfilling the principle of least privilege.

Adım Adım Çözüm

1
Identify required operational permissions
The engineer requires permissions to manage VPC networks, subnets, and firewall rules.
Networking management is the target responsibility requested by the operations team.
2
Select the narrowest predefined role that covers networking tasks
roles/compute.networkAdmin provides network administration without VM instance lifecycle management permissions.
Predefined roles should be chosen over broad primitive roles (Editor/Owner) or over-privileged predefined roles (Compute Admin) to satisfy the principle of least privilege.
3
Determine the minimum necessary resource hierarchy scope
Bind the role at the project level (net-prod-2026).
Role bindings inherit downward. Binding at the organization level would grant network admin rights across all projects in the organization.

Anahtar Kavram

Principle of Least Privilege in GCP IAM Role Assignment
Soru 1277Soru →

An organization is standardizing security compliance across its Google Cloud environment. A cloud engineer enables Uniform Bucket-Level Access (UBLA) on an existing Cloud Storage bucket that previously relied on fine-grained Access Control Lists (ACLs) attached to individual objects. Immediately after enabling UBLA, an automated reporting application's service account loses read access to specific legacy files in the bucket. The engineer needs to restore read access to all objects in the bucket for this service account while adhering to the principle of least privilege and maintaining uniform bucket access controls. Which action should the engineer take?

Cevabı ve açıklamayı göster

Cevap: Grant the predefined Storage Object Viewer role (roles/storage.objectViewer) to the application's service account on the Cloud Storage bucket.

Cevap

Grant the predefined Storage Object Viewer role (roles/storage.objectViewer) to the application's service account at the bucket level.
When Uniform Bucket-Level Access (UBLA) is enabled on a Cloud Storage bucket, Object-Level Access Control Lists (ACLs) are completely disabled. Access control is managed exclusively through Cloud IAM permissions. To restore read access for a service account without granting excessive permissions, the predefined `roles/storage.objectViewer` role should be assigned to the principal at the bucket level.

Adım Adım Çözüm

1
Analyze the impact of enabling Uniform Bucket-Level Access (UBLA).
Enabling UBLA disables legacy Access Control Lists (ACLs) on all objects inside the bucket, rendering individual object-level grants inactive.
UBLA unifies permissions so access is evaluated strictly through Cloud IAM at the bucket or project level.
2
Identify the appropriate IAM role for read access to objects.
The predefined role `roles/storage.objectViewer` permits viewing objects without granting extra management rights.
Predefined roles follow the principle of least privilege compared to primitive roles.
3
Apply the IAM policy binding to the storage bucket.
The service account gains read permissions across all current and future objects in the bucket uniform policy.
Bucket-level IAM bindings restore access that was previously managed via object ACLs.

Anahtar Kavram

Uniform Bucket-Level Access (UBLA) disables per-object ACLs and relies strictly on Cloud IAM policies granted at the bucket, folder, or project level.
Soru 1278Soru →

A cloud engineer needs to perform a canary deployment for an existing Cloud Run service named `inventory-api`. The deployment strategy requires deploying a new revision without immediately receiving production traffic, validating the isolated revision using a revision tag URL, sending 10% of live traffic to the canary, and finally shifting 100% of traffic to the new release. In what order should the engineer execute the following operational steps?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence starts with deploying the new revision with the `--no-traffic` flag and tag `canary`, followed by testing the revision directly via its tag URL, then updating traffic to send 10% of live requests to the `canary` tag, and finally updating traffic to route 100% to the latest revision.
Safely deploying updates to Cloud Run requires isolating new revisions using `--no-traffic` and revision tags (`--tag`), testing through the dedicated tag URL, performing a partial traffic split using `gcloud run services update-traffic --to-tags`, and finally updating the service to route 100% of live traffic to the latest revision.

Adım Adım Çözüm

1
Deploy revision with `--no-traffic` and `--tag` flags.
A new Cloud Run revision is deployed and assigned a dedicated URL tag without receiving main ingress traffic.
Prevents unverified code from handling production requests immediately upon deployment.
2
Perform smoke tests on the generated tag-specific endpoint.
Verification of basic functionality and deployment health on the specific revision.
Validates application readiness in the target GCP environment prior to opening production ingress.
3
Execute `gcloud run services update-traffic` allocating 10% to the `canary` tag.
Cloud Run load balancer splits live incoming requests so 10% go to the canary revision and 90% go to existing traffic targets.
Allows monitoring of production metrics, telemetry, and error rates with minimal customer exposure.
4
Execute `gcloud run services update-traffic` allocating 100% traffic `--to-latest`.
The new revision becomes the primary receiver of all production traffic.
Completes the canary release workflow once stability is confirmed.

Anahtar Kavram

Cloud Run Tagged Canary Deployment and Traffic Splitting Workflow
Tahmini Süre:1m 30s
Soru 1279Soru →

An organization is establishing an automated CI/CD deployment workflow on an external third-party platform that needs to deploy resources into a Google Cloud project. Security policies strictly prohibit exporting or storing long-lived service account JSON key files on external infrastructure. The engineering team decides to set up Workload Identity Federation so the external pipeline can temporarily impersonate a dedicated Google Cloud service account. Which TWO configuration steps must be performed in Google Cloud to complete this setup? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure a Workload Identity Pool and Provider to establish trust with the external identity provider and map token claims to Google Cloud attributes.; Grant the external workload identity principal the Workload Identity User role (roles/iam.workloadIdentityUser) on the target Google Cloud service account.

Cevap

The two required configuration steps are setting up a Workload Identity Pool and Provider to map external token claims, and granting the Workload Identity User role (roles/iam.workloadIdentityUser) on the target Google Cloud service account to the external principal.
To set up keyless authentication for external workloads, Google Cloud requires establishing a trust relationship via a Workload Identity Pool and Provider (to validate and map external ID tokens) and granting the Workload Identity User role on the target service account to the mapped external principal.

Adım Adım Çözüm

1
Establish identity federation trust
Create a Workload Identity Pool and a Provider that configures attribute mapping and conditions matching the external identity provider's tokens.
Google Cloud IAM needs to validate incoming tokens from external identity providers and map external attributes to Google Cloud principal identifiers.
2
Authorize identity impersonation
Bind the mapped external principal to the target Google Cloud service account using the roles/iam.workloadIdentityUser role.
IAM requires explicit permission on the target service account granting the federated principal permission to impersonate it.

Anahtar Kavram

Workload Identity Federation setup requires creating a Workload Identity Pool and Provider to federate external tokens, along with assigning the roles/iam.workloadIdentityUser role on the target service account to permit keyless impersonation.
Soru 1280Soru →

An enterprise security team is establishing key governance policies for customer-managed encryption keys (CMEK) managed in Google Cloud KMS. The team must revoke access to a compromised encryption key version used by Cloud Storage, enforce the principle of least privilege for the Cloud Storage Service Agent, and ensure that administrative actions cannot destroy key audit history or metadata. Which implementation plan correctly achieves these requirements while adhering to Cloud KMS operational constraints?

Cevabı ve açıklamayı göster

Cevap: Schedule destruction of the specific compromised Cloud KMS key version and grant the Cloud Storage Service Agent the Cloud KMS CryptoKey Encrypter/Decrypter role on the specific key, understanding that key rings and keys cannot be deleted.

Cevap

Schedule destruction of the specific compromised Cloud KMS key version and grant the Cloud Storage Service Agent the Cloud KMS CryptoKey Encrypter/Decrypter role on the specific key, understanding that key rings and keys cannot be deleted.
In Google Cloud KMS, key rings and key names are immutable metadata records that cannot be deleted. To revoke access to compromised key material, administrators must disable or schedule destruction of the specific key version. To grant access to service accounts (such as the Cloud Storage Service Agent) following least privilege, the predefined role Cloud KMS CryptoKey Encrypter/Decrypter should be granted specifically on the required key.

Adım Adım Çözüm

1
Identify the key lifecycle operations supported in Google Cloud KMS.
Cloud KMS resources (key rings, keys) cannot be deleted. Only key versions can be disabled or scheduled for destruction (with a minimum 24-hour safety period).
Google Cloud retains key rings and key names permanently for tracking and auditability.
2
Determine the minimum necessary IAM permissions for Cloud Storage CMEK integration.
The service account requires the predefined role 'roles/cloudkms.cryptoKeyEncrypterDecrypter' on the specific key being used.
Granting primitive roles (Viewer, Editor, Owner) grants excess permissions across all project resources, violating security principles.
3
Select the correct combination of IAM roles and key version lifecycle management.
Scheduling destruction of the compromised key version revokes cryptographic access, and granting the CryptoKey Encrypter/Decrypter role enforces least privilege.
This meets all requirements for security compliance, audit preservation, and least privilege access control.

Anahtar Kavram

Cloud KMS Key Lifecycle Management and Least Privilege IAM Access
ÖncekiSayfa 64 / 80Sonraki
Tüm alıştırma soruları — Google Cloud Associate Cloud Engineer | Examkin