Examkin

Tüm alıştırma soruları

64 soru

Tüm türler1,598Çoktan seçmeli815Çoklu seçim537Sayısal8Eşleştirme64Sıralama174
Soru 1Soru →

A global financial organization is deploying a multi-tier enterprise application on Google Cloud under strict zero-trust boundary requirements. As the principal cloud architect, match each enterprise architectural security constraint to the corresponding GCP network perimeter control mechanism that fulfills the requirement.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Prevent unauthorized API-level exfiltration of sensitive BigQuery datasets, even if identity credentials within an authorized VPC subnet are fully compromised.
Mitigate volumetric application-layer (Layer 7) DDoS attacks and SQL injection attempts at the edge before traffic hits backend services.
Enforce organization-wide restriction of inbound SSH access to private compute instances based on workload identity context rather than IP subnet ranges.
Enable on-premises applications to securely invoke Google Cloud APIs over Dedicated Interconnect while blocking all outbound traffic to non-approved Google Cloud services.

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Each architectural security constraint maps to its precise GCP perimeter mechanism: BigQuery exfiltration prevention requires VPC Service Controls with restricted VIP routing; Layer 7 DDoS and SQLi mitigation requires Cloud Armor enterprise security policies at the edge; organization-wide identity-based firewall rules require Hierarchical Firewall Policies with Secure Tags; private on-premises API access restricting unapproved services requires Private Service Connect targeting restricted Google APIs over Interconnect.
The correct pairings accurately align each Google Cloud perimeter defense tool with its explicit architectural security boundary. VPC Service Controls isolate API-level communication for data exfiltration defense; Cloud Armor provides edge WAF and DDoS filtering for public endpoints; Hierarchical Firewall Policies with Secure Tags establish non-bypassable centralized access controls across instance identities; and Private Service Connect with the restricted VIP secures hybrid enterprise access exclusively to compliant Google APIs.

Adım Adım Çözüm

1
Analyze the data exfiltration constraint for BigQuery under credential compromise.
Identify that IAM alone cannot prevent exfiltration if credentials are stolen; VPC Service Controls perimeter boundaries are mandatory to block unauthorized data movements across API boundaries.
VPC Service Controls mitigate risk from compromised credentials by validating the perimeter boundary regardless of identity permissions.
2
Evaluate perimeter edge protection against Layer 7 attacks.
Match SQL injection and HTTP DDoS protection to Google Cloud Armor attached to Global External Load Balancing.
Cloud Armor inspects HTTP(S) traffic at the Google network edge, preventing malicious payloads from reaching backend instances.
3
Determine organization-wide network policy enforcement based on workload context.
Select Hierarchical Firewall Policies coupled with Secure Tags.
Hierarchical policies enforce consistent rules down the resource tree, and Secure Tags allow dynamic context matching independent of IP address ranges.
4
Formulate private hybrid connectivity to Google APIs with service restriction.
Combine Private Service Connect (PSC) targeting restricted Google APIs (`restricted.googleapis.com`) with Cloud Interconnect BGP advertising.
The restricted VIP endpoint blocks access to non-VPC-SC supported services, preventing exfiltration to unapproved public GCP endpoints.

Anahtar Kavram

Perimeter Security Architecture and Defense-in-Depth on GCP
Soru 2Soru →

An enterprise financial institution is modernizing its Google Cloud architecture to satisfy strict regulatory compliance and perimeter security mandates. The architecture team must evaluate and assign the appropriate network security control mechanism to meet four distinct security requirements across their multi-project environment.

Match each architectural security requirement with the corresponding Google Cloud network security mechanism that best satisfies it.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Mitigate Layer 7 web application attacks such as SQL injection and enforce IP-based rate limiting at the Google Cloud network edge.
Prevent authorized IAM users in a sensitive analytics project from copying BigQuery datasets to unauthorized external cloud resources.
Enforce mandatory, non-overridable organization-wide ingress firewall deny rules across all current and future VPC networks.
Provide private, isolated access to a third-party managed SaaS application residing in an external GCP organization without using transitive VPC peering.

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Layer 7 inspection and edge rate limiting map to Cloud Armor Security Policies. BigQuery exfiltration prevention maps to VPC Service Controls Service Perimeter. Organization-wide non-overridable firewall rules map to Hierarchical Firewall Policies. Private third-party SaaS connectivity without VPC peering maps to Private Service Connect (PSC) Endpoints.
Each requirement aligns directly with a distinct layer of Google Cloud's defense-in-depth architecture. Cloud Armor provides edge WAF and DDoS protection for web workloads. VPC Service Controls form logical security perimeters around GCP APIs to block data exfiltration. Hierarchical Firewall Policies enforce top-down network security rules that project owners cannot modify. Private Service Connect delivers private, consumer-endpoint access to SaaS or producer services across project boundaries.

Adım Adım Çözüm

1
Analyze the Layer 7 web threat mitigation requirement.
Identified Cloud Armor Security Policies as the edge defense attached to HTTP(S) Load Balancers.
Cloud Armor operates at the network edge to filter web traffic against OWASP Top 10 risks and apply rate-limiting rules.
2
Analyze the data exfiltration prevention requirement for managed GCP services.
Identified VPC Service Controls as the perimeter boundary mechanism.
IAM controls who can access resources, but VPC Service Controls restrict from where and to where API requests can move data, effectively preventing exfiltration.
3
Analyze the centralized governance firewall requirement.
Identified Hierarchical Firewall Policies attached at Folder or Organization nodes.
Hierarchical firewall rules inherit down the resource hierarchy and take precedence over local VPC firewall rules, preventing local project admin overrides.
4
Analyze the cross-tenant private service connectivity requirement.
Identified Private Service Connect (PSC) Endpoints.
PSC allows unidirectional, private IP connectivity between independent GCP project/organization VPCs without requiring full network peering topology.

Anahtar Kavram

Google Cloud Perimeter Security and Network Controls
Soru 3Soru →

An enterprise cloud architect is designing a multi-layered security model for a multi-tenant SaaS application hosted on Google Cloud. Match each network security and perimeter requirement on the left with the most appropriate Google Cloud security mechanism on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Protect web applications behind an HTTP(S) Load Balancer against Layer 7 attacks such as SQL injection (SQLi) and Cross-Site Scripting (XSS).
Prevent authorized internal users from exfiltrating sensitive BigQuery data to unauthorized external Google Cloud storage locations or projects.
Enforce organization-wide firewall rules across multiple VPC networks using dynamic resource metadata rather than IP subnet ranges.
Provide secure, private cross-tenant API access between VPCs without establishing full network layer IP routability or transitive peering.

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Layer 7 web attack mitigation matches Cloud Armor WAF Security Policies; BigQuery data exfiltration prevention matches VPC Service Controls Service Perimeters; Organization-wide policy enforcement via dynamic metadata matches Hierarchical Firewall Policies with Secure Tags; Private cross-VPC API access without transitive peering matches Private Service Connect (PSC).
Each security requirement aligns directly with standard Google Cloud perimeter defense products: Cloud Armor handles edge Layer 7 protection, VPC Service Controls restrict managed API data movement, Hierarchical Firewalls with Secure Tags manage organization-wide network policy based on tags, and Private Service Connect facilitates isolated cross-VPC service access.

Adım Adım Çözüm

1
Analyze requirement 1 (Layer 7 web protection against SQLi/XSS at load balancer)
Identify Cloud Armor as the perimeter WAF tool designed specifically for Google Cloud external HTTP(S) Load Balancing.
Cloud Armor evaluates inbound traffic at the edge before reaching backend compute resources.
2
Analyze requirement 2 (Preventing data exfiltration from Google APIs like BigQuery)
Identify VPC Service Controls as the mechanism to build perimeters around GCP managed services.
IAM rules control who can access resources, but VPC Service Controls define where data can be accessed from and transferred to.
3
Analyze requirement 3 (Enforcing organization-level firewalls using metadata instead of IPs)
Identify Hierarchical Firewall Policies combined with Secure Tags.
Hierarchical rules apply top-down from organization/folder levels, while Secure Tags provide access control evaluation based on identity/metadata tags rather than IP addresses.
4
Analyze requirement 4 (Private microservice consumption across VPC boundaries without peering)
Identify Private Service Connect (PSC).
PSC uses producer-consumer endpoint mapping to allow private connection across administrative boundaries without establishing full VPC network peering.

Anahtar Kavram

Google Cloud Perimeter Security and Network Controls (Cloud Armor, VPC Service Controls, Hierarchical Firewalls, Private Service Connect)
Soru 4Soru →

A enterprise solution architect is selecting Google Cloud storage and database services for four distinct business workloads. Match each workload requirement on the left with the most appropriate managed Google Cloud service on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Global online payment transaction ledger requiring multi-region relational ACID compliance, horizontal scale-out for write throughput, and a 99.999% availability SLA.
High-frequency IoT fleet telemetry ingest requiring single-digit millisecond write latencies, seamless scale-out to petabytes of time-series key-value data, and integration with Apache HBase APIs.
Cross-platform mobile gaming application requiring real-time document synchronization, offline client data persistence, and automatic scaling for unstructured JSON document collections.
Regulatory financial audit archives requiring Write-Once-Read-Many (WORM) immutability enforcement for compliance, minimum 365-day retention, and lowest storage cost for data accessed less than once per year.

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Global payment ledger matches Cloud Spanner; IoT fleet telemetry matches Cloud Bigtable; Mobile gaming app matches Firestore in Native mode; Regulatory financial archives match Cloud Storage Archive Class with a Locked Retention Policy.
Each workload aligns strictly with GCP storage service design parameters: Cloud Spanner handles global multi-region relational ACID writes; Cloud Bigtable handles petabyte-scale time-series telemetry with HBase API compatibility; Firestore Native mode powers mobile document sync with offline caching; and Cloud Storage Archive with Bucket Lock provides compliant WORM object storage.

Adım Adım Çözüm

1
Analyze global payment ledger workload requirements
Identified relational schema, global multi-region ACID transactions, horizontal write scaling, and 99.999% SLA.
Cloud Spanner is the only relational Google Cloud database engineered for multi-region horizontal scaling with strong global consistency and five-nines availability.
2
Analyze high-frequency IoT fleet telemetry requirements
Identified high write throughput, time-series access pattern, low millisecond latency, petabyte scale, and HBase API compatibility.
Cloud Bigtable is designed specifically for ultra-low latency key-value/wide-column time-series data at scale and supports HBase API interfaces.
3
Analyze cross-platform mobile gaming application requirements
Identified document store model, client-side offline persistence, and real-time synchronization listeners.
Firestore in Native mode natively supports live data synchronization to client devices, offline caching, and hierarchical JSON document collections.
4
Analyze regulatory financial audit archive requirements
Identified cold data access frequency (<1 access/year), lowest storage cost requirement, and WORM immutability compliance.
Cloud Storage Archive storage class offers the lowest cost for long-term cold object storage, while a Locked Retention Policy guarantees non-rewritable, non-deleterious WORM storage.

Anahtar Kavram

Selecting and Designing Storage and Database Resources
Tahmini Süre:2m 0s
Soru 5Soru →

A enterprise solution architect is designing the storage and database architecture for a multi-service cloud platform on Google Cloud. Match each technical application workload requirement on the left with the optimal Google Cloud database or storage service on the right that best satisfies the access pattern, consistency, and operational criteria.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Global order processing system requiring multi-region ACID transactions, strong consistency, ANSI SQL support, and dynamic horizontal scaling without maintenance downtime.
Ad-tech user profile feature store requiring single-digit millisecond latency for massive volume key-value writes and lookup scans by row key at high throughput.
Cross-platform client mobile app requiring rich document hierarchy querying, live listener notifications for state changes, and client SDK offline data synchronization.
Centralized immutable telemetry ingest bucket storing raw unstructured blob objects with automated tier transitions based on object age for cost optimization.

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Global order processing maps to Cloud Spanner; Ad-tech user feature store maps to Cloud Bigtable; Cross-platform client app maps to Firestore; Centralized immutable telemetry ingest bucket maps to Cloud Storage.
Each requirement strictly aligns with the core architecture parameters of the matching GCP product: Cloud Spanner for global multi-region relational ACID transactions, Cloud Bigtable for ultra-low latency key-value high-throughput operations, Firestore for real-time mobile document sync, and Cloud Storage for blob objects with lifecycle management policies.

Adım Adım Çözüm

1
Analyze requirement 1 (Global order processing)
Identified requirement for multi-region ACID transactions, strong consistency, ANSI SQL, and seamless horizontal scaling.
Cloud Spanner is the only relational database service offering global multi-region ACID consistency with zero-downtime horizontal scaling.
2
Analyze requirement 2 (Ad-tech feature store)
Identified low latency (single-digit ms), high throughput key-value / row-key lookup requirements.
Cloud Bigtable excels at scalable NoSQL wide-column key-value workloads demanding consistent sub-10ms performance.
3
Analyze requirement 3 (Client mobile app)
Identified document model, real-time listeners, and client-side offline sync functionality.
Firestore provides built-in client libraries for mobile/web offline data synchronization and real-time document listeners.
4
Analyze requirement 4 (Immutable telemetry ingest)
Identified requirement for unstructured blob storage and object lifecycle class transitions.
Cloud Storage is designed for unstructured object data and natively supports automated lifecycle management for cost efficiency.

Anahtar Kavram

Matching workload access patterns, consistency requirements, and scale demands to appropriate GCP database and storage products.
Soru 6Soru →

A global autonomous transportation enterprise is designing a hybrid network architecture to connect diverse operational sites to Google Cloud. Match each hybrid connectivity requirement on the left with the most appropriate Google Cloud networking solution on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

A primary data center requiring a private, unencrypted link supporting 20 Gbps bandwidth and a 99.99% availability SLA using direct physical connections to Google edge facilities across two metropolitan locations.
A regional telemetry center requiring up to 2 Gbps of encrypted, redundant connectivity over the public internet with dynamic routing provided by BGP.
A remote testing facility requiring SLA-backed 4 Gbps private connectivity where the enterprise does not co-locate in a Google Cloud Interconnect location and must rely on a third-party service provider.
A global multi-branch topology requiring site-to-site WAN connectivity and site-to-cloud routing using Google's global network infrastructure as a transit hub.

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

The primary data center requirement (20 Gbps direct connection, 99.99% SLA) matches Dedicated Interconnect; the regional telemetry center requirement (2 Gbps encrypted link over public internet) matches HA VPN; the remote testing facility requirement (4 Gbps provider-managed private link) matches Partner Interconnect; and the multi-branch global WAN requirement matches Network Connectivity Center.
Matching high bandwidth (20 Gbps) and physical co-location to Dedicated Interconnect ensures 99.99% availability via redundant Cloud Routers across two metro areas. Matching encrypted 2 Gbps public internet traffic to HA VPN satisfies security and routing constraints. Partner Interconnect provides provider-managed sub-10 Gbps private links where direct co-location is unavailable. Network Connectivity Center enables site-to-site transit connectivity using Google Cloud's global backbone.

Adım Adım Çözüm

1
Analyze bandwidth, physical co-location, and SLA requirements for the 20 Gbps primary data center connection.
Since bandwidth exceeds 10 Gbps and physical connection at Google edge facilities is specified, Dedicated Interconnect with redundant circuits across two metros is required to achieve a 99.99% SLA.
Cloud VPN cannot meet 20 Gbps bandwidth demands natively, and Partner Interconnect is meant for environments where direct co-location is not present.
2
Evaluate the regional telemetry center requirement for encrypted transmission over the public internet at 2 Gbps.
HA VPN provides dual active-active IPsec tunnels delivering up to 3 Gbps per tunnel bandwidth with dynamic BGP routing.
Interconnect solutions do not encrypt traffic by default and operate over dedicated private connections rather than the public internet.
3
Assess the remote facility requirement for 4 Gbps private SLA-backed connectivity without direct co-location presence.
Partner Interconnect enables connection through a supported service provider at sub-10 Gbps capacities without requiring colocation in a Google facility.
Dedicated Interconnect requires direct facility co-location, whereas Cloud VPN operates over public internet rather than private provider links.
4
Evaluate the global multi-branch site-to-site routing requirement.
Network Connectivity Center (NCC) allows using Google's global backbone for site-to-site WAN transit between hybrid networks.
Standard VPC Peering is non-transitive and cannot act as a transit network for on-premises-to-on-premises traffic.

Anahtar Kavram

Selecting and architecting Google Cloud hybrid connectivity services based on SLA, bandwidth, encryption, co-location, and WAN transit topology.
Soru 7Soru →

A global retail supply-chain enterprise is designing its hybrid connectivity architecture to connect diverse operational sites to Google Cloud. Match each business unit's network and SLA requirement to the optimal Google Cloud hybrid networking solution.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Primary regional distribution hubs requiring a 99.99% SLA, non-encrypted dedicated physical throughput exceeding 10 Gbps, and direct private connectivity to GCP without using public internet infrastructure.
Remote fulfillment micro-warehouses requiring low-cost IPsec encrypted connectivity under 1 Gbps across public broadband ISP links, featuring SLA-backed automatic failover.
Third-party vendor networks requiring private access to internal microservices hosted in GCP without permitting network-level IP range overlap or bidirectional VPC peering access.
Legacy data centers located where Google Cloud Interconnect colocation facilities are absent, requiring sub-10 Gbps private connectivity provisioned through a supported network service provider.

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

The primary distribution hubs match Dual Dedicated Interconnect across distinct metro facilities; remote micro-warehouses match HA VPN with dynamic BGP routing; third-party vendor networks match Private Service Connect; legacy data centers without colocation match Partner Interconnect through a service provider.
Each requirement aligns precisely with official GCP hybrid connectivity design guidelines: Dedicated Interconnect provides physical high-capacity links; HA VPN provides cost-effective encrypted tunnels over public IP; Private Service Connect delivers unidirectional service-level access without VPC peering or subnet overlap; and Partner Interconnect connects sites via service provider networks where direct Google colocation does not exist.

Adım Adım Çözüm

1
Analyze high-bandwidth and SLA requirements for primary regional distribution hubs.
Requirements exceed 10 Gbps with 99.99% SLA, ruling out Cloud VPN. Dedicated Interconnect across two distinct metro facilities is required for 99.99% availability.
Dedicated Interconnect offers physical 10 Gbps/100 Gbps links directly to Google edge facilities, achieving 99.99% SLA only when dual-hosted in separate metros.
2
Evaluate encrypted broadband connectivity for low-bandwidth remote fulfillment sites.
HA VPN with active-active tunnels and Cloud Router dynamic BGP routing is chosen.
HA VPN provides 99.99% SLA over public internet connections with native IPsec encryption suitable for low-throughput remote locations.
3
Identify isolated service exposure mechanism for third-party networks with potential overlapping CIDRs.
Private Service Connect (PSC) is selected.
PSC exposes specific internal load balancers using NAT endpoint IPs in consumer VPCs without peering entire networks or causing IP address collision.
4
Determine private connection method for facilities lacking direct Google edge colocation presence.
Partner Interconnect with service provider VLAN attachments is chosen.
Partner Interconnect bridges facilities to GCP via supported carrier networks when direct physical colocation with Google is unavailable.

Anahtar Kavram

Selecting GCP Hybrid Connectivity Solutions Based on Bandwidth, Encryption, SLA, and Location Constraints
Soru 8Soru →

Match each application workload access pattern and architectural requirement to the most appropriate Google Cloud storage or database service.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

High-throughput time-series metric ingestion exceeding 1,000,0001,000,000 writes per second requiring low single-digit millisecond latency key-value reads by timestamp.
Globally distributed relational OLTP database requiring full ANSI SQL support, multi-region ACID transactions, and a 99.999%99.999\% availability SLA.
Sub-millisecond latency in-memory data store supporting complex data structures, geospatial queries, and session caching.
Serverless document store offering automatic offline client sync, live query snapshot listeners, and multi-region atomic transactions for web and mobile frontends.

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

High-throughput time-series metric ingestion matches Cloud Bigtable. Globally distributed relational OLTP with multi-region ACID guarantees matches Cloud Spanner. Sub-millisecond in-memory caching with geospatial support matches Memorystore for Redis. Serverless document storage with offline sync matches Firestore.
Each workload specification aligns directly with the architectural design principles of GCP database offerings: Cloud Bigtable for high-scale write-heavy time-series, Cloud Spanner for globally distributed relational ACID transactions, Memorystore for Redis for sub-millisecond in-memory operations, and Firestore for serverless real-time document synchronization.

Adım Adım Çözüm

1
Analyze high-throughput time-series ingestion requirement (>1,000,000 writes/sec)
Identify Cloud Bigtable as the optimal scalable NoSQL wide-column store designed for time-series metrics and heavy write throughput.
Cloud Bigtable scales linearly to handle millions of IOPS with consistent low-latency key lookups.
2
Evaluate global relational OLTP requirement with a 99.999% availability SLA
Identify Cloud Spanner as the target managed relational database.
Cloud Spanner uses TrueTime hardware clocks and Paxos consensus to deliver multi-region strong consistency and five-nines availability.
3
Examine sub-millisecond caching requirement with geospatial query capabilities
Identify Memorystore for Redis.
Memorystore for Redis delivers ultra-low latency in-memory data management supporting advanced Redis primitives like GEO indexing.
4
Review mobile/web frontend document store requirement with offline sync and live listeners
Identify Firestore.
Firestore client SDKs natively support real-time data sync, offline data caching, and automatic scaling for app developers.

Anahtar Kavram

Evaluating workload access patterns, consistency requirements, scale, and latency targets to select optimal GCP storage and database resources.
Soru 9Soru →

Match each Google Cloud data encryption mechanism on the left with its defining key management characteristic on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Google-default Encryption
Customer-Managed Encryption Keys (CMEK)
Customer-Supplied Encryption Keys (CSEK)
Cloud External Key Manager (Cloud EKM)

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Google-default Encryption matches automatic key management by Google; CMEK matches storing keys in Cloud KMS with customer rotation and IAM control; CSEK matches supplying raw AES-256 keys in API headers; Cloud EKM matches keeping encryption keys in an external third-party HSM outside Google Cloud.
Each encryption mechanism in Google Cloud provides a distinct balance of operational management and key control. Google-default encryption is fully automated. CMEK grants control over key rotation and IAM policies inside Cloud KMS. CSEK allows customers to supply raw keys per API call. Cloud EKM delegates key protection to external on-premises or third-party HSMs.

Adım Adım Çözüm

1
Identify the key storage location and management responsibility for Google-default encryption.
Recognize that Google handles all encryption key lifecycle operations automatically without user intervention.
Google-default encryption is fully managed by GCP for data at rest.
2
Analyze Customer-Managed Encryption Keys (CMEK).
Associate CMEK with Cloud KMS where key policies, rotation, and IAM access are customer-configured.
CMEK provides customer control over key lifecycles hosted within Google Cloud infrastructure.
3
Analyze Customer-Supplied Encryption Keys (CSEK).
Link CSEK to raw AES-256 keys supplied per request header that exist only temporarily in volatile memory.
CSEK guarantees Google does not retain key material after the request finishes.
4
Analyze Cloud External Key Manager (Cloud EKM).
Connect EKM to keys residing in external HSM systems outside Google Cloud.
Cloud EKM enables cryptographic operations using keys hosted in an off-cloud HSM.

Anahtar Kavram

Data Encryption Options and Key Management Models in GCP
Soru 10Soru →

Match each enterprise security and compliance requirement on the left with the corresponding Google Cloud key management implementation on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

The enterprise mandates strict key sovereignty where master encryption key material must permanently reside within an on-premises FIPS 140-2 Level 3 Hardware Security Module (HSM) outside Google Cloud, while permitting Cloud Storage and BigQuery to perform cryptographic operations via API calls.
A regulatory compliance framework requires passing a raw, customer-generated 256-bit AES encryption key in the header of each individual API call for Cloud Storage object operations, ensuring no key material or key metadata is persisted in Google Cloud after the request completes.
Internal security policies mandate customer control over key rotation schedules, destruction lifecycle, and IAM permission grants, while performing all cryptographic operations inside cloud-hosted, FIPS 140-2 Level 3 validated hardware security modules managed via Google Cloud APIs.
Standard baseline security policies require transparent data-at-rest encryption across all created storage resources with zero operational management overhead, requiring no custom IAM service account configuration or external cryptographic infrastructure.

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

1. External key sovereignty with on-premises key residence maps to Cloud External Key Manager (Cloud EKM).
2. Raw key supplied per API request without persistence maps to Customer-Supplied Encryption Keys (CSEK).
3. Customer key lifecycle control using cloud-hosted FIPS 140-2 Level 3 hardware maps to Customer-Managed Encryption Keys (CMEK) using Cloud HSM.
4. Transparent zero-overhead automatic protection maps to Google-default Encryption.
Each requirement maps to its exact cryptographic boundary: Cloud EKM keeps keys in external on-premises HSMs; CSEK requires raw key material passed per API call without persistence; CMEK with Cloud HSM provides customer control over keys residing in Google Cloud FIPS 140-2 Level 3 HSMs; Google-default provides automated, zero-overhead encryption.

Adım Adım Çözüm

1
Analyze key residency and external control requirements.
Matched key sovereignty requiring keys to remain outside Google Cloud infrastructure to Cloud External Key Manager (Cloud EKM).
Cloud EKM connects Cloud KMS with external partner HSMs or on-premises key managers so key material never enters Google Cloud.
2
Evaluate key delivery mechanisms per API request.
Matched raw key supply per request header to Customer-Supplied Encryption Keys (CSEK).
CSEK requires raw key material in each API call and bypasses Cloud KMS storage completely.
3
Identify cloud-native HSM key management requirements.
Matched customer key management with FIPS 140-2 Level 3 cloud compliance to CMEK using Cloud HSM.
Cloud HSM hosts customer keys in managed FIPS 140-2 Level 3 hardware modules integrated with Cloud KMS.
4
Determine default platform encryption capability.
Matched zero-overhead automatic encryption to Google-default Encryption.
All GCP data at rest is encrypted by default using Google-managed keys without user configuration.

Anahtar Kavram

Architectural selection between Google-default Encryption, Customer-Managed Encryption Keys (CMEK/Cloud HSM), Customer-Supplied Encryption Keys (CSEK), and Cloud External Key Manager (Cloud EKM) based on compliance and custody requirements.
Soru 11Soru →

Match each Google Cloud security service on the left to its primary functional capability in container security and threat detection on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Container Analysis
Binary Authorization
Event Threat Detection

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Container Analysis pairs with scanning container images for vulnerabilities in Artifact Registry; Binary Authorization pairs with enforcing signature-based image deployment policies on GKE; Event Threat Detection pairs with analyzing log streams in Security Command Center to identify threats.
Container Analysis provides vulnerability scanning for container images stored in registries. Binary Authorization ensures only verified, signed images are deployed to GKE clusters. Event Threat Detection processes log streams to identify active security threats across GCP resources.

Adım Adım Çözüm

1
Identify the primary role of Container Analysis.
Container Analysis scans container images stored in Artifact Registry for vulnerability CVEs.
Container Analysis provides static vulnerability scanning for stored artifacts.
2
Identify the primary role of Binary Authorization.
Binary Authorization verifies cryptographic signatures prior to container deployment on GKE.
Binary Authorization enforces deploy-time security policies based on attestations.
3
Identify the primary role of Event Threat Detection.
Event Threat Detection analyzes log streams within Security Command Center to detect threat indicators.
Event Threat Detection provides real-time analysis of audit and system logs for threat activity.

Anahtar Kavram

Vulnerability Scanning, Container Security, and Threat Detection
Soru 12Soru →

Match each Google Cloud perimeter security mechanism to the specific security threat or operational requirement it primarily addresses.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

VPC Service Controls
Cloud Armor
Hierarchical Firewall Policies
Private Service Connect

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

VPC Service Controls matches with preventing data exfiltration around Google Cloud APIs; Cloud Armor matches with Layer 7 protection and rate-limiting at the edge; Hierarchical Firewall Policies matches with enforcing baseline rules across the organization hierarchy; and Private Service Connect matches with private cross-VPC service access without VPC Peering.
Each feature aligns directly with its primary architecture purpose: VPC Service Controls safeguards API data boundaries against exfiltration; Cloud Armor provides WAF and edge filter capabilities; Hierarchical Firewall Policies enforce network security rules across the enterprise resource hierarchy; and Private Service Connect offers secure private access to services in separate VPCs.

Adım Adım Çözüm

1
Identify the primary perimeter controls for Google Cloud APIs and data protection.
Recognize that VPC Service Controls creates perimeter boundaries to mitigate data exfiltration risks.
VPC Service Controls specifically secures Google Cloud API communications, preventing unauthorized copies or access from outside defined perimeters.
2
Identify the primary edge web application security service.
Match Cloud Armor to Layer 7 protection and edge rate limiting.
Cloud Armor protects web applications attached to Google Cloud load balancers against common web attacks and DDoS.
3
Identify organization-wide network governance tools.
Match Hierarchical Firewall Policies to organization-level rule enforcement.
Hierarchical policies are inherited at the Organization and Folder levels to enforce security guardrails top-down.
4
Identify modern cross-VPC private connectivity options.
Match Private Service Connect to private service consumption without VPC Peering.
Private Service Connect uses endpoints in the consumer VPC to reach producer services privately without needing complex VPC Peering topologies.

Anahtar Kavram

GCP Network Security and Perimeter Controls
Soru 13Soru →

An enterprise security architect is defining key management and data encryption standards across Google Cloud infrastructure to satisfy distinct regulatory guidelines. Match each compliance and operational key control requirement to its corresponding Google Cloud encryption mechanism.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Data must be encrypted at rest using keys hosted on an on-premises Hardware Security Module (HSM), ensuring Google Cloud never stores or directly accesses unencrypted root key material, with cryptographic requests routed externally over private network connections.
Data must be protected using customer-controlled cryptographic keys hosted in Google Cloud, supporting automated key rotation schedules, fine-grained IAM access control, and FIPS 140-2 Level 3 HSM hardware protection.
Transient compute workloads require per-request encryption key material supplied directly in API calls for disk operations, where key material resides only in ephemeral memory and is never retained in GCP persistent storage.
Data resting in cloud storage services must be protected by default using symmetric AES-256 encryption without requiring custom key creation, IAM role assignments, or operational key management overhead.

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Cloud EKM matches external on-premises HSM key hosting; CMEK via Cloud KMS/HSM matches in-cloud customer-controlled key lifecycle and rotation management; CSEK matches raw per-request key material held only in transient memory; Google-Default Encryption matches automated zero-overhead baseline storage encryption.
Each key control requirement maps to a specific GCP encryption model based on key ownership location and operational burden: Cloud EKM protects data with keys residing outside GCP; CMEK offers native GCP KMS lifecycle management; CSEK processes ephemeral client-provided keys per call; and Google-Default handles transparent baseline storage encryption.

Adım Adım Çözüm

1
Analyze external on-premises key retention requirements.
Identify that Cloud External Key Manager (Cloud EKM) routes cryptographic requests to keys hosted outside GCP boundaries.
Cloud EKM connects GCP services to external HSM systems so root keys never leave on-premises infrastructure.
2
Evaluate requirements for customer-managed key lifecycle and rotation within Google Cloud.
Match with Customer-Managed Encryption Keys (CMEK) using Cloud KMS or Cloud HSM.
CMEK gives full control over rotation schedules, IAM policy permissions, and location while running on Google Cloud managed infrastructure.
3
Assess transient per-request key header requirements.
Match with Customer-Supplied Encryption Keys (CSEK).
CSEK accepts user-supplied key material in API request headers without storing the keys anywhere in Google Cloud persistent storage.
4
Identify default baseline platform encryption requirements.
Match with Google-Default Encryption.
Google Cloud automatically encrypts all data at rest using AES-256 standard encryption without requiring manual key management.

Anahtar Kavram

Google Cloud Data Encryption Spectrum (Google-Default, CMEK, CSEK, Cloud EKM)
Soru 14Soru →

Match each Google Cloud network security requirement with the perimeter control mechanism best suited to fulfill it.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Preventing internal users with valid IAM access from copying sensitive BigQuery datasets to unauthorized external Google Cloud projects.
Protecting public-facing web applications at the external HTTP(S) load balancer against SQL injection attacks and volumetric DDoS.
Enforcing organization-wide firewall rules centrally across multiple VPC networks using dynamic resource metadata tags.
Enabling internal Compute Engine Virtual Machines without public IP addresses to securely reach Google Cloud APIs.

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

VPC Service Controls prevent data exfiltration to unauthorized projects; Cloud Armor Security Policies protect edge applications from DDoS and web application attacks; Hierarchical Firewall Policies with Secure Tags enforce organization-wide traffic control; Private Google Access allows private VMs to communicate with GCP APIs.
Each GCP security feature targets a distinct architectural layer: VPC Service Controls protect against data exfiltration across GCP API boundaries; Cloud Armor provides edge WAF and DDoS defenses at load balancers; Hierarchical Firewall Policies enforce centralized organizational firewall rules with secure tags; and Private Google Access provides secure API egress for private VMs.

Adım Adım Çözüm

1
Analyze the threat of unauthorized data copying by privileged internal users.
Identify that IAM roles alone cannot prevent data movement across project boundaries, requiring VPC Service Controls perimeters.
VPC Service Controls restrict API communication between resources inside and outside a perimeter.
2
Evaluate protection controls for internet-facing web endpoints.
Map Web Application Firewall (WAF) features like SQLi protection and volumetric DDoS defense to Cloud Armor.
Cloud Armor operates at the Google Cloud edge attached to load balancers to block malicious traffic before reaching compute backends.
3
Review enterprise-wide firewall administration requirements.
Select Hierarchical Firewall Policies combined with Secure Tags.
Hierarchical policies apply rules across folder and organization levels that individual VPC admins cannot override.
4
Determine the network service required for private VM outreach to Google services.
Identify Private Google Access.
Private Google Access routes internal VM traffic securely to default Google API endpoints without external IPs.

Anahtar Kavram

Google Cloud Perimeter Security Mechanisms
Soru 15Soru →

An enterprise Cloud Architect is designing perimeter security controls for a multi-tenant Google Cloud architecture. Match each enterprise security requirement on the left with the most appropriate Google Cloud perimeter control mechanism on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Prevent an authorized internal identity in a VPC from copying BigQuery dataset contents to an unapproved, external Google Cloud project storage location.
Mitigate Layer 7 credential-stuffing attacks targeting a public Global External HTTP(S) Load Balancer by dynamically throttling clients exceeding request thresholds.
Enforce organization-wide ingress traffic rules across multiple Shared VPC networks using dynamic, IAM-bound workload identity metadata rather than IP ranges.
Provide on-premises workloads private access to a third-party managed SaaS service hosted in a producer VPC without configuring transitive VPC Peering.

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Each enterprise security requirement maps directly to its designated perimeter control: Data exfiltration prevention matches VPC Service Controls; Layer 7 rate limiting matches Cloud Armor edge security policies; dynamic organization-wide firewall rule enforcement matches Hierarchical firewall policies with Secure Tags; and non-transitive private SaaS connection matches Private Service Connect.
The correct alignment maps each specific architectural risk to its appropriate defense mechanism: VPC Service Controls for exfiltration boundary defense, Cloud Armor for L7 edge protection, Hierarchical Firewalls with Secure Tags for organization-wide metadata-driven filtering, and Private Service Connect for non-transitive endpoint access.

Adım Adım Çözüm

1
Analyze data exfiltration vector
Identify that IAM permissions alone cannot stop authorized users from writing to external resources, requiring a security perimeter control.
VPC Service Controls restrict API communication between managed services and external projects outside the perimeter.
2
Evaluate application-layer threat mitigation
Determine the edge protection mechanism for HTTP(S) Load Balancer traffic.
Cloud Armor inspects incoming web traffic at the global edge and enforces threshold-based rate limiting.
3
Assess dynamic network access policy across organization hierarchy
Select hierarchical policies with IAM-bound identity tags.
Hierarchical firewall rules combined with Secure Tags enforce consistent security postures at the organization level without IP static dependencies.
4
Review multi-tenant private connectivity options
Choose Private Service Connect for service endpoint publishing and consumption across network boundaries.
Private Service Connect bypasses transitive routing restrictions associated with VPC Network Peering and isolates tenant networks.

Anahtar Kavram

GCP Network Security & Perimeter Controls
Soru 16Soru →

Match each enterprise security and governance requirement to its corresponding Google Cloud data encryption and key management model.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Automated key rotation policies with cryptographic key material stored inside FIPS 140-2 Level 3 validated hardware security modules managed within Google Cloud.
Supplying raw 256-bit AES keys directly in API request headers for transient in-memory use, ensuring Google Cloud never persists the root key material.
Retaining absolute ownership of root cryptographic keys within an external on-premises HSM while authorizing GCP services to invoke external key management endpoints.
Automatic data protection at rest using symmetric keys without requiring custom IAM configurations, key lifecycle management, or operational oversight.

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Matching pairings: FIPS 140-2 Level 3 automated key rotation maps to CMEK via Cloud HSM; Per-request raw key injection without persistence maps to CSEK; External key management via on-premises HSM endpoints maps to Cloud EKM; Zero-configuration automated encryption maps to Google-default Encryption.
Each encryption model aligns with specific key control boundaries: Google-default is zero-configuration baseline encryption; CMEK via Cloud HSM offers managed hardware protection (FIPS 140-2 Level 3) with Cloud KMS automated rotation; CSEK requires raw AES-256 keys passed per request without storage; Cloud EKM delegates key operations to external on-premises HSM endpoints.

Adım Adım Çözüm

1
Analyze the requirement for automated rotation within a cloud-managed hardware security module.
CMEK backed by Cloud HSM fulfills FIPS 140-2 Level 3 requirements while allowing automated rotation via Cloud KMS.
Cloud HSM hosts key material natively within Google's cloud security boundary under hardware protection.
2
Evaluate the requirement for per-request raw key injection without persistence by Google.
CSEK requires raw 256-bit AES key material passed in API headers for transient in-memory operations.
CSEK ensures Google Cloud stores neither the root key nor key wrapping structures across API calls.
3
Identify the external key sovereignty pattern connecting GCP services to on-premises HSM APIs.
Cloud EKM establishes API connectivity between Google Cloud services and third-party external key managers.
Cloud EKM guarantees root keys reside physically outside Google Cloud infrastructure at all times.
4
Identify the baseline zero-overhead encryption model.
Google-default encryption transparently handles symmetric key generation and data encryption out of the box.
All Google Cloud storage and database services automatically encrypt data at rest by default.

Anahtar Kavram

Classification of GCP Data Encryption Models (Google-default, CMEK/Cloud HSM, CSEK, Cloud EKM)
Soru 17Soru →

Match each organizational data security requirement to its corresponding Google Cloud encryption and key management architecture model.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Google-default Encryption
Customer-Managed Encryption Keys (CMEK)
Customer-Supplied Encryption Keys (CSEK)
Cloud External Key Manager (Cloud EKM)

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Google-default Encryption matches automatic AES-256 encryption managed by Google without configuration. CMEK matches keys generated/stored in Cloud KMS with customer-controlled lifecycle and IAM permissions. CSEK matches customer-supplied raw 256-bit keys provided per API call with no GCP key persistence. Cloud EKM matches key material residing outside GCP in a third-party/on-premises HSM accessed via Cloud KMS.
Each key management tier represents a distinct boundary of operational responsibility and key location: Google-default is fully automated; CMEK stores keys in GCP Cloud KMS with customer-managed IAM/rotation policies; CSEK transiently receives raw customer keys per API call; Cloud EKM keeps master key material inside an external non-GCP HSM.

Adım Adım Çözüm

1
Analyze the operational control and key location for Google-default Encryption.
Identified that Google manages key generation, rotation, and storage automatically without customer configuration (matches statement describing default AES-256 with zero setup).
Google-default encryption is enabled out-of-the-box for all GCP storage services.
2
Differentiate CMEK from CSEK based on key persistence and KMS involvement.
CMEK utilizes Cloud KMS within GCP to manage key lifecycles, IAM service agent permissions, and rotation schedules. CSEK requires passing raw key material in API headers directly, retaining zero key material in Cloud KMS.
CMEK delegates storage to Cloud KMS, whereas CSEK keeps key management completely external to GCP and passes key headers transiently.
3
Evaluate the architectural pattern for Cloud EKM.
Cloud EKM connects Cloud KMS to an external physical HSM infrastructure outside of GCP, ensuring the master key material never leaves the external HSM.
Regulatory compliance may mandate physical separation of cryptographic key storage from cloud service providers.

Anahtar Kavram

GCP Key Management Spectrum (Default, CMEK, CSEK, Cloud EKM)
Tahmini Süre:1m 30s
Soru 18Soru →

A financial services enterprise is designing a comprehensive container security and threat management architecture on Google Cloud for their Google Kubernetes Engine (GKE) microservices. The lead cloud security architect must select and configure specific Google Cloud security services to meet security enforcement, threat monitoring, and vulnerability scanning requirements across the supply chain and runtime environments. Match each Google Cloud security service on the left with its corresponding architectural requirement on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Binary Authorization
Artifact Analysis Container Scanning
Security Command Center Event Threat Detection
GKE Security Posture Dashboard

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Binary Authorization maps to enforcing cryptographic image attestation at deployment time; Artifact Analysis Container Scanning maps to automated image scanning and continuous CVE monitoring in Artifact Registry; Security Command Center Event Threat Detection maps to real-time stream log analysis for threat detection; GKE Security Posture Dashboard maps to auditing workload configuration and container OS vulnerabilities in cluster management views.
Each selected security tool fulfills a specific role in a defense-in-depth container security strategy: Binary Authorization enforces policy checks at GKE deployment time; Artifact Analysis handles vulnerability scanning in Artifact Registry; Event Threat Detection performs log stream threat analysis; and the GKE Security Posture Dashboard delivers runtime workload configuration auditing and vulnerability assessment.

Adım Adım Çözüm

1
Evaluate the requirement for preventing unauthorized image deployment to GKE.
Binary Authorization integrates with GKE admission controllers to enforce signature-based attestation checks before container deployment.
Ensures only trusted, signed images built by approved CI/CD pipelines can execute in the cluster.
2
Determine the service for registry-level image vulnerability scanning.
Artifact Analysis automatically scans images stored in Artifact Registry and maintains an updated CVE status through continuous scanning.
Provides early detection of package vulnerabilities prior to container deployment.
3
Identify the organization-wide threat detection service utilizing log streams.
Security Command Center Event Threat Detection parses log streams in near real-time to identify threat signatures.
Detects suspicious security events across Google Cloud resources without needing container-level agent installation.
4
Match the cluster-native workload security posture and configuration scanner.
GKE Security Posture Dashboard surfaces configuration risks and runtime vulnerability assessments natively within GKE.
Gives cluster administrators direct visibility into Kubernetes workload vulnerabilities and compliance drift.

Anahtar Kavram

Mapping Google Cloud container security, vulnerability scanning, and threat detection services to supply chain and runtime security requirements.
Soru 19Soru →

Match each enterprise security requirement with the Google Cloud perimeter control mechanism best suited to fulfill it according to GCP architectural best practices.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Preventing sensitive data exfiltration from Google-managed storage services (e.g., Cloud Storage, BigQuery) to external projects, even if administrator IAM credentials are compromised.
Mitigating Layer 7 application attacks (such as SQL injection and cross-site scripting) and implementing rate limiting at the global edge network before traffic hits backends.
Enforcing mandatory, organization-wide firewall rules at the folder or organization level that cannot be overridden by individual project administrators.
Providing private, internal IP connectivity from on-premises environments to Google APIs and managed services without relying on public IP addresses or complex VPC peering topologies.

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

The optimal alignment matches: 1) Data exfiltration defense despite compromised IAM credentials to VPC Service Controls security perimeters. 2) Layer 7 protection and edge rate-limiting to Cloud Armor security policies. 3) Non-overridable organization-level firewall rules to Hierarchical firewall policies using Secure Tags. 4) Private on-premises and internal access to Google APIs to Private Service Connect endpoints.
Each control maps directly to its perimeter security domain: VPC Service Controls creates logical perimeters around GCP APIs to block data exfiltration; Cloud Armor provides edge WAF and DDoS protection for public endpoints; Hierarchical firewall policies enforce org-wide security governance using Secure Tags; Private Service Connect delivers private, internal IP access to Google APIs.

Adım Adım Çözüm

1
Analyze requirement 1 regarding data exfiltration prevention.
IAM roles authorize WHO can access resources, but VPC Service Controls establishes boundaries determining WHERE data can move. Isolating Cloud Storage and BigQuery within a VPC SC perimeter prevents unauthorized copying to external projects.
VPC SC is specifically designed to mitigate exfiltration risks even when credential theft occurs.
2
Analyze requirement 2 regarding edge application protection and DDoS defense.
Web Application Firewall (WAF) capabilities, SQLi filtering, and rate limiting at the edge are provided by Cloud Armor when attached to External HTTP(S) Load Balancers.
Cloud Armor operates at the Google edge to inspect incoming HTTP(S) requests before reaching backends.
3
Analyze requirement 3 regarding centralized, non-overridable rule enforcement.
Hierarchical firewall policies inherit rules down the resource hierarchy (Org -> Folder -> Project) and take precedence over local VPC network firewall rules.
Hierarchical firewall policies combined with Secure Tags enable central security governance that project admins cannot disable.
4
Analyze requirement 4 regarding private access to Google APIs from hybrid networks.
Private Service Connect creates internal endpoint IP addresses in consumer VPCs that route to Google API targets natively without public IPs or VPC Peering.
PSC simplifies private API connectivity across Cloud VPN or Cloud Interconnect lines from on-premises.

Anahtar Kavram

GCP Perimeter Security and Defense-in-Depth Mechanisms
Soru 20Soru →

A software enterprise is refining its perimeter defense architecture across multiple Google Cloud projects to satisfy stringent compliance mandates. Match each specific security requirement on the left with the corresponding Google Cloud perimeter control mechanism on the right that best satisfies the architectural goal.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Prevent unauthorized data exfiltration from Cloud Storage and BigQuery to external storage locations, even when requests stem from compromised high-privilege IAM credentials.
Inspect incoming HTTP(S) traffic at the global edge to block Layer 7 SQL injection threats and apply rate-limiting rules prior to reaching workload endpoints.
Enforce consistent organizational network ingress rules across multiple VPCs by binding firewall policies to resource hierarchy nodes and dynamically targeting workloads using IAM-governed tags.
Enable workloads in an isolated private VPC network to securely access managed third-party services over private IP addresses without established VPC Network Peering.

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

1. Data exfiltration prevention against compromised IAM credentials matches VPC Service Controls Service Perimeters.
2. Layer 7 SQL injection and rate-limiting at the edge matches Cloud Armor Security Policies.
3. Organization-wide ingress rules bound to hierarchy nodes with dynamic tagging matches Hierarchical Firewall Policies with Secure Tags.
4. Private IP access to third-party services without VPC peering matches Private Service Connect (PSC) Endpoints.
Each perimeter control fulfills a distinct security layer: VPC Service Controls protect API data boundaries against exfiltration; Cloud Armor provides edge L7 protective filtering; Hierarchical Firewall Policies with Secure Tags enforce top-down network access rules; and Private Service Connect enables private consumer-to-producer service endpoints without establishing VPC peering.

Adım Adım Çözüm

1
Analyze the requirement for exfiltration prevention under credential compromise.
Identify that IAM permissions control WHO has access, whereas VPC Service Controls restrict FROM WHERE and TO WHERE APIs can transfer data. Thus, VPC Service Controls Service Perimeters fulfill this requirement.
IAM alone cannot prevent a compromised identity from copying data to an external bucket; a perimeter around APIs is required.
2
Analyze the requirement for edge Layer 7 filtering and rate-limiting.
Recognize that edge WAF capability attached to Global Load Balancers is provided by Cloud Armor Security Policies.
Cloud Armor provides web application firewall rulesets and edge DDoS/rate-limiting features.
3
Analyze the requirement for hierarchy-wide firewall enforcement using secure tags.
Identify Hierarchical Firewall Policies configured at the organization/folder level combined with Secure Tags.
Hierarchical firewalls enforce top-down rules across multiple VPCs without relying on network-level IP definitions.
4
Analyze the requirement for accessing external or third-party services privately without VPC peering.
Match with Private Service Connect (PSC) Endpoints.
PSC routes traffic via endpoint IP addresses in the consumer VPC to target service attachments without IP overlapping or transitive peering constraints.

Anahtar Kavram

Google Cloud Perimeter Security Architecture
Sayfa 1 / 4Sonraki
Tüm alıştırma soruları — Google Cloud Professional Cloud Architect | Examkin