Designing for security and compliance practice questions

Answer: A) Configure the perimeter in dry-run mode and review the audit log entries marked as dry-run violations

VPC Service Controls dry-run mode logs requests that would violate a perimeter without blocking them. The team can find which workloads need ingress or egress rules before switching to enforcement.

• AA dry-run perimeter logs requests that would violate it as though it were enforced, without denying them. The audit log entries have metadata.dryRun set to true, so the team can tune the rules before enforcing.
• BThis is still enforcement. Legitimate requests that the access level doesn't cover, such as service-to-service traffic, would be blocked in production before anyone could review them.
• CWith no restricted services, the perimeter doesn't evaluate BigQuery or Cloud Storage calls. No relevant violations would be logged, so it shows nothing about what enforcement would block.
• DPolicy Simulator tests changes to IAM allow policies. It doesn't evaluate VPC Service Controls perimeter configurations.

Answer: A) Enforce the compute.requireOsLogin organization policy constraint at the organization node

Enforcing the compute.requireOsLogin organization policy constraint at the organization node requires OS Login in every current and future project and blocks overrides through metadata.

• ACorrect. When enforced, this constraint adds enable-oslogin=true to new projects and rejects any request that sets enable-oslogin to false in project or instance metadata. Because the policy is inherited, it covers existing and future projects.
• BIncorrect. This turns on OS Login only in projects that exist today, and anyone who can edit metadata can set the key to FALSE at the project or instance level. Nothing enforces it.
• CIncorrect. This role lets users log in through OS Login where OS Login is enabled. It doesn't require VMs to use OS Login.
• DIncorrect. Firewall rules control where SSH traffic can come from, not how users are authenticated. VMs could still accept metadata-based SSH keys.

Answer: A) A VPC Service Controls perimeter around the project so its storage/BigQuery APIs can only be reached from inside the perimeter

• AVPC Service Controls adds a context-based boundary on top of IAM: requests to protected services from outside the perimeter (e.g. to copy data to an external project) are denied even with valid credentials.
• BIAM controls who can read, but an authorized reader can still exfiltrate; that's the gap VPC-SC closes.
• CVersioning protects against overwrite/delete; it does nothing to stop data leaving the perimeter.
• DA cost alert is after-the-fact and doesn't block the copy.

Answer: A) Container Threat Detection

• AIt monitors container runtime behavior and reports suspicious activity to Security Command Center.
• BThat governs Cloud Storage permissions.
• CNAT logs record outbound connections, not container behavior.
• DSnapshots back up disk data; they don't watch running containers.

Answer: A) Security Command Center

• ASecurity Command Center aggregates asset inventory, vulnerabilities, and threats across the organization for centralized visibility and response.
• BCloud Scheduler triggers jobs on a schedule and has no security-finding aggregation role.
• CCloud Tasks manages asynchronous task execution, unrelated to security posture visibility.
• DCloud Build runs CI/CD pipelines; it does not aggregate security findings across the organization.

Answer: A) With CSEK, you supply the key with each request

• AGoogle doesn't store CSEKs; with CMEK, keys are managed in Cloud KMS.
• BCMEK keys live in Cloud KMS; CSEKs are provided by the customer at request time.
• CDefault encryption uses Google-managed keys.
• DThey differ in where keys are held and how they're provided.

Answer: A) Download them from Google Cloud's Compliance Reports Manager

Google Cloud publishes its third-party audit reports and certifications, including SOC reports and ISO/IEC certificates, in Compliance Reports Manager. Tools such as Security Command Center, Assured Workloads and Access Transparency deal with the customer's own posture and controls.

• ACorrect. Compliance Reports Manager gives on-demand access, at no extra cost, to Google Cloud's ISO/IEC certificates, SOC reports, other third-party audits and self-assessments. Some resources require signing in with a Google Cloud account.
• BIncorrect. Security Command Center checks the customer's own resources against security benchmarks and standards. It does not provide Google's independent audit reports or certificates.
• CIncorrect. Assured Workloads applies controls such as data residency and personnel restrictions to customer workloads. It does not issue or distribute Google's SOC or ISO audit reports.
• DIncorrect. Access Transparency logs record actions that Google personnel take on customer content. They are operational logs, not third-party certification or attestation reports.

Answer: A) Tokenize PANs at ingestion and isolate the cardholder data environment in dedicated projects inside a VPC Service Controls perimeter

PCI DSS scope depends on where cardholder data is stored and transmitted. Tokenizing PANs and segmenting the cardholder data environment with dedicated projects and VPC Service Controls is Google's recommended way to reduce scope. Encryption, IAM, and Google's own attestation do not remove systems from the customer's scope.

• ACorrect. Google's PCI scope-reduction guidance recommends tokenization together with segmentation through the resource hierarchy and VPC Service Controls. Analytics systems that see only tokens, kept separate from the systems that store or transmit PANs, can be kept out of the cardholder data environment.
• BIncorrect. CMEK encryption is reversible, and the retailer holds the keys, so the dataset and the systems that use it still store cardholder data and stay in scope. Unlike a token, an encrypted PAN can be recovered.
• CIncorrect. Google's attestation covers Google's share of the responsibility. Customers are still responsible for making sure their applications are PCI DSS compliant. Putting everything in one project also brings the analytics systems into scope.
• DIncorrect. Access control is required, but it does not take the dataset out of scope. Any system that stores PANs is part of the cardholder data environment, however tightly access is restricted.

Answer: A) Confidential VMs (Confidential Computing), which keep memory encrypted during processing using hardware (e.g. AMD SEV)

• AConfidential Computing encrypts the VM's memory with keys the hypervisor cannot access, so data stays protected while in use, closing the in-memory gap.
• BCMEK protects data at rest on the disk, not the data being processed in RAM.
• CTLS covers data in transit only.
• DVPC-SC limits where data can move between services; it doesn't encrypt memory during computation.

Answer: A) Automatic key rotation

• ACloud KMS can rotate symmetric keys automatically on a defined schedule.
• BDeleting a key would make data encrypted with it unreadable.
• CDefault encryption doesn't give the customer control of rotation.
• DDisabling blocks use; it doesn't create new versions.