Access Context Manager in GCP - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Understanding Access Context Manager Perimeter Behavior

You have created an Access Context Manager service perimeter around your Google Cloud projects to restrict data access. What happens if a user tries to access a resource inside the perimeter from a device that is not compliant with the defined access level?

A The access request is allowed but logged for auditing purposes only.

B The access request is denied because the device does not meet the access level requirements.

C The access request is allowed without any restrictions since the user is authenticated.

D The access request is redirected to a VPN to meet compliance requirements.

💡 Hint

Think about how Access Context Manager enforces security policies based on device compliance.

Access Context Manager enforces access restrictions by denying requests that do not meet the defined access levels, such as device compliance. This prevents unauthorized or non-compliant devices from accessing protected resources.

❓ Configuration

intermediate

Configuring an Access Level with Device Policy

You want to create an Access Level that only allows access from devices that are encrypted and have a screen lock enabled. Which JSON snippet correctly defines this device policy in Access Context Manager?

A { "devicePolicy": { "encryptionStatus": "ENCRYPTED", "screenLockRequired": true } }

B { "devicePolicy": { "encryptionStatus": "UNENCRYPTED", "screenLockRequired": false } }

C { "devicePolicy": { "encryptionStatus": "ENCRYPTED", "screenLockRequired": false } }

D { "devicePolicy": { "encryptionStatus": "UNENCRYPTED", "screenLockRequired": true } }

💡 Hint

Encryption and screen lock are key device security features to enforce.

The correct device policy requires the device to be encrypted and have a screen lock enabled. Option A correctly sets these requirements.

❓ Architecture

advanced

Designing a Secure Access Perimeter for Multiple Projects

You manage three Google Cloud projects with sensitive data. You want to create a single service perimeter that includes all three projects and restricts access to only users from your corporate network and compliant devices. Which architecture best achieves this?

A Create a service perimeter including only one project and use VPN to connect the other projects securely.

B Create separate service perimeters for each project with different access levels for each corporate subnet and device policy.

C Use firewall rules on each project to restrict IP ranges and rely on IAM roles for device compliance.

D Create one service perimeter including all three projects and define an access level that combines IP subnet restrictions for the corporate network and device compliance policies.

💡 Hint

Think about how Access Context Manager service perimeters can group projects and enforce combined access levels.

Creating one service perimeter that includes all projects and defining a combined access level for IP and device compliance is the best practice to centrally enforce consistent access restrictions.

❓ security

advanced

Evaluating Access Context Manager's Response to Unauthorized Access

When a user outside the defined access levels tries to access a resource inside a service perimeter, what is the default behavior of Access Context Manager?

A The request is blocked and the user receives a 403 Forbidden error.

B The request is redirected to a login page for additional authentication.

C The request is allowed but triggers an alert to the security team.

D The request is queued until an administrator approves it.

💡 Hint

Consider how strict perimeter enforcement works in cloud security.

Access Context Manager blocks requests that do not meet access level requirements by returning a 403 Forbidden error, preventing unauthorized access.

❓ service_behavior

expert

Analyzing Access Context Manager Behavior with Nested Service Perimeters

You have two service perimeters: Perimeter A includes Project 1 and Perimeter B includes Project 1 and Project 2. Both perimeters have different access levels. A user tries to access Project 1 resources. Which access level is enforced?

A The access level of Perimeter B is enforced because it includes more projects.

B The access level of Perimeter A is enforced because it is the smaller perimeter.

C The more restrictive access level between Perimeter A and Perimeter B is enforced.

D No access level is enforced due to overlapping perimeters causing conflict.

💡 Hint

Think about how Access Context Manager handles overlapping perimeters and access levels.

When service perimeters overlap, Access Context Manager enforces the most restrictive access level applicable to the resource to maintain security.