Access Context Manager in GCP - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to create an Access Level with a basic condition.

GCP

access_level = {
  "name": "accessPolicies/123/accessLevels/level1",
  "title": "Office Hours Access",
  "basic": {
    "conditions": [
      {
        "ipSubnetworks": ["[1]"],
        "members": ["user:[e-mail]"]
      }
    ]
  }
}

Drag options to blanks, or click blank then click option'

A"0.0.0.0/0"

B"10.0.0.0/8"

C"172.16.0.0/12"

D"192.168.1.0/24"

Attempts:

3 left

💡 Hint

Common Mistakes

Using a public IP range like 0.0.0.0/0 which allows all IPs.

Choosing a subnet too broad for office access.

The IP subnet "192.168.1.0/24" restricts access to a local office network, which is a common use case for Access Context Manager conditions.

2fill in blank

medium

Complete the code to define an Access Policy with a specific parent resource.

GCP

access_policy = {
  "parent": "[1]",
  "title": "My Access Policy"
}

Drag options to blanks, or click blank then click option'

A"organizations/456"

B"projects/123"

C"folders/789"

D"users/abc"

Attempts:

3 left

💡 Hint

Common Mistakes

Using a project or folder as the parent resource.

Using an invalid resource type like users.

The parent for an Access Policy must be an organization resource, such as "organizations/456".

3fill in blank

hard

Fix the error in the Access Level condition to correctly specify device policy.

GCP

access_level = {
  "name": "accessPolicies/123/accessLevels/level2",
  "devicePolicy": {
    "requireScreenlock": [1]
  }
}

Drag options to blanks, or click blank then click option'

A"true"

Btrue

C"false"

DFalse

Attempts:

3 left

💡 Hint

Common Mistakes

Using string "true" instead of boolean true.

Using Python-style False instead of JSON false.

The value for requireScreenlock must be a boolean true, not a string or Python False.

4fill in blank

hard

Fill both blanks to create a condition that restricts access by device OS and IP subnet.

GCP

condition = {
  "devicePolicy": {
    "osType": "[1]"
  },
  "ipSubnetworks": ["[2]"]
}

Drag options to blanks, or click blank then click option'

AANDROID

BIOS

C192.168.0.0/16

D10.1.0.0/16

Attempts:

3 left

💡 Hint

Common Mistakes

Mixing OS types with IP subnets.

Using public IP ranges instead of private ones.

The device OS type is set to IOS and the IP subnet restricts access to 10.1.0.0/16 network.

5fill in blank

hard

Fill all three blanks to define an Access Level with title, description, and a condition requiring a specific member.

GCP

access_level = {
  "title": "[1]",
  "description": "[2]",
  "basic": {
    "conditions": [
      {
        "members": ["[3]"]
      }
    ]
  }
}

Drag options to blanks, or click blank then click option'

ARemote Access

BAccess for remote employees

Cuser:[e-mail]

Duser:[e-mail]

Attempts:

3 left

💡 Hint

Common Mistakes

Swapping title and description values.

Using the wrong user email for members.

The Access Level is titled "Remote Access", described as "Access for remote employees", and restricts members to "user:[e-mail]".

Practice

1. What is the main purpose of Access Context Manager in Google Cloud?

easy

A. To manage billing accounts and payments

B. To monitor network traffic in real-time

C. To deploy virtual machines automatically

D. To control access to resources based on user context like location and device security

Solution

1. Step 1: Understand Access Context Manager's role

   It controls access by considering user context such as location and device security, not just identity.

2. Step 2: Compare with other options

   Billing, VM deployment, and network monitoring are unrelated to Access Context Manager's function.

3. Final Answer:

   To control access to resources based on user context like location and device security -> Option D

4. Quick Check:

   Access Context Manager controls access context = B [OK]

Hint: Access Context Manager controls access by context, not billing or VMs [OK]

Common Mistakes:

• Confusing Access Context Manager with billing or VM services
• Thinking it manages network traffic monitoring
• Assuming it only uses usernames and passwords

2. Which of the following is the correct way to define an Access Level in Access Context Manager using YAML?

easy

A. accessLevels:
- name: 'accessPolicies/123/accessLevels/level1'
title: 'Office Access'
basic:
conditions:
- ipSubnetworks: ['192.168.1.0/24']
devicePolicy:
osConstraints:
- osType: 'DESKTOP_MAC'
minimumVersion: '10.15'

B. accessLevels:
- id: 'level1'
description: 'Office Access'
conditions:
ipRanges: ['192.168.1.0/24']
device: 'MAC'

C. accessLevel:
- name: 'level1'
title: 'Office Access'
conditions:
ipSubnet: ['192.168.1.0/24']
devicePolicy:
osType: 'MAC'

D. accessLevels:
- name: 'accessPolicies/123/accessLevels/level1'
title: 'Office Access'
conditions:
ipSubnetworks: ['192.168.1.0/24']
devicePolicy:
osConstraints:
- osType: 'DESKTOP_MAC'
minimumVersion: '10.15'

Solution

1. Step 1: Review correct YAML structure for Access Level

   The correct syntax uses 'accessLevels' list with 'name', 'title', and 'basic' containing 'conditions' with 'ipSubnetworks' and 'devicePolicy' including 'osConstraints'.

2. Step 2: Identify errors in other options

   accessLevels: - id: 'level1' description: 'Office Access' conditions: ipRanges: ['192.168.1.0/24'] device: 'MAC' uses wrong keys like 'ipRanges' and 'device'. accessLevel: - name: 'level1' title: 'Office Access' conditions: ipSubnet: ['192.168.1.0/24'] devicePolicy: osType: 'MAC' uses 'accessLevel' singular and wrong keys. accessLevels: - name: 'accessPolicies/123/accessLevels/level1' title: 'Office Access' conditions: ipSubnetworks: ['192.168.1.0/24'] devicePolicy: osConstraints: - osType: 'DESKTOP_MAC' minimumVersion: '10.15' misses 'basic' wrapper around 'conditions'.

3. Final Answer:

   accessLevels: - name: 'accessPolicies/123/accessLevels/level1' title: 'Office Access' basic: conditions: - ipSubnetworks: ['192.168.1.0/24'] devicePolicy: osConstraints: - osType: 'DESKTOP_MAC' minimumVersion: '10.15' -> Option A

4. Quick Check:

   Correct YAML keys and structure = A [OK]

Hint: Look for 'basic' and 'conditions' keys in YAML for Access Level [OK]

Common Mistakes:

• Using singular 'accessLevel' instead of 'accessLevels'
• Missing 'basic' wrapper for conditions
• Incorrect keys like 'ipRanges' or 'device' instead of 'ipSubnetworks' and 'devicePolicy'

3. Given this Access Context Manager policy snippet, what will happen if a user tries to access a resource from IP 203.0.113.5?

accessLevels:
- name: 'accessPolicies/456/accessLevels/levelA'
  basic:
    conditions:
    - ipSubnetworks: ['192.168.0.0/16']
      devicePolicy:
        osConstraints:
        - osType: 'DESKTOP_WINDOWS'
          minimumVersion: '10'

medium

A. Access will be denied because the IP is outside the allowed subnet

B. Access will be allowed because device OS matches

C. Access will be allowed because IP is public

D. Access will be denied because OS version is too low

Solution

1. Step 1: Check IP subnet condition

   The allowed IP subnet is '192.168.0.0/16', which covers private IPs only. The user's IP '203.0.113.5' is public and outside this range.

2. Step 2: Evaluate access decision

   Since IP does not match allowed subnet, access is denied regardless of device OS.

3. Final Answer:

   Access will be denied because the IP is outside the allowed subnet -> Option A

4. Quick Check:

   IP outside allowed subnet = Access denied [OK]

Hint: Check IP subnet first; outside means deny access [OK]

Common Mistakes:

• Ignoring IP subnet and trusting device OS alone
• Assuming public IPs are always allowed
• Confusing IP ranges with device policies

4. You created an Access Level but users report they cannot access resources even when meeting conditions. Which is the most likely error in your Access Context Manager configuration?

medium

A. The device OS version is set too low

B. The Access Level is not attached to any Access Policy

C. The IP subnet range is too broad

D. The Access Level name is missing

Solution

1. Step 1: Understand Access Level usage

   Access Levels must be part of an Access Policy to enforce rules on resources.

2. Step 2: Analyze impact of missing Access Policy attachment

   If Access Level is not attached to any Access Policy, it has no effect, so users cannot access resources despite meeting conditions.

3. Final Answer:

   The Access Level is not attached to any Access Policy -> Option B

4. Quick Check:

   Access Level without policy attachment = no access enforced [OK]

Hint: Access Levels must be linked to Access Policies to work [OK]

Common Mistakes:

• Assuming broad IP ranges cause denial
• Thinking device OS version too low blocks access
• Ignoring the need to attach Access Levels to Policies

5. You want to create a service perimeter that restricts access to a Google Cloud Storage bucket only to users accessing from your corporate network and using compliant devices. Which combination of Access Context Manager components should you configure?

hard

A. Use only IAM roles to restrict access based on user identity and device type

B. Create a firewall rule blocking all external IPs and enable device compliance in IAM roles

C. Create an Access Policy with an Access Level defining IP subnet and device compliance, then apply it in a Service Perimeter around the bucket

D. Configure VPC Service Controls without Access Context Manager components

Solution

1. Step 1: Understand components needed

   Access Context Manager uses Access Policies and Access Levels to define conditions like IP subnet and device compliance.

2. Step 2: Apply conditions with Service Perimeter

   Service Perimeters enforce these Access Levels around resources like Cloud Storage buckets to restrict access accordingly.

3. Final Answer:

   Create an Access Policy with an Access Level defining IP subnet and device compliance, then apply it in a Service Perimeter around the bucket -> Option C

4. Quick Check:

   Access Policy + Access Level + Service Perimeter = A [OK]

Hint: Combine Access Policy, Access Level, and Service Perimeter for resource protection [OK]

Common Mistakes:

• Relying only on firewall or IAM roles without Access Context Manager
• Using VPC Service Controls alone without Access Levels
• Not defining device compliance in Access Levels