Compliance certifications in GCP - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to specify the compliance certification in the GCP resource labels.

GCP

resource_labels = {"compliance": "[1]"}

Drag options to blanks, or click blank then click option'

AISO27001

BUbuntu

CWindowsServer

DMySQL

Attempts:

3 left

💡 Hint

Common Mistakes

Using operating system names instead of compliance certifications.

Using database names instead of compliance certifications.

The label "compliance" should be set to a valid compliance certification like "ISO27001" to indicate the resource meets that standard.

2fill in blank

medium

Complete the code to enable the GCP service that helps manage compliance and security policies.

GCP

gcloud services enable [1]

Drag options to blanks, or click blank then click option'

Astorage.googleapis.com

Bcompute.googleapis.com

Cbigquery.googleapis.com

Dsecuritycenter.googleapis.com

Attempts:

3 left

💡 Hint

Common Mistakes

Enabling unrelated services like Compute Engine or BigQuery.

Confusing storage service with security service.

The Security Command Center API (securitycenter.googleapis.com) helps manage compliance and security policies in GCP.

3fill in blank

hard

Fix the error in the command to list compliance certifications for a GCP project.

GCP

gcloud asset search-all-resources --scope=projects/[1] --query="labels.compliance:ISO27001"

Drag options to blanks, or click blank then click option'

Amy-project-123

B1234567890

Cprojects/my-project-123

Dmy-project

Attempts:

3 left

💡 Hint

Common Mistakes

Including 'projects/' prefix in the scope parameter.

Using numeric project number instead of project ID.

The scope parameter requires the project ID without the 'projects/' prefix. Using just the project ID like 'my-project-123' is correct.

4fill in blank

hard

Fill both blanks to create a policy binding that grants the Security Reviewer role to a user for compliance auditing.

GCP

gcloud projects add-iam-policy-binding [1] \
--member='user:[2]' \
--role='roles/securitycenter.securityReviewer'

Drag options to blanks, or click blank then click option'

Amy-compliance-project

[e-mail]

[e-mail]

Dtest-project

Attempts:

3 left

💡 Hint

Common Mistakes

Using wrong project ID or test project.

Assigning role to wrong user email.

The project ID should be the compliance project, and the user email should be the auditor's email to grant the Security Reviewer role correctly.

5fill in blank

hard

Fill all three blanks to define an organization policy that restricts VM instances to only use compliant machine types.

GCP

gcloud org-policies set-policy [1] \
--organization=[2] \
--policy-from-file=[3]

Drag options to blanks, or click blank then click option'

Arestrict-compliant-machine-types.yaml

B123456789012

Ccompute.vmExternalIpAccess

Dcompute.allowedMachineTypes

Attempts:

3 left

💡 Hint

Common Mistakes

Using wrong constraint name.

Using project ID instead of organization ID.

Incorrect policy file name.

The constraint 'compute.allowedMachineTypes' restricts machine types. The organization ID is numeric, and the policy file defines the restriction.