Security best practices in GCP - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ security

intermediate

Identify the least privilege principle in IAM roles

You have a Google Cloud project with multiple users. Which IAM role assignment best follows the least privilege principle?

A Assign the 'Viewer' role to users who only need to read resources.

B Assign the 'Owner' role to all users for full access.

C Assign the 'Editor' role to users who only need to deploy applications.

D Assign the 'Storage Admin' role to users who manage Compute Engine instances.

💡 Hint

Think about giving users only the permissions they need to do their job.

The 'Viewer' role grants read-only access, which is the minimum needed for users who only need to see resources. Assigning broader roles like 'Owner' or 'Editor' gives unnecessary permissions, violating least privilege.

❓ Architecture

intermediate

Choosing the best network security setup

You want to protect your Google Cloud VM instances from unauthorized internet access. Which setup provides the best security?

A Place VMs in a public subnet with firewall rules allowing all traffic.

B Assign external IPs to VMs and disable firewall rules.

C Use default network with no firewall rules.

D Place VMs in a private subnet with no external IPs and use Cloud NAT for outbound internet access.

💡 Hint

Think about how to keep VMs unreachable from the internet but still allow them to access the internet if needed.

Placing VMs in a private subnet without external IPs prevents inbound internet traffic. Using Cloud NAT allows outbound internet access securely. Other options expose VMs to the internet or lack firewall protection.

❓ Configuration

advanced

Detecting misconfigured Cloud Storage bucket permissions

Which of the following Cloud Storage bucket IAM policies will publicly expose the bucket contents?

A {"bindings": [{"role": "roles/storage.admin", "members": ["group:[e-mail]"]}]}

B {"bindings": [{"role": "roles/storage.objectViewer", "members": ["user:[e-mail]"]}]}

C {"bindings": [{"role": "roles/storage.objectViewer", "members": ["allUsers"]}]}

D {"bindings": [{"role": "roles/storage.objectCreator", "members": ["serviceAccount:[e-mail]"]}]}

💡 Hint

Look for the member that allows anyone on the internet access.

The member 'allUsers' means anyone on the internet can view objects in the bucket, making it public. Other members restrict access to specific users or service accounts.

❓ service_behavior

advanced

Understanding Cloud KMS key rotation impact

You rotate a Cloud KMS key used to encrypt data in Cloud Storage. What happens to the data encrypted with the old key version?

A Data encrypted with old key versions remains accessible and can be decrypted.

B Data encrypted with old key versions is deleted after key rotation.

C Data encrypted with old key versions is automatically re-encrypted with the new key version.

D Data encrypted with old key versions becomes unreadable immediately.

💡 Hint

Think about how key versions work in encryption.

Cloud KMS keeps old key versions active for decryption. Rotating a key creates a new version for encryption, but old data remains decryptable with previous versions.

🧠 Conceptual

expert

Analyzing the effect of enabling VPC Service Controls

You enable VPC Service Controls around your Google Cloud project. Which of the following is a direct effect of this action?

A It automatically encrypts all data at rest with customer-managed keys.

B It prevents data exfiltration by restricting access to services from outside the defined perimeter.

C It disables all firewall rules in the VPC network.

D It allows unrestricted access to Cloud Storage buckets within the project.

💡 Hint

Consider what VPC Service Controls are designed to protect against.

VPC Service Controls create a security perimeter that restricts access to Google Cloud services, preventing data from being accessed or moved outside the perimeter, thus reducing data exfiltration risks.