Security best practices in GCP - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to enable encryption for a Cloud Storage bucket.

GCP

resource "google_storage_bucket" "secure_bucket" {
  name     = "my-secure-bucket"
  location = "US"
  [1] {
    kms_key_name = google_kms_crypto_key.my_key.id
  }
}

Drag options to blanks, or click blank then click option'

Aencryption

Bencryption_type

Cencryption_algorithm

Dencryption_key

Attempts:

3 left

💡 Hint

Common Mistakes

Using incorrect property names like encryption_key or encryption_type.

Forgetting to specify encryption settings.

The encryption block is used to specify the encryption settings for a Cloud Storage bucket in GCP.

2fill in blank

medium

Complete the code to grant the least privilege role to a service account.

GCP

resource "google_project_iam_member" "least_privilege" {
  project = "my-project"
  role    = [1]
  member  = "serviceAccount:[e-mail]"
}

Drag options to blanks, or click blank then click option'

A"roles/viewer"

B"roles/storage.objectViewer"

C"roles/editor"

D"roles/owner"

Attempts:

3 left

💡 Hint

Common Mistakes

Assigning overly broad roles like roles/owner or roles/editor.

Choosing roles that do not match the required permissions.

The roles/storage.objectViewer role grants read-only access to storage objects, following the least privilege principle.

3fill in blank

hard

Fix the error in the firewall rule to allow only HTTPS traffic.

GCP

resource "google_compute_firewall" "https_only" {
  name    = "https-firewall"
  network = "default"
  allow {
    protocol = [1]
    ports    = ["443"]
  }
  source_ranges = ["0.0.0.0/0"]
}

Drag options to blanks, or click blank then click option'

A"http"

B"icmp"

C"tcp"

D"udp"

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'http' as protocol which is invalid in firewall rules.

Using 'udp' or 'icmp' which do not match HTTPS traffic.

The protocol for HTTPS traffic is tcp, not http or udp.

4fill in blank

hard

Fill both blanks to configure a Cloud KMS key ring and key with rotation period.

GCP

resource "google_kms_key_ring" "my_key_ring" {
  name     = "my-key-ring"
  location = [1]
  project  = "my-project"
}

resource "google_kms_crypto_key" "my_crypto_key" {
  name            = "my-crypto-key"
  key_ring        = google_kms_key_ring.my_key_ring.id
  rotation_period = [2]
}

Drag options to blanks, or click blank then click option'

A"us-central1"

B"europe-west1"

C"100000s"

D"2592000s"

Attempts:

3 left

💡 Hint

Common Mistakes

Using invalid region names or formats.

Setting rotation period to an incorrect or unsupported value.

The key ring location is set to us-central1, a valid GCP region. The rotation period 2592000s equals 30 days, a common rotation interval.

5fill in blank

hard

Fill all three blanks to create a secure Cloud SQL instance with private IP and authorized networks.

GCP

resource "google_sql_database_instance" "secure_instance" {
  name             = "secure-db"
  database_version = [1]
  region           = "us-east1"

  settings {
    tier = "db-f1-micro"

    ip_configuration {
      [2] = "projects/my-project/global/networks/default"
      authorized_networks {
        value = [3]
      }
    }
  }
}

Drag options to blanks, or click blank then click option'

A"POSTGRES_14"

Bprivate_network

C"192.168.1.0/24"

D"MYSQL_8_0"

Attempts:

3 left

💡 Hint

Common Mistakes

Using wrong database version strings.

Forgetting to enable private_network or misspelling it.

Providing invalid IP ranges or formats.

The database version is set to POSTGRES_14. Enabling private_network allows private IP access. The authorized network 192.168.1.0/24 restricts access to a specific IP range.

Practice

1. Which of the following is a key security best practice when managing access to Google Cloud resources?

easy

A. Give all users owner permissions for convenience

B. Assign the least privilege necessary using IAM roles

C. Share your service account keys publicly

D. Disable all logging to improve performance

Solution

1. Step 1: Understand IAM role assignment

   IAM roles control what users can do. Assigning least privilege means giving only the permissions needed.

2. Step 2: Evaluate options for security

   Giving owner permissions broadly or sharing keys publicly risks unauthorized access. Disabling logging hides important audit info.

3. Final Answer:

   Assign the least privilege necessary using IAM roles -> Option B

4. Quick Check:

   Least privilege = Assign minimal permissions [OK]

Hint: Always give only needed permissions, never more [OK]

Common Mistakes:

• Giving broad permissions for convenience
• Sharing keys or credentials publicly
• Disabling audit logs

2. Which of the following is the correct way to encrypt data in Google Cloud using Cloud KMS?

easy

A. Use Cloud KMS to generate encryption keys and encrypt data with those keys

B. Store encryption keys in plaintext in Cloud Storage

C. Encrypt data manually without using Cloud KMS

D. Disable encryption to improve speed

Solution

1. Step 1: Understand Cloud KMS role

   Cloud KMS manages encryption keys securely and helps encrypt/decrypt data safely.

2. Step 2: Evaluate encryption methods

   Storing keys in plaintext or disabling encryption risks data exposure. Manual encryption is error-prone.

3. Final Answer:

   Use Cloud KMS to generate encryption keys and encrypt data with those keys -> Option A

4. Quick Check:

   Cloud KMS = Secure key management [OK]

Hint: Always use Cloud KMS for key management and encryption [OK]

Common Mistakes:

• Storing keys unencrypted
• Skipping encryption for speed
• Encrypting data without key management

3. Consider this IAM policy snippet in JSON format:

{
  "bindings": [
    {
      "role": "roles/storage.objectViewer",
      "members": ["user:[e-mail]"]
    }
  ]
}

What permission does Alice have on the storage bucket?

medium

A. She can upload and delete objects

B. She has no access

C. She can only view objects

D. She can manage bucket settings

Solution

1. Step 1: Identify the role assigned

   The role is roles/storage.objectViewer, which grants read-only access to objects.

2. Step 2: Understand permissions of the role

   This role allows viewing objects but not uploading, deleting, or managing bucket settings.

3. Final Answer:

   She can only view objects -> Option C

4. Quick Check:

   objectViewer = read-only access [OK]

Hint: Viewer roles allow read-only access, no changes [OK]

Common Mistakes:

• Confusing viewer with editor or owner roles
• Assuming upload/delete permissions
• Ignoring role details

4. You have a service account key stored in a public GitHub repository. What is the best immediate action to secure your Google Cloud environment?

medium

A. Change the project name to confuse attackers

B. Ignore it since the key is not used

C. Share the key with your team for transparency

D. Delete the exposed key and create a new one

Solution

1. Step 1: Recognize the risk of exposed keys

   Publicly exposed keys can be used by attackers to access resources.

2. Step 2: Take immediate action to revoke and replace keys

   Deleting the exposed key and creating a new one prevents unauthorized access.

3. Final Answer:

   Delete the exposed key and create a new one -> Option D

4. Quick Check:

   Exposed keys = revoke immediately [OK]

Hint: Revoke exposed keys immediately to prevent breaches [OK]

Common Mistakes:

• Ignoring exposed keys
• Changing unrelated settings
• Sharing keys openly

5. You want to enforce that all data stored in Cloud Storage buckets is encrypted with customer-managed keys (CMKs) using Cloud KMS. Which combination of steps ensures this security best practice?

hard

A. Create a Cloud KMS key ring and key, then configure the bucket to use this key for default encryption

B. Store keys in a Compute Engine instance and manually encrypt files before upload

C. Use Google-managed encryption only and disable Cloud KMS

D. Encrypt files locally and upload without bucket encryption settings

Solution

1. Step 1: Create a Cloud KMS key ring and key

   This provides a customer-managed key to control encryption.

2. Step 2: Configure the Cloud Storage bucket to use the CMK for default encryption

   This ensures all objects are encrypted automatically with your key.

3. Final Answer:

   Create a Cloud KMS key ring and key, then configure the bucket to use this key for default encryption -> Option A

4. Quick Check:

   CMK + bucket default encryption = secure data [OK]

Hint: Use CMK with bucket default encryption for strong control [OK]

Common Mistakes:

• Relying only on Google-managed keys
• Encrypting manually without bucket settings
• Storing keys insecurely