Security best practices in GCP - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to enable encryption for a Cloud Storage bucket.

GCP

resource "google_storage_bucket" "secure_bucket" {
  name     = "my-secure-bucket"
  location = "US"
  [1] {
    kms_key_name = google_kms_crypto_key.my_key.id
  }
}

Drag options to blanks, or click blank then click option'

Aencryption

Bencryption_type

Cencryption_algorithm

Dencryption_key

Attempts:

3 left

💡 Hint

Common Mistakes

Using incorrect property names like encryption_key or encryption_type.

Forgetting to specify encryption settings.

The encryption block is used to specify the encryption settings for a Cloud Storage bucket in GCP.

2fill in blank

medium

Complete the code to grant the least privilege role to a service account.

GCP

resource "google_project_iam_member" "least_privilege" {
  project = "my-project"
  role    = [1]
  member  = "serviceAccount:[e-mail]"
}

Drag options to blanks, or click blank then click option'

A"roles/viewer"

B"roles/storage.objectViewer"

C"roles/editor"

D"roles/owner"

Attempts:

3 left

💡 Hint

Common Mistakes

Assigning overly broad roles like roles/owner or roles/editor.

Choosing roles that do not match the required permissions.

The roles/storage.objectViewer role grants read-only access to storage objects, following the least privilege principle.

3fill in blank

hard

Fix the error in the firewall rule to allow only HTTPS traffic.

GCP

resource "google_compute_firewall" "https_only" {
  name    = "https-firewall"
  network = "default"
  allow {
    protocol = [1]
    ports    = ["443"]
  }
  source_ranges = ["0.0.0.0/0"]
}

Drag options to blanks, or click blank then click option'

A"http"

B"icmp"

C"tcp"

D"udp"

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'http' as protocol which is invalid in firewall rules.

Using 'udp' or 'icmp' which do not match HTTPS traffic.

The protocol for HTTPS traffic is tcp, not http or udp.

4fill in blank

hard

Fill both blanks to configure a Cloud KMS key ring and key with rotation period.

GCP

resource "google_kms_key_ring" "my_key_ring" {
  name     = "my-key-ring"
  location = [1]
  project  = "my-project"
}

resource "google_kms_crypto_key" "my_crypto_key" {
  name            = "my-crypto-key"
  key_ring        = google_kms_key_ring.my_key_ring.id
  rotation_period = [2]
}

Drag options to blanks, or click blank then click option'

A"us-central1"

B"europe-west1"

C"100000s"

D"2592000s"

Attempts:

3 left

💡 Hint

Common Mistakes

Using invalid region names or formats.

Setting rotation period to an incorrect or unsupported value.

The key ring location is set to us-central1, a valid GCP region. The rotation period 2592000s equals 30 days, a common rotation interval.

5fill in blank

hard

Fill all three blanks to create a secure Cloud SQL instance with private IP and authorized networks.

GCP

resource "google_sql_database_instance" "secure_instance" {
  name             = "secure-db"
  database_version = [1]
  region           = "us-east1"

  settings {
    tier = "db-f1-micro"

    ip_configuration {
      [2] = "projects/my-project/global/networks/default"
      authorized_networks {
        value = [3]
      }
    }
  }
}

Drag options to blanks, or click blank then click option'

A"POSTGRES_14"

Bprivate_network

C"192.168.1.0/24"

D"MYSQL_8_0"

Attempts:

3 left

💡 Hint

Common Mistakes

Using wrong database version strings.

Forgetting to enable private_network or misspelling it.

Providing invalid IP ranges or formats.

The database version is set to POSTGRES_14. Enabling private_network allows private IP access. The authorized network 192.168.1.0/24 restricts access to a specific IP range.