Security design principles in GCP - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Understanding the Principle of Least Privilege

Which option best describes the principle of least privilege in cloud security?

A Users and services are given only the permissions they need to perform their tasks, no more.

B Permissions are assigned randomly to users to speed up deployment.

C All users are given full access to all resources to avoid permission errors.

D Users share a single account with admin rights to simplify management.

💡 Hint

Think about minimizing access to reduce risk.

The principle of least privilege means giving users and services only the permissions they need to do their job, which limits potential damage from mistakes or attacks.

❓ Architecture

intermediate

Designing a Secure Network Architecture

In a GCP environment, which design best isolates sensitive data from public internet access?

A Allow direct SSH access from the internet to all instances storing sensitive data.

B Store sensitive data in a public subnet with firewall rules allowing all traffic.

C Use a single VPC with all resources having public IPs for easy access.

D Place sensitive data in a private subnet with no external IPs and use Cloud VPN for access.

💡 Hint

Think about how to keep data away from the public internet.

Using private subnets without external IPs and secure VPN access helps protect sensitive data by isolating it from the public internet.

❓ security

advanced

Identifying the Impact of Misconfigured IAM Roles

What is the most likely outcome if a GCP service account is granted the 'Owner' role instead of a more restrictive role?

A The service account will be unable to access any resources, causing failures.

B The service account will have read-only access, preventing changes to resources.

C The service account can modify or delete any resource in the project, increasing risk if compromised.

D The service account will only access storage buckets but not compute resources.

💡 Hint

Consider what the 'Owner' role allows.

The 'Owner' role grants full control over all resources, so if the service account is compromised, it can cause serious damage.

✅ Best Practice

advanced

Implementing Defense in Depth in Cloud Security

Which option best illustrates the defense in depth strategy in GCP security?

A Relying solely on network firewalls to protect all resources.

B Using multiple layers of security controls like firewalls, IAM, encryption, and monitoring together.

C Using only encryption without access controls or monitoring.

D Allowing open access and relying on user vigilance to prevent attacks.

💡 Hint

Think about combining different security measures.

Defense in depth means layering multiple security controls so if one fails, others still protect the system.

❓ service_behavior

expert

Analyzing the Effect of Enabling VPC Service Controls

What is the primary effect of enabling VPC Service Controls around a GCP project?

A It creates a security perimeter that restricts data access to trusted networks and prevents data exfiltration.

B It automatically encrypts all data at rest without any configuration needed.

C It allows unrestricted access to resources from any network for easier collaboration.

D It disables all external internet access to the project resources permanently.

💡 Hint

Consider how VPC Service Controls protect data boundaries.

VPC Service Controls create a virtual security boundary that limits access to resources from outside trusted networks, reducing risk of data leaks.

Practice

1. Which security design principle means giving users only the access they need and nothing more?

easy

A. Secure by default

B. Defense in depth

C. Continuous monitoring

D. Least privilege

Solution

1. Step 1: Understand the principle of least privilege

   Least privilege means users get only the minimum access needed to do their job.

2. Step 2: Compare with other principles

   Defense in depth means multiple layers of security, secure by default means safe settings initially, monitoring means watching for issues.

3. Final Answer:

   Least privilege -> Option D

4. Quick Check:

   Minimum access = Least privilege [OK]

Hint: Minimum access means least privilege [OK]

Common Mistakes:

• Confusing defense in depth with least privilege
• Thinking secure by default means limited access
• Mixing monitoring with access control

2. Which of the following is the correct way to assign a role to a user in GCP IAM using the gcloud CLI?

easy

A. gcloud iam roles assign [e-mail] roles/viewer

B. gcloud iam add-role [e-mail] viewer

C. gcloud projects add-iam-policy-binding my-project --member=user:[e-mail] --role=roles/viewer

D. gcloud iam set-role [e-mail] roles/viewer

Solution

1. Step 1: Recall correct gcloud command syntax for IAM role assignment

   The correct command uses 'projects add-iam-policy-binding' with --member and --role flags.

2. Step 2: Check each option

   gcloud projects add-iam-policy-binding my-project --member=user:[e-mail] --role=roles/viewer matches the correct syntax; others use invalid commands or flags.

3. Final Answer:

   gcloud projects add-iam-policy-binding my-project --member=user:[e-mail] --role=roles/viewer -> Option C

4. Quick Check:

   IAM role assignment uses add-iam-policy-binding [OK]

Hint: Use add-iam-policy-binding with --member and --role [OK]

Common Mistakes:

• Using incorrect gcloud commands like 'iam roles assign'
• Omitting --member or --role flags
• Confusing roles with users in command syntax

3. Consider this GCP IAM policy snippet:

{
  "bindings": [
    {
      "role": "roles/storage.objectViewer",
      "members": ["user:[e-mail]"]
    },
    {
      "role": "roles/storage.objectAdmin",
      "members": ["user:[e-mail]"]
    }
  ]
}

What access does Alice have on the storage bucket?

medium

A. Full control including deleting objects

B. Read-only access to objects

C. No access at all

D. Can create and delete buckets

Solution

1. Step 1: Identify Alice's assigned role

   Alice has the role 'roles/storage.objectViewer' which grants read-only access to objects.

2. Step 2: Understand role permissions

   ObjectViewer allows viewing objects but not modifying or deleting them.

3. Final Answer:

   Read-only access to objects -> Option B

4. Quick Check:

   ObjectViewer = read-only access [OK]

Hint: Viewer roles mean read-only access [OK]

Common Mistakes:

• Confusing objectAdmin with objectViewer
• Assuming viewer can delete objects
• Mixing bucket-level and object-level permissions

4. You wrote this IAM policy JSON but get an error when applying it:

{
  "bindings": [
    {
      "role": "roles/storage.objectViewer",
      "members": ["user:[e-mail]"]
    },
    {
      "role": "roles/storage.objectAdmin",
      "members": ["[e-mail]"]
    }
  ]
}

What is the error and how to fix it?

medium

A. Missing 'user:' prefix before bob's email in members; add 'user:'

B. Role 'roles/storage.objectAdmin' does not exist; use 'roles/storage.admin'

C. JSON syntax error; remove trailing commas

D. Members list must be empty for objectAdmin role

Solution

1. Step 1: Check members format in IAM policy

   Each member must have a prefix like 'user:', 'serviceAccount:', etc.

2. Step 2: Identify the missing prefix for [e-mail]

   Bob's member entry lacks 'user:' prefix, causing the error.

3. Final Answer:

   Missing 'user:' prefix before bob's email in members; add 'user:' -> Option A

4. Quick Check:

   Member identifiers need prefixes like 'user:' [OK]

Hint: Always prefix members with user: or serviceAccount: [OK]

Common Mistakes:

• Omitting user: prefix in members list
• Assuming roles names are incorrect without checking
• Misreading JSON syntax errors

5. You want to design a GCP project with strong security. Which combination of principles and practices best protects your resources?

hard

A. Use least privilege IAM roles, enable defense in depth with multiple controls, and monitor with continuous auditing

B. Use secure by default settings only, no need for monitoring or role restrictions

C. Grant all users owner role for flexibility, disable monitoring to reduce noise, and use default network settings

D. Assign broad roles to users, enable audit logging, and rely on firewall rules only

Solution

1. Step 1: Identify key security principles for GCP

   Least privilege limits access, defense in depth adds multiple security layers, and continuous auditing monitors activity.

2. Step 2: Evaluate options for best security practice

   Use least privilege IAM roles, enable defense in depth with multiple controls, and monitor with continuous auditing combines these principles correctly; others either grant excessive access or skip monitoring.

3. Final Answer:

   Use least privilege IAM roles, enable defense in depth with multiple controls, and monitor with continuous auditing -> Option A

4. Quick Check:

   Least privilege + defense in depth + monitoring = strong security [OK]

Hint: Combine least privilege, defense in depth, and monitoring [OK]

Common Mistakes:

• Granting overly broad roles
• Ignoring monitoring and auditing
• Relying only on default settings