Security design principles in GCP - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Understanding the Principle of Least Privilege

Which option best describes the principle of least privilege in cloud security?

A Users and services are given only the permissions they need to perform their tasks, no more.

B Permissions are assigned randomly to users to speed up deployment.

C All users are given full access to all resources to avoid permission errors.

D Users share a single account with admin rights to simplify management.

💡 Hint

Think about minimizing access to reduce risk.

The principle of least privilege means giving users and services only the permissions they need to do their job, which limits potential damage from mistakes or attacks.

❓ Architecture

intermediate

Designing a Secure Network Architecture

In a GCP environment, which design best isolates sensitive data from public internet access?

A Allow direct SSH access from the internet to all instances storing sensitive data.

B Store sensitive data in a public subnet with firewall rules allowing all traffic.

C Use a single VPC with all resources having public IPs for easy access.

D Place sensitive data in a private subnet with no external IPs and use Cloud VPN for access.

💡 Hint

Think about how to keep data away from the public internet.

Using private subnets without external IPs and secure VPN access helps protect sensitive data by isolating it from the public internet.

❓ security

advanced

Identifying the Impact of Misconfigured IAM Roles

What is the most likely outcome if a GCP service account is granted the 'Owner' role instead of a more restrictive role?

A The service account will be unable to access any resources, causing failures.

B The service account will have read-only access, preventing changes to resources.

C The service account can modify or delete any resource in the project, increasing risk if compromised.

D The service account will only access storage buckets but not compute resources.

💡 Hint

Consider what the 'Owner' role allows.

The 'Owner' role grants full control over all resources, so if the service account is compromised, it can cause serious damage.

✅ Best Practice

advanced

Implementing Defense in Depth in Cloud Security

Which option best illustrates the defense in depth strategy in GCP security?

A Relying solely on network firewalls to protect all resources.

B Using multiple layers of security controls like firewalls, IAM, encryption, and monitoring together.

C Using only encryption without access controls or monitoring.

D Allowing open access and relying on user vigilance to prevent attacks.

💡 Hint

Think about combining different security measures.

Defense in depth means layering multiple security controls so if one fails, others still protect the system.

❓ service_behavior

expert

Analyzing the Effect of Enabling VPC Service Controls

What is the primary effect of enabling VPC Service Controls around a GCP project?

A It creates a security perimeter that restricts data access to trusted networks and prevents data exfiltration.

B It automatically encrypts all data at rest without any configuration needed.

C It allows unrestricted access to resources from any network for easier collaboration.

D It disables all external internet access to the project resources permanently.

💡 Hint

Consider how VPC Service Controls protect data boundaries.

VPC Service Controls create a virtual security boundary that limits access to resources from outside trusted networks, reducing risk of data leaks.