Security design principles in GCP - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to enable encryption at rest for a Cloud Storage bucket.

GCP

resource "google_storage_bucket" "secure_bucket" {
  name     = "my-secure-bucket"
  location = "US"
  [1] = "AES256"
}

Drag options to blanks, or click blank then click option'

Aencryption

Bencryption_key

Cencryption_algorithm

Ddefault_kms_key_name

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'default_kms_key_name' without specifying a KMS key.

Using 'encryption_key' which is not a valid property here.

The encryption block with AES256 enables encryption at rest for the bucket.

2fill in blank

medium

Complete the code to restrict access to a Cloud Storage bucket to only a specific service account.

GCP

resource "google_storage_bucket_iam_member" "member" {
  bucket = google_storage_bucket.secure_bucket.name
  role   = "roles/storage.objectViewer"
  member = "[1]"
}

Drag options to blanks, or click blank then click option'

Auser:[e-mail]

BserviceAccount:[e-mail]

Cgroup:[e-mail]

DallUsers

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'allUsers' which grants public access.

Using 'user:' prefix for a service account.

The member field must specify the service account with the prefix serviceAccount: to restrict access properly.

3fill in blank

hard

Fix the error in the firewall rule to allow only HTTPS traffic on port 443.

GCP

resource "google_compute_firewall" "https_firewall" {
  name    = "allow-https"
  network = "default"

  allow {
    protocol = "[1]"
    ports    = ["443"]
  }

  source_ranges = ["0.0.0.0/0"]
}

Drag options to blanks, or click blank then click option'

Atcp

Budp

Chttp

Dhttps

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'https' as protocol which is invalid.

Using 'udp' which does not match HTTPS traffic.

The firewall protocol must be tcp to allow HTTPS traffic on port 443. 'https' is not a valid protocol name here.

4fill in blank

hard

Fill both blanks to create a VPC firewall rule that denies all ingress traffic except from a trusted IP range.

GCP

resource "google_compute_firewall" "deny_untrusted" {
  name    = "deny-untrusted-ingress"
  network = "default"

  direction    = "INGRESS"
  priority     = 1000
  action       = "[1]"
  source_ranges = ["[2]"]
}

Drag options to blanks, or click blank then click option'

ADENY

BALLOW

C10.1.2.0/24

D0.0.0.0/0

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'ALLOW' action which permits all traffic.

Using '0.0.0.0/0' which means all IPs are allowed.

The firewall rule must deny traffic (DENY) and allow only from the trusted IP range 10.1.2.0/24.

5fill in blank

hard

Fill all three blanks to define an IAM policy binding that grants the 'roles/storage.admin' role to a user with condition on request time.

GCP

resource "google_storage_bucket_iam_binding" "conditional_binding" {
  bucket = google_storage_bucket.secure_bucket.name
  role   = "[1]"
  members = ["[2]"]

  condition {
    title       = "Time-based access"
    description = "Allow access only during business hours"
    expression  = "request.time [3] timestamp('2024-06-01T17:00:00Z')"
  }
}

Drag options to blanks, or click blank then click option'

Aroles/storage.admin

Buser:[e-mail]

C<

DserviceAccount:[e-mail]

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'serviceAccount:' prefix for a user member.

Using '>' instead of '<' in the expression.

The role is roles/storage.admin, the member is the user with prefix user:, and the expression uses '<' to restrict access before the given timestamp.