Security design principles in GCP - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to enable encryption at rest for a Cloud Storage bucket.

GCP

resource "google_storage_bucket" "secure_bucket" {
  name     = "my-secure-bucket"
  location = "US"
  [1] = "AES256"
}

Drag options to blanks, or click blank then click option'

Aencryption

Bencryption_key

Cencryption_algorithm

Ddefault_kms_key_name

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'default_kms_key_name' without specifying a KMS key.

Using 'encryption_key' which is not a valid property here.

The encryption block with AES256 enables encryption at rest for the bucket.

2fill in blank

medium

Complete the code to restrict access to a Cloud Storage bucket to only a specific service account.

GCP

resource "google_storage_bucket_iam_member" "member" {
  bucket = google_storage_bucket.secure_bucket.name
  role   = "roles/storage.objectViewer"
  member = "[1]"
}

Drag options to blanks, or click blank then click option'

Auser:[e-mail]

BserviceAccount:[e-mail]

Cgroup:[e-mail]

DallUsers

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'allUsers' which grants public access.

Using 'user:' prefix for a service account.

The member field must specify the service account with the prefix serviceAccount: to restrict access properly.

3fill in blank

hard

Fix the error in the firewall rule to allow only HTTPS traffic on port 443.

GCP

resource "google_compute_firewall" "https_firewall" {
  name    = "allow-https"
  network = "default"

  allow {
    protocol = "[1]"
    ports    = ["443"]
  }

  source_ranges = ["0.0.0.0/0"]
}

Drag options to blanks, or click blank then click option'

Atcp

Budp

Chttp

Dhttps

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'https' as protocol which is invalid.

Using 'udp' which does not match HTTPS traffic.

The firewall protocol must be tcp to allow HTTPS traffic on port 443. 'https' is not a valid protocol name here.

4fill in blank

hard

Fill both blanks to create a VPC firewall rule that denies all ingress traffic except from a trusted IP range.

GCP

resource "google_compute_firewall" "deny_untrusted" {
  name    = "deny-untrusted-ingress"
  network = "default"

  direction    = "INGRESS"
  priority     = 1000
  action       = "[1]"
  source_ranges = ["[2]"]
}

Drag options to blanks, or click blank then click option'

ADENY

BALLOW

C10.1.2.0/24

D0.0.0.0/0

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'ALLOW' action which permits all traffic.

Using '0.0.0.0/0' which means all IPs are allowed.

The firewall rule must deny traffic (DENY) and allow only from the trusted IP range 10.1.2.0/24.

5fill in blank

hard

Fill all three blanks to define an IAM policy binding that grants the 'roles/storage.admin' role to a user with condition on request time.

GCP

resource "google_storage_bucket_iam_binding" "conditional_binding" {
  bucket = google_storage_bucket.secure_bucket.name
  role   = "[1]"
  members = ["[2]"]

  condition {
    title       = "Time-based access"
    description = "Allow access only during business hours"
    expression  = "request.time [3] timestamp('2024-06-01T17:00:00Z')"
  }
}

Drag options to blanks, or click blank then click option'

Aroles/storage.admin

Buser:[e-mail]

C<

DserviceAccount:[e-mail]

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'serviceAccount:' prefix for a user member.

Using '>' instead of '<' in the expression.

The role is roles/storage.admin, the member is the user with prefix user:, and the expression uses '<' to restrict access before the given timestamp.

Practice

1. Which security design principle means giving users only the access they need and nothing more?

easy

A. Secure by default

B. Defense in depth

C. Continuous monitoring

D. Least privilege

Solution

1. Step 1: Understand the principle of least privilege

   Least privilege means users get only the minimum access needed to do their job.

2. Step 2: Compare with other principles

   Defense in depth means multiple layers of security, secure by default means safe settings initially, monitoring means watching for issues.

3. Final Answer:

   Least privilege -> Option D

4. Quick Check:

   Minimum access = Least privilege [OK]

Hint: Minimum access means least privilege [OK]

Common Mistakes:

• Confusing defense in depth with least privilege
• Thinking secure by default means limited access
• Mixing monitoring with access control

2. Which of the following is the correct way to assign a role to a user in GCP IAM using the gcloud CLI?

easy

A. gcloud iam roles assign [e-mail] roles/viewer

B. gcloud iam add-role [e-mail] viewer

C. gcloud projects add-iam-policy-binding my-project --member=user:[e-mail] --role=roles/viewer

D. gcloud iam set-role [e-mail] roles/viewer

Solution

1. Step 1: Recall correct gcloud command syntax for IAM role assignment

   The correct command uses 'projects add-iam-policy-binding' with --member and --role flags.

2. Step 2: Check each option

   gcloud projects add-iam-policy-binding my-project --member=user:[e-mail] --role=roles/viewer matches the correct syntax; others use invalid commands or flags.

3. Final Answer:

   gcloud projects add-iam-policy-binding my-project --member=user:[e-mail] --role=roles/viewer -> Option C

4. Quick Check:

   IAM role assignment uses add-iam-policy-binding [OK]

Hint: Use add-iam-policy-binding with --member and --role [OK]

Common Mistakes:

• Using incorrect gcloud commands like 'iam roles assign'
• Omitting --member or --role flags
• Confusing roles with users in command syntax

3. Consider this GCP IAM policy snippet:

{
  "bindings": [
    {
      "role": "roles/storage.objectViewer",
      "members": ["user:[e-mail]"]
    },
    {
      "role": "roles/storage.objectAdmin",
      "members": ["user:[e-mail]"]
    }
  ]
}

What access does Alice have on the storage bucket?

medium

A. Full control including deleting objects

B. Read-only access to objects

C. No access at all

D. Can create and delete buckets

Solution

1. Step 1: Identify Alice's assigned role

   Alice has the role 'roles/storage.objectViewer' which grants read-only access to objects.

2. Step 2: Understand role permissions

   ObjectViewer allows viewing objects but not modifying or deleting them.

3. Final Answer:

   Read-only access to objects -> Option B

4. Quick Check:

   ObjectViewer = read-only access [OK]

Hint: Viewer roles mean read-only access [OK]

Common Mistakes:

• Confusing objectAdmin with objectViewer
• Assuming viewer can delete objects
• Mixing bucket-level and object-level permissions

4. You wrote this IAM policy JSON but get an error when applying it:

{
  "bindings": [
    {
      "role": "roles/storage.objectViewer",
      "members": ["user:[e-mail]"]
    },
    {
      "role": "roles/storage.objectAdmin",
      "members": ["[e-mail]"]
    }
  ]
}

What is the error and how to fix it?

medium

A. Missing 'user:' prefix before bob's email in members; add 'user:'

B. Role 'roles/storage.objectAdmin' does not exist; use 'roles/storage.admin'

C. JSON syntax error; remove trailing commas

D. Members list must be empty for objectAdmin role

Solution

1. Step 1: Check members format in IAM policy

   Each member must have a prefix like 'user:', 'serviceAccount:', etc.

2. Step 2: Identify the missing prefix for [e-mail]

   Bob's member entry lacks 'user:' prefix, causing the error.

3. Final Answer:

   Missing 'user:' prefix before bob's email in members; add 'user:' -> Option A

4. Quick Check:

   Member identifiers need prefixes like 'user:' [OK]

Hint: Always prefix members with user: or serviceAccount: [OK]

Common Mistakes:

• Omitting user: prefix in members list
• Assuming roles names are incorrect without checking
• Misreading JSON syntax errors

5. You want to design a GCP project with strong security. Which combination of principles and practices best protects your resources?

hard

A. Use least privilege IAM roles, enable defense in depth with multiple controls, and monitor with continuous auditing

B. Use secure by default settings only, no need for monitoring or role restrictions

C. Grant all users owner role for flexibility, disable monitoring to reduce noise, and use default network settings

D. Assign broad roles to users, enable audit logging, and rely on firewall rules only

Solution

1. Step 1: Identify key security principles for GCP

   Least privilege limits access, defense in depth adds multiple security layers, and continuous auditing monitors activity.

2. Step 2: Evaluate options for best security practice

   Use least privilege IAM roles, enable defense in depth with multiple controls, and monitor with continuous auditing combines these principles correctly; others either grant excessive access or skip monitoring.

3. Final Answer:

   Use least privilege IAM roles, enable defense in depth with multiple controls, and monitor with continuous auditing -> Option A

4. Quick Check:

   Least privilege + defense in depth + monitoring = strong security [OK]

Hint: Combine least privilege, defense in depth, and monitoring [OK]

Common Mistakes:

• Granting overly broad roles
• Ignoring monitoring and auditing
• Relying only on default settings