Why security matters in GCP - Challenge Your Understanding

Challenge - 5 Problems

🧠 Conceptual

intermediate

Why is it important to use Identity and Access Management (IAM) in GCP?

Which of the following best explains why using IAM is crucial for security in Google Cloud Platform?

A IAM controls who can access resources, reducing the risk of unauthorized access.

B IAM automatically backs up all data to prevent loss.

C IAM speeds up network traffic between services.

D IAM encrypts data stored in virtual machines.

💡 Hint

Think about how controlling user permissions helps keep your cloud safe.

IAM lets you decide who can do what in your cloud. This stops people who shouldn't have access from reaching your data or services.

❓ service_behavior

intermediate

What happens if you disable firewall rules in a GCP project?

Consider a GCP project where all firewall rules are disabled. What is the most likely result?

A Firewall rules are ignored, but default security still blocks traffic.

B All incoming traffic is allowed, exposing resources to the internet.

C Only traffic from trusted IPs is allowed automatically.

D All incoming and outgoing traffic is blocked, isolating the network.

💡 Hint

Think about what a firewall does when it is turned off or disabled.

Disabling firewall rules means no rules allow traffic, so all traffic is blocked by default, isolating your network.

❓ Architecture

advanced

Designing a secure multi-region GCP architecture

You need to design a GCP architecture that keeps data secure across multiple regions. Which design choice best supports this goal?

A Use Cloud Storage with uniform bucket-level access and enable CMEK (Customer-Managed Encryption Keys) in each region.

B Use Compute Engine instances with local SSDs in each region without encryption.

C Use Cloud SQL with public IPs and disable SSL connections for faster access.

D Use Cloud Storage with default encryption and allow all users to access buckets.

💡 Hint

Think about encryption and access control across regions.

Using uniform bucket-level access simplifies permissions, and CMEK lets you control encryption keys, enhancing security across regions.

❓ security

advanced

Identifying the risk of using overly permissive service accounts

What is the main security risk of assigning broad roles like 'Owner' to service accounts in GCP?

A It causes the service account to run slower due to extra permissions.

B It prevents the service account from accessing any resources.

C It increases the chance that a compromised service account can cause widespread damage.

D It automatically encrypts all data accessed by the service account.

💡 Hint

Consider what happens if someone steals the credentials of a powerful service account.

Giving too many permissions means if the service account is hacked, the attacker can do a lot of harm.

✅ Best Practice

expert

Choosing the best method to protect sensitive data in GCP

You must protect sensitive customer data stored in GCP. Which approach best follows security best practices?

A Backup data to multiple regions without encryption to ensure availability.

B Store data unencrypted for faster access and rely on network firewalls only.

C Use default encryption and allow all project members to access the data.

D Encrypt data at rest using Customer-Managed Encryption Keys and restrict access with IAM policies.

💡 Hint

Think about encryption control and limiting who can see the data.

Using customer-managed keys gives you control over encryption, and IAM policies limit who can access the data, protecting sensitive information.