Why security matters in GCP - Test Your Understanding

Practice - 5 Tasks

1fill in blank

easy

Complete the code to create a firewall rule that allows HTTP traffic.

GCP

gcloud compute firewall-rules create allow-http --allow [1]

Drag options to blanks, or click blank then click option'

Atcp:80

Budp:53

Ctcp:22

Dicmp

Attempts:

3 left

💡 Hint

Common Mistakes

Using the wrong protocol or port, like udp:53 or tcp:22.

The firewall rule must allow TCP traffic on port 80 for HTTP.

2fill in blank

medium

Complete the code to enable encryption for a Cloud Storage bucket.

GCP

gsutil kms encryption -k [1] gs://my-secure-bucket

Drag options to blanks, or click blank then click option'

Aprojects/my-project/locations/global/keyRings/my-keyring/cryptoKeys/my-key

Bprojects/my-project/locations/us-central1/keyRings/keyring1/cryptoKeys/key1

Cprojects/my-project/locations/europe/keyRings/keyring2/cryptoKeys/key2

Dprojects/my-project/locations/asia/keyRings/keyring3/cryptoKeys/key3

Attempts:

3 left

💡 Hint

Common Mistakes

Using a key path from a different location or project.

The key must be in the correct location and key ring for your project. Here, the US location is used as an example.

3fill in blank

hard

Fix the error in the IAM policy binding to grant a user the Storage Object Viewer role.

GCP

gcloud projects add-iam-policy-binding my-project --member='user:[1]' --role='roles/storage.objectViewer'

Drag options to blanks, or click blank then click option'

Auserexample.com

Buser@.com

[e-mail]

Duser@com

Attempts:

3 left

💡 Hint

Common Mistakes

Omitting the '@' symbol or domain in the email.

The member must be a valid email address with the 'user:' prefix.

4fill in blank

hard

Fill both blanks to create a service account and grant it the Compute Admin role.

GCP

gcloud iam service-accounts create [1] --display-name="[2]"
gcloud projects add-iam-policy-binding my-project --member='serviceAccount:[1]@my-project.iam.gserviceaccount.com' --role='roles/compute.admin'

Drag options to blanks, or click blank then click option'

Acompute-admin-sa

Bstorage-admin-sa

CCompute Admin Service Account

DStorage Admin Service Account

Attempts:

3 left

💡 Hint

Common Mistakes

Using display name as service account id or vice versa.

The service account name is 'compute-admin-sa' and the display name is 'Compute Admin Service Account'.

5fill in blank

hard

Fill all three blanks to create a VPC firewall rule allowing SSH and RDP from a specific IP range.

GCP

gcloud compute firewall-rules create allow-ssh-rdp --network=[1] --allow=[2] --source-ranges=[3]

Drag options to blanks, or click blank then click option'

Adefault

Btcp:22,tcp:3389

C192.168.1.0/24

Dtcp:80,udp:53

Attempts:

3 left

💡 Hint

Common Mistakes

Allowing wrong ports or protocols, or using a wrong IP range.

The firewall rule applies to the 'default' network, allows TCP ports 22 and 3389 for SSH and RDP, and restricts access to the IP range 192.168.1.0/24.