Cloud Engineer Cloud Engineer Security & Identity Management 2 — Questions and Answers
Question 1: Which Cloud KMS key type gives you full control over key material and lets you import your own keys?
- Google-managed keys
- Customer-managed encryption keys (CMEK)
- Customer-supplied encryption keys (CSEK) (Correct answer)
- Hardware Security Module (HSM) keys
Correct answer: Customer-supplied encryption keys (CSEK)
Customer-supplied encryption keys (CSEK) allow you to provide your own key material to Google Cloud, giving you the highest level of key control.
Question 2: What is the purpose of a Google Cloud Organization Policy?
- Audit log access to GCP services
- Enforce guardrails on resource configuration across the organization (Correct answer)
- Monitor VM CPU usage
- Manage user authentication methods
Correct answer: Enforce guardrails on resource configuration across the organization
Organization Policies let administrators set constraints on GCP resource configurations (e.g., restricting allowed regions or disabling public IPs) across an entire organization.
Question 3: Which Google Cloud service provides a managed certificate authority for issuing private SSL/TLS certificates?
- Certificate Manager
- Cloud KMS
- Certificate Authority Service (CAS) (Correct answer)
- Secret Manager
Correct answer: Certificate Authority Service (CAS)
Certificate Authority Service (CAS) is a managed service that lets you create and manage private CAs for issuing internal TLS certificates.
Question 4: A developer accidentally committed a service account key to a public GitHub repository. What is the FIRST action you should take?
- Rotate the service account key immediately (Correct answer)
- Delete the GitHub repository
- Notify the developer
- Revoke the service account's IAM roles
Correct answer: Rotate the service account key immediately
Rotating (or deleting) the exposed key immediately prevents unauthorized use, as the key may already be compromised the moment it was publicly accessible.
Question 5: What Google Cloud tool continuously scans GCP configurations for security misconfigurations and compliance violations?
- Cloud Monitoring
- Security Command Center (Correct answer)
- Cloud Audit Logs
- Cloud Trace
Correct answer: Security Command Center
Security Command Center (SCC) is Google Cloud's centralized security management system that detects misconfigurations, vulnerabilities, and threats across GCP resources.
Question 6: Which log type in Cloud Audit Logs records when an administrator changes IAM policies?
- Data Access audit logs
- System Event audit logs
- Admin Activity audit logs (Correct answer)
- Policy Denied audit logs
Correct answer: Admin Activity audit logs
Admin Activity audit logs capture all API calls that modify resource configurations or metadata, including IAM policy changes, and are always enabled.
Cloud Engineer Cloud Engineer Security & Identity Management 2
Which Cloud KMS key type gives you full control over key material and lets you import your own keys?