Cloud Engineer Cloud Engineer Security & Identity Management 2

Question 1

Which Cloud KMS key type gives you full control over key material and lets you import your own keys?

Accepted Answer

Customer-supplied encryption keys (CSEK)

Answer

Customer-supplied encryption keys (CSEK) allow you to provide your own key material to Google Cloud, giving you the highest level of key control.

Question 2

What is the purpose of a Google Cloud Organization Policy?

Accepted Answer

Enforce guardrails on resource configuration across the organization

Answer

Organization Policies let administrators set constraints on GCP resource configurations (e.g., restricting allowed regions or disabling public IPs) across an entire organization.

Question 3

Which Google Cloud service provides a managed certificate authority for issuing private SSL/TLS certificates?

Accepted Answer

Certificate Authority Service (CAS)

Answer

Certificate Authority Service (CAS) is a managed service that lets you create and manage private CAs for issuing internal TLS certificates.

Question 4

A developer accidentally committed a service account key to a public GitHub repository. What is the FIRST action you should take?

Accepted Answer

Rotate the service account key immediately

Answer

Rotating (or deleting) the exposed key immediately prevents unauthorized use, as the key may already be compromised the moment it was publicly accessible.

Question 5

What Google Cloud tool continuously scans GCP configurations for security misconfigurations and compliance violations?

Accepted Answer

Security Command Center

Answer

Security Command Center (SCC) is Google Cloud's centralized security management system that detects misconfigurations, vulnerabilities, and threats across GCP resources.

Cloud Engineer Practice Test

Cloud Engineer Practice Test

Cloud Engineer Cloud Engineer Security & Identity Management 2