Cloud Engineer Cloud Engineer Security & Identity Management 1 — Questions and Answers
Question 1: Which Google Cloud IAM role grants a user read-only access to all GCP resources within a project?
- roles/viewer (Correct answer)
- roles/editor
- roles/owner
- roles/browser
Correct answer: roles/viewer
The roles/viewer primitive role grants read-only access to all resources in a project without the ability to modify state.
Question 2: What is the recommended method to grant a Compute Engine VM access to Google Cloud APIs without storing credentials in the code?
- Embed a service account key in the VM startup script
- Attach a service account to the VM instance (Correct answer)
- Store credentials in Cloud Storage
- Use environment variables with API keys
Correct answer: Attach a service account to the VM instance
Attaching a service account to a VM instance allows it to authenticate to Google Cloud APIs using Application Default Credentials without managing key files.
Question 3: Which Google Cloud feature allows you to define a perimeter around sensitive GCP resources to prevent data exfiltration?
- VPC Firewall Rules
- Cloud Armor
- VPC Service Controls (Correct answer)
- Identity-Aware Proxy
Correct answer: VPC Service Controls
VPC Service Controls creates security perimeters around GCP resources to restrict access and mitigate data exfiltration risks.
Question 4: When should you use Workload Identity Federation instead of a service account key for external workloads?
- When the workload runs inside Google Cloud
- When the workload runs outside Google Cloud and you want keyless authentication (Correct answer)
- When you need to grant human users access
- When you want to disable multi-factor authentication
Correct answer: When the workload runs outside Google Cloud and you want keyless authentication
Workload Identity Federation allows external workloads (e.g., on AWS or on-premises) to authenticate to GCP without service account keys by exchanging short-lived credentials.
Question 5: Which principle should guide how IAM permissions are assigned to minimize security risk?
- Least privilege (Correct answer)
- Defense in depth
- Zero trust
- Separation of duties
Correct answer: Least privilege
The principle of least privilege means granting only the minimum permissions necessary for a user or service account to perform its required tasks.
Question 6: What does Identity-Aware Proxy (IAP) protect in Google Cloud?
- Encrypts data at rest in Cloud Storage
- Controls access to applications and VMs based on user identity and context (Correct answer)
- Manages SSL certificates for load balancers
- Scans container images for vulnerabilities
Correct answer: Controls access to applications and VMs based on user identity and context
IAP enforces access control for web applications and VM SSH/RDP by verifying user identity and device context before granting access.
Cloud Engineer Cloud Engineer Security & Identity Management 1
Which Google Cloud IAM role grants a user read-only access to all GCP resources within a project?