Cloud Engineer Cloud Engineer Security & Identity Management

Question 1

Which Google Cloud IAM role grants a user read-only access to all GCP resources within a project?

Accepted Answer

roles/viewer

Answer

The roles/viewer primitive role grants read-only access to all resources in a project without the ability to modify state.

Question 2

What is the recommended method to grant a Compute Engine VM access to Google Cloud APIs without storing credentials in the code?

Accepted Answer

Attach a service account to the VM instance

Answer

Attaching a service account to a VM instance allows it to authenticate to Google Cloud APIs using Application Default Credentials without managing key files.

Question 3

Which Google Cloud feature allows you to define a perimeter around sensitive GCP resources to prevent data exfiltration?

Accepted Answer

VPC Service Controls

Answer

VPC Service Controls creates security perimeters around GCP resources to restrict access and mitigate data exfiltration risks.

Question 4

When should you use Workload Identity Federation instead of a service account key for external workloads?

Accepted Answer

When the workload runs outside Google Cloud and you want keyless authentication

Answer

Workload Identity Federation allows external workloads (e.g., on AWS or on-premises) to authenticate to GCP without service account keys by exchanging short-lived credentials.

Question 5

Which principle should guide how IAM permissions are assigned to minimize security risk?

Accepted Answer

Least privilege

Answer

The principle of least privilege means granting only the minimum permissions necessary for a user or service account to perform its required tasks.

Cloud Engineer Practice Test

Cloud Engineer Practice Test

Cloud Engineer Cloud Engineer Security & Identity Management