GCP Professional Standards & Ethics 3 — Questions and Answers
Question 1: A GCP professional discovers a zero-day vulnerability in a widely used open-source library. What is the ethical course of action?
- Exploit it internally to gain competitive advantage
- Ignore it since it is not their library to maintain
- Follow responsible disclosure practices and notify the maintainers privately (Correct answer)
- Immediately post full exploit details publicly to maximize awareness
Correct answer: Follow responsible disclosure practices and notify the maintainers privately
Responsible disclosure requires privately notifying the affected vendor or maintainer first, giving them time to patch before public disclosure.
Question 2: Under the Computer Fraud and Abuse Act (CFAA), which activity constitutes unauthorized access?
- Testing your own production systems with proper written authorization
- Accessing systems or data beyond the scope of your granted permissions (Correct answer)
- Reviewing publicly documented APIs as part of integration work
- Performing penetration testing under a signed rules-of-engagement agreement
Correct answer: Accessing systems or data beyond the scope of your granted permissions
The CFAA prohibits accessing computer systems in ways that exceed authorized permissions, regardless of intent.
Question 3: During a penetration test, you discover evidence of a prior unauthorized intrusion by an external attacker. What is the correct professional response?
- Continue the pentest and include the finding in the final report
- Immediately stop, preserve evidence, and notify the client (Correct answer)
- Use the existing access pathway to test deeper systems
- Remediate the breach yourself before informing the client
Correct answer: Immediately stop, preserve evidence, and notify the client
Discovering a real breach requires halting the engagement to protect evidence integrity and notifying the client so they can activate incident response.
Question 4: What is the professional obligation when a cloud engineer suspects a colleague is accessing client data without authorization?
- Confront the colleague privately and accept their explanation
- Report the suspected misconduct through appropriate internal or external channels (Correct answer)
- Secretly monitor the colleague's activities for 30 days to build a case
- Take no action unless you have definitive forensic proof
Correct answer: Report the suspected misconduct through appropriate internal or external channels
Suspected misconduct involving unauthorized data access must be reported through proper channels; self-investigation or inaction is inappropriate.
Question 5: Which activity remains prohibited during a penetration test even when a signed scope agreement is in place?
- Testing web application injection vulnerabilities within scope
- Scanning for open ports on in-scope hosts
- Accessing systems explicitly listed as out-of-scope (Correct answer)
- Using automated vulnerability scanning tools on agreed targets
Correct answer: Accessing systems explicitly listed as out-of-scope
Out-of-scope systems are never authorized regardless of what is discovered during the engagement; the scope agreement defines hard boundaries.
Question 6: A cloud engineer accidentally gains read access to another customer's data due to a provider misconfiguration. What should they do?
- Review the data to understand the full scope of the exposure
- Immediately report it to the cloud provider and cease all access (Correct answer)
- Use the data to benchmark their own systems' performance
- Wait for the provider to discover and correct the misconfiguration
Correct answer: Immediately report it to the cloud provider and cease all access
Accessing another customer's data — even accidentally — must be stopped immediately and reported to the provider for proper incident handling.
Question 7: Which security principle holds that controls should be proportional to the value of the asset being protected and the cost of protection?
- Defense in depth
- Principle of least privilege
- Risk-based security (Correct answer)
- Zero trust architecture
Correct answer: Risk-based security
Risk-based security prioritizes protection efforts and spending based on asset value, threat likelihood, and the cost of controls.
GCP Professional Standards & Ethics 3
A GCP professional discovers a zero-day vulnerability in a widely used open-source library.
What is the ethical course of action?