GCP Professional Standards & Ethics 3

Question 1

A GCP professional discovers a zero-day vulnerability in a widely used open-source library. What is the ethical course of action?

Accepted Answer

Follow responsible disclosure practices and notify the maintainers privately

Answer

Responsible disclosure requires privately notifying the affected vendor or maintainer first, giving them time to patch before public disclosure.

Question 2

Under the Computer Fraud and Abuse Act (CFAA), which activity constitutes unauthorized access?

Accepted Answer

Accessing systems or data beyond the scope of your granted permissions

Answer

The CFAA prohibits accessing computer systems in ways that exceed authorized permissions, regardless of intent.

Question 3

During a penetration test, you discover evidence of a prior unauthorized intrusion by an external attacker. What is the correct professional response?

Accepted Answer

Immediately stop, preserve evidence, and notify the client

Answer

Discovering a real breach requires halting the engagement to protect evidence integrity and notifying the client so they can activate incident response.

Question 4

What is the professional obligation when a cloud engineer suspects a colleague is accessing client data without authorization?

Accepted Answer

Report the suspected misconduct through appropriate internal or external channels

Answer

Suspected misconduct involving unauthorized data access must be reported through proper channels; self-investigation or inaction is inappropriate.

Question 5

Which activity remains prohibited during a penetration test even when a signed scope agreement is in place?

Accepted Answer

Accessing systems explicitly listed as out-of-scope

Answer

Out-of-scope systems are never authorized regardless of what is discovered during the engagement; the scope agreement defines hard boundaries.

GCP Test Practice Test

GCP Test Practice Test

GCP Professional Standards & Ethics 3