Google Cloud Certified Identity and Access Management 2

Question 1

An application requires access to Cloud SQL from GKE pods. Which approach BEST follows Google's security best practices?

Accepted Answer

Use Workload Identity to bind a Kubernetes service account to a GCP service account

Answer

Mount a service account key as a Kubernetes secret

Answer

Grant the GKE node pool's default service account Cloud SQL Editor

Answer

Use a static username and password stored in environment variables

Question 2

What does the principle of least privilege mean in the context of IAM?

Accepted Answer

Users and services should be granted only the minimum permissions necessary to perform their tasks

Answer

Only administrators can modify IAM policies

Answer

All users should have viewer access to all resources by default

Answer

Permissions should be granted at the project level to simplify management

Question 3

Which tool can be used to analyze and understand what permissions an IAM principal has across a GCP organization?

Accepted Answer

Policy Analyzer (IAM Policy Troubleshooter)

Answer

Cloud Trace

Answer

Cloud Profiler

Answer

Asset Inventory only

Question 4

A Cloud Architect needs to prevent any project in the organization from creating service account keys. Which service should be used?

Accepted Answer

Organization Policy Service with constraints/iam.disableServiceAccountKeyCreation

Answer

Cloud Armor

Answer

Cloud Identity

Answer

VPC Service Controls

Question 5

What is the maximum number of IAM policy bindings that can be set on a single Cloud Storage bucket?

Accepted Answer

1,500

Answer

100

Answer

500

Answer

Unlimited

Question 6

Which type of service account is automatically created when you enable certain GCP APIs and is managed by Google?

Accepted Answer

Google-managed service account

Answer

User-managed service account

Answer

Default service account

Answer

Cross-project service account

Question 7

A developer accidentally granted the Editor role to an external user at the project level. What is the FASTEST way to remediate this while minimizing disruption?

Accepted Answer

Remove the IAM binding for that user at the project level

Answer

Delete the project and recreate it

Answer

Disable all APIs in the project

Answer

Change the project to a read-only state