Free Practice Questions for Google Professional-Cloud-Security-Engineer Exam

Implied IPv4 allow egress rule. An egress rule whose action is allow, destination is 0.0.0.0/0, and priority is the lowest possible (65535) lets any instance send traffic to any destination

Implied IPv4 deny ingress rule. An ingress rule whose action is deny, source is 0.0.0.0/0, and priority is the lowest possible (65535) protects all instances by blocking incoming connections to them.

https://cloud.google.com/vpc/docs/firewalls?hl=en#default_firewall_rules

The problem describes an application with two Cloud Run services (Service A - frontend, Service B - backend) and requires setting up IAM with the principle of least privilege. Service A calls Service B.

Principle of Least Privilege: This principle dictates that each entity (in this case, a Cloud Run service) should only have the minimum permissions necessary to perform its function.

Separate Service Accounts for Separate Services: To adhere to the principle of least privilege, it's best practice to assign a unique service account to each distinct service or component. This ensures that a compromise of one service account does not grant excessive permissions across other services. Service A needs permissions to run itself and to invoke Service B. Service B only needs permissions to run itself.Extract Reference: "Assign a service account to a Cloud Run service. The service account acts as the identity for your service and determines what permissions your revisions have when executing requests. It is a best practice to grant each service account only the permissions that are required to run the specific service (principle of least privilege)." (Google Cloud documentation: https://cloud.google.com/run/docs/configuring/service-accounts)

Authentication for Cloud Run Services: When one Cloud Run service (caller) needs to invoke another Cloud Run service (callee), the caller must be authorized to do so. This is typically achieved by assigning the roles/run.invoker role on the callee service to the caller's service account.Extract Reference: "To allow a service to invoke another service, grant the roles/run.invoker role on the called service to the caller's service account." (Google Cloud documentation: https://cloud.google.com/run/docs/securing/service-to-service)

Let's evaluate the options:

A. Create a new service account with the permissions to run service A and service B. Require authentication for service B. Permit only the new service account to call the backend. This violates the principle of least privilege by giving a single service account permissions for both services. If that service account were compromised, both services would be affected.

B. Create two separate service accounts. Grant one service account the permissions to execute service A, and grant the other service account the permissions to execute service B. Require authentication for service B. Permit only the service account for service A to call the back-end. This aligns perfectly with least privilege. Service A gets its own identity, Service B gets its own identity. Service A's service account is then granted run.invoker permissions on Service B, allowing it to call the backend while Service B requires authentication. This is the recommended approach.

C. Use the Compute Engine default service account to run service A and service B. Require authentication for service B. Permit only the default service account to call the backend. The Compute Engine default service account often has broad permissions (e.g., editor role in its project). Using it violates the principle of least privilege and is generally discouraged for production applications due to the potential for excessive permissions.

D. Create three separate service accounts. Grant one service account the permissions to execute service A. Grant the second service account the permissions to run service B. Grant the third service account the permissions to communicate between both services A and B. Require authentication for service B. Call the back-end by authenticating with a service account key for the third service account. This introduces unnecessary complexity with a third service account just for communication. More critically, using a service account key for authentication is generally discouraged in Cloud Run environments where ADC (Application Default Credentials) can be used, as managing keys securely becomes an operational overhead and security risk. Cloud Run services automatically use their attached service accounts for authentication when making calls to other Google Cloud services, including other Cloud Run services.

Therefore, option B is the best solution, adhering to the principle of least privilege and Google Cloud best practices for Cloud Run service-to-service authentication.

Packet Mirroring Setup: Configure Packet Mirroring in your Google Cloud VPC to capture traffic to and from specific VM instances. This allows you to analyze the traffic for security and compliance purposes.

Security Software: Use specialized security software to inspect the mirrored traffic. This software can detect invalid or malicious content in the IP packets.

Mirroring Configuration: Specify the instances, network, and traffic direction (ingress, egress, or both) to be mirrored. Ensure that the mirrored traffic is directed to an appropriate analysis destination.

Traffic Analysis: Continuously monitor and analyze the mirrored traffic for any signs of malicious activity or anomalies. Use the findings to enhance your security posture and respond to potential threats. References:

Google Cloud - Packet Mirroring

Google Cloud - Packet Mirroring Best Practices

To grant an IAM user access to HTTPS resources protected by Identity-Aware Proxy (IAP), you should assign the IAP-Secured Web App User role.

IAP-Secured Web App User (C):

This role grants the necessary permissions for a user to access web applications secured by IAP. It includes permissions to access the IAP-secured resources, ensuring that users can authenticate and gain the appropriate access based on the policies defined in IAP.

Assigning this role ensures that users have the right level of access to protected web resources, aligned with the security controls enforced by IAP.

References

Identity-Aware Proxy Documentation

IAP Roles and Permissions

https://cloud.google.com/vpc/docs/private-service-connect

An API bundle:

All APIs (all-apis): most Google APIs

(same as private.googleapis.com).

VPC-SC (vpc-sc): APIs that VPC Service Controls supports

(same as restricted.googleapis.com).

VMs in the same VPC network as the endpoint (all regions)

On-premises systems that are connected to the VPC network that contains the endpoint

The core requirements are: centralized, tamper-proof, long-term (seven years) immutable audit trails for administrative and data access activity.

Centralization: The current logging is fragmented. To centralize, you need to collect logs from across the organization. Cloud Logging sinks configured at the organization level are designed for this purpose. They allow you to route logs from all projects within an organization to a single destination.Extract Reference: "Aggregated exports allow you to export logs from multiple Google Cloud projects, folders, or your entire organization. An aggregated export can include all logs from all included resources, or you can use queries to include only specific logs." (Google Cloud documentation: https://cloud.google.com/logging/docs/export/aggregated_exports)

Long-Term Storage (Seven Years): Cloud Logging buckets have default retention periods (e.g., 30 days for Data Access logs, 400 days for Admin Activity logs) which are not sufficient for a seven-year requirement. Cloud Storage is ideal for long-term archival.Extract Reference: "Cloud Storage is a highly scalable and durable object storage service suitable for archiving large volumes of data for extended periods." (Google Cloud documentation, general overview of Cloud Storage features)

Tamper-Proof / Immutability: This is a critical requirement for audit trails in financial services under strict regulatory frameworks. Cloud Storage's "object retention lock" feature provides immutability. Once an object retention lock is set on a bucket, objects within that bucket cannot be deleted or overwritten for a specified duration, ensuring data integrity for compliance purposes.Extract Reference: "Object Retention Lock helps you meet compliance requirements by preventing data from being deleted or modified for a fixed amount of time or indefinitely. This feature satisfies SEC Rule 17a-4(f), FINRA Rule 4511(c), and CFTC Regulation 1.31(c)-(d) requirements." (Google Cloud documentation: https://cloud.google.com/storage/docs/bucket-lock)

Let's evaluate the other options:

A. Implement Pub/Sub to stream all audit logs from each project in real-time to an external SIEM: While Pub/Sub can centralize real-time streaming to a SIEM, the solution described does not inherently guarantee tamper-proof storage or 7-year immutability within Google Cloud. The SIEM itself would need to provide those capabilities, which is outside the scope of Google Cloud's direct offering for this specific requirement.

C. Enable Security Command Center across the organization: Security Command Center (SCC) provides centralized visibility into security posture, threats, and compliance. However, SCC is a security management and monitoring platform; it does not serve as the primary long-term, immutable storage for raw audit logs. It consumes information from logs but doesn't store them in a way that meets the 7-year immutable archival requirement.

D. Individually configure Cloud Audit Logs for all Google Cloud services in each project. Store the logs in regional Cloud Logging buckets with 30-day retention policies: This fails on multiple counts: it's not centralized (requires individual configuration), and the 30-day retention in Cloud Logging buckets is far short of the seven-year requirement. It also doesn't explicitly guarantee tamper-proof storage beyond the default logging immutability.

Therefore, option B directly addresses all aspects of the requirement: centralization via organization-level sinks, long-term storage with Cloud Storage, and immutability/tamper-proofing with object retention lock.

Cloud DNS with DNSSEC (Domain Name System Security Extensions) provides authentication for DNS responses, ensuring that they are legitimate and have not been tampered with. DNSSEC helps protect against DNS spoofing and cache poisoning attacks, which are common techniques used in DDoS attacks.

Steps:

Enable DNSSEC: In the Google Cloud Console, navigate to Cloud DNS and enable DNSSEC for your managed zones.

Configure Key Signing: Set up key signing keys (KSK) and zone signing keys (ZSK) to sign your DNS records.

Monitor DNSSEC Status: Regularly monitor the DNSSEC status and logs to ensure it is functioning correctly.

Configure Binary Authorization:

Binary Authorization is a deploy-time security control that ensures only trusted container images are deployed on GKE. It uses attestations to verify the authenticity and integrity of the images.

Enable Binary Authorization in your project through the Google Cloud Console or using the gcloud command-line tool.

Define attestation policies that specify which attestors (trusted entities) must sign off on container images before deployment.

Set Up Attestors:

Create and configure attestors that will sign the container images. This involves generating cryptographic keys and setting up trusted authorities.

Attestors can be configured to sign images based on criteria such as vulnerability scanning results, compliance checks, and other security policies.

Create a Custom Organization Policy Constraint:

Define an organization policy constraint that enforces Binary Authorization across your GKE clusters.

This custom constraint ensures that all clusters in the organization must adhere to the Binary Authorization policy, preventing the deployment of unsigned or unauthorized container images.

Implement and Enforce the Policies:

Apply the Binary Authorization policy and the organization policy constraint to your GKE clusters.

Regularly review and update the policies and attestation rules to align with your security and compliance requirements.

To migrate the current data backup and disaster recovery solutions to GCP while keeping the production environment on-premises, the most scalable and cost-efficient solution is using Google Cloud Storage with scheduled tasks and the gsutil command.

Setup Cloud Storage: Create a Cloud Storage bucket to store the backups.

Go to the Cloud Console and navigate to Cloud Storage.

Click "Create bucket" and follow the prompts to configure the storage bucket.

Install gsutil: Ensure gsutil is installed on the on-premises servers.

gsutil is a command-line tool for interacting with Cloud Storage.

Follow the installation guide here.

Create Backup Script: Write a script to upload data to Cloud Storage using gsutil.

#!/bin/bash gsutil -m cp -r /path/to/local/backup gs://your-bucket-name

Schedule Backup Task: Use a scheduling tool like cron on Linux to run the backup script at regular intervals.

Edit the crontab file with crontab -e and add an entry like:

Cloud Storage Documentation

gsutil Documentation