Designing for security and compliance
Free Google Cloud Certified - Professional Cloud Architect practice — 6 questions on Designing for security and compliance, with explanations. No sign-up. Full 12-question mixed test →
A financial services company stores sensitive datasets in BigQuery within a shared VPC across multiple projects. Security team must prevent any GCP identity from copying data out of the org's BigQuery datasets into external projects or exporting it, while still permitting an on-premises fraud-detection application (connected via Dedicated Interconnect) to query the data. Which approach BEST meets these requirements?
VPC Service Controls creates a service perimeter around BigQuery (and other supported APIs) that blocks data exfiltration to resources outside the perimeter, regardless of IAM permissions. An access level scoped to the on-prem IP range allows the Interconnect-based application through while blocking copy/export to external projects.
A healthcare organization must use encryption keys that are generated and remain stored entirely within their own on-premises hardware security module (HSM), while still allowing Google Cloud services such as BigQuery and Compute Engine to perform encryption operations using those keys via API calls. Google must never have access to the raw key material at any point. Which key management approach should the architect select?
Cloud EKM lets Google Cloud services call out to an external, customer-controlled key manager (including on-prem HSM-backed partners) at the time of each cryptographic operation, so the raw key material never resides inside Google Cloud infrastructure while still supporting services like BigQuery and Compute Engine.
An architect wants to enforce, at the organization level, that no Compute Engine VM instance anywhere in the resource hierarchy can ever be assigned an external (public) IP address, with no project able to override this. Which Organization Policy constraint should be enforced?
constraints/compute.vmExternalIpAccess is the specific Organization Policy constraint that controls which VM instances (if any) may be assigned external IP addresses; setting it to deny-all at the org node and inheriting down enforces the requirement with no project-level override.
A DevOps team runs its CI/CD pipeline in GitHub Actions and needs to deploy resources to Google Cloud. The security team mandates that no long-lived service account keys may be downloaded or stored as CI/CD secrets. Which solution allows GitHub Actions to authenticate to Google Cloud securely while meeting this requirement?
Workload Identity Federation allows an external identity provider (GitHub's OIDC issuer) to be trusted directly, so the pipeline exchanges a short-lived OIDC token for a short-lived Google Cloud credential impersonating a service account — no long-lived key is ever created, stored, or downloaded.
Before loading customer support chat transcripts into BigQuery for analytics, a company needs to automatically identify and mask credit card numbers, email addresses, and phone numbers embedded in free-form text, without manually writing regex patterns for every possible format. Which Google Cloud service should be used in the data pipeline?
Cloud DLP provides pre-built infoType detectors (CREDIT_CARD_NUMBER, EMAIL_ADDRESS, PHONE_NUMBER, etc.) that use pattern matching, context, and checksums to find sensitive data in free text and can automatically de-identify/mask it as part of an ingestion pipeline — no custom regex required.
An architect is designing IAM policies for a large enterprise with hundreds of engineers across dozens of teams. Following least-privilege best practices, which approach should be used to grant engineers only the permissions they need for their job function, avoiding both overly broad primitive roles and the excessive maintenance overhead of building fully custom roles for every function?
Predefined roles are curated, service-specific bundles of permissions maintained by Google that align closely to common job functions, giving finer granularity than primitive roles without the ongoing maintenance burden of managing fully custom roles for every use case — custom roles are reserved for narrow gaps predefined roles don't cover.
Ready for the real thing?
The full course: two full-length practice tests, video lessons for every exam domain, hands-on labs and detailed explanations.
undefined $34.99 with code A5F51EAB51242FE60905 — valid through Sep 23.
Get my $34.99 deal →