What is the goal of separation of duties in IAM design?

To ensure that all users have access to all resources

To ensure no single user has conflicting permissions that could lead to fraud or error

To reduce the number of roles needed in an organization

To grant every user the same level of access

A healthcare company stores sensitive patient data in Cloud Storage and uses BigQuery for analytics. They are required to encrypt data with customer-managed keys and need to ensure that data in transit is protected. The security team wants to use Cloud KMS for key management. What is the correct approach to meet both encryption requirements?

Enable default encryption at rest and use a VPN for all data transfers.

Use Cloud External Key Manager (Cloud EKM) for data at rest and disable TLS for internal traffic.

Use Google-managed encryption keys for data at rest and rely on HTTPS for data in transit.

Create a Cloud KMS key ring and crypto key, then configure Cloud Storage and BigQuery to use the customer-managed key for encryption at rest. Ensure all client connections use TLS for data in transit.

What is a 'constraint' in the context of Organization Policies?

A network firewall rule that blocks traffic

A type of IAM role that limits user permissions

A logging configuration that captures all events

A rule that restricts or requires specific configurations on resources

How does Google Cloud protect data in transit between a client and a Google Cloud service?

Using IPsec tunnels for all traffic

Using TLS (Transport Layer Security) encryption

Data is not encrypted in transit by default

Using application-layer encryption only

What is the purpose of Cloud Audit Logs in Google Cloud?

To store application logs for debugging purposes

To monitor network traffic in real-time

To record who did what, when, and where in Google Cloud resources

Google CloudProfessional Cloud Architect

Domain 3Objective 1

3.1 Designing for Security PROFESSIONAL-CLOUD-ARCHITECT Practice Questions (Page 10)

Part of the Designing for security and compliance domain, which accounts for ~17.5% of the PROFESSIONAL-CLOUD-ARCHITECT exam. Google Cloud does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–9 in this domain), expect 5–5 from this objective — we provide 55 practice questions to prepare you well beyond it. (estimate)

55questions here

11free pages

23concepts

~17.5%of the exam

23 Concepts in This Objective

IAM Roles and Permissions
IAM Policy Binding
Resource Hierarchy
IAM Best Practices
Data Encryption at Rest and in Transit
Cloud KMS Key Management
Key Hierarchy and Envelope Encryption
Secret Management
Separation of Duties
Audit Logging
VPC Service Controls
Context-Aware Access
Organization Policy
Hierarchical Firewall Policies
Identity-Aware Proxy (IAP)
Service Account Impersonation
Chrome Enterprise Premium
Workload Identity Federation
Software Supply Chain Security
Secure CI/CD Pipeline
Model Armor
Sensitive Data Protection
Secure Model Deployment

Questions 46–50

46foundation · easy
What is the goal of separation of duties in IAM design?
Select an answer first
47application · medium
A healthcare company stores sensitive patient data in Cloud Storage and uses BigQuery for analytics. They are required to encrypt data with customer-managed keys and need to ensure that data in transit is protected. The security team wants to use Cloud KMS for key management. What is the correct approach to meet both encryption requirements?
Select an answer first
48foundation · easy
What is a 'constraint' in the context of Organization Policies?
Select an answer first
49foundation · easy
How does Google Cloud protect data in transit between a client and a Google Cloud service?
Select an answer first
50foundation · easy
What is the purpose of Cloud Audit Logs in Google Cloud?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to PROFESSIONAL-CLOUD-ARCHITECT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Google Cloud. “PROFESSIONAL-CLOUD-ARCHITECT” is a trademark of its owner, used for identification only.