What is the purpose of IAM conditions in a policy binding?

To grant access only when specific attributes (like time or resource tags) are met

To permanently revoke a user's access to a resource

To make a binding apply to all resources in a project

To combine multiple roles into a single binding

What is a 'service perimeter' in VPC Service Controls?

A network subnet that isolates VMs from each other

A VPN tunnel that connects on-premises networks to Google Cloud

A firewall rule that blocks all inbound traffic

A boundary that defines which projects and services are protected and what access is allowed

How can an application securely access a secret stored in Secret Manager?

By using the Cloud KMS API to decrypt the secret

By using the Secret Manager API with a service account that has the Secret Accessor role

By reading the secret from a publicly accessible storage bucket

By embedding the secret in the application source code

Which IAM design pattern enforces separation of duties?

Granting a developer the role to deploy code and a separate reviewer the role to approve production deployments

Using a single service account for all application deployments

Granting a single user both the Owner and Editor roles on a project

Granting all team members the same role on all resources

Google CloudProfessional Cloud Architect

Domain 3Objective 1

3.1 Designing for Security PROFESSIONAL-CLOUD-ARCHITECT Practice Questions (Page 11)

Part of the Designing for security and compliance domain, which accounts for ~17.5% of the PROFESSIONAL-CLOUD-ARCHITECT exam. Google Cloud does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–9 in this domain), expect 5–5 from this objective — we provide 55 practice questions to prepare you well beyond it. (estimate)

55questions here

11free pages

23concepts

~17.5%of the exam

23 Concepts in This Objective

IAM Roles and Permissions
IAM Policy Binding
Resource Hierarchy
IAM Best Practices
Data Encryption at Rest and in Transit
Cloud KMS Key Management
Key Hierarchy and Envelope Encryption
Secret Management
Separation of Duties
Audit Logging
VPC Service Controls
Context-Aware Access
Organization Policy
Hierarchical Firewall Policies
Identity-Aware Proxy (IAP)
Service Account Impersonation
Chrome Enterprise Premium
Workload Identity Federation
Software Supply Chain Security
Secure CI/CD Pipeline
Model Armor
Sensitive Data Protection
Secure Model Deployment

Questions 51–55

51foundation · easy
What is the purpose of IAM conditions in a policy binding?
Select an answer first
52foundation · easy
What is a 'service perimeter' in VPC Service Controls?
Select an answer first
53foundation · easy
A machine learning model is ready to be deployed to production. The organization requires that the model's predictions be reproducible and that the exact model version used for each prediction be traceable. Which Google Cloud service is designed to support these requirements by providing a managed model registry and serving infrastructure?
Select an answer first
54foundation · easy
How can an application securely access a secret stored in Secret Manager?
Select an answer first
55foundation · easy
Which IAM design pattern enforces separation of duties?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to PROFESSIONAL-CLOUD-ARCHITECT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Google Cloud. “PROFESSIONAL-CLOUD-ARCHITECT” is a trademark of its owner, used for identification only.