3.1 Designing for Security PROFESSIONAL-CLOUD-ARCHITECT Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   A data engineer needs to mask a column containing email addresses in a BigQuery table before sharing it with a non-production team. Which Cloud DLP transformation is designed to replace sensitive values with a token that can be reversed later if needed?

   • ABucketing
   • BRedaction
   • CMasking
   • DPseudonymization
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   What is key rotation in Cloud KMS?

   • AThe process of moving a key from one region to another
   • BThe process of sharing a key with another organization
   • CThe process of periodically generating a new key version to replace the old one
   • DThe process of deleting a key and creating a completely new key with a different name
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Why should CI/CD pipelines use least-privilege service accounts?

   • ATo minimize the impact if the pipeline is compromised
   • BTo simplify the pipeline configuration
   • CTo speed up the build process
   • DTo reduce the cost of running the pipeline
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A security team needs to monitor all attempts to modify IAM policies in their Google Cloud organization. They want to be alerted when any user tries to change a role binding, whether the attempt succeeds or fails. What should they configure?

   • AEnable Data Access audit logs for the organization and filter for IAM policy changes.
   • BEnable System Event audit logs for the organization and filter for IAM policy changes.
   • CEnable Policy Denied audit logs for the organization and filter for IAM policy changes.
   • DEnable Admin Activity audit logs for the organization and filter for IAM policy changes.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A financial services company uses Cloud KMS to encrypt sensitive data. Their compliance policy requires that encryption keys be rotated every 90 days and that old keys remain available to decrypt data encrypted with them. The security team wants to automate this process. What is the recommended approach?

   • ADelete the old crypto key and create a new one with the same name every 90 days.
   • BUse the same crypto key but change its purpose from encryption to decryption every 90 days.
   • CCreate a new crypto key version every 90 days and set it as the primary version, keeping old versions enabled.
   • DDisable the old crypto key version and create a new key in a different key ring every 90 days.
   Reveal Solution Discussion Select an answer first