3.1 Designing for Security PROFESSIONAL-CLOUD-ARCHITECT Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   What is the purpose of Binary Authorization in Google Cloud?

   • ATo manage IAM roles for container deployments
   • BTo encrypt container images at rest
   • CTo ensure that only trusted container images are deployed to Google Cloud environments
   • DTo scan container images for vulnerabilities
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A data engineering team uses a service account to run scheduled Dataproc jobs. The service account currently has the primitive Owner role on the project, which the security team wants to remove. The team needs the service account to create Dataproc clusters, submit jobs, and read from a specific Cloud Storage bucket. What is the recommended way to grant these permissions while following least privilege?

   • AGrant the Dataproc Editor role (roles/dataproc.editor) and the Storage Admin role (roles/storage.admin) at the project level.
   • BGrant the Dataproc Worker role (roles/dataproc.worker) and the Storage Object Viewer role (roles/storage.objectViewer) on the bucket.
   • CGrant the Dataproc Admin role (roles/dataproc.admin) and the Storage Object Viewer role (roles/storage.objectViewer) on the specific bucket to the service account.
   • DKeep the Owner role but add an IAM condition that restricts access to Dataproc and the specific bucket.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which type of attack is Model Armor specifically designed to help detect and mitigate?

   • ADistributed denial-of-service (DDoS)
   • BSQL injection
   • CMan-in-the-middle attacks
   • DPrompt injection
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A company wants to ensure that no VM instances in their organization are created with public IP addresses. They want this policy to be enforced across all projects, including future ones. What is the most effective way to implement this?

   • AGrant the Compute Admin role (roles/compute.admin) only to users who need to create VMs and require them to manually avoid public IPs.
   • BCreate a firewall rule at the organization level that blocks all traffic to public IP addresses.
   • CCreate an organization policy that restricts the 'External IP addresses' constraint at the organization node.
   • DCreate a VPC Service Controls perimeter that blocks all external traffic to VM instances.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   An organization has a folder called 'Finance' containing projects for different financial applications. A compliance audit requires that only the Finance team lead (user: finance-lead@example.com) can create and manage BigQuery datasets in all projects under this folder. Other team members should have no access to BigQuery in these projects. Which IAM policy binding should be applied at the Finance folder level?

   • ABind roles/bigquery.dataViewer to finance-lead@example.com at the Finance folder and roles/bigquery.jobUser to all users.
   • BBind roles/bigquery.dataEditor to finance-lead@example.com at each project under Finance.
   • CBind roles/bigquery.dataOwner to finance-lead@example.com at the Finance folder.
   • DBind roles/bigquery.user to finance-lead@example.com at the Finance folder.
   Reveal Solution Discussion Select an answer first