What does an external workload use to authenticate to Google Cloud with Workload Identity Federation?

An API key generated in Google Cloud

A token from its own identity provider (e.g., AWS STS, Azure AD)

A service account key downloaded from Google Cloud

A company wants to provide zero-trust access to both internal web applications and SaaS applications for their employees. They need to enforce granular access policies based on user identity, device security, and context. What should they use?

Use Identity-Aware Proxy (IAP) for internal applications and a separate VPN for SaaS applications.

Use Cloud Identity-Aware Proxy for SaaS applications and a firewall for internal applications.

Use VPC Service Controls to create a perimeter around all applications.

Use Chrome Enterprise Premium to provide zero-trust access to both internal and SaaS applications.

A security engineer wants to automatically redact credit card numbers found in documents stored in Cloud Storage before the documents are shared with external auditors. Which Google Cloud service is designed to inspect and redact sensitive data in this scenario?

Cloud Identity-Aware Proxy (Cloud IAP)

Cloud Key Management Service (Cloud KMS)

Cloud Data Loss Prevention (Cloud DLP)

What is the purpose of Organization Policies in Google Cloud?

To provide a firewall for all VPC networks

To manage IAM roles for individual users

To centrally constrain resource usage and enforce security requirements across the hierarchy

To encrypt data at rest in all projects

Google CloudProfessional Cloud Architect

Domain 3Objective 1

3.1 Designing for Security PROFESSIONAL-CLOUD-ARCHITECT Practice Questions (Page 5)

Part of the Designing for security and compliance domain, which accounts for ~17.5% of the PROFESSIONAL-CLOUD-ARCHITECT exam. Google Cloud does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–9 in this domain), expect 5–5 from this objective — we provide 55 practice questions to prepare you well beyond it. (estimate)

55questions here

11free pages

23concepts

~17.5%of the exam

23 Concepts in This Objective

IAM Roles and Permissions
IAM Policy Binding
Resource Hierarchy
IAM Best Practices
Data Encryption at Rest and in Transit
Cloud KMS Key Management
Key Hierarchy and Envelope Encryption
Secret Management
Separation of Duties
Audit Logging
VPC Service Controls
Context-Aware Access
Organization Policy
Hierarchical Firewall Policies
Identity-Aware Proxy (IAP)
Service Account Impersonation
Chrome Enterprise Premium
Workload Identity Federation
Software Supply Chain Security
Secure CI/CD Pipeline
Model Armor
Sensitive Data Protection
Secure Model Deployment

Questions 21–25

21foundation · easy
Which feature of Cloud DLP allows you to define custom patterns for sensitive data that are not covered by the built-in info types?
Select an answer first
22foundation · easy
What does an external workload use to authenticate to Google Cloud with Workload Identity Federation?
Select an answer first
23application · medium
A company wants to provide zero-trust access to both internal web applications and SaaS applications for their employees. They need to enforce granular access policies based on user identity, device security, and context. What should they use?
Select an answer first
24foundation · easy
A security engineer wants to automatically redact credit card numbers found in documents stored in Cloud Storage before the documents are shared with external auditors. Which Google Cloud service is designed to inspect and redact sensitive data in this scenario?
Select an answer first
25foundation · easy
What is the purpose of Organization Policies in Google Cloud?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to PROFESSIONAL-CLOUD-ARCHITECT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Google Cloud. “PROFESSIONAL-CLOUD-ARCHITECT” is a trademark of its owner, used for identification only.