What is the primary purpose of Model Armor in Google Cloud?

To manage identity and access control for AI platform resources

To protect generative AI models from adversarial prompts and data exfiltration attempts

To encrypt data at rest in Cloud Storage buckets using customer-managed keys

To provide DDoS protection for applications deployed on Google Cloud

What is the primary purpose of VPC Service Controls?

To provide a firewall for virtual machines

To encrypt data in transit between services

To manage IAM roles for service accounts

To create security perimeters that protect Google Cloud services and data from unauthorized access

What is the purpose of Workload Identity Federation in Google Cloud?

To create service account keys for external workloads

To allow external workloads to authenticate to Google Cloud without service account keys

To provide a VPN for external workloads

To encrypt data for external workloads

A company wants to allow a group of contractors to access a specific VM instance via SSH without giving them access to the entire project. The contractors should only be able to connect to this VM and not to any other resources in the project. What is the recommended approach?

Use Identity-Aware Proxy (IAP) TCP forwarding and grant the contractors the IAP-secured Tunnel User role (roles/iap.tunnelResourceAccessor) on the specific VM.

Grant the contractors the roles/compute.instanceUser role on the project and provide them with the VM's SSH keys.

Grant the contractors the Compute Admin role (roles/compute.admin) on the project and instruct them to use SSH.

Create a firewall rule that allows SSH from the contractors' IP addresses and share the VM's public IP with them.

Google CloudProfessional Cloud Architect

Domain 3Objective 1

3.1 Designing for Security PROFESSIONAL-CLOUD-ARCHITECT Practice Questions (Page 7)

Part of the Designing for security and compliance domain, which accounts for ~17.5% of the PROFESSIONAL-CLOUD-ARCHITECT exam. Google Cloud does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–9 in this domain), expect 5–5 from this objective — we provide 55 practice questions to prepare you well beyond it. (estimate)

55questions here

11free pages

23concepts

~17.5%of the exam

23 Concepts in This Objective

IAM Roles and Permissions
IAM Policy Binding
Resource Hierarchy
IAM Best Practices
Data Encryption at Rest and in Transit
Cloud KMS Key Management
Key Hierarchy and Envelope Encryption
Secret Management
Separation of Duties
Audit Logging
VPC Service Controls
Context-Aware Access
Organization Policy
Hierarchical Firewall Policies
Identity-Aware Proxy (IAP)
Service Account Impersonation
Chrome Enterprise Premium
Workload Identity Federation
Software Supply Chain Security
Secure CI/CD Pipeline
Model Armor
Sensitive Data Protection
Secure Model Deployment

Questions 31–35

31foundation · easy
What is the primary purpose of Model Armor in Google Cloud?
Select an answer first
32foundation · easy
What is the primary purpose of VPC Service Controls?
Select an answer first
33foundation · easy
What is the purpose of Workload Identity Federation in Google Cloud?
Select an answer first
34application · medium
A company wants to allow a group of contractors to access a specific VM instance via SSH without giving them access to the entire project. The contractors should only be able to connect to this VM and not to any other resources in the project. What is the recommended approach?
Select an answer first
35foundation · easy
Which Google Cloud service is commonly used to implement Context-Aware Access?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to PROFESSIONAL-CLOUD-ARCHITECT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Google Cloud. “PROFESSIONAL-CLOUD-ARCHITECT” is a trademark of its owner, used for identification only.