What is the primary purpose of Google Cloud Secret Manager?

To manage encryption keys for data at rest

To provide a firewall for network traffic

To securely store and manage sensitive data like API keys, passwords, and certificates

To scan container images for vulnerabilities

An organization is deploying a machine learning model that processes sensitive data. They must ensure that only authorized principals can invoke the model's prediction endpoint and that all access attempts are logged. Which Google Cloud feature should be used to control access to the endpoint?

Identity and Access Management (IAM) roles

Virtual Private Cloud (VPC) firewall rules

What is the purpose of Context-Aware Access in Google Cloud?

To provide a static firewall rule for all network traffic

To encrypt all data in transit between users and applications

To manage encryption keys for data at rest

To enforce access decisions based on user identity and contextual attributes like device and location

What does an IAM policy binding consist of?

A role, a condition, and a service account key

A member, a permission, and a project ID

A permission, a role, and a condition expression

A member, a role, and a resource to which the binding applies

What is the purpose of service account impersonation in Google Cloud?

To allow a user or service to temporarily act as a service account with scoped permissions

To encrypt data using a service account's key

To permanently transfer ownership of resources to another user

To create a new service account for each application

Google CloudProfessional Cloud Architect

Domain 3Objective 1

3.1 Designing for Security PROFESSIONAL-CLOUD-ARCHITECT Practice Questions (Page 8)

Part of the Designing for security and compliance domain, which accounts for ~17.5% of the PROFESSIONAL-CLOUD-ARCHITECT exam. Google Cloud does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–9 in this domain), expect 5–5 from this objective — we provide 55 practice questions to prepare you well beyond it. (estimate)

55questions here

11free pages

23concepts

~17.5%of the exam

23 Concepts in This Objective

IAM Roles and Permissions
IAM Policy Binding
Resource Hierarchy
IAM Best Practices
Data Encryption at Rest and in Transit
Cloud KMS Key Management
Key Hierarchy and Envelope Encryption
Secret Management
Separation of Duties
Audit Logging
VPC Service Controls
Context-Aware Access
Organization Policy
Hierarchical Firewall Policies
Identity-Aware Proxy (IAP)
Service Account Impersonation
Chrome Enterprise Premium
Workload Identity Federation
Software Supply Chain Security
Secure CI/CD Pipeline
Model Armor
Sensitive Data Protection
Secure Model Deployment

Questions 36–40

36foundation · easy
What is the primary purpose of Google Cloud Secret Manager?
Select an answer first
37foundation · easy
An organization is deploying a machine learning model that processes sensitive data. They must ensure that only authorized principals can invoke the model's prediction endpoint and that all access attempts are logged. Which Google Cloud feature should be used to control access to the endpoint?
Select an answer first
38foundation · easy
What is the purpose of Context-Aware Access in Google Cloud?
Select an answer first
39foundation · easy
What does an IAM policy binding consist of?
Select an answer first
40foundation · easy
What is the purpose of service account impersonation in Google Cloud?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to PROFESSIONAL-CLOUD-ARCHITECT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Google Cloud. “PROFESSIONAL-CLOUD-ARCHITECT” is a trademark of its owner, used for identification only.