3.1 Designing for Security PROFESSIONAL-CLOUD-ARCHITECT Practice Questions (Page 9)

Questions 41–45

1. 41foundation · easy

   How do hierarchical firewall policies interact with VPC firewall rules?

   • AHierarchical policies are only applied if no VPC firewall rules exist
   • BThey are independent and do not interact
   • CVPC firewall rules override hierarchical policies
   • DHierarchical policies are evaluated first, and VPC firewall rules are evaluated after
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   A company is expanding its Google Cloud environment and wants to enforce a policy that all projects must have a specific set of labels for cost tracking. The security team also wants to prevent any project from disabling the default encryption for new disks. Where should these constraints be defined to ensure they apply to all current and future projects?

   • ADefine the label requirement as a project-level policy and the disk encryption constraint as a folder policy.
   • BDefine the label requirement using Cloud Audit Logs and the disk encryption constraint using IAM roles.
   • CDefine both the label requirement and the disk encryption constraint as organization policies at the organization node.
   • DDefine the label requirement as an organization policy and the disk encryption constraint as a folder policy at each folder.
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   A company wants to provide remote access to an internal web application for employees. They require that access is granted only when the employee is using a corporate-managed device and is connecting from a trusted network. What should they use to enforce these conditions?

   • AUse Cloud VPN and assign static IP addresses to all employees' devices.
   • BUse a VPN that requires employees to connect from a corporate device.
   • CUse Identity-Aware Proxy (IAP) with an access level that requires the device to be corporate-managed and the network to be trusted.
   • DUse IAP with a basic IAM policy that grants access to all authenticated users.
   Reveal Solution Discussion Select an answer first
5. 44foundation · easy

   What is the purpose of signing container images in a software supply chain?

   • ATo encrypt the image so only authorized users can view it
   • BTo verify the integrity and origin of the image
   • CTo compress the image for faster deployment
   • DTo scan the image for malware
   Reveal Solution Discussion Select an answer first
6. 45foundation · easy

   Which type of Cloud Audit Log records actions that modify the configuration of a resource?

   • APolicy Denied audit logs
   • BAdmin Activity audit logs
   • CData Access audit logs
   • DSystem Event audit logs
   Reveal Solution Discussion Select an answer first