1.2 Designing Secure Applications PROFESSIONAL-CLOUD-DEVELOPER Practice Questions (Page 10)

Questions 46–50

1. 46application · medium

   A company runs an internal web application on Compute Engine behind a global HTTP(S) load balancer. The app uses a custom identity provider and the team wants to enforce access based on the user's group membership in the corporate directory. They also need to ensure that only authenticated users can reach the backend. What should they configure?

   • ADeploy the application on Cloud Run and use the built-in authentication to require Google accounts.
   • BSet up a VPN between the corporate network and the VPC, then restrict the backend instance's firewall rules to only allow traffic from the VPN gateway.
   • CCreate a service account for the application and grant it the IAP-secured Web App User role on the project.
   • DEnable Identity-Aware Proxy (IAP) on the load balancer and configure the OAuth consent screen with the corporate IdP as an identity provider.
   Reveal Solution Discussion Select an answer first
2. 47application · medium

   A company runs a workload on Compute Engine that needs to access a Cloud SQL instance and a Cloud Storage bucket. The security team wants to ensure that all traffic between the workload and these services stays within Google's network and does not traverse the public internet. What should they do?

   • ACreate a VPN between the VPC and Google Cloud and route all traffic through the VPN.
   • BUse the Cloud SQL Auth Proxy and access Cloud Storage via its public IP address.
   • CUse Private Service Connect for Cloud SQL and configure the Compute Engine instance to use a VPC network with Private Google Access for Cloud Storage.
   • DGrant the Compute Engine instance's service account the necessary IAM roles and rely on IAM for security.
   Reveal Solution Discussion Select an answer first
4. 48foundation · easy

   What is the purpose of Binary Authorization?

   • ATo build container images
   • BTo encrypt container images
   • CTo store container images
   • DTo ensure only trusted container images are deployed
   Reveal Solution Discussion Select an answer first
5. 49foundation · easy

   What is the primary purpose of Cloud Service Mesh?

   • ATo enable secure service-to-service communication
   • BTo manage user authentication
   • CTo store container images
   • DTo scan for vulnerabilities
   Reveal Solution Discussion Select an answer first
6. 50expert · hard

   A company runs a data processing application on Google Kubernetes Engine (GKE). The application needs to read data from Cloud Storage and write results to BigQuery. The security team wants to avoid using service account keys and wants the application to authenticate automatically using the environment. What is the recommended approach?

   • ASet the GOOGLE_APPLICATION_CREDENTIALS environment variable to point to a service account key file.
   • BUse Workload Identity Federation to authenticate the GKE cluster to Google Cloud.
   • CCreate a service account key and mount it as a secret in the Kubernetes pod.
   • DUse Workload Identity to bind a Kubernetes service account to a Google service account and use Application Default Credentials (ADC) in the application.
   Reveal Solution Discussion Select an answer first