1.2 Designing Secure Applications PROFESSIONAL-CLOUD-DEVELOPER Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   Which Google Cloud service is designed to automatically scan web applications for common vulnerabilities like XSS and SQL injection?

   • ACloud Armor
   • BCloud IDS
   • CWeb Security Scanner
   • DSecurity Command Center
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Which of the following is a vulnerability that Web Security Scanner is specifically designed to detect?

   • AMisconfigured IAM roles
   • BCross-site scripting (XSS)
   • CInsecure API keys
   • DUnencrypted storage buckets
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A company deploys containerized applications to GKE. The security team wants to ensure that only container images that have been scanned and approved by the security team can be deployed to the production cluster. What should they implement?

   • AGrant the security team the Container Analysis Admin role and have them approve each image in the registry.
   • BUse IAM roles to restrict who can push images to the registry.
   • CEnable Binary Authorization on the GKE cluster and configure an admission policy that requires an attestation from the security team's key.
   • DUse Artifact Analysis to scan images and manually review the findings before deployment.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   A developer needs to automatically move objects in a Cloud Storage bucket to the Nearline storage class after 30 days and delete them after 365 days. Which feature should be used to implement this without manual intervention?

   • APub/Sub notifications
   • BTransfer Service
   • CObject Lifecycle Management rules
   • DRetention policies
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A company runs a microservices application on Google Kubernetes Engine (GKE). They want to enforce mutual TLS (mTLS) between all services and also want to apply fine-grained traffic policies (e.g., timeouts, retries) between specific services. What should they use?

   • AKubernetes Network Policies to restrict traffic and enable TLS termination at each pod.
   • BCloud Service Mesh with a strict mTLS peer authentication policy and traffic management rules.
   • CA combination of IAM roles and service accounts to authenticate services and a separate API gateway for traffic policies.
   • DUse the GKE Ingress with TLS and configure backendConfig for timeouts and retries.
   Reveal Solution Discussion Select an answer first