Cloud Engineer Cloud Engineer Security & Identity Management

Question 1

Which Google Cloud IAM role grants a user read-only access to all GCP resources within a project?

Accepted Answer

roles/viewer

Answer

roles/editor

Answer

roles/owner

Answer

roles/browser

Question 2

What is the recommended method to grant a Compute Engine VM access to Google Cloud APIs without storing credentials in the code?

Accepted Answer

Attach a service account to the VM instance

Answer

Embed a service account key in the VM startup script

Answer

Store credentials in Cloud Storage

Answer

Use environment variables with API keys

Question 3

Which Google Cloud feature allows you to define a perimeter around sensitive GCP resources to prevent data exfiltration?

Accepted Answer

VPC Service Controls

Answer

VPC Firewall Rules

Answer

Cloud Armor

Answer

Identity-Aware Proxy

Question 4

When should you use Workload Identity Federation instead of a service account key for external workloads?

Accepted Answer

When the workload runs outside Google Cloud and you want keyless authentication

Answer

When the workload runs inside Google Cloud

Answer

When you need to grant human users access

Answer

When you want to disable multi-factor authentication

Question 5

Which principle should guide how IAM permissions are assigned to minimize security risk?

Accepted Answer

Least privilege

Answer

Defense in depth

Answer

Zero trust

Answer

Separation of duties

Question 6

What does Identity-Aware Proxy (IAP) protect in Google Cloud?

Accepted Answer

Controls access to applications and VMs based on user identity and context

Answer

Encrypts data at rest in Cloud Storage

Answer

Manages SSL certificates for load balancers

Answer

Scans container images for vulnerabilities