Cloud Security

Your company’s Chief Information Security Officer (CISO) creates a requirement that business data must be stored in specific locations due to regulatory requirements that affect the company’s global expansion plans. After working on the details to implement this requirement, you determine the following:

- The services in scope are included in the Google Cloud Data Residency Terms.
- The business data remains within specific locations under the same organization.
- The folder structure can contain multiple data residency locations.

You plan to use the Resource Location Restriction organization policy constraint. At which level in the resource hierarchy should you set the constraint?

• Project level
• Organization level
• Data center level
• Folder level

A company has been running their application on Compute Engine. A bug in the application allowed a malicious user to repeatedly execute a script that results in the Compute Engine instance crashing. Although the bug has been fixed, you want to get notified in case this hack re-occurs.

What should you do?

• Increase the memory allocation for the Compute Engine instance
• Install a firewall on the Compute Engine instance
• 
  Create an Alerting Policy in Stackdriver using a Process Health condition, checking that the number of executions of the script remains below the desired threshold. Enable notifications.

A customer’s data science group wants to use Google Cloud Platform (GCP) for their analytics workloads. Company policy dictates that all data must be company-owned and all user authentications must go through their own Security Assertion Markup Language (SAML) 2.0 Identity Provider (IdP).

The Infrastructure Operations Systems Engineer was trying to set up Cloud Identity for the customer and realized that their domain was already being used by G Suite.

How should you best advise the Systems Engineer to proceed with the least disruption?

• Ignore the company policy and proceed with the setup
• Advise the customer to switch to a different cloud platform
• Use Cloud Identity with a different domain
• Ask customer’s management to discover any other uses of Google managed services, and work with the existing Super Administrator.

Your organization has implemented synchronization and SAML federation between Cloud Identity and Microsoft Active Directory. You want to reduce the risk of Google Cloud user accounts being compromised. What should you do?

• Create an Active Directory domain password policy with strong password settings, and configure post-SSO (single sign-on) 2-Step Verification with security keys in the Google Admin console..

• Disable MFA for Google Cloud user accounts.
• Implement single-factor authentication for Google Cloud user accounts.
• Use the same password for all Google Cloud user accounts.

You are exporting application logs to Cloud Storage. You encounter an error message that the log sinks don’t support uniform bucket-level access policies. How should you resolve this error?

• Update your sink with the correct bucket destination.

• Delete the log sinks
• Ignore the error and continue exporting logs
• Enable uniform bucket-level access

You are part of a security team investigating a compromised service account key. You need to audit which new resources were created by the service account. What should you do?

• Ask the service account key nicely to reveal its activities
• Check the weather forecast for the day of the compromise
• 
  Query Admin Activity logs.

• Ignore the compromised service account key and hope for the best

An organization is starting to move its infrastructure from its on-premises environment to Google Cloud Platform (GCP). The first step the organization wants to take is to migrate its ongoing data backup and disaster recovery solutions to GCP.

The organization’s on-premises production environment is going to be the next phase for migration to GCP. Stable networking connectivity between the on-premises environment and GCP is also being implemented.

Which GCP solution should the organization use?

• 
  Cloud Storage using a scheduled task and gsutil via Cloud Interconnect

• Dropbox and OneDrive
• IBM Cloud Object Storage and Salesforce
• Amazon S3 and Azure ExpressRoute

As adoption of the Cloud Data Loss Prevention (DLP) API grows within the company, you need to optimize usage to reduce cost. DLP target data is stored in Cloud Storage and BigQuery. The location and region are identified as a suffix in the resource name.

Which cost reduction options should you recommend?

• Increase the amount of data stored in Cloud Storage and BigQuery
• Implement data duplication techniques and data retention policies
• Upgrade to a more expensive DLP API plan
• 
  Use rowsLimit and bytesLimitPerFile to sample data and use CloudStorageRegexFileSet to limit scans.

You need to implement an encryption at-rest strategy that reduces key management complexity for non-sensitive data and protects sensitive data while providing the flexibility of controlling the key residency and rotation schedule. FIPS 140-2 L1 compliance is required for all data types.

What should you do?

• Implement a data encryption solution that supports FIPS 140-2 L1 compliance, but does not differentiate between sensitive and non-sensitive data.
• Encrypt non-sensitive data with Google default encryption, and encrypt sensitive data with Cloud Key Management Service.

• Implement a data encryption solution that only supports FIPS 140-2 L1 compliance for sensitive data and does not allow for key residency and rotation schedule flexibility.
• Do not implement any encryption strategy and rely on standard security measures for both sensitive and non-sensitive data.

A database administrator notices malicious activities within their Cloud SQL instance. The database administrator wants to monitor the API calls that read the configuration or metadata of resources. Which logs should the database administrator review?

• Cloud Storage Logs
• 
  Access Transparency

• Cloud Firewall Logs
• Cloud DNS Logs