Google Cloud Professional Cloud Architect Designing for Security and Compliance Flashcards

24 sample cards from the Designing for Security and Compliance deck

Sampled from the end of the deck, so these are different cards from the ones shown on the syllabus page.

1. What are infoTypes in Sensitive Data Protection (DLP)?

   Predefined or custom detectors that identify specific categories of sensitive data (e.g., CREDIT_CARD_NUMBER, US_SOCIAL_SECURITY_NUMBER, EMAIL_ADDRESS) during inspection scans.

2. What de-identification technique in DLP replaces sensitive values with reversible surrogate tokens?

   Format-preserving tokenization / pseudonymization (cryptographic tokenization, e.g., FPE or deterministic encryption), which can be reversed with the proper key, unlike irreversible redaction or masking.

3. What is Google Cloud Armor and at which layer does it primarily operate?

   A network security service providing DDoS protection and a Web Application Firewall (WAF) at the edge, integrated with external HTTP(S) load balancers (Layer 7), filtering traffic before it reaches backends.

4. What pre-configured WAF rules does Cloud Armor offer to address common web attacks?

   Pre-configured rules based on the OWASP ModSecurity Core Rule Set, protecting against SQL injection (SQLi), cross-site scripting (XSS), local/remote file inclusion, and other OWASP Top 10 threats.

5. In a Cloud Armor security policy, how are rules evaluated?

   Rules are evaluated in ascending priority order (lower number = higher priority). The first matching rule's action (allow/deny/rate-limit) is applied, and evaluation stops.

6. What is Identity-Aware Proxy (IAP) and what does it secure?

   IAP enforces identity-based access control to applications and VMs without a VPN. It verifies user identity and context at the application layer, granting access only to authorized principals via the IAP-secured Web App User role.

7. How does IAP embody Google's BeyondCorp / zero-trust model?

   BeyondCorp shifts access controls from the network perimeter to individual users and devices. IAP enforces this by authenticating and authorizing each request based on identity and context, so trust is never granted merely by network location.

8. What is Private Google Access and what does it enable?

   It allows VM instances that have only internal IP addresses (no external IP) to reach Google APIs and services (like Cloud Storage) through Google's network, rather than over the public internet.

9. What is Private Service Connect (PSC)?

   A capability that lets you privately consume Google APIs or services published by other VPCs/producers using internal IP endpoints within your VPC, keeping traffic on Google's backbone and avoiding external IPs.

10. What is Certificate Manager used for in Google Cloud?

    To acquire, store, and deploy TLS/SSL certificates (Google-managed or self-managed) for load balancers and services, supporting large numbers of certificates and wildcard/SAN certs for HTTPS termination.

11. What is Security Command Center (SCC) and what is its purpose?

    Google Cloud's centralized security and risk management platform that provides asset inventory, vulnerability and misconfiguration detection, threat detection, and compliance monitoring across the organization.

12. What are the two main service tiers of Security Command Center and how do they differ?

    Standard tier: free, basic findings (Security Health Analytics, asset discovery). Premium/Enterprise tier: paid, adds Event Threat Detection, Container Threat Detection, compliance reporting, attack path simulation, and advanced threat detection.

13. What is Assured Workloads in Google Cloud?

    A service that lets you create and manage workloads meeting specific compliance and sovereignty requirements (e.g., FedRAMP, CJIS, IL4, data residency) by enforcing controls like personnel/data location and approved products automatically.

14. What are the four types of Cloud Audit Logs in Google Cloud?

    Admin Activity logs (config changes, always on), Data Access logs (reads/writes of data, mostly off by default), System Event logs (Google system actions), and Policy Denied logs (access blocked by security policy).

15. Which Cloud Audit Log type is enabled by default and cannot be disabled?

    Admin Activity audit logs — they record administrative/config-changing actions, are always written, and incur no charge. Data Access logs, by contrast, must be explicitly enabled (except for BigQuery).

16. What is Access Transparency and how does it differ from audit logs?

    Access Transparency provides logs of actions taken by Google personnel (e.g., support staff) when they access your content, with justification. It logs Google-side access, whereas Cloud Audit Logs record actions by your own users and services.

17. What is Access Approval in Google Cloud?

    A control that requires your explicit approval before Google support or engineering personnel can access your data for support purposes, giving customers a gate over administrative access by Google.

18. Under the shared responsibility model, who is responsible for 'security OF the cloud' vs 'security IN the cloud'?

    Google (the provider) is responsible for security OF the cloud — physical infrastructure, hardware, and managed services. The customer is responsible for security IN the cloud — data, IAM configuration, access controls, and OS/application patching (varies by service type).

19. How does the shared responsibility split change between IaaS, PaaS, and SaaS?

    Moving from IaaS to SaaS, the customer's responsibility decreases and Google's increases. In IaaS the customer manages OS/patching; in PaaS Google manages the OS/runtime; in SaaS Google manages nearly everything except data and access.

20. Does Google require advance notification before you conduct penetration testing on your own Google Cloud resources?

    No. Google does not require you to notify or request permission to pentest your own projects, but you must comply with the Acceptable Use Policy and Terms of Service and only test resources you own.

21. What is the difference between authentication and authorization in the context of GCP IAM?

    Authentication verifies WHO a principal is (proving identity, e.g., via Cloud Identity or a service account key/token). Authorization determines WHAT that authenticated principal is allowed to do (governed by IAM policies and roles).

22. What is Access Context Manager and how does it support security perimeters?

    A service that defines and manages access levels based on attributes like IP ranges, device policy, and geolocation. These access levels are consumed by VPC Service Controls and IAP Conditions to enforce context-aware access.

23. What is the recommended approach to centrally enforce that no Compute Engine VM can have an external/public IP address?

    Apply the Organization Policy constraint constraints/compute.vmExternalIpAccess (a list constraint set to deny all) at the org or folder level, blocking external IP assignment across all projects beneath it.

24. What is envelope encryption as used by Cloud KMS?

    Data is encrypted with a Data Encryption Key (DEK), and the DEK is itself encrypted (wrapped) by a Key Encryption Key (KEK) stored in Cloud KMS. Only the wrapped DEK is stored alongside the data; the KEK never leaves KMS.

What this deck covers

Designing for Security and Compliance flashcards FAQ