You are configuring VPC Service Controls. What happens if the policy is applied incorrectly?
AAccess is granted by default
BSensitive data is exposed
CNo impact on resources
DAccess is denied by default
Explanation
VPC Service Controls deny access if misconfigured; granting access by default is not how it operates.
Q382
Which service provides real-time threat detection in GCP?
ACloud Security Command Center
BGoogle Cloud Logging
CCloud Data Loss Prevention
DCloud Monitoring
Explanation
Cloud Security Command Center offers real-time threat detection, while other options do not specialize in threat detection.
Q383
A company needs to securely manage its API keys. What is a best practice?
AStore keys in code repositories
BUse Google Secret Manager
CExpose keys as environment variables
DShare keys in team communication
Explanation
Using Google Secret Manager ensures secure storage of API keys, avoiding exposure that other options present.
Q384
What happens when a Google Cloud IAM policy is changed?
AImmediate activation across region
BChanges are versioned automatically
CRespective permissions are revoked
DOnly effective in future sessions
Explanation
IAM policy changes take effect immediately across all resources, while the other options are incorrect regarding IAM behavior.
Q385
Which service is primarily used for managing access control in Google Cloud?
AIAM
BCloud Run
CBigQuery
DCloud Storage
Explanation
IAM manages user access, while others are services for application deployment and data processing.
Q386
A company needs to ensure that only specific services can access its Cloud SQL instances. What should they implement?
AService Accounts
BVPC peering
CFirewall rules
DLoad balancers
Explanation
Service Accounts securely manage permissions for services, unlike VPC peering and others which aren't focused on permissions.
Q387
You are analyzing the security event logs on Google Cloud. What happens when a user exceeds their IAM permissions?
AActions blocked, logged as errors
BUser access is permanently revoked
CUser is notified automatically
DActions allowed under least privilege
Explanation
Actions are blocked and logged; users aren't removed or notified automatically.
Q388
Which Google Cloud service provides managed Kubernetes containers?
ACloud Run
BApp Engine
CGoogle Kubernetes Engine
DCloud Functions
Explanation
Google Kubernetes Engine (GKE) is specifically designed for running and managing Kubernetes clusters, unlike the other options which serve different functions.
Q389
A company needs to secure their data stored in Cloud Storage using encryption. What should they use?
ADefault Google-managed encryption keys
BOnly public key encryption
CSymmetric encryption without keys
DCustom customer-managed encryption keys
Explanation
Custom customer-managed encryption keys provide the most control for securing data, while other options are less flexible or secure.
Q390
What happens when a service account is granted overly permissive roles?
ALess security risk for GCP resources
BIncreased potential for misconfigurations
CReputation damage only to the service
DOnly important data is at risk
Explanation
Granting overly permissive roles exposes resources to more security risks and potential misconfigurations.