Prepare and test your skills
Prepare and test your skills
Free sample question, answered and explained below. The Professional Cloud Security Engineer practice bank has 1,343 more like it. Try 10 free: instant score, no account.
An enterprise security architect is designing an encryption and governance model for Google Cloud services across multiple application projects. The security compliance mandate states:
prj-kms-central) to enforce separation of duties.Which combination of Organization Policy constraints and IAM configurations should the architect implement?
constraints/gcp.restrictNonCmekServices constraint to deny non-CMEK service creation, disable Cloud KMS automated key rotation on all centralized keys, and grant roles/cloudkms.viewer to each application's compute service agent.This configuration applies the correct constraint to block non-CMEK resources but pairs it with disabling key rotation and granting read-only metadata permissions (roles/cloudkms.viewer) to service agents.
roles/cloudkms.viewer role only allows viewing key metadata and key ring properties. Service agents need roles/cloudkms.cryptoKeyEncrypterDecrypter to perform envelope encryption (wrap/unwrap data encryption keys).constraints/gcp.restrictCmekCryptoKeyProjects allows users to specify CMEK keys from arbitrary user-controlled projects, bypassing centralized security controls in prj-kms-central.The objective were only to audit key configurations without enabling services to perform active cryptographic read/write operations.
constraints/gcp.restrictCmekCryptoKeyProjects constraint allowing under:projects/prj-kms-central, configure Cloud Audit Logs exports to Cloud Storage, and assign roles/cloudkms.cryptoKeyEncrypterDecrypter to developers in the KMS project.This configuration limits allowed CMEK project sources and enables audit logging, but assigns cryptographic encryption and decryption permissions to individual human developers rather than Google-managed service agents.
constraints/gcp.restrictNonCmekServices is required to deny non-CMEK resources.service-PROJECT_NUMBER@compute-system.iam.gserviceaccount.com or service-PROJECT_NUMBER@gcp-sa-sourcemanager.iam.gserviceaccount.com) require roles/cloudkms.cryptoKeyEncrypterDecrypter to perform envelope encryption operations on behalf of the service. Granting this role to human developers fails to authorize the underlying service workloads.Developers were directly encrypting local files using the Cloud KMS client libraries or CLI rather than configuring integrated GCP services with service agents.
constraints/gcp.restrictNonCmekServices constraint to deny non-CMEK service creation, configure constraints/gcp.restrictCmekCryptoKeyProjects allowing under:projects/prj-kms-central, and grant roles/cloudkms.cryptoKeyEncrypterDecrypter to each service agent on the specific Cloud KMS keys.This configuration combines Google Cloud Organization Policy CMEK constraints with targeted IAM role bindings to establish an enterprise-grade Customer-Managed Encryption Key (CMEK) governance model with strict separation of duties.
constraints/gcp.restrictNonCmekServices in a Deny policy list ensures that integrated services reject creation or provisioning requests if CMEK encryption is omitted, blocking fallback to Google default encryption.constraints/gcp.restrictCmekCryptoKeyProjects with the allowed hierarchy value under:projects/prj-kms-central restricts CMEK keys so that only CryptoKeys residing within the centralized security project can be selected by service teams.roles/cloudkms.cryptoKeyEncrypterDecrypter) specifically to the respective Google Cloud service agents (e.g., service-PROJECT_NUMBER@gcp-sa-...) on individual keys or key rings allows automated cryptographic operations without exposing administrative rights or key management operations.prj-kms-central.This approach aligns with Google Cloud security best practices by decoupling key governance from application infrastructure while relying on native policy enforcement rather than detective controls.
constraints/gcp.enforceCmekPerService constraint to all projects, configure constraints/gcp.restrictCmekCryptoKeyProjects allowing projects/prj-kms-central, and grant roles/cloudkms.admin to each service agent.This configuration attempts to use an invalid constraint name (constraints/gcp.enforceCmekPerService) and assigns an overly permissive administrative IAM role (roles/cloudkms.admin) to automated service accounts.
constraints/gcp.enforceCmekPerService does not exist in Google Cloud. The official constraint used to block services from using default encryption is constraints/gcp.restrictNonCmekServices.roles/cloudkms.admin gives service agents permissions to create, edit, destroy, and manage IAM policies on keys rather than simply allowing cryptographic operations (encrypt and decrypt).constraints/gcp.restrictCmekCryptoKeyProjects requires project hierarchy notation prefixed with under:projects/PROJECT_ID.roles/cloudkms.cryptoKeyEncrypterDecrypter), not key administration capabilities.Google Cloud featured a specific boolean constraint named enforceCmekPerService and service agents required full administrative ownership over key definitions, which is contrary to cloud security architecture.
Answer them yourself and get your score the moment you finish. No account needed.
Full access includes
Keep the momentum going with these hand-picked practice scenarios
Last updated Validated