An enterprise organization is establishing perimeter security and API governance across its Google Cloud resource hierarchy. A security engineer must implement controls to meet the following requirements: Requirement 1: Prevent project owners in the Development folder from activating or consuming any unapproved Google Cloud APIs, ensuring only an explicit allowlist of authorized services (such as Compute Engine and Cloud Storage) can be used. Requirement 2: Secure external API keys used by backend web servers so that the keys can only be used from authorized server IP addresses and can only invoke the designated backend service API. Which combination of controls should the security engineer implement to satisfy these requirements?

Apply the Restrict Service Usage (`constraints/gcp.restrictServiceUsage`) list constraint at the `Development` folder level with an allowlist of approved service identifiers, and configure API key restrictions with IP address application restrictions and specific API target restrictions.: What Restrict Service Usage and API Key Restrictions Are The Restrict Service Usage constraint (constraints/gcp.restrictServiceUsage) is a predefined Google Cloud Organization Policy list constraint that controls which Google Cloud services and APIs can be enabled and used within a specific resource hierarchy container (Organization, Folder, or Project). In parallel, API Key Restrictions provide granular defense-in-depth controls for credentials by restricting requests based on client context (such as IP addresses, HTTP referrers, or mobile app fingerprints) and restricting target API invocation scope. How it meets the requirements Requirement 1 (Enforce API allowlist across hierarchy): Applying constraints/gcp.restrictServiceUsage at the Development folder with spec.rules.allow.values containing authorized service names (e.g., compute.googleapis.com, storage.googleapis.com) establishes an inheritance guardrail. Project owners within this folder cannot enable or make API calls to unapproved Google Cloud services, even if they possess project-level roles/serviceusage.serviceUsageAdmin privileges. Requirement 2 (Granular API key protection): Configuring the API key with IP address application restrictions ensures that only requests originating from the designated backend server IP addresses/CIDR blocks are accepted. Adding API restrictions to the key ensures that the credential can only execute calls against the specified backend API service, mitigating token abuse if the key is compromised. Key advantages and capabilities Centralized Guardrails: Organization policies operate above IAM, preventing project-level administrators from bypassing corporate service governance. Inheritance & Hierarchy: Enforcing the policy at the Development folder automatically cascades down to all current and future projects in that folder. Defense-in-Depth for API Keys: Combining application-level restrictions (IP addresses) with API target restrictions limits both where requests come from and what services can be invoked. Exfiltration & Abuse Prevention: Prevents unauthorized shadow cloud service deployment and limits the blast radius of exposed credentials. Why this is optimal This approach uses native Google Cloud resource hierarchy guardrails for service enablement and follows security best practices for API credential scoping without requiring custom infrastructure proxies.

Enforce Restrict Service Usage Api Key Restrictions | Professional Cloud Security Engineer

AdvancedProfessional Cloud Security Engineer

A security engineer needs to establish centralized detection and alerting across an enterprise Google Cloud organization for unauthorized API invocation attempts and policy violations blocked at the perimeter. The solution must fulfill the following operational requirements: Capture and distinguish between administrative configuration modifications and perimeter or policy denial events. Enable automated near-real-time alerting in Cloud Monitoring when unauthorized or denied API invocation attempts spike across projects. Ingest and centralize the required audit telemetry without incurring unexpected ingestion drop-offs due to default project settings. Which configuration strategy should the engineer implement?

Continually monitoring and restricting configured APIs.

AdvancedProfessional Cloud Security Engineer

An enterprise is deploying confidential workloads onto Compute Engine instances within a custom VPC subnet that has no external IP addresses and no default internet gateway route. The security team has defined a VPC Service Controls (VPC-SC) perimeter protecting services such as Cloud Storage and BigQuery. To enforce strict perimeter boundaries and prevent data exfiltration, the architecture must satisfy these criteria: Compute Engine instances must communicate privately with Google APIs using internal routing. Instances must be blocked from sending requests to Google APIs and services that are not supported by VPC Service Controls. Network routes and DNS resolution within the VPC must guarantee that all API traffic resolves exclusively to the restricted VIP range. Which network and DNS configuration should the security engineer implement?

Continually monitoring and restricting configured APIs.

AdvancedProfessional Cloud Security Engineer

An enterprise runs a global e-commerce platform behind a Global external Application Load Balancer with Cloud CDN enabled on its primary backend service. The security team needs to deploy a Google Cloud Armor security policy containing pre-configured WAF rules (such as SQL injection and Cross-Site Scripting mitigation) to protect dynamic endpoints. To ensure operational readiness without risking disruption to legitimate customer transactions, the team has the following requirements: Inspect dynamic requests and cache misses arriving at the origin backend service. Evaluate the impact of new security rules and tune them for false positives against real production traffic before active enforcement. Ensure that all evaluated requests generate log entries for analysis in Cloud Logging. Which combination of actions should the security team implement?

Configuring web application firewalls (e.g., Google Cloud Armor).

AdvancedProfessional Cloud Security Engineer

An enterprise uses Cloud Identity to govern administrative access to Google Cloud projects hosting mission-critical workloads. A recent internal red-team assessment demonstrated that threat actors could execute adversary-in-the-middle (AitM) reverse-proxy phishing attacks to intercept session cookies and bypass standard multi-factor authentication methods, such as SMS codes and mobile authenticator push prompts. The security architect must enforce an authentication policy for all privileged administrators that eliminates credential harvesting and AitM relay attacks. Which 2-Step Verification (2SV) configuration should the architect implement?

Configuring and enforcing 2-step verification.

AdvancedProfessional Cloud Security Engineer

A security engineer is designing an automated image maintenance pipeline in Google Cloud to ensure base container images are continuously patched against newly disclosed vulnerabilities and dependencies remain up to date. The solution must meet the following requirements: Automatically rebuild base container images on a recurring daily schedule to incorporate upstream operating system patches and library updates. Store rebuilt container images in a private Artifact Registry Docker repository and automatically scan them for vulnerabilities. Trigger the build pipeline programmatically on a cron schedule using native Google Cloud services while adhering to least-privilege access control. Which architecture and configuration should the engineer implement?

Automating virtual machine and container image creation (e.g., hardening, maintenance, VM patch management).

IntermediateProfessional Cloud Architect

Terraform Workspaces vs Directory Separation

Infrastructure as Code (e.g., IaC and Terraform)

Professional Cloud Security Engineer

Enforce Restrict Service Usage Api Key Restrictions

Related questions

Terraform Workspaces vs Directory Separation

Professional Cloud Security Engineer

Enforce Restrict Service Usage Api Key Restrictions

What Restrict Service Usage and API Key Restrictions Are

How it meets the requirements

Key advantages and capabilities

Why this is optimal

Related questions

Terraform Workspaces vs Directory Separation

What Restrict Service Usage and API Key Restrictions Are

How it meets the requirements

Key advantages and capabilities

Why this is optimal